JP4936072B2 - System load monitoring method - Google Patents

Description

  The present invention relates to a system load monitoring method, a system load monitoring device, and a system load monitoring program.

  Baseline monitoring is a monitoring method for determining an abnormality of a monitoring target based on a reference line (hereinafter referred to as “baseline”) indicating a temporal change in system load that is normally assumed. Generally, the degree of deviation from the baseline of the system load is monitored by comparing the observed value of the system load at a certain time with the baseline value corresponding to that time.

  By this method, a flexible threshold value can be set for a system load that changes regularly and regularly according to daily and weekly.

In relation to the above, Patent Document 1 (Japanese Patent Laid-Open No. 2002-152204) discloses an invention relating to a network monitoring device.
The network monitoring apparatus according to the invention of Patent Document 1 includes a first monitoring unit, a second monitoring unit, a determination unit, and a monitoring control unit. Here, the first monitoring means periodically monitors the operation of the network at a predetermined first time interval. The second monitoring means monitors the operation of the network at a second time interval shorter than the first time interval. The discriminating unit discriminates whether the network is normal or abnormal based on the monitoring result of the first monitoring unit. The monitoring control unit activates the second monitoring unit based on the network emergency determination result by the determining unit and stops the operation of the second monitoring unit based on the normal determination result.

Japanese Patent Laid-Open No. 2004-5305 discloses an invention relating to a memory usage monitoring method.
The memory usage monitoring method of the invention of Patent Document 2 is a method for monitoring the memory usage capacity of a computer system operating continuously. The memory usage monitoring method disclosed in Patent Document 2 periodically acquires the memory usage capacity and CPU load of a computer system, accumulates the information in time series along with the acquisition time, and based on the time series data of the memory usage capacity. Then, the arrival time at which the memory usage limit threshold is reached is predicted, and the time zone in which the CPU load decreases immediately before the arrival time is obtained based on the time-series data of the CPU load.

  The memory usage monitoring method according to the invention of Patent Document 2 is intended to store an increase in memory usage and detect an excessive memory usage in advance.

Patent Document 3 (Japanese Patent Application Laid-Open No. 2004-164737) discloses an invention relating to a method for providing a mechanism for performing baseline processing and automatic threshold processing.
The method of providing a mechanism for performing baseline processing and automatic threshold processing of the invention of Patent Document 3 collects performance data for a predetermined interval, aggregates performance data into one data point, and aggregates Update baseline objects based on data points, predict next data values based on aggregated data points, compare predicted data values with actual collected data values, prediction Generating a threshold violation event if there is a discrepancy between the measured data value and the actually collected data value.

  The method of providing a mechanism for performing baseline processing and automatic threshold processing in Patent Document 3 compares the observed value at the current time with the baseline value, but does not consider the history of past observed values. The future load is not predicted.

Japanese Patent Laid-Open No. 2005-135130 discloses an invention relating to a load monitoring condition determination program.
The load monitoring condition determination program of the invention of Patent Document 4 is for causing a computer to execute a load monitoring condition determining method for determining a load monitoring condition for performing load monitoring of a computer system composed of one or a plurality of computers. . The load monitoring condition determination program of the invention of Patent Document 4 includes a process for applying a load to the computer system from the outside, a process for measuring response or throughput outside the computer system while the load is applied to the computer system, and a computer system. While a load is being applied, a process for receiving a measurement result of the resource status inside the computer system from the computer system, an external load applied to the computer system, a response or throughput measurement result, This is to cause the computer to execute processing for determining the load monitoring condition used for load monitoring of the computer system from the measurement result of the resource status.

Patent Document 5 (Japanese Patent Laid-Open No. 2006-146668) discloses an invention relating to an operation management support apparatus.
The operation management support apparatus according to the invention of Patent Document 5 includes an operation information collection unit, an operation information storage unit, a statistical processing unit, a model information storage unit, and a determination unit. Here, the operation information collection means collects operation information of three or more elements every predetermined time. The operation information storage means stores the operation information collected by the operation information collection means. The statistical processing means obtains a statistical analysis value between the operation information of each stored element. The model information storage means stores in advance statistical analysis values between operation information of each element corresponding to a plurality of operation models. The determination unit obtains an operation model corresponding to the collected operation information by comparing the statistical analysis value obtained by the statistical processing means with the statistical analysis value stored in the model information storage means.

  The operation management support apparatus according to the invention of Patent Document 5 uses a measured value as a baseline by a statistical method and uses it for abnormality determination, but does not perform future load prediction based on the baseline. Further, the operation management support apparatus of the invention of Patent Document 5 statistically processes the operation information of a plurality of monitored elements. At this time, the operation information of one monitoring element is simply compared with the baseline, but the difference from the past baseline is not considered in order to determine abnormality.

Patent Document 6 (Japanese Patent Laid-Open No. 2006-178698) discloses an invention relating to a load monitoring device.
The load monitoring device of the invention of Patent Document 6 monitors the load state of the information processing device. The load monitoring device according to the invention of Patent Document 6 includes a measured value storage unit, a variation value calculation unit, and a load state determination unit. Here, the measured value storage means stores the measured value of the performance information of the information processing apparatus and the measurement time. The variation value calculation means reads a plurality of measurement values measured within a predetermined time from the measurement value storage means, and calculates variation values of the read plurality of measurement values. The load state determination unit determines the load state of the information processing device by comparing the variation value calculated by the variation value calculation unit with a predetermined load state determination threshold value.

  The load monitoring device of the invention of Patent Document 6 predicts a future load, but does not perform an abnormality determination based on a baseline or an abnormality determination based on a history of deviations of observed values from the baseline in the past.

JP 2002-152204 A JP 2004-5305 A JP 2004164646 A1 JP 2005-135130 A JP 2006-146668 A JP 2006-178698 A

  The system load monitoring method according to related technology determines a normal state and an abnormal state by paying attention to a difference between a system load observation value at a certain time point and a baseline. For this reason, the system load monitoring method according to the related technology cannot perform analysis in consideration of the correlation between past events.

  For example, if the observed value of the system load continues to fall below the baseline, it means that the load that is supposed to be applied is not applied. Therefore, at some point thereafter, the system load can be predicted to exceed the baseline.

  However, a system load monitoring method that only determines a normal state and an abnormal state at a certain temporary point cannot predict a future system load in relation to a past situation. That is, in the system load monitoring method according to the related art, a decrease and an increase in the system load observation value with respect to the baseline are presented as abnormal states independent of each other.

  For this reason, the system administrator must always be aware of the relationship between a plurality of abnormal states. As described above, in the system load monitoring method according to the related technology, the knowledge and work amount required for the system administrator are enormous. Therefore, there is a problem that a system load monitoring method based on related technology cannot be appropriately handled unless it is a system administrator having high skills.

  Further, the system load monitoring method according to the related art cannot predict that a load will be applied in the future even in the above case. Therefore, it is not possible to take measures such as system enhancement in advance. For example, consider a case where service user requests are concentrated and the load suddenly increases rapidly. The system load monitoring method according to the related art can detect the abnormal state at that point only by monitoring the system load. However, the system load monitoring method according to the related art has a problem that it is not possible to secure a time margin for performing the countermeasure before the abnormal state occurs. In other words, the system load monitoring method according to the related art has a problem that it is impossible to detect a sign of occurrence of an abnormal state.

  An object of the present invention is to provide a system load monitoring method, a system load monitoring device, and a system load monitoring device program that can predict the occurrence of an abnormal state in the future by analyzing a history of system load in the past. is there.

The system load monitoring apparatus according to the present invention includes a storage unit, a collection function unit, a cumulative average storage function unit, a prediction function unit, and a display function unit. Here, the storage unit stores a baseline of the system load to be monitored. The collection function unit periodically performs system load observation and baseline value reading corresponding to the observation time in the baseline. The cumulative average storage function unit accumulates or averages the difference and deviation of the observed system load with respect to the read baseline value. The prediction function unit periodically predicts the future system load based on the baseline, the accumulated difference, and the averaged average deviation. The display function unit displays the prediction result. The storage unit includes a baseline storage unit, a cumulative difference storage unit, and an average deviation storage unit. Here, the baseline storage unit stores the baseline. The cumulative difference storage unit stores the cumulative difference. The average deviation storage unit stores the average deviation. The prediction function unit includes the maximum value Bm of the baseline from the current time to the future after a predetermined period, the total sum ΣD of the differences targeted for accumulation, and the objects of averaging from the current time to the past before the predetermined period. When the average value V of the deviations and the predetermined system load limit value Z satisfy the condition (Bm + ΣD) × (1 + V)> Z, the system load may exceed the system load limit value Z. Predict .

The system load monitoring method according to the present invention includes an observation step (a), a reading step (b), a storage step (c), and a prediction step (d). Here, the observation step (a) is a step for the collection function unit to regularly observe the system load to be monitored. The reading step (b) is a step for the collection function unit to read the baseline value corresponding to the observation time in the baseline of the system load from the storage unit every time observation is performed in the observation step (a). . In the storage step (c), every time the baseline value is read in the reading step (b), the cumulative average storage function unit calculates the difference and deviation between the system load and the baseline value observed in the observation step (a). Are stored in the storage unit. In the prediction step (d), the prediction function unit periodically predicts the future system load based on the baseline, the accumulated difference, and the averaged deviation, and displays the prediction result. This is a step for the part to display. The prediction step (d) is a step (d-1) in which the prediction function unit reads the baseline from the baseline storage unit included in the storage unit and obtains the maximum baseline value from the current time to the future after a predetermined period. A step (d-2) in which the prediction function unit reads the stored difference from the accumulated difference storage unit included in the storage unit and obtains the sum of the stored differences; Step (d-3) of reading the stored deviation from the unit and obtaining the average value of the stored deviation from the current time to the past before a predetermined period, and the system load may exceed a predetermined limit value in the future The step (d-4) in which the prediction function unit predicts, and the step (d-5) in which the display function unit displays the prediction result of the system load in the future. Step (d-4) includes the maximum baseline value Bm obtained in Step (d-1), the stored difference ΣD, and the average value V of the deviation obtained in Step (d-3). When the predetermined system load limit value Z satisfies the condition (Bm + ΣD) × (1 + V)> Z, the prediction function unit predicts that the system load may exceed the system load limit value Z ( d-4-a).

The system load monitoring program according to the present invention includes an observation step (a), a reading step (b), a storage step (c), and a prediction step (d). Here, the observation step (a) is a step for the collection function unit to regularly observe the system load to be monitored. The reading step (b) is a step for the collection function unit to read the baseline value corresponding to the observation time in the baseline of the system load from the storage unit every time observation is performed in the observation step (a). . In the storage step (c), every time the baseline value is read in the reading step (b), the cumulative average storage function unit calculates the difference and deviation between the system load and the baseline value observed in the observation step (a). Are stored in the storage unit. In the prediction step (d), the prediction function unit periodically predicts the future system load based on the baseline, the accumulated difference, and the averaged deviation, and displays the prediction result. This is a step for the part to display. The prediction step (d) is a step (d-1) in which the prediction function unit reads the baseline from the baseline storage unit included in the storage unit and obtains the maximum baseline value from the current time to the future after a predetermined period. A step (d-2) in which the prediction function unit reads the stored difference from the accumulated difference storage unit included in the storage unit and obtains the sum of the stored differences; Step (d-3) of reading the stored deviation from the unit and obtaining the average value of the stored deviation from the current time to the past before a predetermined period, and the system load may exceed a predetermined limit value in the future The step (d-4) in which the prediction function unit predicts, and the step (d-5) in which the display function unit displays the prediction result of the system load in the future. Step (d-4) includes the maximum baseline value Bm obtained in Step (d-1), the stored difference ΣD, and the average value V of the deviation obtained in Step (d-3). When the predetermined system load limit value Z satisfies the condition (Bm + ΣD) × (1 + V)> Z, the prediction function unit predicts that the system load may exceed the system load limit value Z ( d-4-a).

  By using the system load monitoring method, system load monitoring apparatus, and system load monitoring program according to the present invention, it is possible to predict a sudden increase in system load in the future from the past system load history.

  The best mode for carrying out a system load monitoring method according to the present invention will be described below with reference to the accompanying drawings.

(First embodiment)
FIG. 1 is a block diagram of a system load monitoring apparatus for implementing a system load monitoring method according to the present invention.
The system load monitoring apparatus according to the present invention includes an input device 01, a collection function unit 10, a cumulative average storage function unit 20, a targeting confirmation function unit 23, an analysis function unit 30, a display function unit 40, and a storage unit. 50 and a prediction function unit 60. The cumulative average storage function unit 20 includes a difference accumulation function unit 21 and a deviation average function unit 22. The analysis function unit 30 includes a difference comparison unit 31 and a baseline comparison unit 32. The storage unit 50 includes a baseline storage unit 51, a cumulative difference storage unit 52, and an average deviation storage unit 53.

  Each of the plurality of functional units may be an electric circuit, or some or all of the functional units may be realized by a computer. In other words, each of the plurality of functional units may be realized as a program executed on a computer including a CPU, a memory, and a data input / output unit.

  Each of the plurality of storage units may be a storage device independent of each other, or a part or all of the storage units may be realized as a storage area provided inside a single storage device. Absent.

The collection function unit 10 is connected to the baseline storage unit 51 and the cumulative average storage function unit 20. The cumulative average storage function unit 20 is further connected to a target confirmation function unit 23, an analysis function unit 30, a baseline storage unit 51, a cumulative difference storage unit 52, and an average deviation storage unit 53. The target confirmation function unit 23 is also connected to the input device 01 and the display function unit 40. The analysis function unit 30 is further connected to a display function unit 40, a baseline storage unit 51, and a cumulative difference storage unit 52. The baseline storage unit 51, the cumulative difference storage unit 52, and the average deviation storage unit 53 are further connected to the prediction function unit 60, respectively. The prediction function unit 60 is further connected to the display function unit 40.

  The operation of the system load monitoring apparatus according to the present invention will be described. In addition, as a preparatory stage before the system load monitoring apparatus according to the present invention operates, it is desirable that the baseline of the monitoring target system 02 is created in advance. The baseline is a reference line that indicates a temporal change in system load that is normally assumed. Here, the baseline is preferably stored in advance in a baseline storage unit 51 included in the storage unit 50. It is preferable that the baseline can be changed as appropriate even when the monitoring target system 02 and the system load monitoring apparatus of the present invention are operating. However, since the method of creating or changing the baseline is not directly related to the essence of the present invention, the description thereof is omitted.

At time T <b> 1, the collection function unit 10 observes the load on the monitoring target system 02, acquires the observed value X <b> 1, and passes this to the cumulative average storage function unit 20. This operation is desirably performed periodically.

The difference accumulation function unit 21 included in the accumulation average storage function unit 20 reads the baseline value B1 at the time T1 from the baseline storage unit 51. The difference accumulation function unit 21 compares the observed value X1 and the baseline value B1, and derives the difference D1. That is,
D1 = X1-B1
Perform the calculation.

The difference accumulation function unit 21 inquires of the target confirmation function unit 23 about whether or not the data of the difference Di at each time Ti is to be accumulated . The target confirmation function unit 23 automatically performs the inquired determination basically by using various data, but in parallel, even if the system administrator is inquired via the display function unit 40 good. If necessary, the system administrator can return a targeting permission command when determining that D1 should be accumulated, and return a targeting denial command when determining that it is unnecessary. Here, the system administrator, for the difference Di that is the subject of in the past, may issue a target of permission instruction or the target of denial instruction. The targeting permission command or the targeting denial command is preferably transmitted to the targeting confirmation function unit 23 via the input device 01.

As a case where the data of the difference Di is not to be accumulated , the following example can be considered. For example, when a fraction of the processing capacity is temporarily reduced due to maintenance of the monitoring target system 02, the difference data and deviation data between them are not useful in the future. The same applies when communication with the outside of the monitoring target system 02 is concentrated at one time and jumps to several times the normal value. As described above, it is desirable that various data when an irregular situation occurs is discarded by the system administrator's flexible response.

Accumulation differential function unit 21, when receiving the difference Targeting permission command to the difference D1 should be a cumulative target from the target CONFIRMATION function unit 23, and passes the difference data D1 to cumulative difference storage unit 52. Conversely, when receiving a differential Targeting denial instruction that should not the difference D1 and accumulation of the target from the target CONFIRMATION function unit 23, the accumulation differential function unit 21 discards the data of the difference D1.

The cumulative difference storage unit 52 stores a cumulative difference ΣD. The cumulative difference ΣD is the total sum of the differences Di to be accumulated for each time Ti. Here, i is an arbitrary number. The accumulated difference storage unit 52 adds the value of the difference Di to the accumulated difference ΣD so far and stores it as a new accumulated difference ΣD every time the data of the difference Di is passed from the difference accumulation function unit 21 as an accumulation target.

Here, it is preferable that the accumulated difference storage unit 52 stores not only the accumulated difference ΣD but also all the data of the difference Di at each time. In other words, the data of the difference Di that is not originally targeted for accumulation is also stored in the accumulated difference storage unit 52 . Since, for the data of the difference Di in the past, once or objectifying denial instruction is issued after being the accumulation of the target, on the contrary, because there may be a case where the target of permission command comes after being temporarily destroyed. In such a case, naturally, the value of the cumulative difference ΣD in the cumulative difference storage unit 52 is also appropriately corrected by the difference accumulation function unit 21.

On the other hand, the deviation average function unit 22 included in the cumulative average storage function unit 20 as well as the difference accumulation function unit 21 derives the deviation V1 from the baseline value B1 and the observed value X1 at time T1. The deviation V1 at time T1 is a value for expressing how much the observed value X1 deviates from the baseline value B1 by a ratio. The deviation V1 does not necessarily need to be defined by a specific mathematical expression, but can be defined as follows as an example.
When B1> X1: V1 = (B / X) −1
When X1> B1: V1 = (X / B) −1
Alternatively, the deviation called in general statistical mathematics can be treated as the deviation V1 in the present application by making it dimensionless as follows.
V1 = (D1−average value of each time Di) / σ
However, since σ = definition of deviation Vi at standard deviation time Ti of deviation Vi at each time does not directly affect the essence of the present invention, further detailed description is omitted.

Similar to the difference accumulation function unit 21, the deviation average function unit 22 inquires of the target confirmation function unit 23 to determine whether or not the deviation Vi at the time Ti can be targeted .

Average deviation function unit 22, when receiving the target of permission command to be a target of averaging the deviation V1 from the target CONFIRMATION function unit 23, and passes the data of the deviation V1 to the average deviation memory 53. Conversely, when receiving a target of permission command to be not subject to average the deviation V1 from the target CONFIRMATION function unit 23, the deviation average functional unit 22 may discard the data of the deviation V1. However, like the accumulation differential function unit 21, the deviation V1 is preferably stored in the average deviation memory as averaging excluded. This is in preparation for the possibility that the difference D1 corresponding to the deviation V1 will be changed to an averaging target in the future. If the difference D1 that has not been averaged is to be averaged, the deviation V1 corresponding to this difference D1 should also be changed to the averaging target.

The average deviation storage unit 53 stores all the deviations Vi and the average deviation V at each time Ti. Mean deviation V, of the deviation Vi at each time Ti, the mean value of what is averaging target. Mean deviation storage section 53, every time the data of the deviation Vi from the deviation average function unit 22 is passed, by considering the value of the mean deviation V on the deviation Vi until then, is stored as a new mean deviation V.

The cumulative average storage function unit 20 passes the observation value X1 at time T1 to the analysis function unit 30. The difference comparison unit 31 included in the analysis function unit 30 reads the accumulated difference ΣD stored in the accumulated difference storage unit 52. Similarly, the baseline comparison unit 32 included in the analysis function unit 30 reads the baseline value B1 stored at the baseline storage unit 51 at the time T1. The analysis function unit 30 determines whether the observed value X1 is normal or abnormal in consideration of the cumulative difference ΣD and the baseline value B1.

FIG. 2 is a flowchart for the analysis function unit 30 to determine the normality or abnormality of the observed value X1.
In step S01, the analysis function unit 30 determines whether the cumulative difference ΣD is positive or negative. If the cumulative difference ΣD is negative, the process proceeds to step S04. In step S04, the baseline comparison unit 32 obtains the absolute value | X1-B1 | of the difference between the observed value X1 and the baseline value B1. That is, the baseline comparison unit 32 obtains the fluctuation width of the observation value X1 from the baseline value B1. An allowable range is provided in advance for the fluctuation width of the observed value X1 from the baseline value B1. Hereinafter, this allowable range is represented by an allowable value C. The baseline comparison unit 32 compares the absolute value | X1−B1 | with the allowable value C. If the difference between the observed value X1 and the baseline value B1 exceeds the allowable value C, the process proceeds to step S07. Judged as “abnormal”. On the other hand, if the difference between the observed value X1 and the baseline value B1 does not exceed the allowable value C, the analysis function unit 30 proceeds to step S06 and determines “normal”.

If the accumulated difference ΣD is positive in step S01, it can be interpreted that the load assumed to have been applied has not been applied in the past. In this case, the analysis function unit 30 proceeds to step S02, and compares the observed value X1 with the baseline value B1. If the observed value X1 is smaller than the baseline value B1, the analysis function unit 30 proceeds to step S04 described above. On the other hand, when the observed value X1 is larger than the baseline value B1, the analysis function unit 30 proceeds to step S03.

In step S03, the difference comparison unit 31 compares the value obtained by subtracting the baseline value B1 from the observed value X1 with the sum of the allowable value C and the cumulative difference ΣD. If the value obtained by subtracting the baseline value B1 from the observed value X1 exceeds the sum of the allowable value C and the cumulative difference ΣD, the difference comparison unit 31 proceeds to step S05 and determines this state as “abnormal”. Conversely, if the value obtained by subtracting the baseline value B1 from the observed value X1 is within the range of the sum of the allowable value C and the cumulative difference ΣD, the difference comparison unit 31 proceeds to step S06, and this state is set to “normal”. Judge.

  When one of the above steps S05 to S07 is reached, the analysis function unit 30 notifies the display function unit 40 of the determination result. When the display function unit 40 displays the determination result made by the analysis function unit 30, the system administrator can know that the current system load is normal or abnormal.

  The prediction function unit 60 operates periodically separately from the collection function unit 10 to predict the possibility that the system load Di will exceed the limit load value Z in the future.

FIG. 3 is a flowchart for explaining the operation of the prediction function unit 60.
In step S11, the prediction function unit 60 obtains the future time T3 from the current time T2 and the time difference ΔTa. Here, the time difference ΔTa is a predetermined constant. Note that the system administrator may determine the time difference ΔTa. The time difference ΔTa may be changeable during the operation of the monitoring target system 02 or the system load monitoring device of the present invention.

  In step S12, the prediction function unit 60 obtains the maximum value Bm of the baseline value Bi between the current time T2 and the future time T3.

  In step S15, the prediction function unit 60 obtains the past time T1 from the current time T2 and the time difference ΔTb. Here, the time difference ΔTb is a predetermined constant. Note that the system administrator may determine the time difference ΔTb.

In step S16, the prediction function unit 60 calculates an average value V of the deviation Vi stored in the average deviation storage unit 53 between the past time T1 and the current time T2. However, the average value V may be calculated by the deviation average function unit 22 or the like and already stored in the average deviation storage unit 53.

  In addition, the process of the block of steps S11-S12 and the block of steps S15-S16 is independent. Therefore, either block may be executed first, or both blocks may be executed simultaneously in parallel.

In step S13, the prediction function unit 60 adds the baseline maximum value Bm and the cumulative difference ΣD. The sum obtained in this way is the predicted maximum value of the load on the system to be observed. The prediction function unit 60 multiplies the system load prediction maximum value by a value obtained by adding 1 to the average value V of the targeted deviation. The prediction function unit 60 compares the product thus obtained with a predetermined system load limit value Z.

As a result of the above comparison,
(Bm + ΣD) × (V + 1)> Z
Is satisfied, the system load Bi may exceed the limit value Z. In this case, the prediction function unit 60 proceeds to step S14 and issues a warning. As described with reference to FIG. 2, the warning is displayed by the display function unit 40 so that the system administrator can know this warning.

Note that the result of the comparison is (Bm + ΣD) × (V + 1) <Z
In this case, it is determined that there is no concern that the system load Bi exceeds the limit value Z, and the prediction function unit 60 does nothing.

(Second Embodiment)
FIG. 4 is a block diagram of a system load monitoring apparatus for implementing the system load monitoring method in the present embodiment.
In the system load monitoring apparatus according to the present embodiment, the input device 01 is omitted from the system load monitoring apparatus according to the first embodiment, and a difference change database 54 is added to the storage unit 50. The target confirmation function unit 23 is connected to the difference change database 54.

In the first embodiment, when the accumulated average storage function unit 20 inquires whether the target of data to the target CONFIRMATION function unit 23, the subject of checking function unit 23 is the determination ultimately left to the system administrator It was. In the present embodiment, the target confirmation function unit 23 can independently make a high-level judgment as to whether or not data can be targeted even if there is no instruction from the system administrator.

The determination method of the subject of whether the data by the object of checking function unit 23 will be described one example. For example, a difference change database 54 is prepared in advance in which the manner in which the difference Di between the system load observation value Xi and the baseline value B changes in time series is divided into a plurality of patterns.

In FIG. 4, the difference change database 54 has a dedicated area stored in the storage unit 50 in FIG. 4, but may be stored in the target confirmation function unit 23.

It is preferable that the difference change database 54 includes a plurality of pieces of pattern information related to changes in the difference Di and information related to whether or not data corresponding to each pattern information can be targeted . As an example of the pattern related to the change of the difference Di, the timing and period at which the difference Di increases or decreases or does not change, the width of the increase and decrease, and the like can be considered.

The target confirmation function unit 23 first searches the difference change database 54 for a pattern to which the change pattern of the difference Di is best applied. Next, read the information relating to the subject of whether data corresponding to the best fit pattern to changes in the difference Di from the database 54 Mr. Finally, permission or denial of data targeting is performed on the cumulative average storage function unit 20 based on information relating to whether or not the read data can be targeted .

By doing so, the burden on the system administrator is further reduced. However, a human system administrator can respond more flexibly than automatic control. Therefore, it is desirable that the targeting confirmation function unit 23 also includes the same input device 01 as that in the first embodiment so that the system administrator can permit or deny the targeting of data at least in an emergency.

  In addition to the above, there is no difference between the present embodiment and the first embodiment, so further explanation is omitted.

  As described above, when the system load monitoring method, the system load monitoring apparatus, and the system load monitoring program according to the present invention are used, a sudden increase in the future system load can be predicted from the past system load history. Therefore, it is possible to start in advance to cope with an increase in system load. In particular, provisioning and other actions generally take time to prepare, but according to the present invention, it becomes possible to complete before an increase in system load actually occurs. In addition, it is possible to take measures such as temporarily suspending a service with a low priority and allocating system resources to important services in a focused manner or taking a warning posture. Furthermore, when the system load monitoring method according to the present invention is used, a plurality of mutually related abnormalities can be regarded as one abnormality. As a result, the burden on the system administrator is reduced.

FIG. 1 is a block diagram of a system load monitoring apparatus for implementing the system load monitoring method according to the first embodiment of the present invention. FIG. 2 is a flowchart for explaining the operation of the analysis function unit in the system load monitoring apparatus of the present invention. FIG. 3 is a flowchart for explaining the operation of the prediction function unit in the system load monitoring apparatus of the present invention. FIG. 4 is a block diagram of a system load monitoring apparatus for implementing the system load monitoring method according to the second embodiment of the present invention.

Explanation of symbols

01 Input Device 02 Monitoring Target System 10 Collection Function Unit 20 Cumulative Average Storage Function Unit 21 Difference Accumulation Function Unit 22 Deviation Average Function Unit 23 Target Confirmation Function Unit 30 Analysis Function Unit 31 Difference Comparison Unit 32 Baseline Comparison Unit 40 Display Function Unit 50 Storage Unit 51 Baseline Storage Unit 52 Cumulative Difference Storage Unit 53 Average Deviation Storage Unit 60 Prediction Function Unit

Claims (18)

A storage unit for storing a baseline of the system load to be monitored;
A collection function unit that periodically performs observation of the system load and reading of a baseline value corresponding to the time of the observation in the baseline;
A cumulative average storage function that accumulates or averages differences and deviations of the observed system load relative to the read baseline value;
A prediction function unit that periodically predicts future system load based on the baseline, the accumulated cumulative difference, and the averaged average deviation;
A display function unit for displaying the result of the prediction,
The storage unit
A baseline storage unit for storing the baseline;
A cumulative difference storage unit for storing the cumulative difference;
An average deviation storage unit for storing the average deviation;
The prediction function unit includes the maximum value Bm of the baseline from the current time to the future after a predetermined period, the total sum ΣD of the differences to be accumulated, and the average from the current time to the past before the predetermined period. An average value V of deviations to be converted into a target and the predetermined system load limit value Z are:
(Bm + ΣD) × (1 + V)> Z
A system load monitoring device that predicts that the system load may exceed the system load limit value Z when the above condition is satisfied . In the system load monitoring device according to claim 1 ,
An analysis function unit that analyzes whether the observed system load is normal or abnormal based on the baseline and the accumulated difference each time the difference is accumulated;
The display function unit further displays a result of analysis by the analysis function unit. In the system load monitoring apparatus according to claim 2 ,
The analysis function unit
The absolute value of the difference between the system load and the baseline value when the sum of the accumulated differences is negative or the observed system load is less than or equal to the baseline value at the observation time A difference comparison unit that determines that the observed value of the system load is normal only when is equal to or less than a predetermined allowable value;
In the case where the sign of the sum of the accumulated differences is positive and the observation value of the system load is greater than or equal to the baseline value at the observation time, the difference between the system load and the baseline value, A baseline comparison unit that compares a sum of an allowable value and the sum of the differences, and determines that the observed value of the system load is normal only when the difference is equal to or less than the sum;
The system load monitoring device, wherein the analysis function unit determines that the observed value of the system load is abnormal when the difference comparing unit and the baseline comparator do not determine that the observed value of the system load is normal. In the system load monitoring device according to any one of claims 1 to 3 ,
The cumulative average storage function unit includes:
A difference accumulation function unit for calculating a difference between the observed system load and the read baseline value;
A deviation averaging function for calculating a deviation between the observed system load and the read baseline value;
In response to the inquiry of the cumulative average storage function unit, a targeting permission command for permitting storage of the calculated difference and the calculated deviation in the storage unit, or the calculated difference and the A target confirmation function unit that outputs a target denial instruction for denying storage of the calculated deviation in the storage unit;
The difference accumulation function unit stores the calculated difference according to the targeting permission command in the storage unit, and stores the calculated difference according to the targeting denial command as an accumulation target. Store in the department,
The deviation average function unit stores the calculated deviation according to the targeting permission command in the storage unit, and the calculated deviation according to the targeting denial command is excluded from the averaging target. System load monitoring device stored in the storage unit. The system load monitoring device according to claim 4 ,
The display function unit further displays the calculated difference and the calculated deviation supplied from the target confirmation function unit,
The target confirmation function unit
Comprising an input device for inputting the targeting permission command or the targeting denial command,
The target confirmation function unit outputs the target denial command to the cumulative average storage function unit when receiving the target denial command from the input device, and in other cases, the target confirmation A system load monitoring device in which a functional unit outputs the targeting permission instruction to the cumulative average storage functional unit. The system load monitoring device according to claim 4 ,
The storage unit
The target confirmation function unit further includes a difference change database storage unit that stores a difference change database for determining whether or not the difference and the deviation can be targeted.
The target confirmation function unit inquires the difference change database for the change pattern of the difference stored as the accumulation target, and based on the result of the query, the target permission command or the target denial command. A system load monitoring device for outputting to the cumulative average storage function unit. (A) an observation step in which the collection function unit periodically observes a system load to be monitored;
(B) Each time the observation is performed in the observation step (a), a reading step in which the collection function unit reads a baseline value corresponding to the observation time in the baseline of the system load from the storage unit;
(C) Each time the baseline value is read in the reading step (b), the cumulative average storage function unit calculates the difference between the system load observed in the observation step (a) and the baseline value, and A storage step of storing the deviation in the storage unit;
(D) A prediction function unit periodically predicts a future system load based on the baseline, the accumulated difference, and the averaged deviation, and displays the prediction result A prediction step displayed by the department,
The prediction step (d)
(D-1) the prediction function unit reads the baseline from the baseline storage unit included in the storage unit, and obtains the maximum value of the baseline from the current time to the future after a predetermined period;
(D-2) The prediction function unit reads the stored difference from the accumulated difference storage unit included in the storage unit, and obtains the sum of the stored differences;
(D-3) The prediction function unit reads the stored deviation from the average deviation storage unit included in the storage unit, and obtains the average value of the stored deviation from the current time to the past of a predetermined period. When,
(D-4) the step of the prediction function unit predicting the possibility that the system load will exceed a predetermined limit value in the future;
(D-5) The display function unit includes a step of displaying a prediction result of the system load in the future ,
The step (d-4)
(D-4-a) The maximum value Bm of the baseline obtained in the step (d-1), the stored difference ΣD, and the average of the deviation obtained in the step (d-3) The value V and the predetermined system load limit value Z are
(Bm + ΣD) × (1 + V)> Z
The prediction function unit predicts that the system load may exceed the system load limit value Z when the condition of
A system load monitoring method comprising : The system load monitoring method according to claim 7 ,
(E) Each time the difference is accumulated in the difference step (c), the analysis function unit observes the system observed in the step (a) based on the baseline and the accumulated difference. An analysis step for analyzing whether the load is normal or abnormal,
The analysis step (e)
(E-1) A system load monitoring method, wherein the display function unit further includes a step of displaying the result of the analysis. The system load monitoring method according to claim 8 ,
The analysis step (e)
(E-2) When the sign of the sum of the accumulated differences is negative or the observed value of the system load is equal to or less than the baseline value, the observed value of the system load and the baseline A difference comparison unit included in the analysis function unit determines that the observed value of the system load is normal when an absolute value of a difference from a value is equal to or less than the allowable value;
(E-3) The sign of the sum of the accumulated differences is positive, the observed value of the system load is equal to or greater than the baseline value, the baseline value, and the sum of the differences, When the sum of the tolerance and the observed value of the system load is greater than or equal to the observed value of the system load, the baseline comparing unit of the analysis function unit determines that the observed value of the system load is normal;
(E-4) The method further includes a step in which the analysis function unit determines that the observed value of the system load is abnormal when neither the step (e-2) nor the step (e-3) applies. System load monitoring method. In the system load monitoring method according to any one of claims 7 to 9 ,
The difference step (c)
(C-1) The difference accumulation function unit included in the accumulation average storage function unit includes the system load observed in the observation step (a) and the baseline value read in the reading step (b). Calculating the difference;
(C-2) The deviation average function unit included in the cumulative average storage function unit includes the system load observed in the observation step (a) and the baseline value read in the reading step (b). Calculating a deviation;
(C-3) The cumulative average storage function unit is subject to the storage unit for the difference calculated in step (c-1) and the deviation calculated in step (c-2). Inquiring to the target confirmation function unit whether or not
(C-4) a step in which the cumulative average storage confirmation function unit determines whether the objectization is possible;
(C-5) In the step (c-4), when the targeting confirmation function unit outputs a targeting permission command for permitting storage of the difference and the deviation in the storage unit, the difference A cumulative function unit storing the calculated difference in the storage unit, and a deviation averaging function unit storing the calculated deviation in the storage unit;
(C-6) In the step (c-4), when the targeting confirmation function unit outputs a targeting denial instruction for denying storage of the difference and the deviation in the storage unit, the difference The accumulation function unit stores the calculated difference in the storage unit as not to be accumulated, and the deviation averaging function unit stores the calculated deviation in the storage unit as not to be averaged. A system load monitoring method comprising: The system load monitoring method according to claim 10 ,
The step (c-1)
(C-1-a) the display function unit displaying the calculated difference and the calculated deviation;
(C-1-b) when the targeting confirmation function unit receives the targeting denial command from an input device, outputting the targeting denial command to the cumulative average storage function unit;
(C-1-c) In the case other than the case of the step (c-1-b), the target confirmation function unit outputs the target permission command to the cumulative average storage function unit. System load monitoring method. The system load monitoring method according to claim 10 ,
The step (c-1)
(C-1-d) the target confirmation function unit reads the difference stored as an accumulation target in the storage unit and a difference change database from the storage unit;
(C-1-e) the target confirmation function unit inquires the database for information relating to a change pattern of the difference stored as the accumulation target;
(C-1-f) Based on the result of the inquiry, the targeting confirmation function unit outputs the targeting permission command or the targeting denial command to the cumulative average storage function unit. System load monitoring method. (A) an observation step in which the collection function unit periodically observes a system load to be monitored;
(B) Each time the observation is performed in the observation step (a), a reading step in which the collection function unit reads a baseline value corresponding to the observation time in the baseline of the system load from the storage unit;
(C) Each time the baseline value is read in the reading step (b), the cumulative average storage function unit calculates the difference between the system load observed in the observation step (a) and the baseline value, and A storage step of storing the deviation in the storage unit;
(D) A prediction function unit periodically predicts a future system load based on the baseline, the accumulated difference, and the averaged deviation, and displays the prediction result A prediction step displayed by the department,
The prediction step (d)
(D-1) the prediction function unit reads the baseline from the baseline storage unit included in the storage unit, and obtains the maximum value of the baseline from the current time to the future after a predetermined period;
(D-2) The prediction function unit reads the stored difference from the accumulated difference storage unit included in the storage unit, and obtains the sum of the stored differences;
(D-3) The prediction function unit reads the stored deviation from the average deviation storage unit included in the storage unit, and obtains the average value of the stored deviation from the current time to the past of a predetermined period. When,
(D-4) the step of the prediction function unit predicting the possibility that the system load will exceed a predetermined limit value in the future;
(D-5) The display function unit includes a step of displaying a prediction result of the system load in the future ,
The step (d-4)
(D-4-a) The maximum value Bm of the baseline obtained in the step (d-1), the stored difference ΣD, and the average of the deviation obtained in the step (d-3) The value V and the predetermined system load limit value Z are
(Bm + ΣD) × (1 + V)> Z
The prediction function unit predicts that the system load may exceed the system load limit value Z when the condition of
A system load monitoring program comprising: The system load monitoring program according to claim 13 ,
(E) Each time the difference is accumulated in the difference step (c), the analysis function unit observes the system observed in the step (a) based on the baseline and the accumulated difference. An analysis step for analyzing whether the load is normal or abnormal,
The analysis step (e)
(E-1) A system load monitoring program, wherein the display function unit further includes a step of displaying the result of the analysis. In the system load monitoring program according to claim 14 ,
The analysis step (e)
(E-2) When the sign of the sum of the accumulated differences is negative or the observed value of the system load is equal to or less than the baseline value, the observed value of the system load and the baseline A difference comparison unit included in the analysis function unit determines that the observed value of the system load is normal when an absolute value of a difference from a value is equal to or less than the allowable value;
(E-3) The sign of the sum of the accumulated differences is positive, the observed value of the system load is equal to or greater than the baseline value, the baseline value, and the sum of the differences, When the sum of the tolerance and the observed value of the system load is greater than or equal to the observed value of the system load, the baseline comparing unit of the analysis function unit determines that the observed value of the system load is normal;
(E-4) The method further includes a step in which the analysis function unit determines that the observed value of the system load is abnormal when neither the step (e-2) nor the step (e-3) applies. System load monitoring program. In the system load monitoring program according to any one of claims 13 to 15 ,
The difference step (c)
(C-1) The difference accumulation function unit included in the accumulation average storage function unit includes the system load observed in the observation step (a) and the baseline value read in the reading step (b). Calculating the difference;
(C-2) The deviation average function unit included in the cumulative average storage function unit includes the system load observed in the observation step (a) and the baseline value read in the reading step (b). Calculating a deviation;
(C-3) The cumulative average storage function unit is subject to the storage unit for the difference calculated in step (c-1) and the deviation calculated in step (c-2). Inquiring to the target confirmation function unit whether or not
(C-4) a step in which the cumulative average storage confirmation function unit determines whether the objectization is possible;
(C-5) In the step (c-4), when the targeting confirmation function unit outputs a targeting permission command for permitting storage of the difference and the deviation in the storage unit, the difference A cumulative function unit storing the calculated difference in the storage unit, and a deviation averaging function unit storing the calculated deviation in the storage unit;
(C-6) In the step (c-4), when the targeting confirmation function unit outputs a targeting denial instruction for denying storage of the difference and the deviation in the storage unit, the difference The accumulation function unit stores the calculated difference in the storage unit as not to be accumulated, and the deviation averaging function unit stores the calculated deviation in the storage unit as not to be averaged. A system load monitoring program comprising: The system load monitoring program according to claim 16 , wherein
The step (c-1)
(C-1-a) the display function unit displaying the calculated difference and the calculated deviation;
(C-1-b) when the targeting confirmation function unit receives the targeting denial command from an input device, outputting the targeting denial command to the cumulative average storage function unit;
(C-1-c) In the case other than the case of the step (c-1-b), the target confirmation function unit outputs the target permission command to the cumulative average storage function unit. System load monitoring program. The system load monitoring program according to claim 16 , wherein
The step (c-1)
(C-1-d) the target confirmation function unit reads the difference stored as an accumulation target in the storage unit and a difference change database from the storage unit;
(C-1-e) the target confirmation function unit inquires the database for information relating to a change pattern of the difference stored as the accumulation target;
(C-1-f) Based on the result of the inquiry, the targeting confirmation function unit outputs the targeting permission command or the targeting denial command to the cumulative average storage function unit. System load monitoring program.

Images