JP5659751B2 - Management device, management method, and program - Google Patents

Description

  The present invention relates to a management apparatus, a management method, and a program for managing network devices in a computer network.

  In recent years, in a computer network, in order to manage and monitor devices constituting the network, a program called “agent” has been incorporated into managed devices such as various servers and terminals. In this case, a dedicated server for management (hereinafter referred to as “management server”) is arranged in the computer network, and an agent management program called “manager” is incorporated in the management server.

  In such a computer network, when a failure occurs in a device in which the agent is incorporated, each agent creates a message about the failure and sends it to the manager. The manager uses a filter to determine whether the transmitted message can be discarded. In addition, the number of filters used at this time is not one but may be plural. For a message that has not been discarded, the manager performs various processes according to the message, for example, a recovery instruction to the system administrator.

  However, as the computer network becomes larger, the number of messages received by the manager increases accordingly. At this time, since the manager applies a filter for each received message, the message processing load on the manager increases.

  For this reason, for example, Patent Document 1 discloses a system that optimizes the arrangement of filters to reduce the load on the manager. Specifically, the system disclosed in Patent Document 1 first sums up each matching frequency (hit rate) for each filter for a certain period. Next, the system sets the priority of a filter having a high adaptation frequency to be high based on the aggregation result, and applies the filter from the filter having a high priority to reduce the number of man-hours for the filter processing. As a result, the message processing load on the manager is reduced.

JP 2006-260056 A

  By the way, conditions for passing each filter are set according to the definition. At this time, the filter can be passed not only when the conditions are completely matched but also when the conditions are partially matched. It is possible to set as follows. In many cases, the filter is defined by a regular expression.

  Therefore, in the system disclosed in Patent Document 1, when the priority of the filter A is changed and the filter A is arranged at a higher level of another filter B with partially overlapping conditions, it originally functions. The filter B may not function at all.

  Furthermore, the filter may be associated with a command (notification and recovery process) that is executed only when there is a message that passes the filter. In such a case, if the priority setting of the filter is changed and the order of application is changed, the command that is originally targeted for execution may not be executed.

  An object of the present invention is to provide a management device, a management method, and a program that can solve the above-described problems and reduce the number of filter processing steps without changing the filter priority setting.

In order to achieve the above object, a management device according to one aspect of the present invention is a management device that manages the device based on a message received from a device to be managed,
A keyword analysis unit that extracts, as keywords, metadata that has an appearance frequency equal to or greater than a set threshold value from the metadata of a message that has already been received;
Dividing a filter group for selecting messages based on setting conditions into a first filter related to the extracted keyword and a second filter other than the first filter;
Then, for each of the extracted keywords, create a first filter group to which the first filter related to the keyword belongs,
A filter group creating unit for creating a second filter group to which the second filter belongs;
When a message is received from the device, it is determined whether the metadata of the received message matches the extracted keyword, and one of the first filter group and the second filter is determined based on the determination result. A filter group distribution unit that selects a filter group to be applied to the received message from the group;
A filter group applying unit that applies the selected filter group to the received message;
It is characterized by having.

In order to achieve the above object, a management method according to one aspect of the present invention is a method for managing the device based on a message received from a device to be managed,
(A) extracting, as a keyword, metadata having an appearance frequency equal to or higher than a set threshold value from metadata of a message that has already been received;
(B) A filter group for selecting messages based on setting conditions is divided into a first filter related to the extracted keyword and a second filter other than the first filter;
Then, for each of the extracted keywords, create a first filter group to which the first filter related to the keyword belongs,
Creating a second filter group to which the second filter belongs; and
(C) When a message is received from the device, it is determined whether metadata of the received message matches the extracted keyword, and based on the determination result, any one of the first filter group and the first filter group is determined. Selecting a filter group to be applied to the received message from among the two filter groups;
(D) applying the selected filter group to the received message;
It is characterized by having.

Furthermore, in order to achieve the above object, a program in one aspect of the present invention is a program for managing the device based on a message received from a device to be managed by a computer,
In the computer,
(A) extracting, as a keyword, metadata having an appearance frequency equal to or higher than a set threshold value from metadata of a message that has already been received;
(B) A filter group for selecting messages based on setting conditions is divided into a first filter related to the extracted keyword and a second filter other than the first filter;
Then, for each of the extracted keywords, create a first filter group to which the first filter related to the keyword belongs,
Creating a second filter group to which the second filter belongs; and
(C) When a message is received from the device, it is determined whether metadata of the received message matches the extracted keyword, and based on the determination result, any one of the first filter group and the first filter group is determined. Selecting a filter group to be applied to the received message from among the two filter groups;
(D) applying the selected filter group to the received message;
Is executed.

  With the above features, according to the management device, management method, and program of the present invention, it is possible to reduce the man-hours for the filter processing without changing the setting of the filter priority.

FIG. 1 is a block diagram showing a configuration of a management apparatus according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a message transmitted from a device to be managed. FIG. 3 is a flowchart showing an operation at the time of filter group creation processing of the management apparatus according to the present embodiment. FIG. 4 is a block diagram supplementing the description of the filter group creation processing. FIG. 5 is a flowchart showing more specifically the keyword analysis processing in step A1 shown in FIG. FIG. 6 is a diagram illustrating an example of a template in which extracted keywords are registered. FIG. 7 is a diagram illustrating keyword analysis processing. FIG. 8 is a flowchart showing more specifically the filter group creation processing in step A2 shown in FIG. FIG. 9 is a diagram illustrating an example of the created filter group. FIG. 10 is a diagram illustrating an example of the hierarchical structure of the created filter group. FIG. 11 is a flowchart showing an operation at the time of filtering processing of the management apparatus according to the present embodiment. FIG. 12 is a block diagram supplementing the description of the filtering process. FIG. 13 is a flowchart more specifically showing the filtering process in step B4 shown in FIG. FIG. 14 is a flowchart more specifically showing the filtering process in step B3 shown in FIG. FIG. 15 is a flowchart showing an operation during maintenance processing of the management apparatus according to the present embodiment. FIG. 16 is a block diagram supplementing the description of the maintenance process. FIG. 17 is a block diagram illustrating an example of a computer that implements the management device according to the embodiment of the present invention.

(Embodiment)
Hereinafter, a management device, a management method, and a program according to an embodiment of the present invention will be described with reference to FIGS. First, the configuration of the management apparatus according to the present embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing a configuration of a management apparatus according to an embodiment of the present invention.

[Management system configuration]
A management system 140 shown in FIG. 1 is a system for operating and managing the device 210 with a manager-agent configuration. The management apparatus 100 functions as a manager in the management system 140 and executes management of the device 210 based on a message received from the device 210 to be managed.

  In the present embodiment, as will be described later, the management apparatus 100 is implemented by installing a manager program in a computer and executing it. Further, an agent program is incorporated in the device 210, and the agent 200 is constructed. When a failure or the like occurs in the device 210, the agent 200 creates a message related to the failure and transmits the message to the management apparatus 100.

  The management system 140 further includes a monitoring device 300 used by the administrator of the management system. The management device 100 and the monitoring device 300 are connected via a network 400 such as the Internet and an in-house LAN. Similarly, the device 210 to be managed is also connected to the management device 100 via the network 400. In the example of FIG. 1, for ease of explanation, only one device 210 is shown, but in this embodiment, the number of devices to be managed is not particularly limited.

  In the present embodiment, the monitoring device 300 includes a message confirmation unit 301 and a filter setting unit 302. The message confirmation unit 301 extracts the accumulated message log from the message log accumulation unit 104 described later, and displays the selected message on a console (not shown in FIG. 1). The filter setting unit 302 sets a filter definition, which will be described later, in accordance with an instruction from the administrator, and transmits the set filter definition to the management apparatus 100.

[Configuration of management device]
As shown in FIG. 1, the management apparatus 100 mainly includes a filter processing unit 102 and a group processing unit 106. Among these, the group processing unit 106 further includes a keyword analysis unit 113 and a filter group creation unit 114. The filter processing unit 102 includes a filter group distribution unit 115 and a filter group application unit 116.

  The keyword analysis unit 113 extracts, as a keyword, metadata whose appearance frequency is equal to or higher than a set threshold value from the metadata of a message that has already been received. First, the filter group creation unit 114 selects a filter group for selecting messages based on the setting condition as a first filter related to the extracted keyword and a filter other than the first filter, that is, not related to any keyword. Separated into the second filter. Then, for each extracted keyword, the filter group creation unit 114 creates a first filter group to which the first filter related to the keyword belongs. Further, the filter group creation unit 114 creates a second filter group to which the second filter belongs.

  When the filter group distribution unit 115 receives a message from the device 210 to be managed, the filter group distribution unit 115 determines whether the metadata of the received message matches the previously extracted keyword. Then, based on the determination result, the filter group distribution unit 115 selects a filter group to be applied to the received message from any one of the first filter group and the second filter group.

  Further, the filter group application unit 116 applies the selected filter group to the received message. When the received message meets the setting conditions of each filter constituting the selected filter group, this message is selected and accumulated as a message log. The accumulated message is then sent to the monitoring device 300.

  Thus, in the present embodiment, the received message is first classified into at least two based on the metadata. That is, when one of the first filter groups is applied and when the second filter group is applied. In the former case, an appropriate first filter group is further selected based on the metadata. For this reason, according to the present embodiment, it is possible to reduce the number of man-hours for the filtering process without changing the priority setting of the filter.

  Here, the configuration of the management apparatus 100 in the present embodiment will be described more specifically. As shown in FIG. 1, in addition to the filter processing unit 102 and the group processing unit 106, the management apparatus 100 includes a message receiving unit 101, a filter storage unit 103, a message log storage unit 104, a metadata storage unit 105, A schedule unit 107, a group definition storage unit 108, a keyword storage unit 109, an action execution unit 110, a filter update unit 111, and a group maintenance unit 112 are provided.

  The message reception unit 101 receives the message transmitted by the agent 200 and inputs it to the filter group distribution unit 115. Moreover, in this Embodiment, the message is provided with the structure shown in FIG. 2, for example. FIG. 2 is a diagram illustrating an example of a message transmitted from a device to be managed.

  In FIG. 2, lines 1002 to 10005 indicate messages. A row 1001 indicates a category of message metadata, and each category value in the rows 1002 to 1004 corresponds to “metadata”. In the present embodiment, the agent 200 temporarily stores the created message in the message log file storage unit 201, and then transmits the stored message to the management apparatus 100 at regular intervals.

  The filter accumulation unit 103 accumulates a number of filters for selecting messages based on filter groups, that is, setting conditions. In the present embodiment, each filter is a definition described by setting conditions for selecting messages, and the filter storage unit 103 actually stores the definition of each filter. The filter group creation unit 114 takes out one or more filters to be used from the filter storage unit 193.

  The message log storage unit 104 stores a log of messages selected by the filter group application unit 116 described above. The metadata accumulation unit 105 accumulates the metadata of messages selected by the filter group application unit 116.

  In the present embodiment, after applying a filter group to a message, the filter group application unit 116 outputs a log of the selected message to the message log storage unit 104 and outputs metadata to the metadata storage unit 105. In the present embodiment, the keyword analysis unit 113 extracts keywords for the metadata stored in the metadata storage unit 105.

  When the schedule unit 107 reaches the set time interval or the set time, the schedule unit 107 notifies the group processing unit 106 and a later-described group maintenance unit 112 of the start of processing.

  The group definition accumulation unit 108 accumulates the definitions of the first filter group and the second filter group created by the filter group creation unit 114. In the present embodiment, when creating a filter group, the filter group creation unit 114 extracts these definitions and outputs the extracted definitions to the group definition storage unit 108.

  The keyword storage unit 109 stores the keywords extracted by the keyword analysis unit 113. In the present embodiment, when keyword analysis unit 113 extracts a keyword, it outputs the extracted keyword to keyword storage unit 109. In addition, the filter group distribution unit 115 executes filter group selection using the keywords stored in the keyword storage unit 109.

  The action execution unit 110 executes a command associated with the message selected by the filter group application unit 116. Specifically, the action execution unit 110 executes the command 202 held by the agent 200 that is the transmission source of the selected message when the message log is accumulated.

  When the filter definition is set in the monitoring terminal 300, the filter update unit 111 receives the set definition and accesses the filter storage unit 103. Then, the filter update unit 111 changes the definition of the instructed filter.

The group maintenance unit 112 confirms the usefulness of the filter group definitions accumulated in the group definition accumulation unit 108 at regular intervals, and performs filter group definition maintenance based on the confirmation results. If in the present embodiment, the group maintenance unit 112, which aggregates the applied frequency of each full I filter group filter group aggregated frequency does not satisfy the set reference value exists, the filter group Is deleted.

  Next, operation | movement of the management apparatus 100 in embodiment of this invention is demonstrated using FIGS. In the present embodiment, the management method is implemented by operating the management apparatus 100. Therefore, the description of the management method in the present embodiment is replaced with the following description of the operation of the management apparatus 100.

  In the present embodiment, the management apparatus 100 performs three processes roughly. The first is filter group creation processing by the group processing unit 106. The second is filtering processing by the filter processing unit 102. The third is maintenance processing by the group maintenance unit. Hereinafter, the operation of the management apparatus 100 will be described for each process.

[Filter group creation processing: Overall]
First, the entire filter group creation process will be described with reference to FIGS. FIG. 3 is a flowchart showing an operation at the time of filter group creation processing of the management apparatus in the present embodiment. FIG. 4 is a block diagram supplementing the description of the filter group creation processing. In FIG. 4, only the portion operating during the filter group creation process is indicated by a solid line.

  As shown in FIGS. 3 and 4, first, when the keyword analysis unit 113 receives a notification from the scheduling unit 107 that, for example, the start of processing every certain period of time, the keyword analysis unit 113 accesses and accumulates the metadata storage unit 105. Get metadata. And the keyword analysis part 113 extracts the metadata from which the appearance frequency becomes more than the set threshold value from a metadata as a keyword (step A1).

  Next, the filter group creation unit 114 uses the keyword extracted in step A1 to change the filter group accumulated in the filter accumulation unit 103 to the first filter related to any keyword and any keyword. The second filter is not related to the above. Then, for each extracted keyword, the filter group creation unit 114 creates a first filter group to which the first filter related to the keyword belongs, and further includes a second filter group to which the second filter belongs. Create (step A2).

  When step A2 ends, the filter group creation unit 114 outputs the created definitions of the first filter group and the second filter group to the group definition accumulation unit 108, and accumulates them. At this time, the group definition accumulating unit 108 causes the first filter group to belong to the class A and the second filter group to belong to the class B.

[Filter group creation processing: keyword analysis]
Next, step A1 shown in FIG. 3 will be described more specifically with reference to FIGS. FIG. 5 is a flowchart showing more specifically the keyword analysis processing in step A1 shown in FIG. FIG. 6 is a diagram illustrating an example of a template in which extracted keywords are registered. FIG. 7 is a diagram illustrating keyword analysis processing.

  As shown in FIG. 5, first, the keyword analysis unit 113 acquires the metadata 51 (see FIG. 2) for each category stored therein from the metadata storage unit 105 (step A11). Next, the keyword analysis unit 113 sorts the acquired metadata for each category, and further calculates the appearance frequency of each metadata (step A12).

  Next, the keyword analysis unit 113 acquires the threshold data 52 from the metadata storage unit 105. The threshold data 52 includes a preset threshold of appearance frequency. Then, the keyword analysis unit 113 selects one category, compares the appearance frequency calculated in step A12 with the threshold for each metadata of the selected category, and determines whether the appearance frequency is equal to or higher than the threshold. (Step A13).

  As a result of the determination in step A13, if there is at least one metadata whose appearance frequency is greater than or equal to the threshold in the selected category, the keyword analysis unit 113 sets all the metadata greater than or equal to the threshold to the template 53. Add (step A14). Thereafter, the keyword analysis unit 113 executes Step A15. On the other hand, as a result of the determination in step A13, if there is no metadata whose appearance frequency is equal to or higher than the threshold in the selected category, the keyword analysis unit 113 executes step A15 as it is.

  In the present embodiment, the template 53 is configured with keywords (metadata) sorted for each category, as shown in FIG. In step A14, the keyword analysis unit 113 adds metadata that exceeds the threshold as a keyword at the corresponding category position.

  In step A15, the keyword analysis unit 113 determines whether there is a category that has not been subjected to the processing in steps A13 and A14 (a category that has not yet been selected). If the result of determination in step A15 is that there is a category that has not yet been selected, the keyword analysis unit 113 shifts the category to be selected to a category that has not yet been selected (step A16), and then repeats step A13. Run.

  On the other hand, as a result of the determination in step A15, if there is no category that has not yet been selected, the keyword analysis unit 113 determines whether or not one or more keywords are included in the template 53 (step A17). .

  As a result of the determination in step A17, if the template 53 includes one or more keywords, the keyword analysis unit 113 stores the template 53 in the keyword storage unit 109 (step A18), and then performs step A19. Run. On the other hand, as a result of the determination in step A17, if the template 53 does not contain one or more keywords, the keyword analysis unit 113 executes step A19 as it is.

  In step A <b> 19, the keyword analysis unit 113 deletes the metadata added as a keyword to the template 53 from the metadata 51 stored in the metadata storage unit 105. After execution of step A19, step A2 described above is executed.

  Here, the specific example from step A12 to A16 is demonstrated based on FIG. In the example of FIG. 7, there are five metadata categories, and the threshold of appearance frequency is set to “30%”. As shown in FIG. 7, for each category, metadata having an appearance frequency of 30% or more is extracted as a keyword. The extracted metadata is added to the template 53.

[Filter group creation processing: Create filter group]
Next, step A1 shown in FIG. 3 will be described in more detail with reference to FIGS. FIG. 8 is a flowchart showing more specifically the filter group creation processing in step A2 shown in FIG. FIG. 9 is a diagram illustrating an example of the created filter group. FIG. 10 is a diagram illustrating an example of the hierarchical structure of the created filter group.

  As shown in FIG. 8, after the end of step A1, the filter group creation unit 114 selects one keyword from the template 53 (see FIG. 6) including the keyword extracted by the keyword analysis unit 113 (step A21).

  Next, the filter group creation unit 114 acquires the definition of each filter (filter definition 61) from the filter storage unit 103 (step A22). Then, the filter group creation unit 114 creates a filter group by extracting a filter associated with the selected keyword from the filter definition 61 (steps A23 to A26).

  In other words, the filter group creation unit 114 first determines, for one filter, whether or not this filter is related to the selected keyword (step A23). Specifically, in step A23, whether the filter definition matches the selected keyword or includes the selected keyword (ie, whether the keyword falls within the regular expression range). Is determined.

  If the result of determination in step A23 is that the filter is not related to the selected keyword, the filter group creation unit 114 executes step A25. On the other hand, if the result of determination in step A23 is that the filter is related to the selected keyword, the filter group creation unit 114 selects the filter to be determined as the filter group (first filter) of the selected keyword. Group) (step A24), and then step A25 is executed.

  In step A25, the filter group creation unit 114 determines whether there is still a filter that needs to be determined in step A23 (step A25). If the result of determination in step A25 is that a filter still exists, the filter group creation unit 114 executes step A23 again. On the other hand, if the result of determination in step A25 is that there is no filter, the filter group creation unit 114 executes step A27.

  In step A27, the filter group creation unit 114 causes the first filter group obtained in step A24 to belong to the category A, and further causes the group definition accumulation unit 108 to accumulate the first filter group definition 62. .

  Next, the filter group creation unit 114 determines whether or not a keyword that has not yet been selected exists in the template 53 (step A28). As a result of the determination in step A28, if there is a keyword that has not yet been selected, the filter group creation unit 114 shifts the keyword to be selected to a keyword that has not yet been selected (step A29), and again. Step A23 is executed.

  On the other hand, as a result of the determination in step A28, if there is no keyword that has not been selected yet, the filter group creation unit 114 collects filters that are not related to the keyword, and creates a second filter group using these. To do. Then, the filter group creation unit 114 causes the second filter group to belong to the classification B, and further accumulates the second filter group definition 63 in the group definition accumulation unit 108 (step A30). In the following description, the case of including both the definition of the first filter group and the definition of the second filter group may be expressed as “group definition”.

  Here, a specific example of steps A21 to A28 will be described with reference to FIG. As illustrated in FIG. 9, the filter group creation unit 114 uses the template 53 and the filter definition list 61 to belong to the category A (related to the keyword of each category) and the category B. And a filter group (not associated with one keyword). Each generated group definition is stored in the group definition storage unit 108.

  Also, as shown in FIG. 9, in the present embodiment, the keyword analysis unit 109 extracts keywords for each category from the metadata, and then further extracts each keyword for each category of metadata. Assign identifiers (1, 2, etc.).

  Then, the filter group creating unit 114 sets a group ID for the first filter group when setting the first filter group for each extracted keyword. The group ID is set by assigning the identifier of the corresponding keyword to the digit whose number of digits matches the number of categories and the category of the corresponding keyword is assigned.

That is, the group ID is set based on the following conditions 1 to 4.
[Condition 1]
The number of digits of the group ID matches the number of all categories of the template 61.
[Condition 2]
The category group IDs are assigned to the digits from the leftmost digit in order from category number 1. That is, “category number 1” is assigned to the largest digit, and “largest category number” is assigned to the first digit.
[Condition 3]
The corresponding keyword identifier (keyword number) is assigned to the digit to which the corresponding keyword category is assigned, but “0” is assigned to the digit not assigned.
[Condition 4]
If any digit of the group ID is not “0”, the filter group belongs to the classification A. On the other hand, when all digits of the group ID are “0”, the filter group belongs to the classification B.

  For example, when the number of all categories is 5, and the keyword number of the keyword with the category number “1” is 2, the group ID is “20000”. When the number of all categories is 5, and the keyword number of the keyword with the category number “5” is 1, the group ID is “00001”. When the filter to which the user belongs is related to both of the two keywords, the group ID is “20001”. If the number of all categories is five and the filter to which the category belongs is not related to any category keyword, the group ID of this filter group is “00000”.

  Next, the filter group creation unit 114 creates a first filter group composed of filters related to two or more keywords, using the first filter group previously created in steps A23 to A26 (steps). A31-A34).

  Specifically, as illustrated in FIG. 10, the filter group creation unit 114 includes any two or more first filter groups from among the first filter groups configured by filters associated with at least one keyword. Select. Then, a product set of these selected first filter groups is taken to create a new filter group (step A31). In the present embodiment, the intersection of the filter group belonging to class A and the group belonging to class B is not performed.

  Next, the filter group creation unit 114 determines whether or not the newly created filter group includes one or more filters related to two or more keywords (step A32). This is because the new filter group needs to be composed of filters related to two or more keywords.

  If the result of step A32 is that one or more filters are not included, the filter group creation unit 114 executes step A34. On the other hand, if one or more filters are included as a result of step A32, the filter group creation unit 114 causes the newly created filter group to belong to the classification A because the newly created filter group is also the first filter group. The definition is stored in the group definition storage unit 108 (step A33). Thereafter, the filter group creation unit 114 executes Step A34.

  In step A34, the filter group creation unit 114 determines whether or not the processing of steps A31 to A33 has been completed for all combinations of the first filter groups belonging to the classification A.

  If the result of determination in step A34 is that processing has been completed for all the first filter group combinations, processing in the filter group creation unit 114 ends. On the other hand, if the processing has not been completed for all the combinations of the first filter groups, the filter group creation unit 114 executes Step A31 again.

[Filtering process: Overall]
Next, the entire filtering process will be described with reference to FIGS. 11 and 12. FIG. 11 is a flowchart showing an operation at the time of filtering processing of the management apparatus according to the present embodiment. FIG. 12 is a block diagram supplementing the description of the filtering process. In FIG. 12, only the portion operating during the filtering process is shown by a solid line.

  11 and 12, first, the message receiving unit 101 receives a message from the agent 200, and inputs the received message (hereinafter referred to as “received message”) to the filter group distributing unit 115 ( Step B1). Thereby, the filter group distribution unit 115 determines whether or not the keyword is stored in the keyword storage unit 109 by the keyword analysis unit 113 (step B2).

  As a result of the determination in step B2, if keywords are stored in the keyword storage unit 109 by the keyword analysis unit 113, the filter group distribution unit 115 selects a filter group to be applied, and the filter group application unit 116 selects The applied filter group is applied (step B3).

  On the other hand, if the keyword is not accumulated in the keyword accumulation unit 109 by the keyword analysis unit 113 as a result of the determination in step B2, the selection of the default filter group by the filter group distribution unit 115 and the filter group application unit 116 The default filter group is applied (step B4).

[Filtering processing: When keywords are not accumulated]
Next, step B4 shown in FIG. 11 will be described more specifically with reference to FIG. FIG. 13 is a flowchart more specifically showing the filtering process in step B4 shown in FIG.

  As illustrated in FIG. 13, if the filter group distribution unit 115 determines in step B2 that no keyword is stored in the keyword storage unit 109, the filter group distribution unit 115 determines to cause the filter group application unit to perform filter application using a default group. (Step B41). The default group is a group including all filters. Further, the group distribution unit 115 delivers the received message to the filter group application unit 116 together with a notification that the default group is used.

  Next, the filter group application unit 116 accesses the group definition storage unit 108 and acquires the group definition 64 stored therein (step B42). The group definition 64 includes a first filter group definition 62 and a second filter group definition 63 (see FIG. 8).

  Next, the filter group application unit 116 determines whether the group definition 64 includes a default group definition (step B43). If the result of determination in step B43 is that a default group definition exists, the filter group application unit 116 executes step B46.

  On the other hand, if the result of determination in step B43 is that there is no default group definition, the filter group application unit 116 sets the priority of each filter definition (filter definition 61) from the filter storage unit 103. Called in the order of degrees, a default group is created (step B44). Next, the filter group application unit 116 stores the created default group definition in the group definition storage unit 108 (step B45), and then executes step B46.

  In step B46, the filter group application unit 116 performs a selection process using a filter included in the default group on the received message, and selects a received message corresponding to the monitoring target message (steps B46 to B49).

  Specifically, the filter group application unit 116 first selects one filter included in the default group in descending order of priority (step B46), and determines whether or not the received message matches the selected filter. (Step B47).

  As a result of the determination in step B47, if it matches, the filter group application unit 116 executes step B50. On the other hand, if the result of determination in step B47 is not appropriate, the filter group application unit 116 determines whether there is another filter to be applied next (step B48).

  If the result of determination in step B48 is that there is no other filter, the filter group application unit 116 executes step B50. On the other hand, as a result of the determination in step B48, if another filter exists, the filter group application unit 116 selects another filter (step B49), applies this, and executes step B47 again.

  In step B50, the filter group application unit 116 stores the log of the selected message in the message log storage unit 104, and further stores the metadata of the selected message in the metadata storage unit 105. At this time, the metadata is stored in the metadata storage unit 105 by category.

[Filtering processing: When keywords are accumulated]
Next, step B3 shown in FIG. 11 will be described more specifically with reference to FIG. FIG. 14 is a flowchart more specifically showing the filtering process in step B3 shown in FIG.

  As shown in FIG. 14, first, the filter group sorting unit 115 determines that the keyword is stored in the keyword storage unit 109 in step B2. Then, the filter group distribution unit 115 selects one category in the order of the category number from the template 53 stored in the keyword storage unit 109, and further selects one arbitrary keyword included therein (step B21). .

  Next, the filter group distribution unit 115 determines whether or not the keyword selected in step B21 matches the metadata of the received message in the same category (step B22).

  If they match as a result of the determination in step B22, the filter group distribution unit 115 sets the category prepared in step B21 to the ID prepared for calling the filter group (each digit is set to “0” in the initial state). The identifier of the keyword selected in step B21 is assigned to the corresponding digit (step B23). Thereafter, the filter group distribution unit 115 executes Step B24.

  On the other hand, if they do not match as a result of the determination in step B22, the filter group distribution unit 115 assigns “0” to the digit corresponding to the category selected in step B21 of the ID prepared for calling the filter group ( Step B23).

  Then, the filter group distribution unit 115 determines whether another category to be determined is included in the category selected in step B21 (step B26), and if included, selects the keyword. (Step B28), Step B22 is executed again. On the other hand, if not included, the filter group distribution unit 115 executes Step B24.

  In step B24, the filter group distribution unit 115 determines whether the keyword to be determined is included in a category different from the category selected in step B21. As a result of the determination in step B24, if the keyword to be determined is included in another category, the filter group distribution unit 115 selects a keyword in another category (step B27), and executes step B22 again. .

  On the other hand, as a result of the determination in step B24, if the keyword to be determined is not included in another category, the filter group distribution unit 115 finally determines the ID prepared for calling the filter group with the current value. (Step B29). The filter group distribution unit 115 inputs the ID value to the filter group application unit 116.

  Next, the filter group application unit 116 acquires from the group definition storage unit 108 the definition of the filter group in which the determined ID matches the group ID (step B30), and based on the acquired definition, the filter storage unit 103 The necessary filter is acquired from (Step B31).

  Next, the filter group application unit 116 extracts one filter from the acquired filters in order of priority, and determines whether the received message matches the extracted filter (step B32).

  As a result of the determination in step B32, if the result matches, the filter group application unit 116 ends the process. On the other hand, if the result of determination in step B32 shows that they do not match, the filter group application unit 116 determines whether there is another filter to be applied next (step B33).

  As a result of the determination in step B33, if another filter does not exist, the filter group application unit 116 also ends the process in this case. On the other hand, as a result of the determination in step B33, if another filter exists, the filter group application unit 116 selects another filter (step B34), applies this, and executes step B32 again. In the present embodiment, since the template 53 and the group ID are consistent, there is no filter group definition that does not correspond to the group ID.

  As described above, when Steps B21 to B34 or Steps B41 to B50 described above are executed, received messages are selected. In the monitoring apparatus 300, the message confirmation unit 301 can notify the administrator of the selected message via the console. In the present embodiment, when the execution of the command 202 (see FIG. 1) is linked to the definition of the filter that matches the message, the action execution unit 110 sends the command 202 to the execution target agent 200. Is instructed to execute.

[Maintenance processing]
Next, the entire maintenance process will be described with reference to FIGS. 15 and 16. FIG. 15 is a flowchart showing an operation during maintenance processing of the management apparatus according to the present embodiment. FIG. 16 is a block diagram supplementing the description of the maintenance process. In FIG. 16, only the portion that is operating during the maintenance process is shown by a solid line.

  In the present embodiment, as shown in FIG. 7, the appearance frequency of the keyword is calculated for each category. Therefore, there is no guarantee that the use frequency of a filter group configured by combining filters related to such keywords will increase. Therefore, it is preferable to delete the filter groups that are not called at all or that are called extremely low by summing up the frequency called for each generated filter group after operating for a certain period. The group maintenance unit 112 periodically performs a maintenance process according to an instruction from the schedule unit 107 and deletes such a filter group.

  As shown in FIG. 15, first, the group maintenance unit 112 receives a call count 65 for each group during a certain period and a threshold value for the number of calls for which the filter group is to be deleted (deletion threshold) from the group definition accumulation unit 108. ) 66 (Step C1). The filter group application unit 116 counts the number of times each time the filter group is called, and writes the value in the group definition storage unit 108. The written value is the number of calls 65. The deletion threshold 66 is set in advance.

  Next, the group maintenance unit 112 compares the acquired number of calls for each filter group with the deletion threshold value, and determines whether there is a filter group whose number of calls is lower than the threshold value (step C2).

  As a result of the determination in step C2, when there is no filter group in which the number of calls is less than the threshold, the group maintenance unit 112 ends the process. On the other hand, as a result of the determination in step C2, if there is a filter group whose number of calls is less than the threshold value, the group maintenance unit 112 determines whether the filter group is the lowermost filter group (step C3).

  Here, the lowermost filter group refers to a filter group including a filter having one related keyword. For example, “Group 100”, “Group 200”, “Group 010”, “Group 001”, and “Group 002” shown in FIG. 10 correspond to the lowermost filter group.

  If the result of determination in step C3 is that the filter group whose number of calls is less than the threshold is not the lowermost filter group, the group maintenance unit 112 executes step C4. On the other hand, as a result of the determination in step C3, when the filter group whose number of calls is less than the threshold is the lowermost filter group, the group maintenance unit 112 executes step C9.

  In step C4, the group maintenance unit 112 sets a filter whose number of calls does not fall below the threshold in the lower layer of the filter group corresponding to step C2 (a set of filter groups including a filter with one less relevant keyword). Determine if the group exists.

  If the result of determination in step C4 is that there is a filter group whose number of calls does not fall below the threshold value in the lower layer, the group maintenance unit 112 identifies the filter group with the highest number of calls from the corresponding filter group (step C5).

  Further, when step C5 is executed, the group maintenance unit 112 deletes the definition from the group definition accumulation unit 108 for the filter group that is determined in step C2 that the number of calls is less than the threshold value.

  Then, the group maintenance unit 112 maps to the group definition storage unit 108 so that when the filter group application unit 116 calls the deleted filter group, the lower layer filter group specified in step C6 is called. Is set (step C6). After execution of Step C6, the process in the group maintenance unit 112 ends.

  On the other hand, if the result of determination in step C4 is that there is no filter group whose number of calls does not fall below the threshold value in the lower layer, the group maintenance unit 112 calls the lower layer of the layer that was determined in step C4. It is determined whether there is a filter group whose number of times does not fall below the threshold (step C7).

  If the result of determination in step C7 is that there is a filter group in the lower layer whose number of calls does not fall below the threshold value, the group maintenance unit 112 executes step C4 again for this filter group.

  On the other hand, as a result of the determination in step C7, if there is no filter group in which the number of calls does not fall below the threshold value in this lower layer, the group maintenance unit 112 determines that the number of calls in step C2 is less than the threshold value. The definition is deleted from the group definition storage unit 108.

  Then, the group maintenance unit 112 sets the mapping in the group definition accumulation unit 108 so that the second filter group of classification B is called when the filter group application unit 116 calls the deleted filter group. (Step C8). After the execution of step C8, the process in the group maintenance unit 112 ends.

  In Step C9, the group maintenance unit 112 merges the filters included in the filter group determined in Step C2 that the number of calls is less than the threshold value into the second filter group of classification B. Then, the group maintenance unit 112 stores the group definition so that the filter group of the category B is called when the filter group application unit 116 calls the filter group whose number of calls is determined to be lower than the threshold value in step C2. Mapping is set in the unit 108. After execution of Step C9, the process in the group maintenance unit 112 ends.

  Below, a specific example is demonstrated based on FIG. For example, in the example shown in FIG. 10, it is assumed that the filter group “group 111” is to be deleted. In this case, the use frequency is determined for the lower-layer filter groups (group 100, group 101, group 011) that are targeted when creating the intersection set. Of these, assuming that the number of times the filter group of the group 101 is called is the highest, when the filter group applying unit 116 calls the group 111, mapping is performed so that the group 101 is called instead of the group 111. Is called.

  Further, for example, in the example shown in FIG. 9, it is assumed that the filter group “group 200” is to be deleted. In this case, since the group 200 is the lowest layer filter group, the filters included in the filter group are merged with the filter group of the group 000 belonging to the classification B. Then, when the filter group application unit 116 calls the group 200, mapping is performed so that the group 000 is called instead of the group 200.

  As described above, according to the present embodiment, an appropriate filter group can be constructed, and an optimum filter group can be selected from the constructed filter groups. Therefore, useless filter query processing can be reduced, and message processing can be performed. Efficiency can be improved.

[Modification]
Moreover, in this Embodiment, it can also be set as the modification described below. This will be specifically described below.

  In this embodiment, the metadata storage unit 105 and the filter storage unit 103 have a configuration capable of outputting data to the outside, and the group processing unit 106 is configured in another external device (computer). You can also. In this case, since the management apparatus 100 is constructed by a plurality of computers, it is possible to reduce the load on the manager when creating the filter group.

  In addition, the present embodiment can be configured such that the group definition storage unit 108 has a configuration capable of outputting data to the outside, and the group maintenance unit 112 is constructed in another external device (computer). In this case, it is possible to reduce the load on the manager during the maintenance of the filter group.

  Furthermore, in the present embodiment, the appearance frequency is calculated for the accumulated metadata in step A12 shown in FIG. 6, but the present invention is not limited to this. For example, the keyword analysis unit 113 may collect similar metadata based on regular expressions, integrate the appearance frequencies of similar metadata, and compare the integrated appearance frequency with a threshold value. In this case, regular expressions can be used as keywords, so that the range of filter groups can be widened.

For example, it is assumed that the threshold of the appearance frequency of the keyword is 30% or more and the appearance frequency of the stored metadata with the category “host name” is as follows.
・ "HostABC" appearance frequency 20%
・ "HostBBC" 8% appearance frequency
・ "HostCBC" appearance frequency 5%
・ Other frequency of occurrence 70%

  In the above case, if “host? BC” is represented by a regular expression, the appearance frequency will satisfy 30% or more, so “host? BC” is set as the keyword 1 of the category “host name”.

  Further, in the present embodiment, in step A13 shown in FIG. 6, the appearance frequency of the same metadata in each category is compared with the threshold value. However, the present invention is not limited to this, and instead of the appearance frequency, The number of appearances can be used. In this case, the threshold of the number of appearances is used as the threshold.

  Further, in the present embodiment, the number of calls is compared with the threshold value in step C2 shown in FIG. 15, but the present invention is not limited to this, and instead of the number of calls, 1 for all filter groups of the same classification is used. The call ratio of two filter groups can be used. In this case, the threshold of the call ratio is used as the threshold.

  In the present embodiment, filter groups that are below the threshold are deleted in Step C6, Step C8, and Step C9 shown in FIG. As a result, when there is a keyword that is not related to any filter in all the filter groups in the template 53, the keyword may be deleted from the template 53. good. Furthermore, when all keywords belonging to the category of the keyword are deleted due to the deletion of the keyword, the category may be deleted from the template 53. If it is set as the above aspect, matching with the filter group which does not exist and the data of a template will be aimed at, and the processing man-hour of step B21-B26 shown in FIG. 14 will be reduced.

  For example, “keyword 1” and “keyword 2” belong to “category 1” of the template, “keyword 1” belongs to “category 2”, and “keyword 1” belongs to “category 3”. . It is assumed that there is no filter group including “2” in the group ID (three digits) in the filter group generated using the template data. In this case, keyword 2 is deleted from the template.

  The program according to the embodiment of the present invention is stored in the computer in steps A1 and A2 shown in FIG. 3, steps A11 to A19 shown in FIG. 5, steps A21 to A34 shown in FIG. 8, steps B1 to B4 shown in FIG. The program may be any program that executes steps B41 to B50 shown in FIG. 13, steps B21 to B34 shown in FIG. 14, and steps C1 to C9 shown in FIG.

  The management apparatus 100 and the management method according to the present embodiment can be realized by installing and executing this program on a computer. In this case, the CPU (Central Processing Unit) of the computer functions as the message receiving unit 101, the filter processing unit 102, the group processing unit 106, the schedule unit 107, the action execution unit 110, the filter update unit 111, and the group maintenance unit 112. Perform processing.

  A storage device such as a hard disk provided in the computer functions as the filter storage unit 103, the message log storage unit 104, the metadata storage unit 105, the group definition storage unit 108, and the keyword storage unit 109.

  Here, a computer 120 that realizes the management apparatus 100 by executing the program according to the embodiment will be described with reference to FIG. FIG. 17 is a block diagram illustrating an example of a computer that implements the management device according to the embodiment of the present invention.

  As shown in FIG. 17, the computer 120 includes a CPU 121, a main memory 122, a storage device 123, an input interface 124, a display controller 125, a data reader / writer 126, and a communication interface 127. These units are connected to each other via a bus 131 so that data communication is possible.

  The CPU 121 performs various operations by expanding the program (code) in the present embodiment stored in the storage device 113 in the main memory 122 and executing them in a predetermined order. The main memory 122 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). Further, the program in the present embodiment is provided in a state of being stored in a computer-readable recording medium 130. Note that the program in the present embodiment may be distributed on the Internet connected via the communication interface 127.

  Specific examples of the storage device 123 include a semiconductor storage device such as a flash memory in addition to a hard disk. The input interface 114 mediates data transmission between the CPU 121 and the input device 128 such as a keyboard and a mouse. The display controller 125 is connected to the display device 129 and controls display on the display device 129. The data reader / writer 126 mediates data transmission between the CPU 121 and the recording medium 130, and reads a program from the recording medium 130 and writes a processing result in the computer 120 to the recording medium 130. The communication interface 127 mediates data transmission between the CPU 121 and another computer.

  Specific examples of the recording medium 130 include general-purpose semiconductor storage devices such as CF (Compact Flash) and SD (Secure Digital), magnetic storage media such as a flexible disk, or CD-ROM (Compact Disk). Optical storage media such as Read Only Memory).

  Part or all of the above-described embodiments can be expressed by (Appendix 1) to (Appendix 21) described below, but is not limited to the following description.

(Appendix 1)
A management device that manages the device based on a message received from a device to be managed,
A keyword analysis unit that extracts, as keywords, metadata that has an appearance frequency equal to or greater than a set threshold value from the metadata of a message that has already been received;
Dividing a filter group for selecting messages based on setting conditions into a first filter related to the extracted keyword and a second filter other than the first filter;
Then, for each of the extracted keywords, create a first filter group to which the first filter related to the keyword belongs,
A filter group creating unit for creating a second filter group to which the second filter belongs;
When a message is received from the device, it is determined whether the metadata of the received message matches the extracted keyword, and one of the first filter group and the second filter is determined based on the determination result. A filter group distribution unit that selects a filter group to be applied to the received message from the group;
A filter group applying unit that applies the selected filter group to the received message;
A management apparatus comprising:

(Appendix 2)
The filter group distribution unit selects a first filter group to which a first filter related to the matched keyword belongs when metadata of the received message matches the extracted keyword.
The management apparatus according to attachment 1.

(Appendix 3)
The keyword analysis unit extracts keywords from the metadata for each category of the metadata, and then assigns an identifier to each extracted keyword for each category of the metadata,
When the filter group creation unit sets the first filter group for each of the extracted keywords, the number of digits matches the number of categories in the first filter group, and the keyword Set a group ID in which the identifier of the keyword is assigned to the digit corresponding to the category of
When the metadata of the received message matches the extracted keyword, the filter group distribution unit specifies the corresponding group ID from the identifier of the matched keyword and its category. The management device according to attachment 2, wherein the first filter group in which the group ID is set is selected.

(Appendix 4)
After the filter group creation unit creates the first filter group, the first filter configured by the first filter related to two or more keywords using the two or more first filter groups The management device according to any one of appendices 1 to 3, further creating a group.

(Appendix 5)
A metadata storage unit for storing metadata of messages selected by the application of the filter group by the filter group application unit;
The management device according to any one of appendices 1 to 4, wherein the keyword analysis unit extracts keywords for metadata stored in the metadata storage unit.

(Appendix 6)
It aggregates the applied frequency of each of the full I filter group, if the filter group aggregated frequency does not satisfy the set reference value is present, deletes the filter group, the group maintenance unit further comprises The management apparatus according to any one of appendices 1 to 5.

(Appendix 7)
The filter group application unit applies the filters in descending order of priority when priority is set for each filter belonging to the selected filter group. Management device.

(Appendix 8)
A method for managing the device based on a message received from a device to be managed,
(A) extracting, as a keyword, metadata having an appearance frequency equal to or higher than a set threshold value from metadata of a message that has already been received;
(B) A filter group for selecting messages based on setting conditions is divided into a first filter related to the extracted keyword and a second filter other than the first filter;
Then, for each of the extracted keywords, create a first filter group to which the first filter related to the keyword belongs,
Creating a second filter group to which the second filter belongs; and
(C) When a message is received from the device, it is determined whether metadata of the received message matches the extracted keyword, and based on the determination result, any one of the first filter group and the first filter group is determined. Selecting a filter group to be applied to the received message from among the two filter groups;
(D) applying the selected filter group to the received message;
The management method characterized by having.

(Appendix 9)
In the step (c), when the metadata of the received message matches the extracted keyword, the first filter group to which the first filter related to the matched keyword belongs is selected. ,
The management method according to attachment 8.

(Appendix 10)
In the step (a), keywords are extracted from the metadata for each category of the metadata, and then an identifier is assigned to each extracted keyword for each category of the metadata.
In the step (b), when setting the first filter group for each of the extracted keywords, the number of digits in the first filter group matches the number of categories, and Set the group ID in which the identifier of the keyword is assigned to the digit corresponding to the keyword category,
In the step (c), when the metadata of the received message matches the extracted keyword, the corresponding group ID is specified from the identifier of the matched keyword and its category. The management method according to appendix 9, wherein the first filter group in which the group ID is set is selected.

(Appendix 11)
In the step (b), after creating the first filter group, the first filter group is composed of first filters related to two or more keywords using two or more first filter groups. The management method according to any one of appendices 8 to 10, further creating a filter group.

(Appendix 12)
(E) further comprising the step of storing metadata of messages selected by applying the filter group;
The management method according to any one of appendices 8 to 11, wherein in the step (a), keywords are extracted from the metadata accumulated in the step (e).

(Appendix 13)
(F) counts the applied frequency of each of the full I filter group, if the filter group exists that aggregated frequency does not satisfy the set reference value, it deletes the filter group, the step further The management method according to any one of appendices 8 to 12, which has

(Appendix 14)
In the step (d), when priority is set for each filter belonging to the selected filter group, the filters are applied in descending order of priority. Management method.

(Appendix 15)
A program for managing the device based on a message received from a device to be managed by a computer,
In the computer,
(A) extracting, as a keyword, metadata having an appearance frequency equal to or higher than a set threshold value from metadata of a message that has already been received;
(B) A filter group for selecting messages based on setting conditions is divided into a first filter related to the extracted keyword and a second filter other than the first filter;
Then, for each of the extracted keywords, create a first filter group to which the first filter related to the keyword belongs,
Creating a second filter group to which the second filter belongs; and
(C) When a message is received from the device, it is determined whether metadata of the received message matches the extracted keyword, and based on the determination result, any one of the first filter group and the first filter group is determined. Selecting a filter group to be applied to the received message from among the two filter groups;
(D) applying the selected filter group to the received message;
A program that executes

(Appendix 16)
In the step (c), when the metadata of the received message matches the extracted keyword, the first filter group to which the first filter related to the matched keyword belongs is selected. ,
The program according to appendix 8.

(Appendix 17)
In the step (a), keywords are extracted from the metadata for each category of the metadata, and then an identifier is assigned to each extracted keyword for each category of the metadata.
In the step (b), when setting the first filter group for each of the extracted keywords, the number of digits in the first filter group matches the number of categories, and Set the group ID in which the identifier of the keyword is assigned to the digit corresponding to the keyword category,
In the step (c), when the metadata of the received message matches the extracted keyword, the corresponding group ID is specified from the identifier of the matched keyword and its category. The program according to appendix 9, wherein the first filter group for which the group ID is set is selected.

(Appendix 18)
In the step (b), after creating the first filter group, the first filter group is composed of first filters related to two or more keywords using two or more first filter groups. The program according to any one of appendices 8 to 10, further creating a filter group.

(Appendix 19)
(E) causing the computer to further execute a step of storing metadata of messages selected by applying the filter group;
The program according to any one of appendices 8 to 11, wherein in the step (a), keywords are extracted from the metadata accumulated in the step (e).

(Appendix 20)
(F) counts the applied frequency of each of the full I filter group, if the filter group exists that aggregated frequency does not satisfy the set reference value, it deletes the filter group, the step further The program according to any one of appendices 8 to 12, which is executed by the computer.

(Appendix 21)
In the step (d), when priority is set for each filter belonging to the selected filter group, the filters are applied in descending order of priority. Program.

  According to the present invention, it is possible to reduce the number of man-hours for filter processing without changing the setting of the filter priority. Therefore, the present invention is useful in a field where a server needs to be operated and managed by a manager-agent configuration such as a data center and a large amount of messages need to be processed.

51 Metadata 52 Threshold Data 53 Template 61 Filter Definition 62 First Filter Group Definition 63 Second Filter Group Definition 64 Group Definition 65 Number of Calls 66 Deletion Threshold 100 Management Device 101 Message Receiving Unit 102 Filter Processing Unit 103 Filter Accumulation Unit 104 message log storage unit 105 metadata storage unit 106 group processing unit 106
107 Schedule Unit 108 Group Definition Storage Unit 109 Keyword Storage Unit 110 Action Execution Unit 111 Filter Update Unit 112 Group Maintenance Unit 120 Computer 121 CPU
122 main memory 123 storage device 124 input interface 125 display controller 126 data reader / writer 127 communication interface 128 input device 129 display device 130 recording medium 131 bus 140 management system 200 agent 201 message log file storage unit 202 command 210 device to be managed 300 Monitoring Device 301 Message Confirmation Unit 302 Filter Setting Unit 400 Network

Claims (9)

A management device that manages the device based on a message received from a device to be managed,
A keyword analysis unit that extracts, as keywords, metadata that has an appearance frequency equal to or greater than a set threshold value from the metadata of a message that has already been received;
Dividing a filter group for selecting messages based on setting conditions into a first filter related to the extracted keyword and a second filter other than the first filter;
Then, for each of the extracted keywords, create a first filter group to which the first filter related to the keyword belongs,
A filter group creating unit for creating a second filter group to which the second filter belongs;
When a message is received from the device, it is determined whether the metadata of the received message matches the extracted keyword, and one of the first filter group and the second filter is determined based on the determination result. A filter group distribution unit that selects a filter group to be applied to the received message from the group;
A filter group applying unit that applies the selected filter group to the received message;
A management apparatus comprising: The filter group distribution unit selects a first filter group to which a first filter related to the matched keyword belongs when metadata of the received message matches the extracted keyword.
The management apparatus according to claim 1. The keyword analysis unit extracts keywords from the metadata for each category of the metadata, and then assigns an identifier to each extracted keyword for each category of the metadata,
When the filter group creation unit sets the first filter group for each of the extracted keywords, the number of digits matches the number of categories in the first filter group, and the keyword Set a group ID in which the identifier of the keyword is assigned to the digit corresponding to the category of
When the metadata of the received message matches the extracted keyword, the filter group distribution unit specifies the corresponding group ID from the identifier of the matched keyword and its category. The management device according to claim 2, wherein the first filter group in which the group ID is set is selected.   After the filter group creation unit creates the first filter group, the first filter configured by the first filter related to two or more keywords using the two or more first filter groups The management device according to claim 1, further creating a group. A metadata storage unit for storing metadata of messages selected by the application of the filter group by the filter group application unit;
The management device according to claim 1, wherein the keyword analysis unit extracts keywords for metadata stored in the metadata storage unit. It aggregates the applied frequency of each of the full I filter group, if the filter group aggregated frequency does not satisfy the set reference value is present, deletes the filter group, the group maintenance unit further comprises The management apparatus according to any one of claims 1 to 5.   The said filter group application part applies each said filter in order with a high priority, when the priority is set to each filter which belongs to the selected filter group. Management device. A method for managing the device based on a message received from a device to be managed,
(A) extracting, as a keyword, metadata whose appearance frequency is equal to or higher than a set threshold from the metadata of a message that has already been received by the computer ;
(B) A filter group for selecting messages based on setting conditions by the computer is divided into a first filter related to the extracted keyword and a second filter other than the first filter;
Then, for each of the extracted keywords, create a first filter group to which the first filter related to the keyword belongs,
Creating a second filter group to which the second filter belongs; and
(C) When a message is received from the device by the computer, it is determined whether the metadata of the received message matches the extracted keyword, and one of the first filters is determined based on the determination result. Selecting a filter group to apply to the received message from a group and the second filter group;
(D) applying the selected filter group to the received message;
The management method characterized by having. A program for managing the device based on a message received from a device to be managed by a computer,
In the computer,
(A) extracting, as a keyword, metadata having an appearance frequency equal to or higher than a set threshold value from metadata of a message that has already been received;
(B) A filter group for selecting messages based on setting conditions is divided into a first filter related to the extracted keyword and a second filter other than the first filter;
Then, for each of the extracted keywords, create a first filter group to which the first filter related to the keyword belongs,
Creating a second filter group to which the second filter belongs; and
(C) When a message is received from the device, it is determined whether metadata of the received message matches the extracted keyword, and based on the determination result, any one of the first filter group and the first filter group is determined. Selecting a filter group to be applied to the received message from among the two filter groups;
(D) applying the selected filter group to the received message;
A program that executes

Images