JP2009258955A - Monitoring device, monitoring system, monitoring method, and monitoring program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a monitoring device for suppressing a monitoring device from notifying a failure message when abnormality is occurred in a monitoring object, and abnormality is momentary abnormality, and for quickly notifying the failure message when the abnormality is not momentary abnormality. <P>SOLUTION: This monitoring device includes: an abnormality detection part for detecting the abnormality of a monitoring object; a momentary abnormality determination part for determining whether or not the abnormality of the monitoring object is momentary abnormality based on the monitoring result value of the monitoring object until abnormality is detected; and a failure message notification part for notifying the failure message when the abnormality of the monitoring object is not momentary abnormality. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a monitoring device, a monitoring system, a monitoring method, and a monitoring program, and more particularly to a monitoring device, a monitoring system, a monitoring method, and a monitoring program that determine whether an abnormality of a monitoring target is an instantaneous abnormality.

  One of the important functions of the operation monitoring system is a function for notifying the administrator of a failure message when the monitoring device detects an abnormality to be monitored. Here, among the abnormalities detected by the monitoring device, the monitoring device may or may not require message notification. For example, when a load on a CPU (Central Processing Unit) generated by processing by an application is high for a long time, the operation may be affected, and the monitoring device needs to notify the administrator. However, in the case of a momentary high load, there is almost no influence on the operation, and if the monitoring device notifies a failure message, there is a possibility that an extra work may occur for the administrator.

  Here, an example of a monitoring system is described in Patent Document 1. For example, when the monitoring device of Patent Document 1 receives a message indicating a high load on the CPU, it does not present it for the first time and suppresses it without presenting the message until the same message is received seven times. When the monitoring device receives the same message eight times after 560 seconds elapses after receiving the first message, the monitoring device presents the message to the operator and cancels the continuous inhibition function.

JP 2006-252460 A (paragraph number 0030)

  However, the above-described monitoring apparatus disclosed in Patent Document 1 has a problem that a message is not presented even when a message can be promptly presented to an operator instead of an instantaneous high load. For example, when the load on the CPU gradually increases and exceeds a predetermined threshold value, it is desirable that the monitoring device immediately notifies the operator of the message because the CPU is not instantaneously loaded with a high load. However, even in such a case, the monitoring device of Patent Document 1 cannot notify the operator of the message until the same message is received eight times until 560 seconds elapse after receiving the first message.

  The objective of this invention is providing the monitoring apparatus, the monitoring system, the monitoring method, and the monitoring program which solve the said subject.

  The monitoring apparatus of the present invention determines whether or not the abnormality of the monitoring target is a momentary abnormality based on the abnormality detection unit that detects the abnormality of the monitoring target and the monitoring result value of the monitoring target until the abnormality is detected And a failure message notifying unit for notifying a failure message when the monitored abnormality is not a momentary abnormality.

  The monitoring system of the present invention determines whether or not the abnormality of the monitoring target is an instantaneous abnormality based on the abnormality detection unit that detects the abnormality of the monitoring target and the monitoring result value of the monitoring target until the abnormality is detected And a monitoring device including a failure message notification unit that notifies a failure message when the abnormality of the monitoring target is not a momentary abnormality, and a monitoring target monitored by the monitoring device.

  The monitoring method of the present invention detects an abnormality of a monitoring target, determines whether the monitoring target abnormality is a momentary abnormality based on the monitoring result value of the monitoring target until the abnormality is detected, and When the abnormality is not a momentary abnormality, a failure message is notified.

  The program of the present invention is based on the abnormality detection means for detecting the abnormality of the monitoring target in the computer and the monitoring result value of the monitoring target until the abnormality is detected. And a failure message notification means for notifying a failure message when the monitored abnormality is not a momentary abnormality.

  In the present invention, when an abnormality occurs in the monitoring target and the abnormality is a momentary abnormality, the monitoring device is prevented from notifying a failure message, and when the abnormality is not a momentary abnormality, There is an effect that the monitoring device can promptly notify the failure message.

  First, an outline of the present invention will be described. FIG. 1 is a diagram showing a schematic configuration of a monitoring system 100 of the present invention.

  The monitoring system 100 of the present invention includes a monitoring device 010 and a monitoring target 020.

  Monitoring device 010 includes an abnormality detection unit 012, an instantaneous abnormality determination unit 014, and a failure message notification unit 015. The abnormality detection unit 012 detects an abnormality of the monitoring target 020. The instantaneous abnormality determination unit 014 determines whether the abnormality of the monitoring target 020 is an instantaneous abnormality based on the monitoring result value of the monitoring target 020 until the abnormality is detected. The failure message notification unit 015 notifies a failure message when the abnormality of the monitoring target 020 is not a momentary abnormality.

  The monitoring system 100 of the present invention has the following effects. That is, when an abnormality occurs in the monitoring target 020 and the abnormality is a momentary abnormality, the monitoring apparatus 010 can be prevented from reporting a failure message. On the other hand, when the abnormality is not a momentary abnormality, the monitoring device 010 can promptly notify a failure message.

  The reason is that the monitoring apparatus 010 of the present invention includes an instantaneous abnormality determination unit 014 that detects an instantaneous abnormality of the monitoring target 020 based on the monitoring result value of the monitoring target 020 until the abnormality is detected. It is.

  Next, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 2 is a diagram showing a configuration of the monitoring system 100 according to the embodiment of the present invention.

  The monitoring system 100 according to the embodiment of the present invention includes a monitoring device 010 and a monitoring target 020.

  The monitoring device 010 is an information processing device such as a server, and includes a CPU (Central Processing Unit) that operates under program control. The monitoring device 010 implements various functions by executing a program stored in a program storage medium. The monitoring device 010 instructs the monitoring target 020 to output a monitoring result value at a predetermined monitoring interval, and inputs the monitoring result value from the monitoring target 020. The monitoring device 010 includes a result table writing unit 011, an abnormality detection unit 012, a result table reading unit 013, an instantaneous abnormality determination unit 014, a failure message notification unit 015, and a storage unit 016.

  The record table writing unit 011 writes the monitoring time, the monitoring interval, and the monitoring result value in the record table included in the storage unit 016.

  The abnormality detection unit 012 determines whether the monitoring result value exceeds the monitoring result threshold value.

  When the monitoring result value exceeds the monitoring result threshold, the result table reading unit 013 determines whether there are monitoring results corresponding to the number of times of application. The application count is the number of the latest monitoring result values before the current monitoring result value, which is used by the instantaneous abnormality determination unit 014 described later. The operator of the monitoring device 010 stores the application count in the storage unit 016 in advance. Then, the result table reading unit 013 reads the monitoring result values corresponding to the number of application times from the result table of the storage unit 016.

  The instantaneous abnormality determination unit 014 calculates the degree of increase in the monitoring result value. Also, the instantaneous abnormality determination unit 014 determines whether or not the increase degree of the monitoring result value exceeds the increase degree threshold value.

  The failure message notification unit 015 notifies a failure message when there are no monitoring result values corresponding to the number of times of application or when the increase degree of the monitoring result value does not exceed the increase threshold.

  The monitoring target 020 is a monitoring target device such as a server, for example. Upon receiving the monitoring result value output command from the monitoring device 010, the monitoring target 020 outputs the monitoring result value to the monitoring device 010.

  FIG. 3 is a diagram showing an example of a performance table in the embodiment of the present invention. The actual result table includes a monitoring time, a monitoring interval, and a monitoring result value. The storage unit 016 includes an actual result table, and the actual result table writing unit 011 writes each value into the actual result table at every monitoring interval. The contents of specific value examples in FIGS. 3A and 3B will be described later.

  FIG. 4 is a diagram illustrating an example of values registered in advance in the storage unit 016 according to the embodiment of the present invention.

  FIG. 4A shows an example of the monitoring interval value.

  FIG. 4B is an example of the value of the number of times of application. The result table reading unit 013 reads the monitoring result value from the storage unit 016, and reads the latest monitoring result value of the number indicated in the value of the number of application times among the monitoring result values.

  FIG. 4C is an example of the monitoring result threshold value and the increase degree threshold value. The monitoring result threshold value is a threshold value used for comparison with the monitoring result value because the abnormality detection unit 012 detects an abnormality of the monitoring target 020. The increase degree threshold is a threshold used by the instantaneous abnormality determination unit 014 for comparison with the increase degree of the monitoring result value in order to detect an instantaneous abnormality.

  FIG. 5 is a flowchart showing the operation of the monitoring apparatus 010 in the embodiment of the present invention. Before the monitoring device 010 starts operation, the operator stores the monitoring interval, the number of times of application, the monitoring result threshold value, and the increase threshold value shown in FIGS. 4A, 4B, and 4C in the storage unit 016 in advance. The monitoring apparatus 010 inputs a monitoring result value from the monitoring target 020 for each monitoring interval stored in the storage unit 016 when the operation starts. And the monitoring apparatus 010 starts the operation | movement shown to the following flowchart.

  First, the performance table writing unit 011 writes the monitoring time, the monitoring interval, and the monitoring result value in the performance table (S101).

  Next, the abnormality detection unit 012 determines whether or not the monitoring result value exceeds the monitoring result threshold (S102). That is, the abnormality detection unit 012 compares the monitoring result value shown in FIG. 3 with the monitoring result threshold value shown in FIG. 4C, and determines whether or not the monitoring result value exceeds the monitoring result threshold value. When the monitoring result value does not exceed the monitoring result threshold value (S102, No), the embodiment of the present invention ends the operation of the monitoring device 010 at the current monitoring timing.

  When the monitoring result value exceeds the monitoring result threshold (S102, Yes), the result table reading unit 013 determines whether there are monitoring result values for the number of application times (S103).

  When there are monitoring result values for the number of application times (S103, Yes), the result table reading unit 013 reads the monitoring result values for the number of application times (S104). That is, the result table reading unit 013 reads the latest monitoring result value (for example, the CPU usage rate with an upper limit of 100%) shown in FIG. 3 for the number of times of application (3 times) shown in FIG. . For example, in the example shown in FIG. 3A, the record table reading unit 013 reads the monitoring result values (“50”, “60”, “70”). In the example shown in FIG. 3B, the record table reading unit 013 reads the monitoring result values (“20”, “20”, “20”).

  Next, the instantaneous abnormality determination unit 014 calculates the increase degree of the monitoring result value (S105). That is, the instantaneous abnormality determination unit 014 calculates a difference between each of the latest monitoring result values corresponding to the number of application and the current monitoring result value among the monitoring result values.

  In the example illustrated in FIG. 3A, the instantaneous abnormality determination unit 014 has the latest monitoring result values (“50”, “60”, “70”) corresponding to the number of application times (three times) and the current monitoring result value “ The difference from “85” (“35” “25” “15”) is calculated.

  In the example illustrated in FIG. 3B, the instantaneous abnormality determination unit 014 has the latest monitoring result values (“20”, “20”, “20”) corresponding to the number of times of application (three times) and the current monitoring result value “ The difference from “85” (“65” “65” “65”) is calculated.

  Next, the instantaneous abnormality determination unit 014 determines whether or not the increase degree of the monitoring result value exceeds the increase degree threshold value (S106). That is, the instantaneous abnormality determination unit 014 increases the degree of increase in the monitoring result value shown in FIG. 4C among any one of the differences between the latest monitoring result values corresponding to the number of application times and the current monitoring result value. It is determined whether or not a threshold value (increase degree threshold value) is exceeded.

  In the example shown in FIG. 3A, the difference (increase degree) calculated in S105 is “35”, “25”, and “15”, so that both of them are higher than the increase degree threshold value “60” shown in FIG. Is also small. Therefore, the increase degree of the monitoring result value does not exceed the increase degree threshold value. In the example shown in FIG. 3A, the difference (increase) calculated in S105 is “65”, “65”, and “65”, and therefore, the increase threshold (“60”) shown in FIG. Bigger than). Therefore, the increase degree of the monitoring result value exceeds the increase degree threshold value. As described above, the instantaneous abnormality determination unit 014 determines whether the increase degree of the monitoring result value exceeds the increase degree threshold based on the result table (the monitoring result value of the monitoring target 020 until the abnormality is detected). To determine if it is a normal abnormality).

  When the degree of increase in the monitoring result value exceeds the degree of increase threshold (S106, Yes), the embodiment of the present invention ends the operation of the monitoring device 010 at the current monitoring timing.

  When there are no monitoring result values corresponding to the number of times of application (S103, No), or when the increase degree of the monitoring result value does not exceed the increase degree threshold (S106, No), the monitoring device 010 is in trouble. A message is notified (S107). For example, the monitoring device 010 displays that a failure has occurred on a display (not shown) of the monitoring device 010.

  In the embodiment of the present invention, when an abnormality occurs in the monitoring target 020 (the monitoring result value exceeds the monitoring result threshold), but the abnormality is an instantaneous abnormality, the monitoring apparatus 010 displays a failure message. Can be prevented from being notified. On the other hand, when the abnormality is not a momentary abnormality, the monitoring device 010 can promptly notify a failure message.

  This is because the monitoring apparatus 010 includes an instantaneous abnormality determination unit 014 that detects an instantaneous abnormality of the monitoring target 020 based on the monitoring result value of the monitoring target 020 until the abnormality is detected.

  Specifically, the instantaneous abnormality determination unit 014 compares the increase degree of the monitoring result value with the increase degree threshold to determine whether or not there is an instantaneous abnormality. Suppress notifications. At this time, the instantaneous abnormality determination unit 014 determines whether the abnormality is instantaneous based on the monitoring result value of the monitoring target 020 until the abnormality is detected. That is, the instantaneous abnormality determination unit 014 makes a determination using the monitoring result value already stored in the result table.

  The monitoring device described in Patent Document 1 (Japanese Patent Application Laid-Open No. 2006-252460) makes a judgment based on whether or not a message indicating a high CPU load is received eight times instead of an increase degree of the high CPU load. Yes. In addition, since the monitoring device described in Patent Document 1 makes a determination using a message received after receiving a message indicating a high CPU load for the first time, it cannot immediately determine whether or not there is an instantaneous abnormality. .

  Next, a modification of the embodiment of the present invention will be shown.

  In the process of S106 illustrated in FIG. 5, the instantaneous abnormality determination unit 014 may display any one of the differences (increases) between the latest monitoring result values corresponding to the number of application times and the current monitoring result value. It was determined whether the increase threshold shown in 4 (c) was exceeded. Instead of this, the instantaneous abnormality determination unit 014 may determine whether a specific number or all of the differences (increases) exceed the increase threshold.

  Further, in the modified example, the processes of S205 and 206 shown in FIG. 6 may be adopted instead of the processes of S105 and 106 shown in FIG. That is, in the modification, the instantaneous abnormality determination unit 014 calculates the average of the monitoring result values (S205), that is, calculates the average of the monitoring result values from the monitoring result values for the number of times of application. In the modification, the instantaneous abnormality determination unit 014 may determine whether or not the average of the monitoring result values exceeds the average threshold (S206). In this case, the operator stores the average threshold value in advance in the storage unit 016 instead of the increase degree threshold value shown in FIG. In the modification, the failure message notification unit 015 is not used when the average of the monitoring result values does not exceed the average threshold but when the average of the monitoring result values exceeds the average threshold (S206, Yes). Notifies the failure message (S207).

  Further, in the modified example, the processing of S305 and 306 shown in FIG. 7 may be adopted instead of the processing of S105 and 106 shown in FIG. That is, in the modification, the instantaneous abnormality determination unit 014 calculates the sum of the monitoring result values from the monitoring result values for the number of application times (S305), that is, calculates the sum of the monitoring result values from the monitoring result values for the number of application times. calculate. In the modification, the instantaneous abnormality determination unit 014 may determine whether or not the sum of the monitoring result values exceeds the total threshold value (S306). In this case, the operator stores the total threshold value in advance in the storage unit 016 instead of the increase degree threshold value shown in FIG. In the modification, the failure message notification unit 015 is not when the total of the monitoring result values does not exceed the total threshold value but when the average of the monitoring result values exceeds the average threshold value (S306, Yes). Notifies the failure message (S307).

  The instantaneous abnormality determination unit 014 in the modification shown in FIGS. 6 and 7 also determines whether the monitoring target 020 abnormality is an instantaneous abnormality based on the monitoring result value of the monitoring target 020 until the abnormality is detected. Can be determined.

1 is a diagram showing a schematic configuration of a monitoring system 100 of the present invention. It is a figure which shows the structure of the monitoring system 100 in embodiment of this invention. It is a figure which shows the example of the performance table in embodiment of this invention. It is the figure which showed the example of the value previously registered into the memory | storage part 016 in embodiment of this invention. It is a flowchart which shows operation | movement of the monitoring apparatus 010 in embodiment of this invention. It is a flowchart which shows the modification of operation | movement of the monitoring apparatus 010 in embodiment of this invention. It is a flowchart which shows the modification of operation | movement of the monitoring apparatus 010 in embodiment of this invention.

Explanation of symbols

010 Monitoring device 011 Performance table writing unit 012 Abnormality detection unit 013 Performance table reading unit 014 Instantaneous abnormality determination unit 015 Fault message notification unit 016 Storage unit 020 Monitoring target 100 Monitoring system

Claims (12)

An anomaly detector that detects an anomaly of the monitoring target;
Based on the monitoring result value of the monitoring target until an abnormality is detected, an instantaneous abnormality determination unit that determines whether the abnormality of the monitoring target is an instantaneous abnormality; and
And a failure message notification unit that notifies a failure message when the abnormality to be monitored is not a momentary abnormality. The abnormality detection unit detects that a monitoring result value of the monitoring target exceeds a threshold value (monitoring result threshold value) for the monitoring result value;
The instantaneous abnormality determination unit determines whether the monitoring result value instantaneously exceeds a threshold value for the monitoring result value;
The monitoring apparatus according to claim 1, wherein the failure message notification unit notifies a failure message when the monitoring result value does not instantaneously exceed a threshold for the monitoring result value. The monitoring according to claim 2, wherein the instantaneous abnormality determination unit notifies a failure message when the degree of increase in the monitoring result value does not exceed a threshold (increase degree threshold) for the degree of increase in the monitoring result value. apparatus. The monitoring apparatus according to claim 2, wherein the instantaneous abnormality determination unit notifies a failure message when an average of monitoring result values exceeds a threshold (average threshold) with respect to an average of monitoring result values. The monitoring apparatus according to claim 2, wherein the instantaneous abnormality determination unit notifies a failure message when the sum of the monitoring result values exceeds a threshold value (total threshold value) for the sum of the monitoring result values. An anomaly detector that detects an anomaly of the monitoring target;
Based on the monitoring result value of the monitoring target until an abnormality is detected, an instantaneous abnormality determination unit that determines whether the abnormality of the monitoring target is an instantaneous abnormality; and
A monitoring device including a failure message notification unit for notifying a failure message when the abnormality to be monitored is not a momentary abnormality;
A monitoring system including the monitoring target monitored by a monitoring device. Detect an abnormality in the monitoring target,
Based on the monitoring result value of the monitoring target until an abnormality is detected, determine whether the monitoring target abnormality is a momentary abnormality,
A monitoring method for notifying a failure message when the abnormality to be monitored is not a momentary abnormality. Detecting that the monitoring result value of the monitoring target exceeds a threshold value (monitoring result threshold value) for the monitoring result value;
Determining whether the monitoring result value instantaneously exceeds a threshold value for the monitoring result value;
The monitoring method according to claim 7, wherein a failure message is notified when the monitoring result value does not instantaneously exceed a threshold for the monitoring result value. The monitoring method according to claim 8, wherein a failure message is notified when the degree of increase in the monitoring result value does not exceed a threshold (increase degree threshold) for the degree of increase in the monitoring result value. The monitoring method according to claim 8, wherein a failure message is notified when an average of monitoring result values exceeds a threshold (average threshold) with respect to an average of monitoring result values. The monitoring method according to claim 8, wherein a failure message is notified when a total of the monitoring result values exceeds a threshold (total threshold) with respect to the total of the monitoring result values. On the computer,
An anomaly detection means for detecting an anomaly of the monitoring target;
Based on the monitoring result value of the monitoring target until an abnormality is detected, an instantaneous abnormality determining means for determining whether the monitoring target abnormality is an instantaneous abnormality;
A program for functioning as a failure message notification means for notifying a failure message when the monitored abnormality is not a momentary abnormality.

Images