JP2014137635A - Response time monitoring program, method and device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a response time monitoring device which monitors response time by using an optimal threshold for a job executed by a monitoring object.SOLUTION: A response time monitoring device 1 comprises: a learning unit 14 which calculates the number of simultaneous executions of all jobs in total and the number of simultaneous executions and an average response time of a single type of jobs according to each type of jobs, executed in a specific time by a monitoring object computer, generates a first correspondence relation between the average response time of each type of jobs and the number of simultaneous executions of all jobs in total according to each type of jobs, and second correspondence relation between the average response time of each type of jobs and the number of simultaneous executions of its single type of jobs according to each type of jobs, and selects one of the first correspondence relation and the second correspondence relation corresponding to a type of jobs, which has higher correlation with the average response time; and a diagnosis unit 15 which acquires a response time of each job executed by the monitoring object computer according to preliminarily set time, and determines whether the response time of each job should be as an alert object on the basis of a threshold determined using the correspondence relation selected corresponding to a type of jobs.

Description

  The present invention relates to a response time monitoring process of a computer.

  Monitors the response time of the computer being monitored, and issues an alert when the response time exceeds normal and acceptable range (normal range), but properly sets the normal range threshold (upper limit, lower limit) It is difficult to set.

  If the normal range threshold is too low, alerts may occur frequently and the administrator may become used to the alerts and not pay attention. If the threshold is too high, an alert is not issued even if a problem occurs, and there is a possibility that the administrator may be delayed in dealing with the problem.

  Further, when the response time naturally increases due to short-term load concentration of the computer, it is desirable to suppress the alert because there is no problem that the administrator needs to deal with.

  For example, when the response time of an e-mail management server (computer) increases during a specific time period, or when the response time of a computer of a personnel management system or salary management system increases during a specific period, due to temporary processing concentration When an alert is issued based on an increase in response time, the administrator is required to investigate the cause of the alert and take countermeasures. Problems such as an increased possibility of oversight occur.

  For this reason, conventionally, when there is an alert due to an increase in response time, the administrator manually investigates the cause of the alert on the monitored computer and determines whether it is necessary to deal with the problem that has occurred. It was. Specifically, when an alert is detected about the response time of a monitored computer, the administrator checks various other performance indicators to determine what is happening to the computer and to determine if there is a problem. Necessary actions were taken when it was determined that

  In addition, conventionally, in order to issue an alarm of a plurality of ranks, an invariant indicating a relationship between device data to be monitored is extracted, and a plurality of equivalent threshold values of a plurality of rules are calculated in an invariant network, When an alarm is received from a device to be monitored, a device is known that ranks the alarm according to how different the situation is from a normal state.

  Furthermore, conventionally, for the capacity planning and resource optimization of a distributed system, an invariant that indicates the relationship between measured values collected from each device or resource is obtained, and the distributed system is determined by the invariant and the flow intensity that indicates the user load. There are known methods for determining the abilities of the elements that make up.

Special table 2011-521380 gazette Special table 2010-507146

  If the response time increases due to a problem with the monitored computer, it is necessary to promptly generate an alert. However, as described above, when the response time naturally increases due to short-term load concentration on the computer, It is desirable to suppress alerts.

  As a case where the response time increases due to the concentration of the load on the computer, generally, there are cases where a large number of users access at the same time. In addition, when processing for performing exclusive lock is executed, the response time temporarily increases even if the number of accessing users is small, but no alert is required.

  Therefore, it is necessary to set a normal range so that an alert can be generated by distinguishing between a natural increase in response time due to short-term load concentration and an abnormal response time increase due to the occurrence of a problem. It is difficult to set a normal range that can distinguish between two response time increases.

  For example, when judging abnormality based on correlation analysis between multiple data, the correlation of multiple data used for setting the normal range is unknown, and even if natural load concentration, the correlation is disturbed and Judgment may occur and alerts may occur frequently.

  Furthermore, it is necessary to appropriately set the threshold value of the normal range of response time without actually causing a problem in the monitoring target.

  The object of the present invention is to set a normal range for the response time of the computer to be monitored so that it can distinguish between temporary load concentration and the occurrence of a problem, and to output an alert only when the response time increases abnormally. Is to provide technology.

  A response time monitoring program disclosed as one aspect of the present invention is provided for a computer to monitor the response time of a monitored computer. 1) The number of simultaneous executions of all jobs executed in a certain time on the monitored computer; For each job type, the number of simultaneous executions of the job type and the average response time of the job type are calculated. 2) For each job type, the average response time of the job type and the total number of simultaneous executions of all jobs Generating a first correspondence and a second correspondence between the average response time of the job type and the number of simultaneous executions of the job type alone, and 3) the first correspondence corresponding to each job type And a correspondence relationship having a high correlation with the average response time of the job type is selected from the second correspondence relationships, and 4) the response time of each job executed by the monitoring target computer every preset time. The And 5) to determine whether the response time of each job is to be alerted based on a threshold value determined using the correspondence selected corresponding to the job type of the job. Is for.

  According to the disclosed response time monitoring program, it is possible to monitor whether the increase in the response time of the monitoring target is a natural response time increase due to short-term load concentration or an abnormal response time increase due to the occurrence of a problem. Can be realized.

FIG. 1 is a diagram illustrating a hardware configuration example in an embodiment of a response time monitoring apparatus. It is a figure for demonstrating the basis which sets the normal range of response time based on the linear approximation of the relationship between the number of simultaneous executions and response time. It is a figure which shows the structural example of the system by which a response time monitoring apparatus is implemented. It is a figure which shows the functional block structural example in one Example of a response time monitoring apparatus. It is a figure which shows the example of the protocol message memorize | stored in the message memory | storage part in one Example. It is a figure which shows the classification rule of the job type of the HTTP protocol in one Example. It is a figure which shows the classification rule of the job type of DB protocol in one Example. It is a figure which shows the example of each subdivision section divided | segmented into the fixed time interval in one Example, and the response time of each job. It is a figure which shows the example of calculation of the number of simultaneous executions and response time in one Example. It is a figure which shows the example of a plot of the correspondence of the concurrent execution number and response time in one Example. It is a figure for demonstrating the selection of the linear approximation and the simultaneous execution number in one Example. It is a figure which shows the example of a setting of the normal range of the response time by the confidence interval on the graph in one Example. It is a figure which shows the example of the response time model in one Example. It is a figure (1) which shows the example of a processing flow of the learning process in one Example. It is a figure (2) which shows the example of a processing flow of the learning process in one Example. It is a figure which shows the example of a processing flow of the diagnostic process of the response time in one Example. It is a figure which shows the example of a more detailed process flow of the diagnostic process of step S32 in one Example.

  Hereinafter, a response time monitoring apparatus that executes the response time monitoring method disclosed as one aspect of the present invention will be described.

  FIG. 1 is a diagram illustrating a hardware configuration example in one embodiment of the response time monitoring apparatus 1.

  The response time monitoring apparatus 1 includes a CPU 101, a short-term storage unit (DRAM) 102, a long-term storage unit (HDD) 103, a network interface 104, an input device (keyboard, mouse, etc.) 105, and an output device (display, printer, etc.) 106. It can be implemented as a computer connected via a network or the like.

  The response time monitoring device 1 stores information necessary for response time monitoring processing of a monitored computer, computer system, etc. as a file in the long-term storage unit 103, starts an execution program from the input device 105, and starts the execution program However, the monitoring target loaded in the short-term storage unit 102 and received by the network interface 104 executes processing based on the packet data.

  The response time monitoring apparatus 1 proceeds with the response time monitoring process while reading information from the long-term storage unit 103 to the short-term storage unit 102 as necessary. When the response time to be monitored exceeds the normal range, the response time monitoring apparatus 1 Alert information is transmitted to the terminal device of the administrator set in advance. The response time monitoring apparatus 1 can also output alert information to the output device 106.

  The execution program for the response time monitoring process is provided not only on a recording medium such as a CD-ROM, CD-RW, DVD-R, DVD-RAM, DVD-RW, or flexible disk, but also on the end of a communication line. It may be stored in another storage device or a hard disk of a computer.

  The response time monitoring apparatus 1 sets a threshold value (upper limit value or lower limit value or both) indicating a range (normal range) that can be accepted that the response time of the monitored computer or computer system is normal as the load amount of the monitored computer. Change dynamically based on

  The response time monitored by the response time monitoring device 1 means an elapsed time from when the request arrives at the computer or computer system to be monitored until when the response is output.

  In addition, the simultaneous execution number of jobs for each fixed time unit is used as the load amount to be monitored.

  The response time increases as the number of jobs (simultaneous executions) executed on the computer at the same time increases. When hardware resources are saturated, the response time increases beyond the increase in the number of jobs executed simultaneously.

  The response time monitoring apparatus 1 includes the response time for each job type executed on the computer to be monitored, the number of simultaneous executions for each job type (job type alone) executed within a certain time, and all jobs (all Measure the total number of concurrent jobs).

  Then, as a learning phase, the response time monitoring apparatus 1 obtains a correspondence relationship between the response time and the number of simultaneous executions of each of the two types for each job type. Evaluate whether it correlates more with the number of executions, obtain a linear approximation of the correspondence between the type of concurrent executions evaluated to be more correlated and the response time, and calculate the upper and lower limits of the statistical confidence interval from the approximation line. As a normal range, a response time model indicating the threshold value (upper limit value, lower limit value) is obtained and held.

  FIG. 2 is a diagram for explaining the basis for setting the normal range of the response time based on the linear approximation of the relationship between the number of simultaneous executions and the response time.

  The distribution of the number of simultaneous executions shown in FIG. 2A shows the variation in the amount of resources (such as CPU) consumed by individual jobs. For example, even for the same job type, the amount of resources required for processing varies depending on the specific job content. In addition, an increase in response time accompanying an increase in the number of simultaneous executions also causes a variation from the theoretical value. In FIG. 2, the slope indicated by (b) indicates that the theoretical value of the job response time increases in proportion to the number of concurrent executions in a range where there is a single competing resource and no waiting time for other resources occurs. It shows a tendency to.

  In FIG. 2, the increment from the approximate straight line indicated by (c) indicates the waiting time of other competing resources generated due to the dependency between resource usage, and is likely to occur when the number of jobs executed simultaneously increases.

  In FIG. 2, the part indicated by (d) indicates that when a certain resource is completely saturated, further concurrent execution cannot be processed, so that the increase in the number of concurrent executions of jobs directly leads to an increase in waiting time. It shows that the response time increases geometrically due to the generated waiting time. Therefore, when the measured response time exceeds the confidence interval from the approximate line as in the part (d), it can be considered that the resource is completely saturated, and the response time due to the occurrence of a problem in the monitoring target As an increase in the number of alerts, alerts to administrators are required. The response time monitoring apparatus 1 distinguishes between the response time corresponding to (a) to (c) in FIG. 2 and the response time corresponding to the part (d), and alerts the increase in the response time corresponding to (d). set to target.

  After that, the response time monitoring apparatus 1 acquires the start time and end time of all jobs at regular time intervals as a diagnostic phase, calculates the average response time for each job type, and uses the response time model as a learning result. Determine the normal range threshold from the number of concurrent executions of the specified type and the average response time, and if the calculated response time exceeds the threshold, that job type is the alert target (job type whose response time exceeds the normal range) Output.

  FIG. 3 is a diagram illustrating a configuration example of a system in which the response time monitoring apparatus 1 is implemented.

  The monitoring target of the response time monitoring apparatus 1 is a computer system (hereinafter referred to as a monitoring target system) 2 including a web (Web) server 21, a database (DB) server 22, and the like. The Web server 21 and DB server 22 of the monitoring target system 2 are connected to the network switch 3. The Web server 21 is further connected to the Internet 5 through the proxy (firewall) 4 and returns a response to the request from the client 6 to provide a service.

  The response time monitoring apparatus 1 is connected to a network switch 3 provided between the monitoring target system 2 and the proxy 4. Further, the response time monitoring apparatus 1 may be implemented as an internal function of the performance monitoring server 7 connected to the network switch 3.

  The response time monitoring device 1 uses the port mirroring function of the network switch 3 to transmit and receive packet data (IP packet) between the Web server 21 and the DB server 22 and between the Web server 21 and the client 6 of the monitored system 2. To collect.

  FIG. 4 is a diagram showing a functional block configuration example in one embodiment of the response time monitoring apparatus 1.

  The response time monitoring apparatus 1 includes a packet collection unit 11, a protocol analysis unit 12, a job type classification unit 13, a learning unit 14, a diagnosis unit 15, and a result output unit 16 in order to execute response time monitoring processing. As data storage locations, a message storage unit 17, a classified message storage unit 18, and a response time model storage unit 19 are provided.

  The packet collection unit 11 collects from the network switch 3 a stream of packet data (IP packets) transmitted and received within a predetermined time between the Web server 21 and the DB server 22 and between the Web server 21 and the client 6 of the monitoring target system 2. Then, the acquisition time is added to each packet data. When the response time monitoring device 1 is implemented as an internal function of the performance monitoring server 7, the packet collection unit 11 collects packet data to which a time stamp (acquisition time) is added by the time stamp function of the performance monitoring server 7. .

  The protocol analysis unit 12 analyzes the protocol of the packet data collected by the packet collection unit 11, and determines the message type (request (request), response (response), etc.), the source and destination IP addresses of the packet data, and the port The number, session number, command name, CGI parameters, and the like are extracted, and a protocol message including the extracted information and acquisition time is stored in the message storage unit 17.

  FIG. 5 is a diagram illustrating an example of protocol messages stored in the message storage unit 17.

  Each protocol message includes a packet acquisition time, a session number, a source and destination IP address and port number, a command name, a message type, and the like. For example, the protocol message of number = 1 shown in FIG. 5 includes a packet acquisition time “2009/09/07 12: 12: 04.787360”, a session number “132290-1”, and a message source IP address “194.185.39.24”. ", Port number" 51272 ", destination IP address" 194.23.5.226 ", port number" 10443 ", and protocol type" Request HTTP ".

  The job type classification unit 13 classifies the protocol message for each job, associates the request message with the response message, and stores the protocol message classified into the job type based on the job type classification rule 131 in the classified message storage unit 18. .

  In the example of the protocol message shown in FIG. 5, the request and response protocol messages with numbers = 1 and 20 are associated with the same job, and the request and response protocol messages with numbers 9 and 10 are associated with the same job.

  The job type classification rule 131 is information indicating a rule for specifying the job type from the job content included in the protocol message.

  HTTP messages are transmitted and received between the Web server 21 and the client 6. The HTTP message is requested with an identifier such as “http://www.server.com/job/type.jsp?param1=foo&param2=bar”, and the Web server 21 (server www.server.com) receives a request. On the other hand, the content specified by address notation such as “/job/type.jsp” is returned as a response.

  Between the Web server 21 and the DB server 22, an inquiry by SQL and the inquiry result are transmitted and received. For example, in response to an inquiry “SELECT employee number FROM employee table WHERE employee ID = 00001”, the DB server 22 searches the “employee table” for data that satisfies the condition “employee ID = 00001”. The inquiry result is returned to the Web server 21.

  In the HTTP protocol job type, the job type classifying unit 13 uses one type for each address or a combination of an address and some CGI parameters (for example, /job/type.jsp? Determine the job type from param2 = ba).

  FIG. 6 is a diagram showing classification rules for job types of the HTTP protocol.

  A job type classification rule 131 of the HTTP protocol represents that each job type is specified using a command name, a part of a local address in the address, and a part of a CGI parameter.

  Further, the job type classification unit 13 is a DB protocol job type that abstracts SQL based on the job type classification rule 131, for example, a “SELECT statement for accessing the employee table”. Decide as job type.

  FIG. 7 is a diagram illustrating a classification rule for a job type of the DB protocol.

  The job type classification rule 131 of the DB protocol message represents that the job type is specified by a conversion rule that abstracts the command name and the contents of the SQL statement.

  The learning unit 14 inputs protocol messages classified by job type stored in the classified message storage unit 18 as learning data, and a response time model (model formula) indicating a threshold value indicating a normal range of response time for each job type. )

  The diagnosis unit 15 inputs a protocol message data stream classified by the job type stored in the classified message storage unit 18 every predetermined time set in advance, and the response time stored in the response time model storage unit 19 Using the time model, it is determined whether the measured response time of each job type is within the normal range.

  The result output unit 16 outputs the job type determined by the diagnosis unit 15 as the response time exceeding the normal range as an alert.

  The message storage unit 17 stores the collected protocol messages with acquisition time.

  The classified message storage unit 18 stores protocol messages with acquisition times classified by job type.

  The response time model storage unit 19 stores a response time model indicating the normal range of the response time of each job type obtained by the learning unit 14.

  Next, the learning process (learning phase) of the learning unit 14 of the response time monitoring apparatus 1 will be described in more detail.

  The learning unit 14 uses the protocol message collected in a certain time stored in the classified message storage unit 18 as learning data, and performs the following processing.

  (1) The learning data is divided into predetermined time intervals. Further, the response time of each job is calculated with the acquisition time of the protocol message of the request associated with each job as the start time and the acquisition time of the response protocol message as the end time.

  FIG. 8 is a diagram illustrating an example of each subdivision section divided into fixed time intervals and the response time of each job.

  In FIG. 8, the rectangle indicates one job, the value below the rectangle is the response time of the job (millisecond [ms]), and Dn (n is 1, 2,...) In the rectangle is the job type of the job. Represents.

  (2) The learning data is divided into predetermined time intervals, and within the divided section (subdivided section: 100 ms), the average number of simultaneous executions of all jobs, the average number of simultaneous executions of job types alone, The average response time is calculated with the following formula:

Average number of simultaneous executions of all jobs = total of response times of all jobs / subdivision interval Average number of simultaneous executions of job type alone = response time of the job type / subdivision interval Average response time of each job type = job type Total response time / average number of concurrent executions of the job type Note that for a job that spans two subdivision sections, the response time is prorated for each subdivision section, and each response time is used.

  FIG. 9 is a diagram illustrating a calculation example of the simultaneous execution number and the response time.

When the response time of each job of learning data is in the state shown in FIG. 7, the following calculations are performed. For example,
Average number of simultaneous executions of all jobs = (12 + 11 + 58 + 11 + 15 + 30 + 38 + 9 + 7 + 10) / 100
= 2.01,
Average number of simultaneous executions of job type D1 job type alone = (11 + 15 + 9) /100=0.35,
Response time of each job type of job type D1 = (11 + 15 + 9) /3=11.7
It becomes.

In the case of job type D2, the job executed third is prorated in two subdivision sections T1 and T2,
Average number of simultaneous executions of job type D2 job type alone = (30 + 38 + 10) /100=0.78,
Average response time for each job type of job type D2 = (30 + 38 + 10) /1+1+10/34=34.0
It becomes.

  (3) From the calculation result of (2) above, the first set data of “average total number of simultaneous executions of all jobs, response time of the job type” for the number of subdivision sections, and “job type of the job type” The second set data of “the number of independent simultaneous executions and the average response time of the job type” is generated.

  (4) For each job type, a graph corresponding to each of the two types of generated set data is prepared, and the correspondence between the average number of concurrent executions in each segment and the average response time of the job type is displayed on each graph. Plot to.

  FIG. 10 is a diagram illustrating a plot example of the correspondence relationship between the number of concurrent executions and the response time.

  The graph shown on the left side of FIG. 10 is a graph with the horizontal axis representing the total number of simultaneous executions of all jobs and the vertical axis representing response time, and the average simultaneous execution in each subdivision section based on the first set data of job type D1. The correspondence between the number and the average response time is plotted.

  The graph shown on the right side of FIG. 10 is a graph in which the horizontal axis represents the number of simultaneous executions of a job type alone and the vertical axis represents response time. The average simultaneous number in each subdivision section based on the second set data of the job type D1. The correspondence between the number of executions and the average response time is plotted.

  Two types of graphs shown in FIG. 10 are generated for each job type.

  (5) On each of the two graphs generated in (4) above, an approximate straight line is obtained by, for example, the least square method, and the degree of deviation between each plotted correspondence and the approximate straight line is obtained. Select the graph with the higher degree. The least square method is a calculation method for obtaining f (x) that minimizes the sum of squares of the residual (measured response time−f (x)).

  FIG. 11 is a diagram for explaining linear approximation and selection of the number of simultaneous executions.

  Assume that it is determined from the graph shown in FIG. 11 that the left graph has a higher degree of linear approximation. In this case, the type of the number of simultaneous executions of the first set data corresponding to the left graph is selected, and the number of simultaneous executions of “total of all jobs” is selected as the response time model.

  When a job correlates with a resource that is commonly used for all job types, such as a CPU, for example, the degree of approximation of the correspondence relationship by the graph on the left side, that is, the average number of simultaneous executions of all jobs is increased. On the other hand, when a job correlates with a resource that is unique to a job type, for example, an exclusive lock of a transaction, the degree of approximation is higher in the graph on the right side, that is, the correspondence relationship by the number of concurrent executions of the job type alone. .

  (6) For each job type, in the selected graph, calculate the standard deviation of the response time from the approximate line (average value), calculate its confidence interval, calculate the upper and lower limits of the confidence interval, and respond The upper limit / lower limit of the normal time range.

  FIG. 12 is a diagram illustrating an example of setting a normal range of response time based on a confidence interval on a graph.

  Based on the graph based on the selected number of simultaneous executions, the standard deviation is obtained by dividing the sum of squares obtained in the linear approximation by (sample number-1) and taking the square root, and the confidence interval (99.99). %) Is obtained by “approximate straight line (average value) ± confidence level constant (3.89) × standard deviation”. The reliability constant (3.89) is a value at the 99.99% confidence level and can be obtained from the standard normal distribution table.

  The upper limit value of the normal range of response time is obtained by “f (x) + 3.89 × standard deviation”, and the lower limit value is obtained by “f (x) −3.89 × standard deviation”.

  (7) A response time model indicating the upper limit / lower limit of the normal range of the response time of each job type is stored in the response time model storage unit 19.

  FIG. 13 is a diagram illustrating an example of a response time model.

  As a response time model, for each job type, an equation for determining the type of the number of concurrent executions and the normal range of the response time is recorded. “Type of concurrent execution number” indicates the type of concurrent execution number selected in (5) above (total of all jobs, job type alone). X in the formula f (x) for obtaining the normal range is the number of concurrent executions defined by the type of the selected number of concurrent executions. Here, an equation for obtaining the upper limit value of the normal range is recorded as an equation for obtaining the normal range of the response time.

  Next, the diagnosis process (diagnosis phase) of the diagnosis unit 15 of the response time monitoring apparatus 1 will be described in more detail.

  The diagnosis unit 15 inputs a protocol message data stream collected at a predetermined time stored in the classified message storage unit 18 at predetermined time intervals, and performs the following processing.

  (1) The response time of each job is calculated with the reception time of the protocol message of the request linked from the protocol message classified for each job as the start time and the reception time of the response protocol message as the end time.

  (2) The average number of simultaneous executions of all jobs, the average number of simultaneous executions of each job type and the average response time of each job type are calculated for each job type.

  (3) For each job type, the response time model of the job type stored in the response time model storage unit 19 is referred to, and the type set to “type of simultaneous execution number” (total of all jobs or job type alone) The threshold value (upper limit value, lower limit value) of the response time of the job type is determined using the “formula for determining the normal range of response time” with the average number of concurrent executions.

  (4) For each job type, it is determined whether the calculated average response time exceeds the threshold value (upper limit value) obtained in (3) above.

  (5) When the calculated average response time exceeds the threshold, the job type is output as a job type in which an abnormal response time (response time too slow) is recorded.

  The diagnosis processes (1) to (5) are executed at regular intervals, and a list of job types in which a slow response time is recorded is output as an alert.

  FIG. 14 and FIG. 15 are diagrams illustrating an example of a processing flow of learning processing in one embodiment.

  The learning unit 14 inputs data collected from the classified message storage unit 18 for a predetermined time as learning data, and divides the input data into subdivided sections (step S10).

  The learning unit 14 performs a loop process as long as the segmentation section remains (steps S11 and S17).

  The learning unit 14 calculates the average number of simultaneous executions of all jobs in the subdivision section (step S12).

  Further, the learning unit 14 performs a loop process for each job type (steps S13 and S16).

  The learning unit 14 calculates the average number of simultaneous executions of the selected job type alone in the subdivision section (step S14), and further calculates the average response time of the selected job type (step S15).

  Further, the learning unit 14 performs a loop process for each job type (steps S18 and S24).

  The learning unit 14 linearly approximates the relationship between the total number of simultaneous executions of all jobs and the average response time of the selected job type (step S19), and the simultaneous execution number of the selected job type alone and the average of the job type The relationship with the response time is linearly approximated (step S20).

  Then, the learning unit 14 selects the type of the number of concurrent executions (total of all jobs, job type alone) used in the higher of the two linear approximations (step S21).

  Further, the learning unit 14 obtains a difference in response time from the approximate straight line (average value) for each subdivided section, calculates a standard deviation from the difference (step S22), and uses the statistical confidence criterion to determine the response time. Is calculated in the response time model storage unit 19 as an equation for obtaining the normal range (upper limit / lower limit) of the response time (step S23), and all job types are calculated. After the loop processing for is finished, the processing is terminated.

  FIG. 16 is a diagram illustrating an example of a process flow of a response time diagnosis process according to an embodiment.

  The diagnosis unit 15 repeats the loop process indefinitely until a stop command is received (steps S30 and S33). The diagnosis unit 15 reads input data for a fixed time from the classified message storage unit 18 from the data stream (step S31), performs diagnosis processing for each time (step S32), and ends the process by a stop command.

  FIG. 17 is a diagram illustrating a more detailed processing flow example of the diagnostic processing in step S32 in the embodiment.

  The diagnosis unit 15 calculates the average number of simultaneous executions of all jobs in the input data section (step S320), and performs loop processing for each job type (steps S321 and S329).

  The diagnosis unit 15 calculates the average response time of the selected job type in the classification of the input data (step S322), and the type of the number of simultaneous executions determined by the learning unit 14 is “job” for the selected job type. It is determined whether it is “species alone” (step S323). If the type at the time of calculating the number of simultaneous executions is “job type alone” (Y in step S323), the average number of simultaneous executions of the selected job type alone in the input data section is calculated (step S324), and the simultaneous execution is performed. If the number type is not “job type alone” (N in step S323), the average number of simultaneous executions of all jobs in the input data section is calculated and used as the number of simultaneous executions (step S325).

  The diagnosis unit 15 calculates a response time threshold (upper limit) according to the obtained number of simultaneous executions from the response time model (step S326), and the average response time of the selected job type exceeds the threshold (upper limit). Is determined (step S327). If the response time of the selected job type exceeds the threshold (Y in step S327), the selected job type is output as a job type having an abnormally long response time (step S328). If the response time does not exceed the threshold value (N in step S327), the process is terminated after the loop process for all job types is completed.

  As described above, according to the response time monitoring apparatus 1, in the learning phase, by obtaining a response time model reflecting a value (normal range) that the response time can normally take for each job type, Since a normal range of response time is set according to the species, no alert is output if the response time is within a natural variation range.

  Therefore, when the response time monitoring apparatus 1 outputs an alert, it can be seen that some problem has occurred, not the range of natural increase due to the increase in the number of simultaneous executions of the response time.

  Further, according to the response time monitoring apparatus 1, since learning is performed by linearly approximating the relationship between the number of concurrent executions for each job type and the response time, only learning data in a normal state (the number of concurrent executions is small) is used. Response time can be modeled.

  The response time monitoring apparatus 1 disclosed as one aspect of the present invention has the following effects.

  -Since alerts are not issued for natural response time increases that do not need to be addressed, useless alerts can be reduced.

  ・ It is possible to save the trouble of diagnosing whether the alert is really caused by a problem. For example, there is no need to investigate whether there is an abnormality compared to the usual response time as in the past, or to investigate whether the job is temporarily congested against the number of concurrent jobs. .

  -Data on the situation where resources are saturated in the monitoring target is unnecessary, and it is possible to learn from data in the case of normal load and generate a response time model.

  By exhibiting these effects, the response time monitoring apparatus 1 can monitor the response time with higher accuracy, and can stabilize the performance of services provided on the computer.

  The elements constituting the disclosed response time monitoring apparatus 1 may be realized in any combination. A plurality of components may be realized as one member, and one component may be configured from a plurality of members. The response time monitoring device 1 is not limited to the above-described embodiment, and various improvements and changes may naturally be made without departing from the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 Response time monitoring apparatus 11 Packet collection part 12 Protocol analysis part 13 Job type classification part 131 Job type classification rule 14 Learning part 15 Diagnosis part 16 Result output part 17 Message storage part 18 Classified message storage part 19 Response time model storage part 2 Monitoring target system 21 Web server 22 DB server 3 Network switch 4 Proxy 5 Internet 6 Client 7 Performance monitoring server

Claims (3)

To monitor the response time of the monitored computer,
Calculate the total number of simultaneous executions of all jobs executed in a certain time on the monitored computer, the number of simultaneous executions of the job type for each job type, and the average response time of the job type,
For each job type, a first correspondence between the average response time of the job type and the total number of simultaneous executions of all jobs, and a second correspondence between the average response time of the job type and the simultaneous execution number of the job type alone And create a correspondence
For each job type, select a correspondence having a high correlation with the average response time of the job type from the corresponding first correspondence and second correspondence.
Obtain the response time of each job executed on the monitored computer at a preset time,
Response time monitoring for executing the processing to determine whether the response time of each job is to be alerted based on the threshold value determined using the correspondence selected corresponding to the job type of the job program. To monitor the response time of a monitored computer, the computer
Calculate the total number of simultaneous executions of all jobs executed in a certain time on the monitored computer, the number of simultaneous executions of the job type for each job type, and the average response time of the job type,
For each job type, a first correspondence between the average response time of the job type and the total number of simultaneous executions of all jobs, and a second correspondence between the average response time of the job type and the simultaneous execution number of the job type alone And create a correspondence
For each job type, select a correspondence having a high correlation with the average response time of the job type from the corresponding first correspondence and second correspondence.
Obtain the response time of each job executed on the monitored computer at a preset time,
A response time monitoring method that executes a process of determining whether the response time of each job is to be alerted based on a threshold value determined using a correspondence selected in correspondence with the job type of the job. The total number of simultaneous executions of all jobs executed in a certain time on the monitored computer, and for each job type, calculate the number of simultaneous executions of the job type alone and the average response time of the job type, for each job type, Generating a first correspondence between the average response time of the job type and the total number of simultaneous executions of all jobs, and a second correspondence between the average response time of the job type and the number of simultaneous executions of the job type alone A learning unit that selects, for each job type, a correspondence having a high correlation with an average response time of the job type from among the corresponding first correspondence and the second correspondence;
The response time of each job executed on the monitored computer is acquired every preset time, and the response time of each job is determined using the correspondence selected corresponding to the job type of the job A response time monitoring apparatus comprising: a diagnosis unit that determines whether to be an alert target based on the threshold value.

Images