JP5561182B2 - System analysis support program, system analysis support device, and system analysis support method - Google Patents

Description

  The present invention relates to a system analysis support program, a system analysis support apparatus, and a system analysis support method for supporting analysis of a network system.

  In recent years, it has become difficult to accurately grasp the operating status and performance problems of network systems that are becoming larger and more complex. For example, in a network system in which multiple applications operate in cooperation, in order to determine the cause of performance degradation or failure, not only the behavior of each server but also the performance of the entire system is observed and analyzed. Difficult to grasp.

  As a related prior art, for example, there is a technique for performing an operation analysis of a parallel database system including a plurality of processors. The conventional operation analysis method collects history information of the start time and end time of the database access process for each of a plurality of processors, and associates the start time and end time of the database access process for the same processor. Then, the operation analysis method calculates a processing time from the end time and the start time associated with each processor, and determines whether or not the processing time exceeds a specified time.

  As a prior art, there is a technique for managing an operation history for a database. A conventional management apparatus stores an operation history indicating operation contents in a log storage unit every time a database operation is performed, except during batch processing. Further, when the batch processing is executed in response to the batch processing request, the management device stores the checkpoint log indicating the execution of the batch processing in the log storage unit without storing the operation history during the execution of the batch processing.

  Further, as a prior art, there is a technique for analyzing the operation status of the system. When a model generation instruction is input, a conventional system analysis apparatus generates a transaction model that satisfies a call restriction condition between servers based on a message set selected according to a selection criterion based on the probability of a call relation between processes. . Further, when an analysis instruction is input, the system analysis apparatus analyzes the transaction processing state using a protocol log that matches the transaction model.

JP-A-8-339381 Japanese Patent No. 4166056 JP 2006-11683 A

  However, in the conventional technology, when online processing and batch processing are performed together in a network system, it is difficult to determine whether a message transmitted / received between servers in the system is either online processing or batch processing. There's a problem. As a result, for example, it is difficult to accurately obtain the processing time of each server related to online processing, and there is a problem that the analysis accuracy of the network system is lowered.

  In one aspect, an object of the present invention is to provide a system analysis support program, a system analysis support apparatus, and a system analysis support method that can determine a message related to batch processing.

  In one aspect, a request / response pair of a protocol immediately above a protocol for operating a database in the system is detected from a group of messages passed in the system in which the hierarchical structure of the protocol is defined. And selecting a set of messages related to a predetermined operation on the database transmitted within a predetermined period from the group of messages, and request time of one or more pairs detected from the selected set of messages. A first index value representing a ratio of messages transmitted between the response time and a response time, and a second ratio representing a ratio of a period from the request time to the response time of the one or more pairs in the predetermined period And the predetermined operation is performed based on the calculated first and second index values. To determine work or not, and outputs the determined determination result.

  According to one aspect, there is an effect that a message related to batch processing can be determined.

FIG. 1 is a system configuration diagram illustrating an example of a network system according to an embodiment. FIG. 2 is an explanatory diagram (part 1) illustrating an example of a message group in the network system. FIG. 3 is an explanatory diagram (part 2) illustrating an example of a message group in the network system. FIG. 4 is a block diagram of an example of a hardware configuration of the system analysis support apparatus according to the embodiment. FIG. 5 is an explanatory diagram showing an example of the contents stored in the message DB. FIG. 6 is an explanatory diagram of a specific example of hierarchical structure definition information. FIG. 7 is a block diagram of an example of a functional configuration of the system analysis support apparatus according to the embodiment. FIG. 8 is an explanatory diagram showing an example of the stored contents of the pair information table. FIG. 9 is an explanatory diagram of an example of the contents stored in the appearance rate / occupancy rate table. FIG. 10 is an explanatory diagram of a specific example of the object list. FIG. 11 is an explanatory diagram of a specific example of the response message object. FIG. 12 is an explanatory diagram (part 3) illustrating an example of a message group in the network system. FIG. 13 is an explanatory diagram of an example of the contents stored in the intermediate table. FIG. 14 is an explanatory diagram (part 4) illustrating an example of a message group in the network system. FIG. 15 is an explanatory diagram of an example of the contents stored in the multiplicity table. FIG. 16 is an explanatory diagram (part 1) of an example of determining a batch processing object. FIG. 17 is an explanatory diagram (part 2) of an example of determining a batch processing object. FIG. 18 is an explanatory diagram of an example of the contents stored in the processing target table. FIG. 19 is a flowchart illustrating an example of a system analysis support processing procedure of the system analysis support apparatus according to the embodiment. FIG. 20 is a flowchart illustrating an example of a specific processing procedure of the appearance rate calculation processing in step S1905. FIG. 21 is a flowchart illustrating an example of a specific processing procedure of the occupation ratio calculation processing in step S1906. FIG. 22 is a flowchart (part 1) illustrating an example of a specific processing procedure of the determination processing in step S1909. FIG. 23 is a flowchart (part 2) illustrating an example of a specific processing procedure of the determination processing in step S1909. FIG. 24 is a flowchart illustrating an example of a specific processing procedure of message deletion processing.

  Exemplary embodiments of a system analysis support program, a system analysis support apparatus, and a system analysis support method according to the present invention will be explained below in detail with reference to the accompanying drawings.

(System configuration of network system)
FIG. 1 is a system configuration diagram illustrating an example of a network system according to an embodiment. In FIG. 1, a network system 100 includes a system analysis support apparatus 101, a Web server 102, an AP (application) server 103, a DB (database) server 104, and a client terminal 105.

  In the network system 100, the Web server 102, the AP server 103, the DB server 104, and the client terminal 105 are connected to be able to communicate with each other via a network 110 such as the Internet, a LAN (Local Area Network), and a WAN (Wide Area Network). Has been.

  Here, the network system 100 is a system in which a hierarchical structure of protocols is defined. The protocol is a communication protocol when computers (Web server 102, AP server 103, DB server 104) communicate with each other via the network 110. Here, HTTP (HyperText Transfer Protocol) is defined in the highest first layer. This HTTP is a protocol used for communication between the client terminal 105 and the Web server 102.

  In the second layer, IIOP (Internet Inter-ORB Protocol) is defined. This IIOP is a protocol used for communication between the Web server 102 and the AP server 103. In the third lowest layer, SQL (Structured Query Language) is defined. This SQL is a protocol used for communication between the AP server 103 and the DB server 104.

  The network system 100 is a system in which online processing and batch processing are mixed. The online processing is a processing method that performs processing in response to a request from the client terminal 105. Batch processing is, for example, a processing method in which data collected for a certain period is batch-processed, or processing consisting of a plurality of procedures is continuously processed according to a predetermined procedure.

  The system analysis support apparatus 101 is a computer that supports system analysis of the network system 100. The Web server 102 is a computer that transmits an HTML (HyperText Markup Language) document in response to a request from a browser installed in the client terminal 105.

  The AP server 103 is a computer that bridges between the Web server 102 and the DB server 104 and controls processing (for example, search processing, update processing, deletion processing, etc.) for the database 120. The DB server 104 is a computer that includes a database 120 that stores a data group and executes processing on the database 120.

  The client terminal 105 is a computer that includes a browser and communicates with the Web server 102. The client terminal 105 is, for example, a personal computer, a smartphone, a mobile phone terminal, or the like.

  Here, an example of a message group delivered in the network system 100 will be described. A message is a message transmitted and received between computers in the network system 100 using any one protocol of HTTP, IIOP, and SQL.

  FIG. 2 is an explanatory diagram (part 1) illustrating an example of a message group in the network system. In FIG. 2, messages M1 to M16 transmitted and received between computers (Web server 102, AP server 103, DB server 104) in network system 100 are shown in time series. In FIG. 2, a rightward arrow indicates a request message, and a leftward arrow indicates a response message.

  The messages M <b> 1 to M <b> 10 are a set of messages transmitted / received between the computers in response to a request from the client terminal 105. Specifically, the messages M <b> 1 to M <b> 10 indicate an online processing transaction that occurs when “URL1” is designated by the browser of the client terminal 105.

  Messages M11 to M16 are a set of messages transmitted and received between the AP server 103 and the DB server 104 in response to a request from the AP server 103. Specifically, the messages M11 to M16 are a set of batch processing messages. That is, messages M1 to M10 for online processing are mixed with messages M11 to M16 for batch processing.

  For example, when analyzing the message groups M1 to M16 and calculating the processing time of each computer for online processing, it is necessary to exclude the batch processing messages M11 to M16 from the message groups M1 to M16. However, the messages M1 to M16 do not include information for determining whether the processing is online processing or batch processing.

  Therefore, the system analysis support apparatus 101 according to the present embodiment uses the characteristics of the batch processing message, and information for determining the batch processing message from the message group delivered within the network system 100. Create Next, characteristics of the batch processing message will be described with reference to FIG.

  In the following description, in this specification, the lower layer protocol (for example, SQL) transmitted between the request message transmission time and the response message transmission time of the upper layer protocol (for example, IIOP) is described. The message is referred to as a “message with a parent”. On the other hand, a message of a lower layer protocol that is not transmitted between the transmission time of the request message of the upper layer protocol and the transmission time of the response message is referred to as a “message having no parent”.

  FIG. 3 is an explanatory diagram (part 2) illustrating an example of a message group in the network system. In FIG. 3, messages M <b> 11 to M <b> 16 are batch processing messages transmitted and received between the AP server 103 and the DB server 104. The batch processing messages M11 to M16 are messages of the protocol “SQL”.

  Here, the messages M11 to M16 of the batch processing do not have a parent-child relationship with the message of the protocol “IIOP” in the immediately upper layer. The parent-child relationship represents a call relationship in which a processing request to a lower-layer protocol computer is generated in accordance with a processing request to a higher-layer protocol computer.

  Since the message of the batch process does not have a parent-child relationship with the message of the protocol immediately above, it can be said that the message having no parent among the messages of the protocol “SQL” in the third layer is the message of the batch process. However, when online processing messages and batch processing messages are mixed, there may be a parent even for batch processing messages.

  In the example of FIG. 3, messages M11, M12, and M16 among the messages M11 to M16 for batch processing are messages that have a parent. For this reason, in the network system 100 in which online processing and batch processing are mixed, it is difficult to determine the message of batch processing by determining only the parent-child relationship.

  Here, the tendency of the parent to exist in the batch processing message is that the period between the request message transmission time and the response message transmission time of the protocol immediately above the aggregation period T (hereinafter referred to as “occupation period”). As the proportion of occupies increases, it becomes more prominent.

  In the example of FIG. 3, in the counting period T, the occupation period between the transmission time of the request message M2 of the protocol “IIOP” of the immediately higher layer and the response message M9 is “t1”. Further, in the counting period T, the occupation period between the transmission time of the request message M17 of the protocol “IIOP” immediately above and the response message (not shown) is “t2”.

  In other words, a message in which the ratio of the presence of a parent increases with an increase in the ratio of the occupation period (for example, “t1 + t2”) to the aggregation period T (hereinafter referred to as “occupancy ratio”) is a message for batch processing. You can say that.

  Therefore, the system analysis support apparatus 101 creates information for discriminating batch processing messages by using the feature that the ratio of the presence of the parent increases as the occupation ratio of the protocol in the immediately upper layer increases. Specifically, for example, the system analysis support apparatus 101 classifies messages of the protocol “SQL” in the third layer in units of objects.

  An object is for classifying messages. In the case of a message of the protocol “SQL” in the third layer, it is expressed by a part or all of a command statement representing an operation on the database 120 included in the message. A specific example of the object will be described later.

  Next, the system analysis support apparatus 101 obtains, for each object of the message of the protocol “SQL”, an appearance rate of a message having a parent among messages within the aggregation period T of the object. Then, the system analysis support apparatus 101 determines batch processing objects based on the occupation period of the immediately upper layer protocol “IIOP” with respect to the aggregation period T and the appearance ratio of each object.

  Thus, during system analysis, messages of batch processing objects can be determined and removed from the message data group in the network system 100 to be processed, and analysis accuracy can be improved.

(Hardware configuration of system analysis support apparatus 101)
FIG. 4 is a block diagram of an example of a hardware configuration of the system analysis support apparatus according to the embodiment. In FIG. 4, a system analysis support apparatus 101 includes a CPU (Central Processing Unit) 401, a ROM (Read-Only Memory) 402, a RAM (Random Access Memory) 403, a magnetic disk drive 404, a magnetic disk 405, An optical disk drive 406, an optical disk 407, a display 408, an I / F (Interface) 409, a keyboard 410, a mouse 411, a scanner 412, and a printer 413 are provided. Each component is connected by a bus 400.

  Here, the CPU 401 controls the entire system analysis support apparatus 101. The ROM 402 stores programs such as a boot program. The RAM 403 is used as a work area for the CPU 401. The magnetic disk drive 404 controls the reading / writing of the data with respect to the magnetic disk 405 according to control of CPU401. The magnetic disk 405 stores data written under the control of the magnetic disk drive 404.

  The optical disk drive 406 controls reading / writing of data with respect to the optical disk 407 according to the control of the CPU 401. The optical disk 407 stores data written under the control of the optical disk drive 406, or causes the computer to read data stored on the optical disk 407.

  The display 408 displays data such as a document, an image, and function information as well as a cursor, an icon, or a tool box. As the display 408, for example, a CRT, a TFT liquid crystal display, a plasma display, or the like can be adopted.

  The I / F 409 is connected to a network 110 such as a LAN (Local Area Network), a WAN (Wide Area Network), and the Internet through a communication line, and is connected to another computer via the network 110. The I / F 409 controls an internal interface with the network 110 and controls input / output of data from an external computer. For example, a modem or a LAN adapter may be employed as the I / F 409.

  The keyboard 410 includes keys for inputting characters, numbers, various instructions, and the like, and inputs data. Moreover, a touch panel type input pad or a numeric keypad may be used. The mouse 411 moves the cursor, selects a range, moves the window, changes the size, and the like. A trackball or a joystick may be used as long as they have the same function as a pointing device.

  The scanner 412 optically reads an image and takes in the image data into the system analysis support apparatus 101. The scanner 412 may have an OCR (Optical Character Reader) function. The printer 413 prints image data and document data. As the printer 413, for example, a laser printer or an ink jet printer can be adopted.

  Note that the Web server 102, AP server 103, DB server 104, and client terminal 105 shown in FIG. 1 can also be realized with the same hardware configuration as the system analysis support apparatus 101 described above.

(Contents stored in message DB 500)
Next, the message DB 500 used by the system analysis support apparatus 101 will be described with reference to FIG. The message DB 500 is realized by a storage device such as the RAM 403, the magnetic disk 405, and the optical disk 407 shown in FIG.

  FIG. 5 is an explanatory diagram showing an example of the contents stored in the message DB. In FIG. 5, the message DB 500 has fields for message ID, time stamp, protocol, message type, and object. By setting information in each field, message data (for example, message data 500-1 to 500-12) of the message is stored as a record.

  The message ID is an identifier of a message transmitted / received in the network system 100. The same message ID is assigned to a pair of messages. The time stamp is a message transmission time. Each message data is sorted and stored in the message DB 500 in ascending order of transmission time. The protocol is a message protocol.

  The message type is information indicating a request message or a response message. Hereinafter, the request message indicates a message of the message type “request”, and the response message indicates a message of the message type “response”. The object is an identifier for classifying each message. In the example of FIG. 5, only the object for the request message of the protocol “SQL” in the third layer is shown.

  Here, an object about the request message of the protocol “SQL” in the third layer will be described. For example, the object SQL1 is a character string extracted from a command statement representing an operation on the DB 120 included in the request message S1.

  More specifically, for example, a command statement representing an operation on the DB 120 included in the request message S1 is “SELECT ID, Name FROM Customer WHERE ID = 100”. This statement is for acquiring “ID” and “Name” of “ID = 100” from the “Customer” table in the DB 120. In this case, for example, “SELECT... FROM Customer WHERE...” Included in the statement can be set as the object “SQL1”. Note that “...” included in the object “SQL1” indicates an arbitrary character string.

  Also, the command statement is “DELETE FROM Customer WHERE ID = 100”. This statement is for deleting the record of “ID = 100” from the “Customer” table in the DB 120. In this case, for example, “DELETE FROM Customer WHERE...” Included in the statement can be set as the object “SQL1”.

  The command statement is “UPDATE Customer SET ID = 100”. This statement is for updating the record of “ID = 100” from the “Customer” table in the DB 120. In this case, for example, “UPDATE Customer SET...” Included in the command statement can be the object “SQL1”.

  As described above, an object can be expressed by a combination of one or more phrases or clauses included in a request message. In the case of a request message of the protocol “HTTP”, for example, a URL (Uniform Resource Locator) can be used as an object. In the case of a request message of the protocol “IIOP”, for example, the name of a program for realizing a certain function can be used as an object.

  Here, taking the message data 500-4 as an example, it is recognized that the request message S1 of the protocol “SQL” is transmitted from the AP server 103 to the DB server 104 at the transmission time “00: 00: 00.003”. it can. Further, the object “SQL1” of the request message S1 can be recognized.

  The message source and destination computers can be identified from the protocol and the message type. For example, in the case of the protocol “HTTP” and the message type “request”, the transmission source computer is the client terminal 105 and the transmission destination computer is the Web server 102. In the above description, the time stamp is defined as the message transmission time, but the time stamp may be defined as the message reception time.

(Specific example of hierarchical structure definition information 600)
Next, a specific example of the hierarchical structure definition information that defines the hierarchical structure of the protocol of the network system 100 will be described.

  FIG. 6 is an explanatory diagram of a specific example of hierarchical structure definition information. In FIG. 6, the hierarchical structure definition information 600 defines a three-layer protocol of the network system 100. Specifically, in the hierarchical structure definition information 600, HTTP is defined in the highest first hierarchy, IIOP is defined in the second hierarchy, and SQL is defined in the lowest third hierarchy.

(Functional configuration of the analysis support apparatus 101)
FIG. 7 is a block diagram of an example of a functional configuration of the system analysis support apparatus according to the embodiment. 7, the system analysis support apparatus 101 includes an acquisition unit 701, a detection unit 702, a specification unit 703, a selection unit 704, a first calculation unit 705, a second calculation unit 706, and a determination unit 707. And an output unit 708 and a deletion unit 709. Specifically, each function unit (acquisition unit 701 to deletion unit 709) causes the CPU 401 to execute a program stored in a storage device such as the ROM 402, the RAM 403, the magnetic disk 405, and the optical disk 407 illustrated in FIG. Or the I / F 409 realizes the function. Further, the processing results of the respective functional units are stored in a storage device such as the RAM 403, the magnetic disk 405, and the optical disk 407 unless otherwise specified.

  The acquisition unit 701 has a function of acquiring hierarchical structure definition information 600 (see FIG. 6) in which the hierarchical structure of the protocol of the network system 100 is defined. Specifically, for example, the acquisition unit 701 may acquire the hierarchical structure definition information 600 by a user operation input using the keyboard 410 or the mouse 411 illustrated in FIG. The structure definition information 600 may be received. According to the hierarchical structure definition information 600, the hierarchical structure of the protocol of the network system 100 can be recognized.

  The acquisition unit 701 has a function of acquiring a message group delivered within the network system 100. The message is, for example, a message including a message ID, a time stamp, a protocol, and a message type. The request message includes an object.

  Specifically, for example, the acquisition unit 701 captures packets transmitted and received between computers in the network system 100 via a switch (not shown) provided in the network system 100. Then, the system analysis support apparatus 101 acquires a message group by analyzing the captured packet group and reconstructing each message.

  For example, the acquisition unit 701 may acquire a message group by a user operation input using the keyboard 410 or the mouse 411, and may further receive a message group from an external computer. The message ID, time stamp, protocol, and message type of the acquired message are stored in, for example, the message DB 500 shown in FIG.

  The detection unit 702 has a function of detecting a request message and response message pair of a protocol immediately above the protocol for operating the database 120 in the network system 100 from the acquired message group.

  Here, the protocol for operating the database 120 is “SQL” defined in the third layer of the network system 100. The protocol immediately above the protocol “SQL” is “IIOP” defined in the second layer of the network system 100.

  Specifically, for example, the detection unit 702 first detects arbitrary message data of the protocol “IIOP” from the message DB 500. Next, the detection unit 702 detects message data having the same message ID as the selected message data and the protocol “IIOP” from the message DB 500. Thereby, a pair of a request message and a response message of the protocol “IIOP” can be detected.

  As an example, it is assumed that the detection unit 702 detects message data 500-3 from the message DB 500. In this case, the detection unit 702 detects the message data 500-7 of the message ID “I1” and the protocol “IIOP” from the message DB 500. Thereby, a pair of the request message I1 and the response message I1 of the protocol “IIOP” can be detected.

  For example, the detection unit 702 repeatedly performs the process of detecting pairs until there is no message data of the protocol “IIOP” that has not been detected in the message DB 500. As a result, all pairs of request message and response message of protocol “IIOP” can be detected from the message DB 500.

  Further, for each detected pair, the detection unit 702 specifies the transmission time of the request message of the pair as a request time, and specifies the transmission time of the response message of the pair as a response time. As an example, a case where a pair of protocol “IIOP” and message ID “I1” is detected is assumed. In this case, the time stamp “00: 00: 0.0002” of the message data 500-3 is specified as the request time, and the time stamp “00: 00: 0.0006” of the message data 500-7 is specified as the response time.

  The detected detection result is stored in, for example, the pair information table 800 shown in FIG. The pair information table 800 is realized by a storage device such as the RAM 403, the magnetic disk 405, and the optical disk 407, for example. Here, the pair information table 800 will be described.

  FIG. 8 is an explanatory diagram showing an example of the stored contents of the pair information table. In FIG. 8, a pair information table 800 has fields for a pair ID, a message ID, a request time, and a response time. By setting information in each field, pair information (for example, pair information 800-1 and 800-2) for each detected pair is stored as a record.

  Here, the pair ID is an identifier of a pair of a request message and a response message of the protocol “IIOP”. The message ID is a paired message ID. The request time is the transmission time of the pair request message. The response time is the transmission time of the pair response message.

  For example, according to the pair information 800-1, the request message I1 of the pair P1 is transmitted at the request time “00: 00: 00.002”, and the response message of the pair P1 at the response time “00: 00: 00.006”. It can be recognized that I1 has been transmitted.

  Returning to the description of FIG. 7, the specifying unit 703 has a function of specifying a message object of a protocol for operating the database 120 in the network system 100 among the acquired message group.

  Specifically, for example, first, the specifying unit 703 specifies an object of a request message of the protocol “SQL”. More specifically, for example, the specifying unit 703 specifies an object by extracting a part or all of a command sentence from a request message of the acquired protocol “SQL” according to a predetermined extraction rule. .

  For example, the command statement included in the acquired request message S1 is “SELECT ID, Name FROM Customer WHERE ID = 100”. In this case, for example, the identifying unit 703 identifies the object “SQL1” by extracting “SELECT ... FROM Customer WHERE ...” from the request message S1.

  The specified request message object is set in the object field of the corresponding message data in the message DB 500. For example, the identified object “SQL1” of the request message S1 is set in the object field of the message data 500-4 in the message DB 500.

  Next, the identifying unit 703 identifies the response message object of the protocol “SQL”. Specifically, for example, the identifying unit 703 first selects message data of the protocol “SQL” and the message type “request” from the message DB 500. Then, the specifying unit 703 specifies the object of the selected message data.

  Thereafter, the specifying unit 703 searches the message DB 500 for message data having the same message ID as the selected message data and the protocol “SQL”. Here, when the message data is searched, the specifying unit 703 sets the specified object in the object field of the message data in the message DB 500.

  Thereby, the object of the response message of the protocol “SQL” can be specified. A specific example of the response message object of the protocol “SQL” will be described later with reference to FIG.

  The selection unit 704 has a function of selecting a set of messages relating to a predetermined operation on the database 120 transmitted within a predetermined period T from the acquired message group. The message related to the predetermined operation on the database 120 is a request message including a command statement representing the predetermined operation on the database 120 and a response message having the same message ID as the request message.

  That is, a set of messages related to a predetermined operation is a set of messages of the same object of the protocol “SQL”. Specifically, for example, the selection unit 704 refers to the object field of the message DB 500 and extracts a set of messages of the same object transmitted within a predetermined period T for each object of the protocol “SQL”.

  As an example, the predetermined period T is set to “00: 00: 00.000 to 00: 00: 00.011”. In this case, for example, the selection unit 704 refers to the object field of the message DB 500 and selects the request message S1 and the response message S1 of the object “SQL1” transmitted within the predetermined period T.

  The predetermined period T can be arbitrarily set, and is stored in a storage device such as the RAM 403, the magnetic disk 405, and the optical disk 407, for example. Specifically, for example, the predetermined period T is, for example, a period of 10 minutes or 1 hour.

  The first calculation unit 705 calculates an index value representing the ratio of messages transmitted between the request time and the response time of one or more pairs detected by the detection unit 702 in the selected set of messages. It has a function.

  Here, the selected message is a message of the protocol “SQL”. The detected pair is a message pair of the protocol “IIOP”. That is, the message transmitted between the request time and the response time of one or more detected pairs is a message having a parent.

  Specifically, for example, for each object of the protocol “SQL”, the first calculation unit 705 indicates an index value (hereinafter, referred to as a ratio of messages having a parent among a set of messages of the selected object). (Referred to as “appearance rate”). The specific processing content of the first calculation unit 705 will be described later with reference to FIG.

  For the sake of explanation, an arbitrary object of the protocol “SQL” is expressed as “object SQLi”.

  The second calculation unit 706 includes an index value (hereinafter, referred to as “the occupied period”) that occupies a period from the request time to the response time of one or more detected pairs in the predetermined period T (hereinafter referred to as “occupation period”). It has a function of calculating an occupancy rate). Here, the occupation period is a total of periods in which the multiplicity is 1 or more in the predetermined period T. The multiplicity is the number of overlapping periods from the request time to the response time of the protocol pair immediately above the protocol for operating the database 120.

  Specifically, for example, the second calculation unit 706 calculates the occupation period of the protocol “IIOP” that represents the total of the multiplicity periods of 1 or more in the predetermined period T. Then, the second calculation unit 706 calculates an occupancy ratio representing a ratio of the occupation period of the protocol “IIOP” in the predetermined period T. The specific processing content of the second calculation unit 706 will be described later with reference to FIG.

  The determination unit 707 determines whether a predetermined operation on the database 120 is a batch processing operation based on the calculated appearance rate and occupancy rate. Specifically, for example, the determination unit 707 determines the appearance rate of the object SQLi of the protocol “SQL” (hereinafter referred to as “appearance rate Ai”) and the occupation rate of the predetermined period T (hereinafter referred to as “occupancy rate P”). Based on this, it is determined whether or not the object SQLi is an object for batch processing.

  More specifically, for example, when the appearance rate Ai of the object SQLi is equal to or less than the threshold value α and the occupation rate P of the predetermined period T is equal to or less than the threshold value β, the determination unit 707 determines that the object SQLi is an object for batch processing. . The threshold values α and β are set in advance and stored in a storage device such as the ROM 402, the RAM 403, the magnetic disk 405, and the optical disk 407.

  Here, the lower the appearance rate Ai of the object SQLi, the higher the possibility that the object SQLi is an object for batch processing. In addition, the lower the occupation ratio P of the predetermined period T, the higher the possibility that the object SQLi is an object for batch processing.

  That is, the smaller the thresholds α and β are set, the more accurately the batch processing object can be determined. On the other hand, if the threshold values α and β are too small, the criterion for determining that the object is a batch process becomes strict, and the object SQLi may not be determined even if it is a batch process object.

  For this reason, the threshold value α is an appropriate value (for example, 10 [%] that increases the possibility that the object SQLi is an object of batch processing when the appearance rate Ai of the object SQLi is equal to or less than the threshold value α by performing a simulation or the like. ]). Similarly, the threshold value β is an appropriate value (for example, 10 [], for example, when the occupation rate P of the predetermined period T is equal to or less than the threshold value β by performing a simulation or the like. %]).

  The selection unit 704 may select a set of messages of the object SQLi transmitted within each predetermined period from the message group for each predetermined period of the plurality of predetermined periods. Here, the plurality of predetermined periods are, for example, a set of periods divided by dividing the entire aggregation period of the message group by the predetermined period T.

  For the following description, a plurality of predetermined periods are denoted as “aggregation periods T1 to Tm”, and an arbitrary aggregation period among the aggregation periods T1 to Tm is denoted as “aggregation period Tj” (j = 1, 2,... m).

  In addition, the first calculation unit 705 calculates, for each aggregation period Tj, an appearance rate Ai that represents a ratio of messages in which a parent exists in a set of messages of the object SQLi selected for each aggregation period Tj. May be. In addition, the second calculation unit 706 may calculate an occupancy rate P that represents a ratio of the occupation period in the aggregation period Tj for each aggregation period Tj.

For the sake of explanation, the appearance rate Ai of the object SQLi in the aggregation period Tj is expressed as “appearance rate A _j i”. Further, the occupation rate P representing the proportion of the occupation period in the total period Tj is expressed as “occupancy rate Pj”.

The appearance rate A _j i and the occupation rate Pj of the object SQLi in the calculated total period Tj are stored in, for example, the appearance rate / occupancy rate table 900 illustrated in FIG. The appearance rate / occupancy rate table 900 is realized by a storage device such as the RAM 403, the magnetic disk 405, and the optical disk 407, for example. Here, the appearance rate / occupancy rate table 900 will be described.

  FIG. 9 is an explanatory diagram of an example of the contents stored in the appearance rate / occupancy rate table. In FIG. 9, the appearance rate / occupancy rate table 900 has fields of a total period ID, an object ID, an appearance rate, and an occupation rate. By setting information in each field, appearance rate / occupancy rate information (for example, appearance rate / occupancy rate information 900-1 and 900-2) for each aggregation period Tj is stored as a record.

The aggregation period ID is an identifier of the aggregation period Tj. The object ID is an identifier of an object of the protocol “SQL”. The appearance rate is the appearance rate A _j i of the object SQLi in the total period Tj. The occupation ratio is an occupation ratio Pj that represents the ratio of the occupation period to the total period Tj.

Taking the appearance rate / occupancy rate information 900-1 as an example, the appearance rate A ₁ 1 of the object SQL1, the appearance rate A ₁ 2 of the object SQL2, the appearance rate A ₁ 3 of the object SQL3, and the aggregation in the aggregation period T1 The occupation rate P1 of the period T1 is set.

Returning to the description of FIG. 7, the determination unit 707 determines whether or not the object SQLi is an object of batch processing based on the appearance rate A _j i and the occupation rate Pj of the object SQLi calculated for each aggregation period Tj. You may decide to do it. The specific processing contents of the determination unit 707 will be described later with reference to FIGS.

  The output unit 708 has a function of outputting the determined determination result. Specifically, for example, the output unit 708 may output an object list 1000 that lists batch processing objects SQLi as shown in FIG.

  The output format includes, for example, display on the display 408, print output to the printer 413, and transmission to an external device via the I / F 409. Alternatively, the data may be stored in a storage area such as the RAM 403, the magnetic disk 405, and the optical disk 407. Here, a specific example of the object list 1000 will be described.

  FIG. 10 is an explanatory diagram of a specific example of the object list. In FIG. 10, an object list 1000 is information indicating a list of batch processing objects SQL3, SQL4, and SQL6. According to the object list 1000, it is possible to determine the objects SQL3, SQL4, and SQL6 that are determined to be batch processing objects among the objects of the protocol “SQL”.

  Returning to the description of FIG. 7, the deletion unit 709 deletes the message of the object SQLi from the message group delivered in the network system 100 when it is determined that the object SQLi is an object of batch processing. Have

  Specifically, for example, the deletion unit 709 specifies a request message including a character string representing the object SQLi from the message group. Next, the deletion unit 709 searches the message group for a response message having the same message ID as the identified request message.

  Then, the deletion unit 709 deletes the identified request message and response message from the message group. Thereby, the message of the batch processing object SQLi can be deleted from the message group delivered within the network system 100. An example of message deletion will be described later with reference to FIG.

  Further, the output unit 708 may output a deleted message group from which the message of the batch processing object SQLi is deleted from the message group delivered in the network system 100. Thereby, it is possible to obtain the processing time of each computer in the network system 100 using the remaining message group excluding the message of the batch processing object SQLi, and the analysis accuracy of the system analysis can be improved.

  In the above description, the three-layer network system 100 of HTTP, IIOP, and SQL has been described as an example, but the present invention is not limited to this. For example, it may be a multi-layer system (for example, two layers, four layers, etc.) including a protocol for operating the database 120 in the network system 100.

(Specific example of response message object)
Next, a specific example of the object SQLi of the response message of the protocol “SQL” will be described with reference to FIG.

  FIG. 11 is an explanatory diagram of a specific example of the response message object. In (11-1) of FIG. 11, objects SQL1, SQL2, and SQL3 of request messages S1, S2, and S3 of the protocol “SQL” are set in the message DB 500.

  Hereinafter, a case where the objects SQLi of the response messages S1 to S3 having the same message ID as the request messages S1, S2, and S3 are specified will be described as an example.

-Object SQLi of response message S1
First, the specifying unit 703 selects the message data 500-4 having the protocol “SQL” and the message type “request” from the message DB 500. Then, the specifying unit 703 specifies the object SQL1 of the message data 500-4. Next, the specifying unit 703 searches the message DB 500 for message data having the same message ID as the message data 500-4 and the protocol “SQL”.

  Here, message data 500-6 is searched. Then, the specifying unit 703 sets the specified object SQL1 in the object field of the message data 500-6 in the message DB 500 (see (11-2) in FIG. 11). Thereby, the object SQL1 of the response message S1 can be specified.

-Object SQLi of response message S2
First, the identifying unit 703 selects the message data 500-8 having the protocol “SQL” and the message type “request” from the message DB 500. Then, the specifying unit 703 specifies the object SQL2 of the message data 500-8. Next, the specifying unit 703 searches the message DB 500 for message data having the same message ID as the message data 500-8 and the protocol “SQL”.

  Here, message data 500-9 is searched. Then, the specifying unit 703 sets the specified object SQL2 in the object field of the message data 500-9 in the message DB 500 (see (11-2) in FIG. 11). Thereby, the object SQL2 of the response message S2 can be specified.

-Object SQLi of response message S3
First, the identifying unit 703 selects message data 500-11 of the protocol “SQL” and the message type “request” from the message DB 500. Then, the specifying unit 703 specifies the object SQL3 of the message data 500-11. Next, the specifying unit 703 searches the message DB 500 for message data having the same message ID as the message data 500-11 and the protocol “SQL”.

  Here, message data 500-12 is searched. Then, the specifying unit 703 sets the specified object SQL3 in the object field of the message data 500-12 in the message DB 500 (see (11-2) in FIG. 11). Thereby, the object SQL3 of the response message S3 can be specified.

(Specific processing contents of the first calculation unit 705)
Next, specific processing contents of the first calculation unit 705 that calculates the appearance rate A _j i of the object SQLi in the counting period Tj will be described with reference to FIG.

The first calculation unit 705 calculates the appearance rate A _j i of the object SQLi in the counting period Tj using, for example, the following equation (1). However, A _j i is the appearance rate of the object SQLi in the total period Tj. Y is the total number of messages of the object SQLi in the aggregation period Tj. X is the total number of messages of the object SQLi in which the parent exists in the aggregation period Tj.

A _j i = X / Y (1)

  FIG. 12 is an explanatory diagram (part 3) illustrating an example of a message group in the network system. In FIG. 12, messages m1 to m3 are messages of the protocol “IIOP” transmitted and received between the Web server 102 and the AP server 103 during the aggregation period Tx. Further, the messages m4 to m17 are messages of the protocol “SQL” transmitted / received between the AP server 103 and the DB server 104 in the aggregation period Tx. The aggregation period Tx is any one of the aggregation periods T1 to Tm.

  Here, the messages m1 and m2 of the protocol “IIOP” are the pair p1 having the same message ID. Time t1 is the transmission time of the message m1 (request) of the protocol “IIOP”. Time t2 is the transmission time of the message m2 (response) of the protocol “IIOP”.

  The messages m3 and m18 of the protocol “IIOP” are the pair p2 having the same message ID. Time t3 is a transmission time of the message m3 (request) of the protocol “IIOP”. Time t5 is the transmission time of the message m18 (response) of the protocol “IIOP”. However, the transmission time of the message m18 (response) is outside the total period Tx. Time t4 is the final time of the counting period Tx.

  Messages m4, m5, m8, m10, m16, and m17 are a set of messages of the object SQL1. The messages m6 and m7 are a set of messages of the object SQL2. Messages m9, m11, m12, m13, m14, and m15 are a set of messages of the object SQL3.

-Appearance rate A _x 1 of object SQL1
Here, an example of specific processing contents of the first calculation unit 705 that calculates the appearance rate A _x 1 of the object SQL1 in the total period Tx will be described. First, the first calculation unit 705 counts the total number Y of messages m4, m5, m8, m10, m16, and m17 of the object SQL1 in the aggregation period Tx. Here, the total number Y is “Y = 6”. The counted total number Y is stored, for example, in an intermediate table 1300 shown in FIG.

  Next, the first calculation unit 705 counts the total number of messages of the object SQL1 transmitted between the request time and the response time of one or more pairs of the protocol “IIOP” in the aggregation period Tx. That is, the first calculation unit 705 counts the total number X of messages of the object SQL1 in which the parent exists in the aggregation period Tx.

  Here, among the messages m4, m5, m8, m10, m16, and m17 of the object SQL1, the messages m4, m5, m8, and m10 are transmitted between the request time t1 and the response time t2 of the pair p1 of the protocol “IIOP”. Message. That is, the messages m4, m5, m8, and m10 are messages that have a parent.

  Of the messages m4, m5, m8, m10, m16, and m17 of the object SQL1, the messages m16 and m17 are transmitted between the request time t3 of the pair p2 of the protocol “IIOP” and the time t4 before the response time t5. Message. That is, the messages m16 and m17 are messages having a parent.

  Accordingly, the messages m4, m5, m8, m10, m16, and m17 are all messages having a parent. For this reason, the total number X of messages of the object SQL1 in which the parent exists in the total period Tx is “X = 6”. The counted total number X is stored, for example, in an intermediate table 1300 shown in FIG.

In this case, the first calculation unit 705 calculates the appearance rate A _x 1 of the object SQL1 in the total period Tx by substituting “X = 6” and “Y = 6” into the above equation (1). Here, the appearance rate A _x 1 is “A _x 1 = _6/6 = 1”.

-Appearance rate A _x 2 of object SQL2
Next, an example of specific processing contents of the first calculation unit 705 that calculates the appearance rate A _x 2 of the object SQL2 in the total period Tx will be described. First, the first calculation unit 705 counts the total number Y of messages m6 and m7 of the object SQL2 in the aggregation period Tx. Here, the total number Y is “Y = 2”.

  Next, the first calculation unit 705 counts the total number X of messages of the object SQL2 in which the parent exists in the counting period Tx. Here, the messages m6 and m7 are messages transmitted between the request time t1 and the response time t2 of the pair p1 of the protocol “IIOP”.

That is, the messages m6 and m7 of the object SQL2 are all messages having a parent. For this reason, the total number X of messages of the object SQL2 in which the parent exists in the total period Tx is “X = 2”. In this case, the first calculation unit 705 calculates the appearance rate A _x 2 of the object SQL2 in the aggregation period Tx by substituting “X = 2” and “Y = 2” into the above equation (1). Here, the appearance rate A _x 2 is “A _x 2 = _2/2 = 1”.

-Appearance rate A _x 3 of object SQL3
Next, an example of specific processing contents of the first calculation unit 705 that calculates the appearance rate A _x 3 of the object SQL3 in the total period Tx will be described. First, the first calculation unit 705 counts the total number Y of messages m9, m11, m12, m13, m14, and m15 of the object SQL3 in the aggregation period Tx. Here, the total number Y is “Y = 6”.

  Next, the first calculation unit 705 counts the total number X of messages of the object SQL3 in which the parent exists in the counting period Tx. Here, of the messages m9, m11, m12, m13, m14, and m15 of the object SQL3, the messages m9 and m11 are messages transmitted between the request time t1 and the response time t2 of the pair p1 of the protocol “IIOP”. is there. That is, the messages m9 and m11 are messages having a parent.

  Of the messages m9, m11, m12, m13, m14, and 15 of the object SQL3, the message m15 is transmitted between the request time t3 of the pair p2 of the protocol “IIOP” and the time t4 before the response time t5. Message. That is, the message m15 is a message having a parent.

  On the other hand, among the messages m9, m11, m12, m13, m14, and m15 of the object SQL3, the messages m12, m13, and m14 are between the request time and the response time of any pair p1 and p2 of the protocol “IIOP”. The message has not been sent. That is, the messages m12, m13, and m14 are messages that do not have a parent.

Therefore, the total number X of messages of the object SQL3 in which the parent exists in the total period Tx is “X = 3”. In this case, the first calculation unit 705 calculates the appearance rate A _x 3 of the object SQL3 in the total period Tx by substituting “X = 3” and “Y = 6” into the above equation (1). Here, the appearance rate A _x 3 is “A _x 3 = 3/6 = 0.5”.

  For example, FIG. 13 shows the total number Y of messages of the object SQL1 and the total number X of messages of the object SQLLi in which the parent exists during the counting period Tx counted during the series of processes of the first calculation unit 705 described above. It is stored in the intermediate table 1300. The intermediate table 1300 is realized by a storage device such as the RAM 403, the magnetic disk 405, and the optical disk 407, for example. Here, the intermediate table 1300 will be described.

  FIG. 13 is an explanatory diagram of an example of the contents stored in the intermediate table. In FIG. 13, the intermediate table 1300 includes fields for a total period ID, an object ID, a message count, and a parent message count. By setting information in each field, intermediate data 1300-1 to 1300-3 are stored as records.

  The aggregation period ID is an identifier of the aggregation period Tj. The object ID is an identifier of the object SQLi of the protocol “SQL”. The number of messages is the total number Y of messages of the object SQLi in the aggregation period Tj. The number of parent messages is the total number X of messages of the object SQLi in which the parent exists in the aggregation period Tj.

  Taking the intermediate data 1300-1 as an example, the total number “Y = 6” of messages of the object SQL1 in the counting period Tx and the total number of messages “X = 6” of the object SQL1 in which the parent exists in the counting period Tj are shown. ing. Here, the storage period of the intermediate table 1300 has been described by taking the aggregation period Tx as an example, but the intermediate table 1300 is created for each of the aggregation periods T1 to Tm.

(Specific processing contents of the second calculation unit 706)
Next, specific processing contents of the second calculation unit 706 that calculates the occupation rate Pj representing the proportion of the occupation period in the total period Tj will be described with reference to FIG.

  The second calculation unit 706 calculates an occupancy rate Pj that represents the proportion of the occupation period in the aggregation period Tj using, for example, the following equation (2). However, L is an occupation period (time length) from the request time to the response time of one or more pairs of the protocol “IIOP” in the aggregation period Tj. Tj is a total period (time length). Pj is an occupancy ratio that represents the ratio of the occupation period L in the total period Tj.

  Pj = L / Tj (2)

  FIG. 14 is an explanatory diagram (part 4) illustrating an example of a message group in the network system. In FIG. 14, messages m19 to m23 are messages of the protocol “IIOP” transmitted / received between the Web server 102 and the AP server 103 during the counting period Ty. Further, the messages m24 to m37 are messages of the protocol “SQL” transmitted / received between the AP server 103 and the DB server 104 in the aggregation period Ty. The aggregation period Ty is one of the aggregation periods T1 to Tm.

  Here, the messages m19 and m21 of the protocol “IIOP” are the pair p3 having the same message ID. Time t6 is the transmission time of the message m19 (request) of the protocol “IIOP”. Time t8 is a transmission time of the message m21 (response) of the protocol “IIOP”.

  Further, the messages m20 and m22 of the protocol “IIOP” are the pair p4 having the same message ID. Time t7 is a transmission time of the message m20 (request) of the protocol “IIOP”. Time t9 is a transmission time of the message m22 (response) of the protocol “IIOP”.

  Further, the messages m23 and m38 of the protocol “IIOP” are the pair p5 having the same message ID. Time t10 is a transmission time of the message m23 (request) of the protocol “IIOP”. Time t12 is a transmission time of the message m38 (response) of the protocol “IIOP”. However, the transmission time of the message m38 (response) is outside the counting period Ty. Time t11 is the final time of the counting period Ty. The messages m24 to m37 are messages of the protocol “SQL”.

  First, the second calculation unit 706 calculates the multiplicity of the protocol “IIOP” in the aggregation period Ty. Specifically, for example, the second calculation unit 706 calculates the multiplicity of the messages m19 to m23 of the protocol “IIOP” transmitted in the aggregation period Ty for each transmission time t6 to t10 in time series.

  More specifically, for example, in the counting period Ty, the second calculation unit 706 increments the multiplicity every time a request message is transmitted, and decrements the multiplicity every time a request message is transmitted. However, the initial value of multiplicity is “0”. As a result, the multiplicity for each of the transmission times t6 to t10 of the messages m19 to m23 can be calculated.

  In the example of FIG. 14, first, the second calculation unit 706 increments the multiplicity because the request message m19 is transmitted at the transmission time t6. As a result, the multiplicity at the transmission time t6 is “1”. Next, since the request message m20 is transmitted at the transmission time t7, the second calculation unit 706 increments the multiplicity. As a result, the multiplicity of the transmission time t7 is “2”.

  Next, since the response message m21 is transmitted at the transmission time t8, the second calculation unit 706 decrements the multiplicity. As a result, the multiplicity at the transmission time t8 is “1”. Next, since the response message m22 is transmitted at the transmission time t9, the second calculation unit 706 decrements the multiplicity. As a result, the multiplicity at the transmission time t9 is “0”.

  Next, since the request message m23 is transmitted at the transmission time t10, the second calculation unit 706 increments the multiplicity. As a result, the multiplicity at the transmission time t10 is “1”.

  The calculated multiplicity for each transmission time t6 to t10 is stored, for example, in a multiplicity table 1500 shown in FIG. The multiplicity table 1500 is realized by a storage device such as the RAM 403, the magnetic disk 405, and the optical disk 407, for example. Here, the multiplicity table 1500 will be described.

  FIG. 15 is an explanatory diagram of an example of the contents stored in the multiplicity table. In FIG. 15, the multiplicity table 1500 stores the multiplicity for each transmission time t6 to t10 in the counting period Ty. Here, the storage period of the multiplicity table 1500 has been described by taking the aggregation period Ty as an example, but the multiplicity table 1500 is created for each of the aggregation periods T1 to Tm.

  Thereafter, the second calculation unit 706 calculates the occupation period L by referring to the multiplicity table 1500, for example, and calculating the total of the multiplicity periods of 1 or more in the aggregation period Ty. Specifically, for example, first, the second calculation unit 706 calculates the periods L1 and L2 having a multiplicity of 1 or more in the counting period Ty.

  The period L1 is a period from the transmission time t6 to the transmission time t9. The period L2 is a period from the transmission time t10 to the transmission time t11. Next, the second calculation unit 706 calculates the occupation period L (= L1 + L2) by calculating the sum of the periods L1 and L2 having a multiplicity of 1 or more in the counting period Ty.

  And the 2nd calculation part 706 represents the ratio for which the occupation period L accounts among the total periods Ty by substituting the total period Ty (time length) and the occupation period L (time length) to said Formula (2). The occupation rate Py is calculated.

  Note that the multiplicity at the end of the counting period Tj may be carried over to a counting period (for example, the counting period T (j + 1)) that is continuous in time series with the counting period Tj. Thereby, the multiplicity can be appropriately calculated even when the request message and response message pair of the protocol “IIOP” spans a plurality of aggregation periods.

(Specific processing contents of the determination unit 707)
Next, using FIG. 16 and FIG. 17, a determination is made as to whether or not the object SQLi is an object of batch processing based on the appearance rate A _j i and the occupation rate Pj of the object SQLi calculated for each aggregation period Tj. Specific processing contents of the unit 707 will be described.

<Judgment example 1>
FIG. 16 is an explanatory diagram (part 1) of an example of determining a batch processing object. FIG. 16 shows a coordinate system 1600 including an X axis representing the occupation rate Pj of the counting period Tj and a Y axis representing the appearance rate A _j i of the object SQLi in the counting period Tj. In the coordinate system 1600, points f1 to f27 indicate combinations of the occupation rate Pj calculated for each aggregation period Tj and the appearance rate A _j i of the object SQLi.

Specifically, points f1 to f9 indicate combinations of the occupation rate Pj calculated for each aggregation period Tj and the appearance rate A _j 1 of the object SQL1. Point f10~f18 shows a combination of incidence A _j 2 occupancy Pj and objects SQL2 calculated for each counting period Tj. Point f19~f27 shows a combination of incidence A _j 3 occupancy Pj and objects SQL3 calculated for each counting period Tj.

More specifically, for example, the point f1 indicates a combination of the occupation rate Pz of the aggregation period Tz in any of the aggregation periods T1 to Tm and the appearance rate A _z1 of the object SQL1 in the aggregation period Tz. That is, the coordinate position of the point f1 is “(X, Y) = (Pz, A _z 1)”. A point f10 indicates a combination of the occupation rate Pz of the counting period Tz and the appearance rate A _z2 of the object SQL2 in the counting period Tz. That is, the coordinate position of the point f10 is “(X, Y) = (Pz, A _z 2)”. A point f19 indicates the occupancy Pz aggregation period Tz, a combination of incidence A _z 3 of the object SQL3 aggregation period Tz. That is, the coordinate position of the point f19 is “(X, Y) = (Pz, A _z 3)”.

The determination unit 707 determines that the occupancy Pj of the aggregation period Tj having the minimum occupancy among the aggregation periods T1 to Tm is equal to or less than the threshold value β, and the appearance rate A _j i of the object SQLi in the aggregation period Tj is equal to or less than the threshold value α. In this case, it is determined that the object SQLi is a batch processing object.

  Specifically, for example, first, the determination unit 707 identifies the occupation rate Pj of the aggregation period Tj that minimizes the occupation ratio among the aggregation periods T1 to Tm. In the example of FIG. 16, the occupation rate Pz of the total period Tz that minimizes the occupation rate is specified. Next, the determination unit 707 determines whether or not the occupation rate Pz of the aggregation period Tz that minimizes the occupation rate is equal to or less than the threshold value β.

  Here, when the occupation rate Pz of the total period Tz in which the occupation rate is minimum is larger than the threshold value β, the determination unit 707 determines that the objects SQL1, SQL2, and SQL3 are not batch processing objects. In the example of FIG. 16, since the occupation rate Pz of the total period Tz is equal to or less than the threshold value β, the determination unit 707 proceeds to the next process.

Next, the determination unit 707 determines, for each object SQLi, whether or not the appearance rate A _z i of the object SQLi in the aggregation period Tz is equal to or less than the threshold value α. Here, when the appearance rate A _z i of the object SQLi is equal to or less than the threshold value α, the determination unit 707 determines that the object SQLi is an object of batch processing. On the other hand, when the appearance rate A _z i of the object SQLi is larger than the threshold value α, the determination unit 707 determines that the object SQLi is not an object for batch processing.

In the example of FIG. 16, the appearance rate A _z 1 of the object SQL1 in the total period Tz is larger than the threshold value α. For this reason, the determination unit 707 determines that the object SQL1 is not an object for batch processing (corresponding to the point f1). In addition, the appearance rate A _z 2 of the object SQL2 in the total period Tz is larger than the threshold value α. For this reason, the determination unit 707 determines that the object SQL2 is not an object for batch processing (corresponding to the point f10).

On the other hand, the appearance rate A _z 3 of the object SQL3 in the total period Tz is equal to or less than the threshold value α. Therefore, the determination unit 707 determines that the object SQL3 is a batch processing object. Accordingly, it is possible to determine that the object SQL3 is an object of batch processing among the objects SQL1, SQL2, and SQL3 of the protocol “SQL”.

  In FIG. 16, an object SQL1 is an object used only for online processing. The object SQL2 is an object used for both online processing and batch processing. The object SQL3 is an object used only for batch processing. That is, according to the above determination, the object SQL 3 used only for batch processing can be determined in the network system 100 in which objects of online processing and batch processing are mixed.

<Judgment example 2>
FIG. 17 is an explanatory diagram (part 2) of an example of determining a batch processing object. FIG. 17 shows a coordinate system 1700 including an X axis representing the occupation rate Pj of the counting period Tj and a Y axis representing the appearance rate A _j i of the object SQLi in the counting period Tj. In the coordinate system 1700, points f28 to f42 indicate combinations of the occupation rate Pj calculated for each aggregation period Tj and the appearance rate A _j i of the object SQLi.

Specifically, points f28 to f32 indicate combinations of the occupation rate Pj calculated for each aggregation period Tj and the appearance rate A _j 1 of the object SQL1. Point f33~f37 shows a combination of incidence A _j 2 occupancy Pj and objects SQL2 calculated for each counting period Tj. Point f38~f42 shows a combination of incidence A _j 3 occupancy Pj and objects SQL3 calculated for each counting period Tj.

The determination unit 707 calculates the slope ai of the regression line Di of the object SQLi in the coordinate system 1700 based on the appearance rate A _j i and the occupation rate Pj of the object SQLi calculated for each aggregation period Tj. Specifically, for example, the determination unit 707 obtains the slope ai of the regression line Di based on the appearance rate A _j i and the occupation rate Pj of the object SQLi calculated for each aggregation period Tj by the least square method.

  For example, the regression line D1 is “Y = a1 × X + b1”. However, a1 is the inclination of the regression line D1, and b1 is the intercept of the regression line D1. In this case, the determination unit 707 calculates the slope a1 and the intercept b1 that minimize the sum of the squares of the distances between the points 28 to f32 of the coordinate system 1700 and the regression line D1, by the least square method.

  Then, the determination unit 707 determines whether or not the calculated slope ai of the regression line Di of the object SQLi is equal to or greater than a predetermined threshold γ. Here, when the slope ai of the regression line Di is equal to or greater than the threshold γ, the determination unit 707 determines that the object SQLi is an object for batch processing.

  On the other hand, when the slope ai of the regression line Di is less than the threshold γ, the determination unit 707 determines that the object SQLi is not an object for batch processing. The threshold value γ is set in advance and stored in a storage device such as the ROM 402, the RAM 403, the magnetic disk 405, and the optical disk 407.

Here, the lower the appearance rate A _j i of the object SQLi, the higher the possibility that the object SQLi is an object of batch processing. Further, the lower the occupation rate Pj of the total period Tj, the higher the possibility that the object SQLi is an object for batch processing.

In other words, the batch processing object SQLi has a strong tendency that the appearance rate A _j i increases as the occupation rate Pj increases. For this reason, the regression line Di of the batch processing object SQLi has a larger slope ai than the regression line of the online processing object.

  Therefore, the larger the threshold γ is set, the more accurately the batch processing object can be determined. On the other hand, if the threshold value γ is too large, the criterion for determining that the object is a batch process becomes strict, and the object SQLi may not be determined even if it is a batch process object.

  For this reason, the threshold value γ is an appropriate value (for example, when the slope ai of the regression line Di of the object SQLi is greater than or equal to the threshold value γ, for example, by performing a simulation). 0.7).

  In FIG. 17, the regression line D is a straight line whose slope is the threshold γ. In the example of FIG. 17, the slope a1 of the regression line D1 of the object SQL1 is less than the threshold γ. Further, the slope a2 of the regression line D2 of the object SQL2 is less than the threshold value γ. For this reason, the determination unit 707 determines that the objects SQL1 and SQL2 are not batch processing objects.

  On the other hand, the slope a3 of the regression line D3 of the object SQL3 is equal to or greater than the threshold value γ. For this reason, the determination unit 707 determines that the object SQL3 is an object of batch processing. Accordingly, it is possible to determine that the object SQL3 is an object of batch processing among the objects SQL1, SQL2, and SQL3 of the protocol “SQL”.

(Message deletion example)
Next, referring to FIG. 18, the specific processing contents of the deletion unit 709 that deletes the message of the object SQLi determined to be an object of batch processing from the message group delivered in the network system 100. Will be described.

  First, the acquisition unit 701 acquires a message group to be processed that has been transferred within the network system 100. The acquired message group to be processed is stored, for example, in a processing target table 1800 shown in FIG. The processing target table 1800 is realized by a storage device such as the RAM 403, the magnetic disk 405, and the optical disk 407, for example. Here, the processing target table 1800 will be described.

  FIG. 18 is an explanatory diagram of an example of the contents stored in the processing target table. In FIG. 18, the processing target table 1800 has fields for message ID, time stamp, protocol, message type, and deletion flag. By setting information in each field, message data 1800-1 to 1800-12 of a message to be processed is stored as a record.

  The message ID is an identifier of a message transmitted / received in the network system 100. The time stamp is a message transmission time. The message type is information indicating a request message or a response message. The deletion flag is a flag indicating a message to be deleted. Here, a message having a deletion flag “1” is a deletion target. The initial state of the deletion flag is “0”.

  In the processing target table 1800 of (18-1) in FIG. 18, message data 1800-1 to 1800-12 of the acquired message group to be processed are stored. Although illustration is omitted, in the processing target table 1800, messages corresponding to the message data 1800-1 to 1800-12 are stored in association with each other.

  Hereinafter, a case where it is determined that the object SQL3 of the protocol “SQL” is an object of batch processing will be described as an example.

  First, the deletion unit 709 selects arbitrary message data of the protocol “SQL” from the processing target table 1800. Next, the deletion unit 709 determines whether “request” is set in the message type field of the selected message data. Here, when “request” is set, the deletion unit 709 extracts the object SQLi from the message corresponding to the selected message data.

  Then, the deletion unit 709 determines whether or not the extracted object SQLi is the object SQL3. Here, when the object SQLi is the object SQL3, “1” is set to the deletion flag of the selected message data. In the example of (18-2) in FIG. 18, “1” is set in the deletion flag of the message data 1800-11.

  If “response” is set in the message type field of the selected message data, the deletion unit 709 searches the processing target table 1800 for message data having the same message ID as the selected message data. Here, when a search is performed, the deletion unit 709 extracts the object SQLi from the message corresponding to the searched message data.

  Then, the deletion unit 709 determines whether or not the extracted object SQLi is the object SQL3. Here, when the object SQLi is the object SQL3, “1” is set to the deletion flag of the selected message data. In the example of (18-2) in FIG. 18, “1” is set in the deletion flag of the message data 1800-12.

  For example, the deletion unit 709 repeats the series of processes described above until there is no unselected message data that has not been selected from the processing target table 1800. Finally, the deletion unit 709 deletes message data in which “1” is set in the deletion flag from the processing target table 1800.

  In the example of (18-3) in FIG. 18, message data 1800-11 and 1800-12 are deleted from the processing target table 1800. Thereby, the message of the batch processing object SQLi can be removed from the message group to be processed.

  In the example illustrated in FIG. 18, the case where the message of the batch processing object SQLi is deleted has been described as an example. However, the remaining messages other than the message of the batch processing object SQLi may be deleted. . Thereby, it is possible to extract the message of the batch processing object SQLi from the message group to be processed.

(System analysis support processing procedure of the system analysis support apparatus 101)
Next, a system analysis support processing procedure of the system analysis support apparatus 101 according to the embodiment will be described.

  FIG. 19 is a flowchart illustrating an example of a system analysis support processing procedure of the system analysis support apparatus according to the embodiment. In the flowchart of FIG. 19, first, the acquisition unit 701 determines whether a message group passed within the network system 100 has been acquired (step S1901).

  Here, the acquisition unit 701 waits to acquire a message group (step S1901: No). When the message group is acquired (step S1901: Yes), the detection unit 702 detects a request message / response message pair of the protocol “IIOP” from the acquired message group (step S1902).

  Next, the identifying unit 703 identifies the object SQLLi of the message of the protocol “SQL” from the acquired message group (step S1903). Thereafter, the selection unit 704 sets “j” in the total period Tj to “j = 1” (step S1904).

Then, the first calculation unit 705 executes appearance rate calculation processing for calculating the appearance rate A _j i of the object SQLi in the aggregation period Tj (step S1905). Next, the second calculation unit 706 executes an occupancy rate calculation process for calculating an occupancy rate Pj representing the proportion of the total period Tj occupied by the occupancy period L (step S1906).

  Thereafter, the selection unit 704 increments “j” of the total period Tj (step S1907), and determines whether “j” is greater than “m” (step S1908). If “j” is equal to or less than “m” (step S1908: NO), the process returns to step S1905.

  On the other hand, when “j” is larger than “m” (step S1908: Yes), the determination unit 707 executes determination processing for determining whether or not the object SQLi is a batch processing object (step S1909). Then, the output unit 708 outputs the object list 1000 showing the batch processing objects SQLi in a list (step S1910), and the series of processing according to this flowchart ends.

  As a result, among the objects of the protocol “SQL”, the batch processing object SQLi can be determined.

<Specific processing procedure of appearance rate calculation processing>
Next, a specific processing procedure of the appearance rate calculation processing in step S1905 shown in FIG. 19 will be described.

  FIG. 20 is a flowchart illustrating an example of a specific processing procedure of the appearance rate calculation processing in step S1905. In the flowchart of FIG. 20, first, the selection unit 704 selects a set of messages of the object SQLi transmitted within the counting period Tj from the message group acquired in step S1901 shown in FIG. S2001).

  Next, the first calculation unit 705 registers the object ID of the object SQLi of the selected message set in the intermediate table 1300 of the aggregation period Tj (step S2002). Thereafter, the first calculation unit 705 selects an arbitrary message from the selected set of messages (step S2003).

  Then, the first calculation unit 705 increments the number of messages of the object SQLi in the intermediate table 1300 (step S2004). Note that the initial value of the number of messages of the object SQLi in the intermediate table 1300 is “0”.

  Next, the first calculation unit 705 determines whether or not a parent exists in the selected message (step S2005). Here, when the parent does not exist (step S2005: No), the process proceeds to step S2007.

  On the other hand, when a parent exists (step S2005: Yes), the first calculation unit 705 increments the number of messages owned by the object SQLi in the intermediate table 1300 (step S2006). Note that the initial value of the number of messages owned by the object SQLi in the intermediate table 1300 is “0”.

  Next, the first calculation unit 705 determines whether there is an unselected message that has not been selected from the set of messages selected in step S2001 (step S2007). If there is an unselected message (step S2007: Yes), the process returns to step S2003.

  On the other hand, if there is no unselected message (step S2007: No), the selection unit 704 determines whether there is a set of messages of unselected objects SQLi not selected from the message group (step S2008). ). If there is a set of unselected messages (step S2008: Yes), the process returns to step S2001.

On the other hand, if there is no set of unselected messages (step S2008: No), the first calculation unit 705 refers to the intermediate table 1300 to calculate the appearance rate A _j i for each object SQLi (step S2009). ), The process proceeds to step S1906 shown in FIG. The calculated appearance rate A _j i for each object SQLi is stored in the appearance rate / occupancy rate table 900 shown in FIG.

Thereby, the appearance rate A _j i for each object SQLi in the total period Tj can be calculated.

<Specific processing procedure of occupation rate calculation processing>
Next, a specific processing procedure of the occupation ratio calculation processing in step S1906 shown in FIG. 19 will be described.

  FIG. 21 is a flowchart illustrating an example of a specific processing procedure of the occupation ratio calculation processing in step S1906. In the flowchart of FIG. 21, first, a set of messages of protocol “IIOP” transmitted by the second calculation unit 706 from the message group acquired in step S1901 shown in FIG. 19 within the total period Tj. Is extracted (step S2101).

  Next, the second calculation unit 706 selects an unselected message with the oldest transmission time from the set of extracted messages (step S2102). Then, the second calculation unit 706 determines whether the message type of the selected message is “request” (step S2103).

  If the message type is “request” (step S2103: Yes), the second calculation unit 706 increments the multiplicity of the total period Tj (step S2104), and the process proceeds to step S2106. Note that the initial value of the multiplicity of the total period Tj is “0”.

  On the other hand, when the message type is “response” (step S2103: No), the second calculation unit 706 decrements the multiplicity of the total period Tj (step S2105). Then, the second calculation unit 706 registers the multiplicity of the aggregation period Tj and the transmission time of the selected message in the multiplicity table 1500 of the aggregation period Tj (step S2106).

  Thereafter, the second calculation unit 706 determines whether there is an unselected message that has not been selected from the message set extracted in step S2101 (step S2107). If there is an unselected message (step S2107: YES), the process returns to step S2102.

  On the other hand, when there is no unselected message (step S2107: No), the second calculation unit 706 refers to the multiplicity table 1500 and obtains the total of the multiplicity periods of 1 or more in the aggregation period Tj. Thus, the occupation period L is calculated (step S2108).

  Then, the second calculation unit 706 calculates the occupation rate Pj of the total period Tj by substituting the total period Tj and the occupation period L into the above equation (2) (step S2109), which is shown in FIG. The process proceeds to step S1907.

  Thereby, the occupation rate Pj of the total period Tj can be calculated. In the above description, the initial value of the multiplicity of the total period Tj is “0”. However, the multiplicity at the end of the total period T (j−1) may be the initial value of the multiplicity of the total period Tj. .

<Specific Processing Procedure of Determination Processing (Part 1)>
Next, a specific processing procedure of the determination processing in step S1909 shown in FIG. 19 will be described. Here, first, a specific processing procedure of determination processing corresponding to the above-described <determination example 1> will be described.

  FIG. 22 is a flowchart (part 1) illustrating an example of a specific processing procedure of the determination processing in step S1909. In the flowchart of FIG. 22, first, the determination unit 707 refers to the appearance rate / occupancy rate table 900 to identify the occupation rate Pj of the aggregation period Tj that minimizes the occupation ratio among the aggregation periods T1 to Tm (step S2201).

  Thereafter, the determination unit 707 determines whether or not the occupation rate Pj of the specified total period Tj is equal to or less than the threshold value β (step S2202). Here, when the occupation rate Pj is equal to or less than the threshold β (step S2202: Yes), the determination unit 707 refers to the appearance rate / occupancy rate table 900 and selects an arbitrary object SQLi in the aggregation period Tj (step S2203). ).

Thereafter, the determination unit 707 refers to the appearance rate / occupancy rate table 900 to determine whether the appearance rate A _z i of the selected object SQLi is equal to or less than the threshold value α (step S2204). If the appearance rate A _z i is greater than the threshold value α (step S2204: NO), the process proceeds to step S2207.

On the other hand, when the appearance rate A _z i is equal to or less than the threshold value α (step S2204: Yes), the determination unit 707 determines that the selected object SQLi is an object for batch processing (step S2205). Then, the determination unit 707 registers the object ID of the object SQLi determined to be an object of batch processing in the object list 1000 (step S2206).

  Thereafter, the determination unit 707 refers to the appearance rate / occupancy rate table 900 to determine whether there is an unselected object SQLi that has not been selected (step S2207). If there is an unselected object SQLi (step S2207: YES), the process returns to step S2203. On the other hand, when there is no unselected object SQLi (step S2207: No), the process proceeds to step S1910 shown in FIG.

  In step S2202, if the occupation ratio Pj is larger than the threshold β (step S2202: No), the determination unit 707 determines that all the objects SQLi are not batch processing objects (step S2208), and FIG. The process proceeds to the step S1910 shown.

  Thereby, the threshold value α and the threshold value β can be set to arbitrary values that are highly likely to be batch processing objects, and batch processing objects can be determined.

<Specific Processing Procedure of Determination Processing (Part 2)>
Next, a specific processing procedure of the determination process corresponding to <determination example 2> described above will be described.

  FIG. 23 is a flowchart (part 2) illustrating an example of a specific processing procedure of the determination processing in step S1909. In the flowchart of FIG. 23, first, the determination unit 707 refers to the appearance rate / occupancy rate table 900 to select an arbitrary object SQLi (step S2301).

  Thereafter, the determination unit 707 refers to the appearance rate / occupancy rate table 900 to calculate the slope ai of the regression line Di of the selected object SQLi (step S2302). Then, the determination unit 707 determines whether or not the calculated slope ai of the regression line Di is greater than or equal to the threshold γ (step S2303).

  If the slope ai of the regression line Di is greater than or equal to the threshold γ (step S2303: Yes), the determination unit 707 determines that the object SQLi is an object for batch processing (step S2304). Then, the determination unit 707 registers the object ID of the object SQLi determined to be an object of batch processing in the object list 1000 (step S2305).

  Thereafter, the determination unit 707 refers to the appearance rate / occupancy rate table 900 to determine whether there is an unselected object SQLi that has not been selected (step S2306). If there is an unselected object SQLi (step S2306: YES), the process returns to step S2301. On the other hand, when there is no unselected object SQLi (step S2306: No), the process proceeds to step S1910 shown in FIG.

  In step S2303, when the slope ai of the regression line Di is less than the threshold γ (step S2303: No), the determination unit 707 determines that the object SQLi is not a batch processing object (step S2307), and step S2306. Migrate to

Thereby, among the objects of the protocol “SQL”, the object SQLi in which the appearance rate A _j i tends to increase with the increase in the occupation rate Pj of the aggregation period Tj can be determined as the object of batch processing.

<Message deletion process>
Next, a specific processing procedure of the deletion processing for deleting the message of the object SQLi determined to be an object of batch processing will be described.

  FIG. 24 is a flowchart illustrating an example of a specific processing procedure of message deletion processing. In the flowchart of FIG. 24, first, the acquisition unit 701 determines whether or not a message group to be processed passed within the network system 100 has been acquired (step S2401).

  Here, waiting for acquiring a message group to be processed (step S2401: No), and when acquired (step S2401: Yes), the acquiring unit 701 registers the acquired message group in the processing target table 1800. (Step S2402).

  Next, the deletion unit 709 selects arbitrary message data of the protocol “SQL” from the processing target table 1800 (step S2403). Then, the deletion unit 709 determines whether “request” is set in the message type field of the selected message data (step S2404).

  If “response” is set in the message type field (step S2404: No), the deletion unit 709 searches the processing target table 1800 for message data having the same message ID as the selected message data. (Step S2405).

  If the message data is searched (step S2406: YES), the deletion unit 709 extracts the object SQLi from the message corresponding to the searched message data (step S2407). On the other hand, when message data is not searched (step S2406: No), the process proceeds to step S2410.

  If “request” is set in the message type field in step S2404 (step S2404: Yes), the deletion unit 709 extracts the object SQLi from the message corresponding to the message data selected in step S2403 (step S2404). S2407).

  Thereafter, the deletion unit 709 determines whether or not the object list 1000 includes the object ID of the extracted object SQLi (step S2408). If it is not included in the object list 1000 (step S2408: NO), the process proceeds to step S2410.

  On the other hand, if it is included in the object list 1000 (step S2408: Yes), the deletion unit 709 changes the deletion flag in the processing target table 1800 for the message data selected in step S2403 from “0” to “1” (step S2403). S2409). Then, the deletion unit 709 determines whether there is message data of an unselected protocol “SQL” that has not been selected from the processing target table 1800 (step S2410).

  If there is unselected message data (step S2410: YES), the process returns to step S2403. On the other hand, when there is no unselected message data (step S2410: No), the deletion unit 709 corresponds to message data whose deletion flag in the processing target table 1800 is “1” from the message group to be processed. The message is deleted (step S2411).

  Then, the output unit 708 outputs the deleted message group in which the message corresponding to the message data with the deletion flag “1” is deleted from the message group to be processed (step S2412), and according to this flowchart. A series of processing ends.

  Thereby, when the system analysis of the network system 100 is performed, the message of the batch processing object SQLi can be removed from the message group to be processed.

As described above, according to the system analysis support apparatus 101 according to the present embodiment, whether or not the object SQLi is an object for batch processing based on the appearance rate A _j i and the occupation rate Pj of the object SQLi in the counting period Tj. Can be determined. Thereby, the message of the batch processing object SQLi can be determined from the message group delivered in the network system 100.

Further, according to the system analysis support apparatus 101, when the appearance rate A _j i of the object SQLi in the counting period Tj is equal to or less than the threshold value α and the occupation rate Pj is equal to or less than the threshold value β, it is determined that the object SQLi is an object of batch processing. be able to. Thereby, the threshold value α and the threshold value β can be set to arbitrary values that are highly likely to be batch processing objects, and batch processing objects can be determined.

Further, according to the system analysis support apparatus 101, it is possible to determine whether or not the object SQLi is an object for batch processing based on the appearance rate A _j i and the occupation rate Pj of the object SQLi calculated for each aggregation period Tj. it can. Thereby, it is possible to statistically determine whether or not the object SQLi is an object for batch processing, and improve the determination accuracy.

Further, according to the system analysis support apparatus 101, the occupation rate Pj of the aggregation period Tj in which the occupation ratio is the minimum among the aggregation periods T1 to Tm is equal to or less than the threshold value β, and the appearance rate A _j i of the object SQLi is equal to or less than the threshold value α. In this case, it can be determined that the object SQLi is an object of batch processing.

Further, according to the system analysis support apparatus 101, based on the appearance rate A _j i of the object SQLi and the slope ai of the regression line Di based on the occupation rate Pj for each counting period Tj, whether or not the object SQLi is an object of batch processing. Can be determined. Thereby, among the objects of the protocol “SQL”, the object SQLi in which the appearance rate A _j i tends to increase with the increase in the occupation rate Pj of the aggregation period Tj can be determined as the object of batch processing.

  Further, according to the system analysis support apparatus 101, the message of the object SQLi determined to be an object of batch processing can be deleted from the message group delivered within the network system 100. Thereby, when the system analysis of the network system 100 is performed, the message of the batch processing object SQLi can be removed from the message group to be processed. As a result, the processing time of each computer in the network system 100 can be obtained with high accuracy, and the analysis accuracy of system analysis can be improved.

  The system analysis support method described in the present embodiment can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. The system analysis support program is recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, and a DVD, and is executed by being read from the recording medium by the computer. The system analysis support program may be distributed via a network such as the Internet.

DESCRIPTION OF SYMBOLS 100 Network system 101 System analysis support apparatus 102 Web server 103 AP server 104 DB server 500 Message DB
701 Acquisition unit 702 Detection unit 703 Identification unit 704 Selection unit 705 First calculation unit 706 Second calculation unit 707 Determination unit 708 Output unit 709 Deletion unit 800 Pair information table 900 Appearance rate / occupancy rate table 1000 Object list 1300 Intermediate table 1500 Multiplicity table 1800 Processing target table

Claims (8)

A detection step of detecting a request and response pair of a protocol immediately above the protocol for operating the database in the system from among a group of messages passed in the system in which the hierarchical structure of the protocol is defined;
A selection step of selecting a set of messages relating to a predetermined operation on the database transmitted within a predetermined period from the message group;
A first index value representing a ratio of messages transmitted between the request time and the response time of one or more pairs detected by the detection step in the set of messages selected by the selection step; 1 calculation step;
A second calculation step of calculating a second index value representing a ratio of a period from the request time to the response time of the one or more pairs in the predetermined period;
A determination step of determining whether or not the predetermined operation is a batch processing operation based on the first and second index values calculated by the first and second calculation steps;
An output step for outputting the determination result determined by the determination step;
A system analysis support program characterized by causing a computer to execute. The determination step includes
2. The predetermined operation is determined to be a batch processing operation when the first index value is equal to or smaller than a first threshold value and the second index value is equal to or smaller than a second threshold value. System analysis support program described in 1. The selection step includes
For each predetermined period of a plurality of predetermined periods, a set of messages relating to a predetermined operation on the database, transmitted within the predetermined period, is selected from the message group,
The first calculation step includes:
For each of the predetermined periods, a first value representing a ratio of messages transmitted between the request time and the response time of the one or more pairs of the set of messages selected for each of the predetermined periods. Calculate the index value,
The second calculation step includes:
For each of the predetermined periods, a second index value representing a ratio of the period from the request time to the response time of the one or more pairs in each predetermined period is calculated,
The determination step includes
3. The method according to claim 1, wherein whether or not the predetermined operation is a batch processing operation is determined based on the first and second index values calculated for each predetermined period. System analysis support program. The determination step includes
Among the plurality of predetermined periods, the second index value in a predetermined period in which the second index value is minimum is equal to or less than the second threshold value, and the predetermined period in which the second index value is minimum The system analysis support program according to claim 3, wherein when the first index value is equal to or less than the first threshold value, the predetermined operation is determined to be a batch processing operation. In the computer,
Based on the first and second index values calculated for each predetermined period, a regression line in a coordinate system including an axis representing the first index value and an axis representing the second index value A third calculation step for calculating the inclination is executed,
The determination step includes
The system according to claim 3, wherein when the slope of the regression line calculated by the third calculation step is equal to or greater than a third threshold, the predetermined operation is determined to be a batch processing operation. Analysis support program. In the computer,
If the determination step determines that the predetermined operation is a batch processing operation, a deletion step of deleting a message related to the predetermined operation from the message group;
A message output step of outputting the message group after deletion in which the message related to the predetermined operation is deleted by the deletion step;
The system analysis support program according to claim 1, wherein the system analysis support program is executed. A detection unit for detecting a request and response pair of a protocol immediately above the protocol for operating the database in the system from among a group of messages passed in the system in which the hierarchical structure of the protocol is defined;
A selection unit that selects a set of messages related to a predetermined operation on the database, transmitted from the message group within a predetermined period;
A first index value representing a ratio of messages transmitted between the request time and the response time of one or more pairs detected by the detection unit in the set of messages selected by the selection unit; 1 calculation unit;
A second calculation unit that calculates a second index value representing a ratio of a period from the request time to the response time of the one or more pairs in the predetermined period;
A determination unit that determines whether or not the predetermined operation is a batch processing operation based on the first and second index values calculated by the first and second calculation units;
An output unit that outputs a determination result determined by the determination unit;
A system analysis support apparatus comprising: Computer
From a group of messages passed in the system in which the protocol hierarchy is defined, a protocol request and response pair immediately above the protocol for operating the database in the system is detected,
From the group of messages, select a set of messages related to a predetermined operation on the database transmitted within a predetermined period,
Calculating a first index value representing a ratio of messages transmitted between the request time and the response time of one or more detected pairs of the selected set of messages;
A second index value representing a ratio of a period from the request time to the response time of the one or more pairs in the predetermined period is calculated;
Based on the calculated first and second index values, it is determined whether the predetermined operation is a batch processing operation,
Output the result of the judgment.
A system analysis support method characterized by executing processing.

Images