JP2014142683A - Monitoring control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a monitoring control system capable of tracing the detail operational state of monitoring control processing without damaging a monitoring control operation.SOLUTION: Each of a plurality of monitoring control devices 1 includes: a log trace storage part 21 for storing an operation log generated in accordance with the operation of the monitoring control device as a log trace file; a log data processing part 23 for, in response to a log collection request from a log collection device 4, extracting and outputting necessary log data DL from a stored log trace file FL; an interrupt propriety determination part 22 for, when the pattern of the operation log is coincident with a preliminarily defined definition log pattern (definition file PD), determining that interrupt is not allowed; and a processing operation control part 24 for, on the basis of the determination result (interrupt propriety information JI) of the interrupt propriety determination part 22, limiting processing by the log data processing part 23.

Description

  The present invention relates to a configuration for collecting log trace files accumulated for each monitoring control device in a monitoring control system in which a plurality of monitoring control devices operate in cooperation to perform monitoring control.

  The monitoring control system collects monitoring data from a remote location or a plurality of monitoring targets, accumulates and displays the collected monitoring data, and controls the monitoring target. These monitoring and control processes are performed at regular intervals and during state changes / operations via the network. If monitoring data is not collected within a certain period of time or if the process is not completed, it is recognized that an error has occurred in the system. .

  On the other hand, log tracing files are accumulated in a plurality of monitoring control devices (computers) constituting the monitoring control system in order to trace the detailed operation state of the monitoring control processing executed in each monitoring control device. Yes. This log trace file is larger than the monitoring control data, and is usually only stored in each device. Display processing is performed.

  If the log trace file is large, data compression may be performed before collection. However, since the log trace file exists in such a large amount, resources such as the network load and the CPU and memory of the monitoring control device are present during log collection processing. The load of becomes higher. For this reason, the load of log collection hinders the monitoring control process, which causes a delay in the monitoring control process, data loss, processing failure, and the like, resulting in an abnormality in the monitoring control system.

  Therefore, in order to reduce the load at the time of log trace collection, the load is distributed so that log collection processing and monitoring control processing do not overlap by scheduling log collection by predicting low load time. A data collection method is proposed (see, for example, Patent Document 1).

Japanese Patent Laying-Open No. 2006-79488 (paragraphs 0011 to 0015, FIG. 2)

  However, the data collection method as described above is effective for a steady load of a fixed pattern such as fixed cycle data, but sudden loads such as monitoring data transmission and screen operation at the time of state change occur. It was not suitable for easy monitoring and control systems. In addition, in the supervisory control system, there are some processes that are important for control even if the load is light. There is a possibility that it is impossible to perform proper monitoring and control.

  The present invention has been made to solve the above-described problems, and an object of the present invention is to obtain a monitoring control system capable of tracing the detailed operation state of the monitoring control process without impairing the monitoring control operation. To do.

  A monitoring control system according to the present invention includes a plurality of monitoring control devices that are distributedly arranged on a network and perform monitoring control on a monitoring target in cooperation with each other, and a log collection device that collects logs of the plurality of monitoring control devices. Each of the plurality of monitoring control devices includes a log trace accumulating unit for accumulating an operation log generated as a result of the operation of the monitoring control device as a log trace file; and In response to a log collection request, the log data processing unit that extracts and outputs the necessary log data from the accumulated log trace file, and compares the operation log pattern with a predefined log pattern And an interrupt enable / disable determining unit that determines that an interrupt is impossible when the action log pattern matches the definition log pattern; Based on the determination result of the interruption determination section, characterized in that and a processing operation control unit for limiting processing by the log data processing unit.

  According to the monitoring control system of the present invention, since the interrupt processing by the log collection processing is limited according to the operation state determined by the operation log pattern, detailed monitoring control processing can be performed without impairing the monitoring control operation. A supervisory control system capable of tracing the operation state can be obtained.

It is a block diagram which shows the structure of the monitoring control system concerning Embodiment 1 of this invention. It is a flowchart for demonstrating operation | movement of the log storage process in the monitoring control system concerning Embodiment 1 of this invention. It is a flowchart for demonstrating the operation | movement regarding the log collection process in the monitoring control system concerning Embodiment 1 of this invention. It is a flowchart for demonstrating the operation | movement regarding the log collection process in the monitoring control system concerning Embodiment 1 of this invention. It is a figure which shows the example of the definition file for judging the propriety of execution of the log collection process in the monitoring control system concerning Embodiment 1 of this invention. It is a block diagram which shows the structure of the monitoring control system concerning Embodiment 2 of this invention. It is a flowchart for demonstrating the operation | movement regarding the log storage process in the monitoring control system concerning Embodiment 2 of this invention. It is a block diagram which shows the structure of the monitoring control system concerning Embodiment 3 of this invention. It is a flowchart for demonstrating the operation | movement regarding the log storage process in the monitoring control system concerning Embodiment 3 of this invention. It is a block diagram which shows the structure of the monitoring control system concerning Embodiment 4 of this invention. It is a flowchart for demonstrating the operation | movement regarding the log collection process in the monitoring control system concerning Embodiment 4 of this invention. It is a flowchart for demonstrating the operation | movement regarding the log collection process in the monitoring control system concerning Embodiment 4 of this invention. It is a block diagram which shows the structure of the monitoring control system concerning Embodiment 5 of this invention. It is a flowchart for demonstrating the operation | movement regarding the log collection process in the monitoring control system concerning Embodiment 5 of this invention. It is a block diagram which shows the structure of the monitoring control system concerning Embodiment 6 of this invention. It is a flowchart for demonstrating the operation | movement regarding the log collection process in the monitoring control system concerning Embodiment 6 of this invention.

Embodiment 1 FIG.
The configuration and operation of the monitoring control system according to the first embodiment of the present invention will be described with reference to the drawings. FIGS. 1 to 5 are diagrams for explaining the monitoring control system according to the first embodiment. FIG. 1 shows an overall configuration and a detailed configuration of a part related to log collection processing as the configuration of the monitoring control system. 2 to 4 are flowcharts for explaining the operation of the monitoring control system, FIG. 2 shows the operation of the log accumulation process, FIG. 3 shows the operation of the log collection process, and FIG. The operation | movement which controls execution / stop of a process is shown. FIG. 5 is a diagram showing a specific example of a definition log pattern (definition file) for determining whether log collection processing can be executed.

The monitoring control system collects monitoring data from a remote location or a plurality of monitoring targets, accumulates and displays the collected monitoring data, and controls the monitoring target. Therefore, as shown in FIG. 1, a plurality of monitoring and control device 1 from the monitor control apparatus 1 _-1 provided in accordance with the monitored (not shown) or an operation point or the like to the monitoring control apparatus 1 _-M, each A log collection device 4 that collects desired log data from log trace files stored in the monitoring control device 1 and a network 5 that connects these devices are provided.

Each of the monitoring control devices 1 executes a variety of functions as a monitoring control system such as transmission / reception of monitoring data, data calculation, data accumulation, abnormality detection of monitoring targets, and control operations from the screen. Monitoring control processing unit _10-1 to monitoring control processing unit 10 _-N (collectively monitoring control processing unit 10), and log trace management unit 20 for accumulating detailed operation states of each monitoring control processing unit 10 as log traces Has been built. The operation of each monitoring control processing unit 10 is not directly related to the present invention and will be omitted. However, when the processing is executed by each monitoring control processing unit 10, the CPU, memory, etc. that construct the network 5 and the monitoring control device 1. Use a load. At this time, each monitoring control processing unit 10 transmits a log output request to the log trace management unit 20 in order to accumulate the detailed operation state in the processing as the log trace file FL ₃₀ .

The log trace management unit 20 includes a log storage unit 21 for sequentially recording (accumulating) the log trace file FL ₃₀ in the storage device 30, and an interrupt determination for determining whether or not an interrupt due to log collection processing is possible depending on the load. Controls the determination unit 22, the log data processing unit 23 that extracts and processes necessary log data DL from the log trace file FL ₃₀ stored in the storage device 30 during the log collection processing, and outputs the log data DL. A processing operation control unit 24 is provided.

When receiving the log output request transmitted from each monitoring control processing unit 10, the log storage unit 21 writes the contents of a log (hereinafter referred to as an operation log) generated in the log trace file FL ₃₀ which is an actual file. At the same time, the contents of the operation log (log pattern) are transmitted to the interrupt enable / disable determining unit 22.

The interrupt enable / disable determining unit 22 compares the content of the operation log transmitted from the log storage unit 21 with a definition file PD ₂₂ stored in advance (details will be described later) to determine whether or not to interrupt the log collection process. The determination is made, and the interrupt enable / disable information JI ₂₂ as the determination result is output to the log data processing unit 23.

  The log data processing unit 23 returns a collection request reception unit 231 that receives a collection request from the log collection device 4, a log compression unit 232 that performs log compression as necessary, and returns log data DL to the log collection device 4 ( And a log transmission unit 233 for output).

  The log collection device 4 includes a request for collecting logs from the user, a collection condition setting unit 41 for setting log collection conditions based on the received request, and a log corresponding to the set log collection conditions A collection request transmission unit 42 that transmits a collection request to each monitoring control device 1, a log reception unit 43 that receives log data DL as a result of the log collection request, and a collection result display unit 44 that displays the log collection result Is provided.

Next, operations related to log collection processing in the monitoring control system according to the first embodiment will be described with reference to FIGS. 1 and 2 to 4.
In a normal monitoring control process in which the log collection process is not executed, only the log accumulation process of FIG. In the log accumulating process, the log accumulating unit 21 waits for a log output request from each monitoring control processing unit 10, and when the operation log data is received (step SC100), the contents are written in the log trace file FL ₃₀ (steps). SC110).

The data (pattern) of this operation log is also sent to the interrupt enable / disable determining unit 22. The interrupt enable / disable determining unit 22 determines whether or not the content of the received operation log matches the definition file PD ₂₂ (step SC120). If the content of the received operation log matches the definition file PD ₂₂ (“Y” in step SC120), it is determined that the process should be executed preferentially while avoiding interruption of other processes. As the determination result, interrupt enable / disable information JI ₂₂ indicating that the interrupt stop is set is output to the log data processing unit 23 (step SC200). However, if the operation log output has not occurred for a certain period of time after determining that the pattern matches ("Y" in step SC130), it is determined that the process has been canceled, and the process proceeds to step SC300.

On the other hand, if the content of the received operation log does not match the definition file PD ₂₂ (“N” in step SC120), interrupt enable / disable information JI ₂₂ indicating that the interrupt stop has been canceled is output to the log data processing unit 23 ( Step SC300). At this time, the interrupt enable / disable information JI ₂₂ is also shared by the processing operation control unit 24, and the log data processing unit 23 and the processing operation control unit 24 have an interrupt indicating whether the interrupt is stopped or cancelled. The inclusion permission / inhibition information JI ₂₂ is output.

Here, specific determination processing in step SC120 will be described.
The content of the action log is a combination of [type] and [pattern], and the definition file PD ₂₂ used for the determination is also defined by a combination of the type and pattern according to the contents of the action log as shown in FIG. doing. The target of pattern definition is the main function of monitoring control, “Process to collect, calculate, and accumulate monitoring target data at regular intervals” and “Notify the alarm / alarm when something happens to the monitoring target. The contents of the action log related to "Process to do" are set. By defining in this way, processing with high priority for monitoring control is not hindered by the log collection processing. As a result, the main function as the monitoring control operates at high speed without being interrupted by the low-priority log collection processing, and the monitoring control can be performed normally.

  When the type is “FROM” or “TO”, one set consists of two lines. When “FROM” is received, it is determined that the processing of the pattern has started, and when “TO” is received. , It is determined that the processing of the pattern has been completed. On the other hand, when the type is “EVENT (t)”, one set is made in one line, and t indicates the duration (second) of the process. Therefore, when the operation log of this type is received, the process of the pattern is started. It is determined that the processing has been completed when t seconds have passed since the operation log was received (after t seconds).

Any number of sets (conditions) can be described in the definition file PD ₂₂ , and determination is performed for each condition. The determination as a whole is determined by, for example, OR of each determination condition. In that case, it is determined to be ON when any of the conditions is turned on (matched), and is determined not to be matched when all the conditions are turned off (mismatched). Thus, by determining whether or not the content of the operation log matches the definition file PD ₂₂ , at this time, processing that should be preferentially executed while avoiding interruption of other processing (log collection) is being executed. Whether or not there is, in some cases, the duration can also be determined. Needless to say, the contents described in the definition file PD ₂₂ can be appropriately changed according to the target of the monitoring control and the configuration of the monitoring control device.

Next, a case where log collection processing is executed will be described.
As shown in FIG. 3, when the collection condition setting unit 41 in the log collection device 4 accepts a log collection request from the user, the log collection condition is set based on the received request content (step SA400). A log collection request corresponding to the set log collection condition is output to the collection request transmission unit 42. The log collection conditions to be set include information on “collection target device”, “collection target log trace file”, and “log compression presence / absence”.

  The collection request transmission unit 42 sets the log collection condition as a loop (step SALS to step SALT) for each device that is a target of log collection based on the information of the “collection target device” included in the output log collection request. The corresponding log collection request is transmitted to each of the monitoring control devices 1 to be collected (SA410).

When the collection request receiving unit 231 receives the log collection request (step SA100), each of the monitoring control devices 1 to be collected receives the log data processing unit 23 from the log trace file FL ₃₀ stored in the storage device 30. The log data DL specified in the log collection condition is extracted and acquired (step SA110). At this time, if the information with log compression is included in the log collection condition, the log data DL is compressed by the log compression unit 232 (step SA120), and then the log collection unit 4 which is the collection request source by the log transmission unit 233. Log data DL is transmitted to

  When the log receiving unit 43 receives the transmitted log data DL (step SA420), the log collection for the device is completed, and the loop for all the target devices is completed (“Y” in step SALT). The log data DL is displayed (step SA430), and the log collection process ends.

Among the log collection processes described above, during the log data process (denoted as process A in the figure) from step SA100 to SA130 executed for each collection target device, the processing operation control unit 24 performs the following in a regular cycle. A process operation control sequence (denoted as process J in the figure) for interrupting or resuming the operation of the log data process described in (1) is executed. This process refers to the interrupt enable / disable information JI ₂₂ and determines whether or not it is in an interrupt stop state (step SJ100) as shown in FIG. 4, and if it is in an “interrupt stop” state (“Y” in step SJ100) ”), It is determined that an important process is being performed for monitoring control, and the process A is temporarily stopped (step SJ200). The interrupt enable / disable information JI ₂₂ is continuously referred to at a predetermined cycle, and the status is“ interrupt stop release ”. Wait until it becomes. If it is in the “interrupt stop release” state (“N” in step SJ100), the temporary stop is released and the rest of process A is continued (step SJ300).

  In the flowchart of FIG. 3, for simplification of description, it is described that the collection target monitoring control devices 1 are operated in series. However, the present invention is not limited to this. Needless to say, the process A may be performed in parallel in each of the monitoring control devices 1 to be collected.

  As described above, since the process J is executed at a constant cycle during the execution of the log data process (process A) for each apparatus, when a process with high priority is started or being executed in the monitoring control operation. Log data processing is interrupted or prevented from starting. Therefore, the monitoring control process can be normally continued without being hindered by the log collection process.

As described above, according to the monitoring control system according to the first embodiment, a plurality of monitoring control devices 1 (1 ₋₁ to 1) that are distributed on the network 5 and execute monitoring control on the monitoring target in cooperation with each other. _-M ) and a log collection device 4 that collects logs of the plurality of monitoring control devices 1, each of the plurality of monitoring control devices 1 being associated with the operation of the monitoring control device. In response to a log collection request from the log collection device 4 that accumulates the generated operation log as a log trace file, the necessary log data DL is extracted from the accumulated log trace file FL ₃₀ The log data processing unit 23 to output, the operation log pattern, and a predefined definition log pattern (definition file PD ₂₂ ) are compared, and the operation log pattern is compared. And the definition log pattern (definition file PD ₂₂ ) match, the interrupt enable / disable determination unit 22 that determines that an interrupt is impossible and the determination result (interrupt enable / disable information JI ₂₂ ) of the interrupt enable / disable determination unit 22 And a processing operation control unit 24 that restricts processing by the log data processing unit 23. Therefore, in an environment where predetermined processing and log collection processing can be executed simultaneously, a predetermined priority with higher priority is provided. When the process is in operation, the log collection process is temporarily stopped, and conversely, by executing the log collection process at a timing when the predetermined process does not operate, the necessary log data DL can be acquired without adversely affecting the necessary process. That is, it is possible to obtain a monitoring control system that can trace the detailed operation state of the monitoring control process without impairing the predetermined processing operation.

In particular, the definition log pattern (definition file PD ₂₂ ) is defined so as to match the pattern of the operation log generated with the periodic operation for processing the monitoring target data and the operation when the monitoring target state changes. Therefore, in an environment where processing necessary for monitoring control and log collection processing can be executed at the same time, log collection processing is paused while monitoring control processing with higher priority is in operation, and monitoring control processing operates By executing the log collection process at the timing when the log data is not used, the necessary log data DL can be acquired without adversely affecting the monitoring control process. That is, it is possible to obtain a monitoring control system that can trace the detailed operation state of the monitoring control process without impairing the monitoring control operation.

  In addition, when one operation log is generated and no other operation log is generated for a predetermined time, the interrupt enable / disable determination unit 22 determines that there is no one operation log and determines whether or not an interrupt is possible. Since it did in this way, even if it fails to detect that the process which should avoid interruption was complete | finished, the detailed operation state of the monitoring control process can be traced.

Embodiment 2. FIG.
In the second embodiment, a function for determining the network state is added to the interrupt enable / disable determining unit of the monitoring control system in the first embodiment. 6 and 7 are diagrams for explaining the monitoring control system according to the second embodiment. FIG. 6 is a block diagram showing the overall configuration and the detailed configuration of the log collection processing part as the configuration of the monitoring control system. FIGS. 7A and 7B are flowcharts for explaining the operation of the log accumulation process. In the second embodiment, FIGS. 3 to 5 described in the first embodiment are used. The same components as those in the first embodiment are denoted by the same reference numerals, and detailed description thereof is omitted.

  In the second embodiment, as shown in FIG. 6, a network state determination unit 223 (denoted as an NW state determination unit in the figure) that performs load state determination based on the network state is provided in the interrupt enable / disable determination unit 22. ing. The network state determination unit 223 refers to the load state of the network 5 and determines whether or not an interrupt is possible depending on whether the network load is equal to or greater than a threshold value. In addition, in order to clarify the change of the interrupt enable / disable determining unit 22 in the second embodiment, the part for determining the processing state based on the contents of the operation log described in the first embodiment is independent of the interrupt enable / disable determining unit 22. It was described as a function unit (processing state determination unit 222).

The flow of processing in the second embodiment will be described based on the flowchart of FIG. In the monitoring control system according to the second embodiment, in determining whether or not an interrupt is possible in the log accumulation process, in addition to the determination based on the contents of the operation log (steps S120 to SC130), the determination based on the magnitude of the network load (step SC140) is performed. Like to do. In the example of the flowchart of FIG. 7, when any of the processing state determination unit 222 and the network state determination unit 223 determines that an interrupt is not possible, interrupt enable / disable information JI ₂₂ indicating that interrupt is not possible is output.

  As described above, according to the monitoring control system according to the second embodiment, the interrupt availability determination unit 22 is provided with the network state determination unit 223 that determines whether or not the load amount of the network 5 exceeds the threshold value. If the network load amount exceeds the threshold, it is determined that interruption is impossible. Therefore, the network load other than that caused by the monitoring control processing of the own device, specifically, the monitoring control processing of the other device Log collection processing that does not affect the monitoring control processing can be realized by temporarily suspending the data collection processing even with respect to the network load.

Embodiment 3 FIG.
In the third embodiment, a function for determining the load states of the CPU and the memory of the self-monitoring control device is added to the interrupt enable / disable determining unit of the monitoring control system in the second embodiment. FIGS. 8 and 9 are diagrams for explaining the monitoring control system according to the third embodiment. FIG. 8 is a block diagram showing the overall configuration and the detailed configuration of the log collection processing part as the configuration of the monitoring control system. FIG. 9 and FIG. 9 are flowcharts for explaining the operation of the log accumulation process. In the third embodiment, FIGS. 3 to 5 described in the first embodiment are used. The same components as those in the second embodiment are denoted by the same reference numerals, and detailed description thereof is omitted.

  In the third embodiment, as shown in FIG. 8, in the interrupt enable / disable determination unit 22, a resource state determination unit 224 that performs load state determination of the CPU and memory constituting the resources of the monitoring control device (resources in the figure). It is described as a determination unit.) The resource state determination unit 224 refers to the load state of the CPU and the use state of the memory constituting the self-monitoring control device 1, and determines whether or not an interrupt is possible depending on whether the load on the CPU or the use rate of the memory is equal to or greater than a threshold I have to.

The flow of processing in the third embodiment will be described based on the flowchart of FIG. In the monitoring control system according to the third embodiment, a determination based on the CPU load or the memory usage rate is performed (step SC150) in determining whether or not an interrupt is possible in the log accumulation process. In the example of the flowchart of FIG. 9, when any of the processing state determination unit 222, the network state determination unit 223, and the resource state determination unit 224 determines that interruption is not possible, the interrupt availability information JI ₂₂ indicating that interruption is not possible is output. To do.

In the above example, the example in which the resource state determination unit 224 is added to the configuration of the second embodiment has been described. However, for example, the resource state determination unit 224 may be added to the configuration of the first embodiment. Good. That is, the amount corresponding to the difference in each embodiment may be added in appropriate combination. In this case, for example, when either the processing state determination unit 222 or the resource state determination unit 224 determines that interrupt is not possible, the interrupt availability information JI ₂₂ indicating that interrupt is not possible may be output.

  As described above, according to the monitoring control system according to the third embodiment, the interrupt availability determination unit 22 has the threshold value of the load amount of the arithmetic device (CPU) or the memory usage amount constituting the monitoring control device. Since the resource state determination unit 224 that determines whether or not the amount exceeds the threshold value, and the load amount of the arithmetic device or the memory usage amount exceeds the threshold value, it is determined that the interruption is impossible. Log collection processing that does not further affect the monitoring control processing can be realized by temporarily stopping the data collection processing even when the CPU is heavily loaded and the memory usage rate is high.

Embodiment 4 FIG.
In the fourth embodiment, with respect to the monitoring control system according to the third embodiment, a system in which a plurality of paths between devices exist is assumed, and a transmission path is selected in the log data processing unit according to the state of the network path. The function to perform is added. 10 to 12 are diagrams for explaining the monitoring control system according to the fourth embodiment. FIG. 10 is a block diagram showing the overall configuration and the detailed configuration of the log collection processing part as the configuration of the monitoring control system. 11 and 12 are flowcharts for explaining the operation of the log collection processing. In the fourth embodiment, FIG. 9 (flow of log accumulation process) described in the third embodiment and FIG. 5 described in the first embodiment are used. The same components as those in the third embodiment are denoted by the same reference numerals and detailed description thereof is omitted.

  In the fourth embodiment, as shown in FIG. 10, each monitoring control device 1 and log collection device 4 are connected to multiple networks 5A, 5B and a plurality of routes of a wireless network 6. A removable disk 7 is connected to each monitoring control device 1 and log collection device 4. Although the removable disk 7 is not generally referred to as a path, the data on each monitoring control device 1 can be moved to the log collection device 4 by manually moving the removable disk 7. In the form, it is treated as one of a plurality of routes (broadly defined route).

  In the log data processing unit 23, a transmission path selection unit 234 that selects a path for outputting a log file to the log collection device 4 is provided. At this time, the network state determination unit 223 calculates not only information on whether or not the load exceeds the threshold value, but also the load status for each route, and outputs the result to the transmission route selection unit 234. Therefore, the transmission route selection unit 234 can select a route based on the network state information output from the network state determination unit 223.

  The flow of processing in the fourth embodiment will be described based on the flowchart of FIG. In the monitoring control system according to the fourth embodiment, in the log collection process A, the following process is executed after log compression (step SA120) and before execution of log data transmission (step SA130). The transmission route selection unit 234 acquires the load states of the plurality of routes (the network 5A, the duplex network 5B, and the wireless network 6 in FIG. 11) from the network state determination unit 223 (step SA124). Then, the transmission route selection unit 234 selects the route with the lowest load or room as the transmission execution route based on the acquired load state for each route, and outputs the selection result to the log transmission unit 233 (step S3). SA126). Then, the log transmission unit 233 executes log data transmission using the selected route (step SA130).

  Further, in the fourth embodiment, as shown in FIG. 12, timeout detection (step SJ210) is performed in the operation of processing J with a fixed period. As a result, if a time-out occurs due to a long network load (“Y” in step SJ210), the log data transmission via the normal path (network) is abandoned and the path is changed to the removable disk 7 (step SJ220). And process A is resumed. As described above, since the removable disk 7 does not communicate as it is, the log data DL is not collected as it is (automatic). However, the log data DL can be collected by manually collecting the removable disk 7 on the monitoring control device 1 and moving it to the log collection device 4 as a batch process. As a result, even when the network connected to the apparatus continues to be unavailable for collecting the log data DL, the log data DL can be collected although a time difference occurs and manual operation is required.

  In the above example, the transmission route selection unit 234 is added to the configuration of the third embodiment. However, the transmission route selection unit 234 may be added to the configuration of the second embodiment. Further, if a function capable of determining the state of the network is provided, it may be added to the configuration of the first embodiment or may be added by appropriately combining the corresponding differences of the respective embodiments. .

  As described above, according to the monitoring control system according to the fourth embodiment, the network is configured by the plurality of paths 5A, 5B, and 6 (also 7 in some cases). Includes a route selection unit (transmission route selection unit) that selects one route from among a plurality of routes as a route when log data DL is output to the log collection device 4 in accordance with the load status of each of the plurality of routes. 234 and the network state determination unit 223) are provided, so that an optimum route can be selected when there are a plurality of log collection routes. If the removable disk 7 is also included in the options, manual collection can be performed even in a situation where the load is continuously high and the log collection process cannot be operated for a long period of time.

Embodiment 5 FIG.
In the fifth embodiment, a resource management unit for managing used resources is provided in the log data processing unit of the monitoring control system in the fourth embodiment. FIGS. 13 and 14 are diagrams for explaining the monitoring control system according to the fifth embodiment. FIG. 13 is a block diagram showing the overall configuration and the detailed configuration of the log collection processing part as the configuration of the monitoring control system. FIG. 14 and FIG. 14 are flowcharts for explaining the operation of the log collection processing. In the fifth embodiment, FIG. 5 described in the first embodiment, FIG. 9 described in the third embodiment, and FIG. 12 described in the fourth embodiment are used. The same components as those in the embodiments are denoted by the same reference numerals and detailed description thereof is omitted.

  In the fifth embodiment, as shown in FIG. 13, a resource management unit 235 for managing resources used such as the number of CPUs and the amount of memory in the self-monitoring control device 1 is provided in the log data processing unit 23. Provided. The resource management unit 235 limits the number of CPUs used for log collection processing and the memory usage based on the CPU load status and memory usage status information output from the resource status determination unit 224.

  The flow of processing in the fifth embodiment will be described based on the flowchart of FIG. In the monitoring control system according to the fifth embodiment, in the log collection process A, the following process is executed after the log collection request is received (step SA100) and before the log file acquisition (step SA110). . The resource management unit 235 acquires information about the resource status such as the number of CPUs on the own device, the current memory usage amount, and the total memory amount from the resource state determination unit 224 (step SA102). When it is determined from the acquired information that the resources allocated to the log collection process should be restricted, for example, when the multi-core configuration has a plurality of CPUs, the number of CPUs allocated to the subsequent log collection process is, for example, one. Settings are made so as to limit (step SA104). Alternatively, for the memory, the remaining free memory is calculated from the memory usage and the total memory amount, and the maximum memory amount used in the subsequent log collection processing is limited so as to be equal to or less than the specified ratio of the remaining free memory (step SA106). ). Then, even when interruption due to log collection is permitted, by limiting the resources used for log collection, it is possible to allocate more than a certain amount of resources to the monitoring control process. That is, the monitoring control process can be properly executed.

  In the above example, the example in which the resource management unit 235 is added to the configuration of the fourth embodiment has been described. However, the resource management unit 235 may be added to the configuration of the third embodiment. Further, as long as a function capable of determining the states of the CPU and the memory is provided, the present invention may be applied to the first embodiment or may be added by appropriately combining the corresponding differences of the respective embodiments. .

As described above, according to the monitoring control system according to the fifth embodiment, each of the plurality of monitoring control devices 1 configures the resources of the monitoring control device 1- _j and loads on the arithmetic device (CPU). Since the resource management unit 235 that restricts the allocation of the number of arithmetic devices or the capacity of the memory to the operation of the log data processing unit 23 based on the amount or the memory usage is provided, log collection By dynamically limiting the use of CPU and memory, which are resources used in the computer used for processing, it is possible to prevent the log collection processing from using up resources and affecting the monitoring control processing.

Embodiment 6 FIG.
In the sixth embodiment, a detailed condition setting unit for setting detailed conditions for log collection in the log collection device of the monitoring control system in the fifth embodiment, and a log collection result based on the set detailed conditions. A collection result shaping unit for shaping is provided, and a log filtering unit for filtering log data based on the set detailed condition is provided in the log data processing unit. FIGS. 15 and 16 are diagrams for explaining the monitoring control system according to the sixth embodiment. FIG. 15 is a block diagram showing the overall configuration and the detailed configuration of the log collection processing part as the configuration of the monitoring control system. FIG. 16 and FIG. 16 are flowcharts for explaining the operation of the log collection processing. In the sixth embodiment, FIG. 5 described in the first embodiment, FIG. 9 described in the third embodiment, and FIG. 12 described in the fourth embodiment are used. The same components as those in the embodiments are denoted by the same reference numerals and detailed description thereof is omitted.

  In the sixth embodiment, as shown in FIG. 15, a detailed condition setting unit 45 for setting detailed conditions in log collection in the log collection device 4, and a log collection result based on the set detailed conditions A collection result shaping unit 46 is provided for shaping. Thus, further detailed collection conditions and display conditions are set in the “collection target device”, “collection target log trace file”, and “log compression presence / absence” that are the collection conditions set by the collection condition setting unit 41. The detailed collection condition specified by the detailed condition setting unit 45 is included in the log collection request transmitted from the collection request transmission unit 42 to the collection target device.

  In the target collection device, the collection request reception unit 231 develops detailed collection conditions from the received log collection request. At this time, since each of the monitoring control devices 1 is provided with a log filtering unit 236 (described as a log F unit in the figure) in the log data processing unit 23, based on the developed detailed collection condition, The log filtering unit 236 can perform necessary information filtering. Specifically, only specified log data such as a specified time range is narrowed down from the acquired log file. The narrowed result is output to the log compression unit 232 as the collected log data DL.

  This process is executed in each collection target device, and after all the collected logs are finally received on the log collection device 4, the collected result display unit 46 displays the collected logs designated by the detailed condition setting unit 45. It is shaped according to the conditions and output to the collection result display unit 44.

The flow of processing in the sixth embodiment will be described based on the flowchart of FIG. In the monitoring control system according to the sixth embodiment, after the collection condition setting process (step SA400) in the log collection process, the detailed condition setting unit 45 sets detailed conditions and display conditions (step SA402). Specifically, "collection time range: start time to end time", "collection target log type (error / warning / information / debug)", "collection target part (monitoring control processing unit 10- _j )", etc. are specified. To do. In addition, as the display condition of the collection result, for example, “merge multiple acquisition result files”, “sort in time order”, and the like are specified.

Then, the process proceeds to a loop for each device (steps SALS to SALT).
In process A performed for each apparatus, log filtering processing (step SA112) is executed after log file acquisition (step SA110) and before log compression (step SA120). Specifically, only specified log data such as a specified time range is narrowed down from the acquired log file. The narrowed result is used as collected log data DL, and thereafter (step SA120 and subsequent steps) are compressed and transmitted.

  Then, this processing is executed in each collection target device, and finally all collection logs are received on the log collection device 4 (Step SA420, SALT), and then collected before the collection log display (Step SA430). The log collected by the result shaping unit 46 is shaped in accordance with the display conditions specified by the detailed condition setting unit 45 (step SA425). Specifically, the filtered collection logs acquired from each of the plurality of monitoring control devices 1 are merged and aggregated into one log. In addition, the merge results are sorted in order of time and shaped into a format that is easy to see in chronological order. The shaped result is displayed on the collection result display unit 44 (step SA430).

  In the above example, the example in which each functional unit described above is added to the configuration of the fifth embodiment has been described. However, the present invention is not limited to this. For example, the present invention may be applied to the first embodiment, or the parts corresponding to the differences of the respective embodiments may be added in appropriate combination.

  As described above, according to the monitoring control system according to the sixth embodiment, by setting more detailed collection filtering conditions and display conditions in the log collection process, the former collects only necessary logs. By reducing the load on the network and filtering unnecessary logs, only necessary logs are displayed and the results are easy to see. In the latter, the result can be displayed in an easy-to-see form by easily shaping the result.

1: monitoring control device, 4: log collection device, 5: network, 6: wireless network, 7: removable disk, 10: monitoring control processing unit, 20: log trace management unit, 21: log storage unit, 22: interrupt Availability determination unit, 23: log data processing unit, 24: processing operation control unit, 30: storage device, 41: collection condition setting unit, 42: collection request transmission unit, 43: log reception unit, 44: collection result display unit, 45: Detailed condition setting unit 46: Collection result shaping unit 222: Processing state determination unit 223: Network state determination unit 224: Resource state determination unit 231: Collection request reception unit 232: Log compression unit 233: Log transmission unit, 234: transmission path determination unit, 235: used resource management unit, 236: log filtering unit,
DL: log data, FL ₃₀ : log trace file, JI ₂₂ : interrupt enable / disable information, PD ₂₂ : definition file.

Claims (7)

A monitoring control system comprising a plurality of monitoring control devices that are distributedly arranged on a network and execute monitoring control on a monitoring target in cooperation with each other, and a log collection device that collects logs of the plurality of monitoring control devices. ,
Each of the plurality of monitoring control devices is
A log trace accumulating unit for accumulating an operation log generated along with the operation of the monitoring control apparatus as a log trace file;
In response to a log collection request from the log collection device, a log data processing unit that extracts and outputs necessary log data from the accumulated log trace file;
An interrupt availability determination unit that compares the operation log pattern with a predefined definition log pattern and determines that an interrupt is impossible when the operation log pattern matches the definition log pattern;
Based on the determination result of the interrupt enable / disable determination unit, a processing operation control unit that limits processing by the log data processing unit,
A supervisory control system characterized by comprising:   The definition log pattern is defined so as to match a periodic operation for processing the monitoring target data and an operation log pattern generated in accordance with an operation when the monitoring target state changes. The supervisory control system according to claim 1, wherein   The interrupt enable / disable determining unit determines whether or not an interrupt is possible by assuming that there is no one operation log when another operation log does not occur for a predetermined time after one operation log is generated. The supervisory control system according to claim 1 or 2, characterized by the above. The interrupt enable / disable determination unit includes a network state determination unit that determines whether or not the load amount of the network exceeds a threshold value,
The monitoring control system according to any one of claims 1 to 3, wherein when the load amount of the network exceeds a threshold value, it is determined that interruption is impossible. The interrupt enable / disable determining unit is provided with a resource state determining unit that determines whether or not the load amount or the memory usage amount of the arithmetic device that constitutes the resource of the monitoring control device exceeds a threshold value,
The monitoring control system according to any one of claims 1 to 4, wherein when the load amount of the arithmetic device or the memory usage amount exceeds a threshold value, it is determined that interruption is impossible. The network is composed of a plurality of routes,
In each of the plurality of monitoring control devices, one route among the plurality of routes is used as a route for outputting the log data to the log collection device according to the load status of each of the plurality of routes. The monitoring control system according to any one of claims 1 to 5, wherein a route selection unit for selection is provided.   Each of the plurality of monitoring control devices includes the log data of the number of the arithmetic devices or the memory capacity based on the load amount or the memory usage amount of the arithmetic device constituting the resource of the monitoring control device. The monitoring control system according to any one of claims 1 to 6, further comprising a resource management unit that restricts allocation to the operation of the processing unit.

Images