JPH09325903A - Fault recording system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To record the fault of a computer system so as to be easily analyzed. SOLUTION: Fault information required for analyzing the fault of the computer system is collected by an input/output collecting means 1, time sequential information collecting means 2, system load collecting means 3, system abnormality monitoring means 4, APP state information collecting means and user definition information collecting means 6. On the other hand, the kinds or the like of information to be collected/monitored are registered by a collected information registering means 7. Based on these registered contents, a fault information recording means 8 collects the information of respective collecting/monitoring means 1-6 and records it in one recording area 9 on a main memory. When any fault occurs, a main memory image damp file 11 is generated by compressing the image in the main storage device, and the information recorded while being compressed is extracted by a recording area reading means 13 and displayed on a main memory image display means 12.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a fault recording system for recording information for analyzing a fault occurring in a computer system.

[0002]

2. Description of the Related Art FIG. 18 is a block diagram of a conventional fault recording system of this type. In FIG. 18, the input / output device information collecting means 101 is incorporated in the input / output device driver and collects information such as the number of accesses, the access size, and the number of errors, and the recording area (1) 91 in the input / output device driver. I am writing to.

The time-series information collecting means 102 is incorporated in the OS and collects attribute information of a process executed when a part of the OS is executed, and a recording area (2) 9 in the OS is collected.
I am writing in 2 in chronological order.

The system load collecting means 103 is built in the OS and collects the system load information when an event in the OS such as a context switch or a call to a system call occurs, and a recording area (3) in the OS. 93
Is written in.

The system abnormality monitoring means 104 constantly monitors an abnormality on the computer system such as abnormal termination of a process or an abnormality of a specific recording file size. If an abnormal event occurs, the recording area is recorded. (4) I wrote it in 94.

The APP (application program) information collecting means 105 is incorporated in each application program, collects the trace information of the operation event of the program, and writes it in the recording area (5) 95. .

The fault information written in the recording areas 91 to 95 on the main memory is the main memory image compression dump means 1
Main memory image dump file 11 compressed by 0
Is stored in In order to display the failure information stored in the main memory image dump file 11, the main memory image decompressing means 14 is used to restore the main memory image before compression.

Thereafter, the input / output device information display means 15, the time-series information display means 16, the system load display means 17, the system abnormality display means 18, and the APP information display means 19 prepared for each collecting / monitoring means are used. Recording area 9
The failure information recorded in 1 to 95 is displayed.

[0009]

[Problems to be Solved by the Invention]

(1) Since the conventional failure information recording method is configured as described above, when adding or changing failure information to be collected, new collecting means and display means are created, OS or existing There was a problem that the collection means and the display means had to be modified, which was not easy.

This problem is because there is no fault information data collected in one place on the main memory, so a necessary data is searched for by tracing a large number of OS data structures which are complicatedly connected by a plurality of pointers on the main memory. It was necessary to perform complicated calculation processing such as counting the number of links by tracing pointers.

Further, since the information of such a data structure is immediately lost, it has been impossible to know the change of the data structure in the course of execution until now. Furthermore, the OS
Since the internal data structure depends on the OS version, it was necessary to modify the display program every time the OS was changed.

(2) Also, as the scale of the computer system increases and the capacity of the main memory provided also increases, the size of the main memory image dump file 11 taken when a failure occurs also increases, and is necessary for analysis. There is a problem that the disk capacity increases.

(3) Also, each collecting means and monitoring means 10
Nos. 1 to 105 each have a recording area 91 on the main storage device.
~ 95 is secured and information is recorded, and each recording method must be understood when the main memory image is displayed after a failure occurs, which makes the work complicated and takes time. there were.

(4) Generally, when the computer system has a different method, the method of recording the failure information in the main storage device is different. Therefore, a main memory image display means is required for each method, and the computer of the different method is used. It was difficult to analyze a failure in a large-scale system that combines systems.

The present invention has been made to solve the above problems, and provides a failure recording method for preventing an increase in disk capacity and unifying the failure information recording method in the main storage device. Another object of the present invention is to provide a failure recording method that unifies the failure information recording method in the main memory even when different computer systems are combined.

[0016]

Means for Solving the Problems (1) A failure recording method according to the present invention is a failure recording method for recording failure information necessary for failure analysis of a computer system having a main storage device and an input / output device. Information collecting means for collecting information related to failure analysis, collected information registering means for registering the type of information to be collected in advance, and information for the information collecting means according to the registered contents of the collected information registering means However, it is a system provided with failure information recording means for recording in a recording area on the main storage device.

(2) Further, in a fault recording system for recording fault information necessary for fault analysis of a computer system having a main memory device and an input / output device, a means for collecting input / output information representing an operating state of the input / output device. A means for collecting time-series information indicating the operation history of the computer system, a means for collecting system load indicating the load on the computer system, a system abnormality monitoring means for reporting an abnormal event occurring on the computer system, the computer system A means for collecting application program status information indicating the status of business processing executed above, a user-defined information collecting means for collecting failure information defined by the user, and a collected information registration means for registering the type of information to be collected in advance And collecting information of the various information collecting means and abnormality monitoring means according to the registered contents of the collected information registration means, Is a method in which a fault information recording means for recording the recording area on Kinushi storage device.

(3) Further, in the fault recording system for recording fault information necessary for fault analysis of a computer system having a main memory unit and an input / output unit, when the computer systems of different systems are used, each computer described above is used. The system collects information related to various failure analyzes, collected information registration means for registering the type of information to be collected in advance, and the above information collection according to the registered contents of the collected information registration means. And a failure information recording means for collecting information of the means and recording it in the recording area on the main storage device.

(4) Further, in the fault recording system according to any one of (1) to (3) above, the fault information recording means is:
This is a method of collectively recording failure recording information in the main storage device in one recording area of the main storage device.

(5) In the fault recording method according to any one of (1) to (4), the fault information recorded in the main storage device is divided into a predetermined size and compressed to form a dump file. A compression dump unit for storing and a reading unit for extracting the failure information divided and stored in a divided manner while extracting the desired failure information in divided units based on the address information divided and stored, and for extracting the failure information on the main storage device. It is a prepared method.

(6) Further, in the fault recording method according to any one of (1) to (4) above, the fault information recorded in the temporary storage means, the display means, and the main storage device is made into a predetermined size. Compressed dump means for dividing and compressing and storing as a dump file, and desired failure information is taken out in a divided unit on the basis of address information corresponding to the separately stored failure information, and decompressed by the temporary storage means. When displaying on the display means, the failure information stored in the temporary storage means is displayed on the display means, and when the same failure information is displayed next time, the temporary information is stored on the temporary storage means. This is a method of displaying using the failure information stored in the storage means.

(7) Further, in the fault recording method of (5) or (6), the compression dump means is a method in which a means for selecting a compression method according to the type of data to be compressed is added.

[0023]

BEST MODE FOR CARRYING OUT THE INVENTION

Embodiment 1. Hereinafter, an embodiment of the present invention will be described. FIG. 1 is a block diagram showing a fault recording method according to an embodiment of the present invention. FIG. 2 is a diagram showing an internal structure of the fault information collecting means 8. 3 to 7 are diagrams showing the data structure of each collecting means and monitoring means. FIG. 8 is a collection information registration table showing an example of the contents of the collection information registration means 7. FIG. 9 is a diagram showing the structure of a recording area on the main memory. 10 to 13 are flowcharts showing the flow of processing of the fault information recording means 8.

The operation of this embodiment will be described with reference to FIG. The input / output device information collecting means 1 is incorporated in, for example, an input / output device driver, and whenever an access to the input / output device occurs, the number of accesses and the access size,
Information such as the number of errors is collected and written in the data area in the I / O device driver. An example of the data structure of this input / output device information is shown in FIG.

The time-series information collecting means 2 is incorporated in, for example, the OS, collects attribute information of the processing executed when a part of the OS is executed, and writes it in a data area in the OS in time series. There is. An example of the data structure of this time series information is shown in FIG. In the data number in Figure 4, "syscal
“L-0, sysend-0, ...” denotes system call invocation data, system call end data, signal reception data, process switch data, and the like, and is composed of detailed data (not shown). When a certain amount of time series information is accumulated in the data area, the time series information collecting means 2 sends a signal to the failure information recording means 8 to copy the time series information in the data area.

The system load collecting means 3 is incorporated in the OS, for example, and collects the system load information when an event in the OS such as a context switch or a call to a system call occurs and stores it in a data area in the OS. I am writing. An example of the data structure of this system load information is shown in FIG.

The system abnormality monitoring means 4 constantly monitors abnormalities on the computer system for abnormal termination of processes and abnormalities of a certain specific recording file size. If an abnormal event occurs, the failure information recording means 8 of the failure information recording means 8 will be described. The failure information recording means 8 calling unit is called to notify the failure information recording means 8 of the occurrence of an abnormal event. An example of the data structure of this system abnormality monitoring information is shown in FIG.

The APP information collecting means 5 is incorporated in each application program and collects, for example, trace information of operation events of the program. At the timing of collecting the trace information, the failure information recording means 8 calling unit of the failure information recording means 8 is called to notify the failure information recording means 8 of the occurrence of the event. An example of the data structure of this APP information is shown in FIG.

The collected information registration means 7 is, for example, a table as shown in FIG. 8, and holds the types of failure information and the collection / recording method that the failure information recording means 8 must record.

The recording area 9 is an area reserved in the main memory for recording the failure information collected by the failure information recording means 8. In the recording area 9, each information is divided and recorded as shown in FIG.

The fault information recording means 8 has the input / output device information collecting means 1, the time series information collecting means 2, the system load collecting means 3, as described in the collected information registering means 7.
The recording area 9 secured on the main memory by taking out the information collected by the system abnormality monitoring means 4 and the APP information collecting means 5
To record.

The internal structure of the fault information recording means 8 will be described with reference to FIG. The failure information recording means 8 is composed of four parts. The timer interrupt receiving unit 801 is a unit that receives a timer interrupt sent from the OS at regular intervals.

The OS signal receiving unit 802 copies the time series information collected in the data area of the OS by the time series information collecting means 2 to the recording area 9 when the time series information collecting means 2 is used.
It is the part that receives the signal sent from.

The fault information recording means calling unit 803 is a library function called to notify the fault information recording means 8 of the occurrence of an event when the system abnormality monitoring means 4 and the APP information collecting means 5 detect the event. is there. The fault information recording unit 804 is a part that reads the collected information registration unit 7, secures the recording area 9, and writes the fault information collected by each collecting / monitoring unit in the recording area 9.

Next, the operation of the fault information recording means 8 is shown in FIG.
~ It demonstrates using the flowchart of FIG. (1) As shown in FIG. 10, the failure information recording means 8 first reads the contents registered in the collection information registration means 7 (ST01), and (2) knows which information is to be collected and at what timing. It is set as information (ST02).

(3) Next, the recording area 9 is secured as a shared memory in the main memory (ST03). (4) After that, an event occurs and the computer system O
A signal from S is accepted or failure information recording means 8
Is called. Alternatively, it is in a standby state until a timer interrupt is generated (ST04).

A process of accumulating a certain amount of time-series information in the data area of the OS will be described with reference to the flowchart of FIG. (1) A signal is input from the time series information collecting means 2 (ST
11), (2) If the fault information recording means 8 has information sequence information data in the OS data area (ST12),

(3) Time series information is read from the data area in the OS (ST13), (4) It is written in the recording area 9 on the main memory (ST1).
4). (5) When all the information is processed in step ST12, “no data” is given and step ST04 in FIG.
It returns to and becomes a waiting state again.

Next, the processing when the timer interrupt occurs will be described with reference to the flowchart of FIG. (1) When a timer interrupt is generated (ST21), (2) The fault information recording means 8 confirms whether or not there is a process to be performed at that timing by the internal setting of collected information (ST22),

(3) If there is a process, that process is executed (ST23). (4) The execution result is written in the recording area 9 (ST24). (5) When all the processes are completed in step ST12, “no process” is set, and the process returns to step ST04 in FIG. 10 to enter the standby state again.

When the system abnormality monitor means 4 detects an abnormal event, and when the APP information collecting means 5 detects APP
Figure 1 shows the case where an action event is detected by the program
3 will be described.

(1) When an event occurs, the failure information recording means 8 calling unit 803 is called, and the failure information recording means 8 is notified of the occurrence of the event (ST31). (2) If there is data of abnormality information or data of trace information of an event of APP program operation (ST3
2),

(3) The fault information recording means 8 reads the event information from the location where the event has occurred according to the type of event (ST33), and (4) writes the information in the recording area 9 (ST34). (5) When writing (recording) of all data is completed in step ST32, "no data" is given, and the process returns to step ST04 in FIG. 10 to enter the standby state again.

Next, the contents of the collected information registration means 7 will be described with reference to FIG. As in the collection information registration table shown in FIG. 8, for example, a collection information classification 701, a type of data to be collected 702, a collection processing method content 703, and collection necessity information 704 are stored.

The classification of the collected information is carried out according to the above-mentioned trouble information collection /
Indicates by which of the monitoring means the information is collected. The type of data to be collected indicates the details of the information to be collected. The collection method indicates how to collect the information. Specify whether to collect or not depending on the necessity of collection.

In the table of FIG. 8, like the information in the first line, the classification is "time series information", the type is "read system call", the collection method is "OS signal", and the event collection necessity is ""Required" means "collect the history of read system calls as time series information."
Means that.

Next, the addition and change of the type of information to be collected will be described. The information to be collected can be changed by changing the collected information registration table of the collected information registration means 7 in FIG. For example, in the information on the second line, "exi
The time-series information of the exit system call can be collected by changing the necessity of collecting the "t system call" to "necessary".

When adding collected information that is not listed in the collected information registration table, the user-defined information collecting means 6 adds it. As an example, a method of using a program created by the user or a script in which commands are combined will be described. A program or script name is specified in the column of the type of the collected information registration table in FIG.

The fault information recording means 8 activates the corresponding program or script as set in the collection method of the collection information registration table. The program or script collects the information that the user wants to collect, and sends the execution result to the failure information recording means 8.

This may be realized, for example, by the fault information recording means 8 capturing all standard outputs of programs and scripts. The fault information collecting means 8 records the received result in the recording area 9 of the main storage device.

The data (main storage image) recorded in the recording area 9 of the main storage device is compressed by the main storage image compression dump means 10 by a known data compression means, and is stored as a main storage image dump file 11 as an external file. It is stored in a disk or the like of the storage device.

Normally, the main memory image dump file 11
Is generated in response to an abnormality signal when there is a system failure or abnormality. That is, when the system is normal, the disk is not consumed without being dumped, and when the system is abnormal, the disk is dumped so that failure analysis can be performed. In this way, the disk is not consumed unnecessarily. The abnormal signal is generated, for example, when the OS determines that the system cannot operate any more. Further, the main memory image dump file 11 can be generated even when the user gives a generation instruction other than when a failure (fault) occurs.

The main memory image dump file 11 is usually a file obtained by dumping the entire data in the recording area on the main memory including the recording area 9. Of course, only the fault data in the recording area 9 may be dumped.

When the stored data is read out and displayed, the recording area reading means 13 reads out the compressed data as it is into the main storage device and decompresses the compressed data to obtain an image of the main storage device. It is displayed on the display means 12. It should be noted that the display format may be displayed for each data collected by each collecting means, or may be displayed as one piece of time series information, and the display format may be any format such as table format, list format, time series format, etc. Display with.

As described above, it is possible to obtain the information to be collected according to the content of the failure based on the type and the collection method of the failure information collected by the collection information registration means 7, and to analyze the failure in a short time. There is an effect that can be. Also, you can easily change the type of failure information to collect,
Further, the failure information collected by the user-defined information collecting means 6 can be newly added, and the information to be collected can be obtained according to the contents of the failure.

Further, by securing one recording area 9 on the main storage device and recording the failure information data in a predetermined format, when the data is taken out by the main storage device image display means, the recording area is recorded. Since only the data of No. 9 need be read from the compressed file, the data can be easily taken out. Furthermore, since the data structure of this portion does not depend on the OS or the model of the computer, it is possible to handle even the data of computers of different methods in a unified manner.

The merit of recording the failure information in the main memory is that the information "immediately before" when the system crash occurred remains. Data may be lost on the disc because the writing was not in time. In the case of a disk, the cache function of the file system or the cache of the disk may exacerbate this problem, but the main storage device does not have this kind of problem.

Since the time required for writing is short, a large amount of event information can be recorded in an extremely short time. By recording such information while cyclically reusing the data area on the main storage device, detailed information immediately before the system crash can be recorded.

Since the main memory image dump file 11 can be collected, more detailed information on the main memory can be viewed at the same time if necessary. This is because the main memory image dump file 11 also generally stores data on the main memory other than the fault data in the recording area 9, so that when it is necessary to refer to this data, data other than the fault data in the recording area 9 is stored. Data is also read and displayed.

Since it is integrated with the main memory image, there is no time lag with the main memory image. In addition, there is no mistake that you see it in combination with another different main memory image.

Further, the advantage of providing the user-defined information collecting means is that it cannot be collected by other collecting means, but the collection of information required by the user can be added. Furthermore, since the user-defined information collecting means is activated when necessary,
The load on the CPU is small.

Embodiment 2. In this embodiment, as shown in FIG. 1, the data recorded in the recording area 9 on the main memory is compressed and stored. That is, this is a method in which the main memory image recorded in the recording area 9 on the main memory is compressed and dumped, and the compressed image is read out without being expanded (restored to an uncompressed file).

FIG. 14 is a diagram showing an example of the main memory image compression means. FIG. 15 is a table showing an example of the contents of the directory information required when compressed. FIG.
FIG. 6 is a flowchart data showing a flow of a process of reading a compressed main memory image dump file without expanding it.

This method will be described with reference to FIGS. 14 and 15. (1) First, when dumping, the main memory image is divided into a certain size, and (2) each divided area is compressed.
The compression method is, for example, compr of UNIX system.
An existing method such as ess may be used.

(3) The compressed areas are merged to generate the main memory image dump file 11. (4) Finally, the position of the beginning of each area is shown in the directory information shown in FIG. 15 (the contents of the directory information in FIG.
Directory information) of the main memory image dump file 11.

A means for reading out the main memory image dump file 11 compressed in this way will be described with reference to the flowchart of FIG. (1) First, which divided area the data to be read belongs to is calculated from the size of the divided main memory image, and the divided area number is specified (ST41).

In this calculation procedure, the size of the area when the original file is divided is kept constant. For example, 4k
Byte. Address of data in file = 0x8
If it is located at the address 800, (0x8800 / 4k) + 1 = (0x8800 / 0x1
000) + 1 = 8 + 1 = 9 and it can be seen that it is in the ninth divided area. In addition,
In the formula, division is rounded down to the nearest whole number.

(2) Next, from the number of the corresponding divided area, as shown in FIG.
The directory information 5 is subtracted, and it is checked whether the area is within the compressed main memory image dump file 11 to where (ST42). In this process, since the divided area number is known, the position information on the right side of the number corresponding to the divided area number on the left side of FIG. 15, that is,
Find the offset (address) in the compressed file.

For example, to read the divided area numbers 4 and 5 from FIG. 15, the addresses of the compressed file are 0x9a0-0x.
You can read up to 122f (from the beginning of 4 to just before 6).

(3) Next, the compressed divided areas within the range are read out to the main memory (ST43), and (4) only the read divided areas are expanded (compression is released in the main memory). (ST44). (5) Read necessary data from the developed divided area (ST45).

Explaining the decompression here, in the normal decompression, the compressed file is restored to the original uncompressed file, and an uncompressed file is created instead of the compressed file. In this process, it is usually impossible to delete the compressed file until the "decompression" is completed, so an extra disk is used during the "decompression".

In the "expansion" here, the compressed file is on the disk, and the compression is decompressed only in the portion read out to the main storage device, so that the waste of the disk can be eliminated.

As described above, according to this embodiment, when a failure occurs, the image of the main storage device is stored in the main storage image dump file 11 by the main storage image compression dump means 10 and is extracted while being compressed. Since it is decompressed and displayed by the main memory image display means 12, there is an effect that the disk capacity required when analyzing a failure is reduced.

Embodiment 3 This embodiment is a system in which the data formats of failure information of computer systems of different systems are unified and data can be commonly extracted and displayed.

The means for displaying the main memory image will be described with reference to FIG. FIG. 17 shows A and B with different methods.
The outline of means for reading and displaying the recording area 9 on the main storage device recorded by the failure information recording means 8 of the computer system by the common main storage image display means 12 is shown.

The computer systems A and B each have the fault information recording means 8 (see FIG. 1) according to the means shown in FIG.
A recording area 9 secured in the main memory (not shown in FIG. 7)
Record fault information in. When a failure occurs, the main memory image dump files 11 and 11 on each computer
a is acquired.

Fault information recording means 8 of each computer system
By unifying the data structure when writing data to the buffer by the failure information recording means 8 (shown in FIG. 1 respectively), the only difference is the address on the main memory where the recording area 9 starts. . The common main memory image display means 12 is obtained by obtaining the address through the recording area reading means 13 and 13a prepared for each system.
You can use to display the collected information.

To explain the above in detail, the main memory image display means 12 reads the recording area from the main memory image dump files 11, 11a dumped by the computer of the different system and displays the contents.

Usually, a computer A of a certain system has a main memory image display means A, and naturally, the recording area in the main memory image dump file dumped by the computer A can be read and its contents can be displayed. it can. But,
Since the computer B of a different system has a completely different main memory structure, the contents of the main memory image display means A cannot normally be displayed.

Therefore, as in this embodiment, if computer B also records a fault record in the recording area in the same format as computer A, the main memory image dump file dumped by computer B can be copied to computer A. , The recording area is read out from the area, and the contents are displayed.

At this time, the only information that is required is the address information indicating from which position in the main storage image dump file the recording area exists. System A / B recording area reading means 1 of FIG.
Since 3 and 13a recognize the address information and read the recording area, the common main memory image display means 12 can be used to analyze the failure of both computers A and B.

The means for recognizing the address information and reading the recording area, when the data is divided and recorded, is used in the second embodiment.
If the data is recognized as described above and the data is not divided and recorded, the address information management method that is usually performed is used.

As described above, according to this embodiment,
In computer systems of different methods, the failure information recording means records the failure information in the recording area on the main storage device in a unified format, and the recording area read-out means is prepared in each of the computer systems of different methods. Since the recording area stored in the file is read, the main memory image display means can display the failure information of the main memory image dump file of the computer system of the different system via the recording area read means. Therefore, even in a large-scale system in which computer systems of different methods are combined, there is an effect that failure analysis can be performed in a short time.

Embodiment 4 This embodiment will be described with reference to FIG. In FIG. 18, a temporary storage means 20 serving as a cache is provided and combined with the main storage image display means 12. The main memory image means 12 includes a divided area input unit 1201, a control unit 1202, and a display unit 120.
3.

The divided area input unit 1201 reads one divided area from the compressed main memory image dump file, decompresses the area, and stores it in the temporary storage means 20. Then, the control unit 1202 is notified that the data has been stored. The control unit 1202 notifies the display unit 1203 of the end of storage, and the display unit 1203 reads out necessary data from the temporary storage means 20 and displays it.

When next reading the same area as described above, the display unit 1203 first informs the control unit 1202 of the address to be read, and the control unit 1202 already has the temporary storage means 2.
The fact that it is stored in 0 is returned to the display unit 1203. The display unit 1203 reads the data from the temporary storage unit 20 and performs a process.

For example, it is assumed that the temporary storage means 20 can store 10 divided areas. This eliminates the need to read from the main memory image dump file 11 one by one when performing a process of reading the data many times in a size that spans a plurality of divisions.
Processing can be done at high speed.

As described above, according to this embodiment,
Since the temporary storage means 20 is configured to be used as a cache of the main storage image display means 12, the main storage image display means 12 uses the main storage image dump file 1.
The time required to read the information 1 is shortened, the information display performance of the main memory image display means 12 is improved, and the failure analysis can be promptly performed.

Embodiment 5 This embodiment is shown in FIG.
This will be described with reference to FIG. FIG. 19 is a flowchart showing the processing algorithm of the compression method selection means. 20
It is an example of directory information added to the head of the compressed file when the compression method selection means is used.

Various types of data are stored in the main memory. There are compression methods suitable for the type of data. The compression method selection means determines what type of data is applicable at the time of compression, selects an appropriate compression method, and performs compression.

Description will be given with reference to the flowchart of FIG. (1) In the compression processing, dumping is performed up to the end of the main memory and loop processing is performed (ST51). (2) First, it is checked whether the portion to be dumped is a program code (ST52). This is determined, for example, by examining the internal structure of the OS or knowing the logical address to which the part is assigned.

(3) If it is the code of the program, it is compressed by the compression method 1 suitable for compressing the code of the program, that is, the machine language code, and written in the main memory image dump file (ST53). (4) If it is not the program code, then it is checked whether or not that portion is actually used (ST54). This can be determined by checking the OS main memory page management table.

(5) If the waste data is not actually used, the compression method 2 compresses it, for example, to make it only the size information (ST55). (6) If both cases do not apply, compression method 3
To perform compression (ST56). The compression method is, for example, U
NIX standard compression method compress or the like may be used.

When decompressing, it is necessary to know how the part was compressed. Therefore, the compression method information is added to the directory information added to the beginning of the compressed file. An example of directory information is shown in FIG. The area number is a sequential number of the divided areas.

The address information indicates which address range of the main memory the area is information. The compression method indicates which one of the compression methods 1, 2 and 3 has been used for compression.
The offset in the compressed file indicates where in the compressed file the compressed area is. The size of the compressed area indicates the size of the area occupied in the compressed file.

As described above, according to this embodiment,
Since the compression method selecting means selects the appropriate compression method according to the type of data, the overall compression rate is improved, and the disk device can be effectively used.

[0097]

【The invention's effect】

(1) As described above, according to the present invention, since the collected failure information is recorded in the main memory according to the registered contents, the failure can be analyzed in a short time, and the disk capacity can be saved. Can be reduced.

(2) Further, since the failure information can be unified and recorded in the main memory, it can be applied to a system composed of computers of different formats, and failure analysis can be performed in a short time. .

(3) Further, since the failure information is recorded at one place on the main memory, writing / reading can be speeded up.

(4) Further, since the failure information is divided and stored in the compressed dump file, the disk capacity can be reduced.

(5) Further, since the temporary storage device is constructed so that the main storage can be used as the cache of the main storage image display means, the time for reading the fault information is shortened,
The information display performance of the main memory image display means is improved.

(6) Also, since the suitable compression method is selected according to the type of data, the overall compression rate is improved and the disk device can be effectively used.

[Brief description of drawings]

FIG. 1 is a block diagram of a fault recording method according to a first embodiment of the present invention.

FIG. 2 is a block diagram showing an internal structure of fault information recording means 8 according to the first embodiment of the present invention.

FIG. 3 is a diagram showing a data structure of input / output device information according to the first embodiment of the present invention.

FIG. 4 is a diagram showing a data structure of time series information according to the first embodiment of the present invention.

FIG. 5 is a diagram showing a data structure of system load information according to the first embodiment of the present invention.

FIG. 6 is a diagram showing a data structure of system abnormality monitoring information according to the first embodiment of the present invention.

FIG. 7 is a diagram showing a data structure of APP information according to the first embodiment of the present invention.

FIG. 8 is a diagram showing an example of contents of collected information registration means 7 according to the first embodiment of the present invention.

FIG. 9 is a diagram showing a configuration of a recording area on a main memory according to the first embodiment of the present invention.

FIG. 10 is a flowchart showing a processing flow after activation of the fault information recording means 8 according to the first embodiment of the present invention.

FIG. 11 is a flowchart showing a flow of processing when a signal is generated from the time-series information collecting means 2 of the failure information recording means 8 according to the first embodiment of the present invention.

FIG. 12 is a flowchart showing a processing flow when a timer interrupt of the failure information recording means 8 according to the first embodiment of the present invention occurs.

FIG. 13 is a flowchart showing a processing flow when a failure information recording unit calling block of the failure information recording unit 8 according to the first embodiment of the present invention is called.

FIG. 14 is a diagram showing a flow of file compression according to the second embodiment of the present invention.

FIG. 15 is a diagram showing an example of contents of directory information added after compression according to the second embodiment of the present invention.

FIG. 16 is a flowchart showing a flow of processing for reading a compressed main storage image dump file 11 without expanding it according to Embodiment 2 of the present invention.

FIG. 17 is a schematic block diagram of a method of reading collected information of a computer system having a different method according to the third embodiment of the present invention.

FIG. 18 is a block diagram of a main part according to a fourth embodiment of the present invention.

FIG. 19 is a diagram showing an algorithm of compression method selection means according to the fourth embodiment of the present invention.

FIG. 20 is a diagram showing directory information added to the end of the compressed file according to the fifth embodiment of the present invention.

FIG. 21 is a schematic block diagram of a conventional fault recording method.

[Explanation of symbols]

1 input / output device information collection means, 2 time series information collection means, 3 system load collection means, 4 system abnormality monitoring means, 5 APP information collection means, 6 user-defined information collection means, 7 collected information registration means, 8 fault information recording Means, 9, 9a recording area, 10 main memory image compression dumping means, 11 11a main memory image dump file, 12 main memory image displaying means, 13, 13a recording area reading means, 14 main memory image expanding means,
15 input / output device information display means, 16 time series information display means, 17 system load display means, 18 system abnormality display means, 19 APP information display means, 20 temporary storage means, 801 timer interrupt reception section, 802 OS
Signal reception unit, 803 Failure information recording means calling unit, 804 Failure information recording unit.

Claims (7)

[Claims] 1. A failure recording method for recording failure information necessary for failure analysis of a computer system having a main memory and an input / output device, and information collecting means for collecting information related to various failure analyzes, and collecting in advance. Collection information registering means for registering the type of information to be registered, and failure information recording for collecting the information of the information collecting means according to the registered contents of the collection information registering means and recording it in the recording area on the main storage device. A fault recording method comprising means. 2. A fault recording method for recording fault information necessary for fault analysis of a computer system having a main storage device and an input / output device, a means for collecting input / output information indicating an operating state of the input / output device, and the computer. Means for collecting time-series information indicating the history of system operation, means for collecting system load indicating the load on the computer system, system abnormality monitoring means for reporting an abnormal event occurring on the computer system,
Collection means for collecting application program status information indicating the status of business processing executed on the computer system, user-defined information collection means for collecting user-defined failure information, and collection for registering the type of information to be collected in advance An information registration means and a failure information recording means for collecting information of the various information collecting means and the abnormality monitoring means according to the registered contents of the collected information registration means and recording the information in a recording area on the main storage device. A fault recording method characterized by that. 3. In a fault recording system for recording fault information necessary for fault analysis of a computer system having a main memory unit and an input / output unit, when the computer system is composed of different systems, each of the computer systems is Information collecting means for collecting information related to various failure analyses, collected information registering means for registering the type of information to be collected in advance, and information of the information collecting means according to the registered contents of the collected information registering means And a failure information recording means for collecting the information and recording it in a recording area on the main storage device. 4. The fault recording method according to claim 1, wherein the fault information recording means, when recording the fault recording information in the main storage device, stores the fault recording information in one recording area of the main storage device. A failure recording method characterized by a means for collectively storing. 5. The failure recording method according to claim 1, further comprising: a compression dump unit that divides failure information recorded in the main storage device into a predetermined size and compresses and stores the compressed compression information as a dump file. A read means for extracting the desired failure information in a divided unit on the basis of the divided and stored address information while decompressing it in the main storage device when the failure information is stored separately. Failure recording method. 6. The fault recording system according to claim 1, wherein the fault information recorded in the temporary storage means, the display means and the main storage device is divided into a predetermined size and compressed. Compression dump means for storing as a dump file, and reading means for extracting desired failure information in compressed units in units of division based on address information corresponding to the separately stored failure information, and decompressing and storing in the temporary storage means When displaying on the display means, the failure information stored in the temporary storage means is displayed on the display means, and when the same failure information is displayed next, the failure information stored in the temporary storage means is displayed. A fault recording method characterized by displaying using fault information. 7. The fault recording method according to claim 5 or 6, wherein the compression dump means is provided with means for selecting a compression method according to the type of data to be compressed.