KR20090001786A - System for analyzing business influence due to computational failure - Google Patents

Abstract

A system for analyzing a business influence caused by computation failure is provided to construct a system for sensing important failure automatically and coping with the failure quickly, and to support fast decision-making and failure-coping, then to suggest a method for improving predictive accuracy in failure measures of a computation organization. A management tool unit transmits a failure event message. A service desk unit decides on a failure seriousness grade by receiving and analyzing the event message, and transmits a failure message. An influence analyzer compares/analyzes influence information and organized resource information stored in an integrated DB, and outputs result data. The influence analyzer comprises as follows. An application includes a failure event processing module, an influence analysis processing module, and a failure event/influence screen display module. A monitoring unit provides influence analysis data to a user. A DB stores data processed in the monitoring unit and the application.

Description

System for analyzing business influence due to computational failure

1 is an exemplary configuration diagram of relationship information for linking business and IT components

Figure 2 is an example of the overall view UI showing all of the analysis perspective of Table 1 in one screen

3 is a network diagram according to an embodiment of the present invention.

4 is a block diagram of a failure response system applying the impact analysis system to a real environment

Figure 5 is a block diagram showing the configuration of a monitoring server, application server, DB server according to an embodiment of the present invention

6 is a database structure diagram of the impact analysis system

7 is a flowchart of a failure event processing module of the application server shown in FIG.

8 is a flowchart of an impact analysis processing module of the application server shown in FIG.

9 is a flowchart of a screen display module of the application server shown in FIG.

10 is a fault event processing flow chart

11 is a diagram illustrating a configuration of connection between entities for an application scenario of a business impact analysis system;

12 is an exemplary diagram of a service status inquiry screen of FIG. 5 for business monitoring.

FIG. 13 is an exemplary diagram of an IT comprehensive status diagram inquiry screen of FIG. 5 for monitoring a computer resource comprehensive status.

14 is an exemplary diagram of a network status diagram inquiry screen of FIG. 5 for network equipment and line monitoring.

15 is an exemplary view showing a system configuration diagram inquiry screen showing a connection relationship between related systems

16 is an exemplary diagram of a work flow chart inquiry screen showing a process flow of a corresponding work

17 and 18 are exemplary diagrams of the work impact status inquiry screen of FIG. 5 for identifying and analyzing an impact range.

FIG. 19 is an exemplary view of the failover status inquiry screen of FIG. 5 for inquiring failure status from failure to the present; FIG.

20 is an exemplary screen diagram illustrating the connection relationship between items related to monitoring items.

21 is a diagram illustrating a screen implementing items related to a target monitoring item in a tabular form.

22 is a screen example of displaying a map management function

The present invention relates to a business monitoring system for analyzing the impact on the business when a computer failure occurs in various computer systems.

Currently, models such as IT Governance, Enterprise Architecture (EA), IT Service Management (ITSM), and IT Infra-Tool (SMS, NMS, etc.) for the convergence of business and IT provide direction to companies. However, there is a gap between these models in the actual application stage.

In other words, the importance of IT governance is recognized, but the degree of implementation or utilization is insufficient. The establishment of an enterprise-wide IT system can be established through the establishment of EA, but it is operated independently of the IT service management tool. Is impossible. In addition, ITSM has a disadvantage in that it is limited to monitoring from an IT organization's point of view due to lack of linkage with the enterprise business system.In the case of ITIL, it is possible to monitor the failure or performance of individual computing resources but lacks the linkage with the business.

Therefore, in order to respond quickly to failures, it is necessary to introduce a business monitoring system that quickly identifies the effects of information technology on the business and facilitates cause analysis. In order to solve this problem, it is necessary to converge the real business and IT that can guarantee the profits of companies operating computer systems. 1) Integrating the business tier and the infrastructure tier, 2) Infra Consistent management of all services to users, 3) Dynamic information processing to actively support real-time enterprise environment, 4) Information flow management between sequential and serial management tools, 5) Business and IT control and 24x7 business continuity through monitoring, 6) continuous monitoring of key tasks that have a significant impact on the life and death of the business, 7) integration of EA's data structure, configuration management (CMDB), event DB and linkage information between them, 8) It can provide practical utilization technology, not framework, such as IT Governance, EA, and ITIL.

To this end, the present inventors conceptualize the connection between the business layer and the infrastructure layer into a huge and complex pipeline to manage the business impact caused by computational obstacles by a dynamic service pipeline integration technology that integrates and manages the currently disconnected IT environment. We have developed a system for analysis.

Therefore, the object of the present invention is to establish a system that automatically detects important obstacles and responds quickly, supports rapid decision-making and response in the field of business such as sales counters and media correspondence in the event of a failure, and improves the accuracy of predicting failure measures of computerized organizations. In order to prepare the system, the purpose of this study is to provide a business impact analysis system due to computational disability.

<Background description>

Type of Disability

Failures include line failures, communication equipment failures, DB failures, server failures, information system failures, and terminal failures. These obstacles have a direct impact on the business running the computer system (eg financial business). In the case of the previous five failures, the impact varies depending on the resource type. Therefore, it is necessary to understand the impact of each configuration item when constructing the CMDB. The last terminal failure has a direct impact on the customer, but the influence is limited to some areas.

Importance of Analyzing Impacts from Computational Disorders

Disability-response organizations are largely composed of action workers (workers), reporters (team leaders), and decision makers (executive officers), who are urgent in identifying and acting on disability, and the reporter's decision makers are not systematic. For systematic disability decision making, it is necessary to analyze the influence of various viewpoints on the disability generated.

Requirements for Impact Analysis

Impact analysis includes impact analysis on system (development level) and infrastructure impact analysis (operational level). In the case of infrastructure, various analysis tools such as SMS and NMS are introduced / operated, but in the case of systems, this is not the case.

User hierarchy

Business monitoring is performed by business and IT organizations, but the information provided must be different depending on the user type. Therefore, the user hierarchy can be classified into three types: strategic layer, tactical layer, and business layer. do.

Strategic Tier-The highest level of decision making, including decision making, policy making, rulemaking, and setting the level of financial activity. It refers to the user level at the executive level of business and IT organizations. This layer provides business-oriented monitoring information.

Tactical tier-A layer that implements policies and rules determined by the strategic tier and manages and supervises all activities, and refers to the user tier at the IT manager's level. This layer provides monitoring information focused on business, information system, database, and network perspectives.

Practical tier-means a group of practitioners who implement the short and long term plans determined by the tactical tier and monitor and resolve all IT failures.As well as the executives of the IT organization, the third party employees who perform all IT service activities Include. It is necessary to provide overall monitoring information for this layer.

Target of business monitoring

Communication in business monitoring should be implemented from a business perspective. For this purpose, the monitoring targets are defined in five perspectives: customer, business, information system, database, and network, and each is applied as a standard of user interface (Table 1). Reference). It can be seen from Table 1 that the items (MI) to be monitored are set for each analysis point of view.

On the other hand, to effectively monitor the impact of IT failures on the business, it is a prerequisite to define the relationship between the monitoring items (MI) in Table 1. This is because the relationship between the impact analysis and monitoring screens can be interconnected using the defined relationship information. This MI relationship is shown in FIG. Design a business monitoring system on the premise of the linkage information defined as in FIG. 1 is an exemplary configuration diagram of relationship information for linking business and IT components.

The UI may be designed to determine a risk level for each monitoring target. FIG. 2 illustrates an overview UI showing all of the analysis viewpoints of Table 1 on one screen. From the left, system availability from the customer's point of view, system availability from the business point of view, system availability from the information system point of view, database availability from a database point of view It also shows the system availability from a network perspective. In FIG. 2, the system availability% is displayed in bar form and actual value for each analysis point of view, and it can be seen that the average of the previous month is set as the blue line and the expected level is set as the red line. Below each perspective item is a "Detail View" button that allows you to enter the screen. If the availability is lower than expected, the availability bar is contrasted with red to identify it immediately. In Figure 2, selecting each availability bar, 1) Customer Perspective-to determine the risk level for each customer group, can be configured to enable screen linkage by detailed customer classification when clicking the item, 2) Business Perspective-The risk level of each business group can be judged, and when a corresponding item is clicked, the screen can be linked by detailed business functions, or when the function is linked with BPM (business process manager), it is linked with the business monitoring screen. By linking the flow charts, it is possible to monitor each activity in the work flow chart. 3) The perspective of the information system-It is possible to determine the level of risk for each information system group. , 4) Database Perspective-Allows you to determine the level of risk for each database group. It can be configured to move to the screen. 5) Network Perspective-It can determine the risk level by network and server, and can be configured to move to the linking screen when the corresponding item is clicked. In addition, "MI relationship inquiry function" that can monitor the connection relationship and status with the linked monitoring item based on monitoring individual items such as customer, business, information system, database, circuit, communication equipment, and server can be granted.

<Overview of invention>

According to a first aspect of the present invention to achieve the above object, a management tool means for detecting a failure occurring in the computing resources of the organization, such as mainframes, servers, databases, applications, communication equipment, networks, and transmits a failure event message;

Service desk means for receiving and analyzing the failure event message to determine a failure severity level and transmitting a failure message;

And an impact analysis means for receiving the failure message, comparing the failure event included in the message with the component resource information and the impact information stored in the integrated database in real time, and outputting the result data.

The impact analysis means includes an application including a fault event processing module, an impact analysis processing module, and a fault event / effect screen display module; A monitoring unit for providing a user with impact analysis data processed by the application; Disclosed is a business impact analysis system due to a computer failure, comprising a database storing data processed by the monitoring unit and an application.

In the system, the management tool means includes an individual failure monitoring tool including a tool for detecting a system failure of the organization, a network failure detection tool, and an application failure detection tool; And an integrated event management tool for generating a failure event message by integrally processing a failure signal output from the system failure detection tool, a network failure detection tool, and an application failure detection tool.

In addition, the monitoring unit of the impact analysis means can be seen at a glance the service status display screen showing the status of what work of the organization is hindered by the failure of the computer resources, and the status of the failure action for each individual failure at a glance. Inquiry on the status of the disability actions that can be viewed, the work impact inquiry screen that displays information on the impact level so that the disability severity or the scope of the disability can be identified, and the work on the disability related to work It may include a task flow screen for inquiring function and input / output elements for each function, and a task flow screen for inquiring the fault status of each item in the workflow diagram, and a linkage relation screen for displaying the relationship between the items related to the monitoring items.

In addition, the failure event processing module of the application in the impact analysis means, after analyzing the failure reception message received from the service desk means to compare and search the monitoring items in the database to determine / map the event identifier and monitoring items, And a means for storing the fault reception contents and the fault event status, wherein the impact analysis processing module extracts the basic information and the impact information stored in the master information of the database from the identifier of the monitoring item, Means for delivering the impact information and the relationship information to the fault event / effect screen display module by extracting the identifiers of the related items based on the relationship information between the stored monitoring items and merging / processing the impact information and the relationship information. It may include.

According to the second aspect of the present invention, a component resource stored in an integrated database by receiving a failure message generated from an organization's computational resources such as a mainframe, a server, a database, an application, a communication device, and a network, and storing the failure event included in the message. It is a device that compares and analyzes information with impact information in real time and outputs the result data. This device is a monitoring unit that provides users with all the services of impact analysis through an impact analysis system implemented in the Internet environment. Computational failure, characterized in that it comprises an application including a failure event processing module, the impact analysis processing module, a failure event / impact display module, and a database storing data processed by the monitoring unit and the application The business impact analysis device caused by the present invention is disclosed.

Here, the monitoring unit also displays a service status screen that displays the status of what kind of work is being disrupted due to the failure of the computational resource, and the failure situation that can grasp the failure status for each failure at a glance. Task impact inquiry screen that displays the degree inquiry screen, the screen that provides the impact-related information to identify the disability severity or the scope of the impact on task-related obstacles, and the function and input / output elements by task for the task-related disorder It may include a work flow diagram screen for inquiring a work flow diagram indicating a fault condition and a fault status of each item on the work flow diagram, and a linkage relation inquiry screen showing a relationship between items related to monitoring items.

In addition, the failure event processing module of the application, after analyzing the failure reception message received from the service desk means to compare and search the monitoring items in the database to determine and map the event identifier and monitoring items, and the failure reception content and failure It may include means for storing the status of the event, the impact analysis processing module, extracts the basic information and the impact information stored in the master information of the database to the identifier of the monitoring item, the monitoring item stored in the relationship information table And extracting identifiers of related items based on the relationship information therebetween, and then merging / processing the influence information and the relationship information to convey the impact information and the relationship information to the fault event / effect screen display module. .

According to a third aspect of the present invention, a component resource stored in an integrated database by receiving a failure message generated from a computing resource of an organization such as a mainframe, a server, a database, an application, a communication device, a network, and the like, the failure event included in the message A method of comparing and analyzing information and influence information in real time through an impact analysis device and outputting the result data. When a failure occurs in the computer resource to be managed, a failure monitoring tool agent installed in each computer resource is pre-installed. Automatically transmit the fault event, integrate the fault events received from individual computing resources, and notify the staff in charge of the integrated fault event through SMS or e-mail by using the preset alarm function. The event content to the event room screen, The fault internal notification step of transmitting a trouble ticket in the form of a mat, and when compared with a predetermined importance condition for a received fault event, the corresponding fault event is more than the importance corresponding to the delivery target to the impact analysis device. The fault reception step of transmitting the error to the impact analysis system, and the event transmitted to the impact analysis device according to the fault severity and fault notification medium according to the policy / rule predefined in the system, Disclosed is a method for analyzing business impact due to computer failure, including a disability propagation step that enables business users to recognize and respond to a failure situation.

Here, if the user who checks the failure notification message received by the failure propagation step changes the status of the failure event record to failure completion in order to take a countermeasure, the corresponding failure termination message is transmitted to the impact analysis device. May be further included.

The impact analysis method may be implemented by a computer program or software, and a computer recording medium recording the program or software also includes the technical scope of the present invention.

Hereinafter, with reference to the drawings will be described a specific configuration and operation of the present invention.

Composition and Action of the Invention

Figure 3 is a block diagram illustrating the configuration of a network for explaining the concept of the impact analysis system due to computational disorders according to the present invention. Users (10, 20) of the impact analysis system can access the system through the Internet, the system is largely service status (Fig. 12), IT overall status (Fig. 13), network configuration (Fig. 14), Screen display unit for displaying the results of the impact analysis such as the failure status (Fig. 16), work impact (Fig. 17), system configuration (Fig. 16, 17), connection relations (Fig. 21, 22), etc. 30) and a database unit 50 for storing impact analysis information such as failure event information, monitoring target item information, impact and relationship information between items, information on a monitoring map screen, and fault / change / propagation history information. ), And an application program unit 40 for inquiring the database unit 50 according to a user's request and delivering the same to the designated screen display unit 30.

FIG. 4 is a block diagram of a failure response system in which a business impact analysis system is applied to a real environment in order to describe FIG. 3 in more detail.

In FIG. 4, the failure response system includes a situation propagation medium 100, a user 200, a business impact analysis system 300, an integrated database 400, an event integrated management tool 500, a service desk 600, and management. The tool 700 and the computerized resource 800 to be managed.

The management tool 700 automatically detects a failure occurring in the computing resource 800 of the organization, such as a mainframe, a server, a database, an application, a communication device, a network, and real-time a failure event message as a failure event integrated management tool 500. send.

The service desk 600 determines a failure degree by recognizing a failure event generated by the event integrated management tool 500 and transmits a failure message to the business impact analysis system 300.

The impact analysis system 300 compares / analyzes the received failure event with constituent resource information and impact information stored in the database 400 in real time, stores the result in the database 400, and monitors the overall business such as business monitoring. The failure message is displayed or released on the screen 300.

FIG. 5 shows a configuration of an embodiment of the business business impact analysis system 300 of FIG. The impact analysis system is largely composed of three elements: the monitoring unit 301, the application 302, and the database 303.

In FIG. 5, the monitoring unit 301 provides a user with various services of the impact analysis through the impact analysis system implemented in the Internet environment.

The service status inquiry screen 310 of the monitoring unit 301 is a screen that can identify at a glance what kind of work of the organization is affected by the failure of computing resources. Allows you to determine whether an abnormality is in real time.

FIG. 12 is an exemplary view of an implementation screen of the service status inquiry screen 310. The service status diagram includes a failure event list unit at the top, a network situation unit at the bottom left, and a service comprehensive situation unit at the bottom right. In the fault event list part, a summary list of fault events that have not been closed is displayed, and when the fault is terminated, the fault event automatically disappears from the list. The network status unit automatically changes the color of the region when a network line or a major communication equipment failure (disability corresponding to 5 in FIG. 11) occurs, and when the failure ends, the color of the region automatically changes to the normal white color again. This is displayed or released through the process of 5 → 6 → 7 → 10 → 16 of FIG. The Service Comprehensive Situation is a screen that monitors the disability situation of each task. When a task-related disability (disability corresponding to 1, 2, 3, and 4 of FIG. 10) occurs, the color of the task is automatically changed. The color is automatically changed back to the normal white color, which is displayed or released through the process of 1 (or 2, 3, 4) → 6 → 7 → 8 → 9 → 11 of FIG.

The IT comprehensive situation diagram 320 of FIG. 5 is a screen for identifying at a glance the failure status of each computing resource excluding the network.

FIG. 13 shows an example of an implementation screen of the IT general situation inquiry screen 320. The enterprise resources are classified into six categories (three main frame regions and three client / server regions), and the failure status of each category is evaluated. In case of work-related disability, it is indicated or released through the process of 1 (or 2, 3, 4) → 6 → 7 → 8 → 9 → 12 of FIG. In the case of FIG. 10 (or 2, 3, 4) → 6 → 7 → 10 → 17, the display or release is performed.

The network status inquiry screen 330 of FIG. 5 is a screen for grasping the failure status of important network resources at a glance, and FIG. 14 corresponds to an implementation screen thereof.

Enterprise network resources are classified into four types: backbone switch (backbone SW), regional connection equipment (BP server), broadband router (WAN router), and backbone router. It is displayed or cleared through the process of 5 → 6 → 7 → 10 → 18 of 10.

Disability action status inquiry screen 340 of Figure 5 is a screen that can grasp the disability action status for the individual failure at a glance, Figure 19 corresponds to the implementation screen thereof.

Disability situation is largely divided into three parts: disability list, configuration information and disability action. At the top of the list of faults, a list of individual faults appears, and when the list is selected, the left and right screens at the bottom are replaced with the screen for the fault. The configuration information unit on the lower left can query the configuration summary information and detailed information, failure history and detailed failure history, change history, and detailed failure history for the monitoring item that has a failure. In the lower right corner, the failover status section can query the failure status and the propagation status by time from the time of failure to the present time. In addition, it included functions that can handle a series of processes on disability at one time by registering disability action information or disseminating disability if necessary. At the bottom of the failover status inquiry screen, there are function buttons such as recovery procedure inquiry, work flow chart, system configuration diagram, work impact inquiry, and so on.

The task impact inquiry screen 350 of FIG. 5 is a screen that provides impact-related information so as to grasp a disability severity or an impact range for a task-related disorder, and an impact status screen (FIG. 17) and an affected service inquiry screen. (FIG. 18).

FIG. 17 is a screen for inquiring the status of the impact of a disability item related to a task, and searches and provides information such as the monthly average transaction processing number, the number of subscribers, the impact task, and the severity of the task previously stored in a database. It is used as important judgment information for determining the severity.

The affected service inquiry screen of FIG. 18 searches for and provides tasks related to the corresponding task among the information in the CI relationship table 1 of the database structure diagram of FIG. 6 and is used as judgment information when determining the fault propagation range.

17 and 18 is displayed through the process of 1 (or 2, 3, 4) → 6 → 7 → 8 → 9 → 15 of FIG.

The system configuration inquiry screen 360 of FIG. 5 may query the fault status of each item on the schematic diagram and the schematic diagram for finding out at a glance the computational resource composition for each task related to the task-related obstacles. (Or 2, 3, 4) → 6 → 7 → 8 → 9 → 13

15 is an implementation screen of a system configuration diagram, which is composed of seven areas such as a channel, an internal channel, a server system, a host system, a linked system, an external channel, and an external institution, and a channel is a contact point with a user. The type of connection between the channel and the relevant business system, the server system is the computational resources related to the relevant task, the host system is the host system related to the relevant task, the linked system is the in-house linked system related to the relevant task, and the external organization is the relevant task. The external channels related to the external channels, and the external channels indicate the type of connection between the relevant business system and the external organizations, are marked in red when a failure occurs, and return to the normal white color when the action is completed.

The task flow inquiry screen 370 of FIG. 5 may inquire at a glance about a task-specific function and input / output elements with respect to a task-related disorder, and query the fault status of each item on the task flow diagram. (Or 2, 3, 4) → 6 → 7 → 8 → 9 → 14

FIG. 16 is an implementation screen of a work flow diagram, which is composed of five areas, such as input data, output data, work function, linked work, and external linkage work. The input data shows the media type of information input to the corresponding work. Indicates the media type of the data output through the relevant business, the business function indicates the individual function configuration of the relevant business, the linked business refers to other internal tasks related to the relevant business, and the external linked business refers to related organizations or tasks external to the company. In case of a failure, the corresponding item is displayed in red, and when the action is completed, the item returns to the normal white color.

The connection relationship inquiry screen 380 of FIG. 5 is a screen showing a relationship between items related to a monitoring item.

FIG. 20 is a diagram illustrating a connection relationship, which shows a target monitoring item in the center, and displays the monitoring items related to a radial line so that the correlation can be seen. FIG. 21 is a screen in which items related to a target monitoring item are implemented in a tabular form, and they are displayed on the screen by referring to the configuration master table 2 of FIG. 7 and the CI relationship table 1 of FIG. 7.

5 again, the application of the business impact analysis system (302 of FIG. 5) includes a fault event processing module 410, an impact analysis processing module 420, a fault event / impact display module 430, and monitoring. The item management module 440 and the monitoring screen map management module 450 are configured.

FIG. 7 illustrates the processing flow of the fault event processing module 410 of FIG. 5 in detail. When a failure is received at the service desk (600 of FIG. 4) of the system configuration of FIG. 4, the failure reception information is automatically delivered to the impact analysis system 300 in a message form (S411), and a failure reception message is received therefrom. After disassembly (S412), and compare and search the monitoring items (configuration master table (2) of Fig. 6) of the database to determine and map the event identifier and monitoring items (S413), the failure reception details are the failure status of Fig. In the table 26, the fault event status is stored in the event status 27 of FIG.

8 shows the flow of the impact analysis processing module 420 of FIG. 5 in detail. Call of the analysis process is driven by inputting the identifier of the monitoring item in the display module (430 of FIG. 5) (S421), the identifier of the monitoring item to the master information of the database (configuration master table (2) of FIG. 6) After extracting the stored basic information and the impact information, and extract the identifiers of the related items based on the relationship information between the monitoring items stored in the relationship information table (CI relationship table (1) of FIG. 7) (S422) After merging / processing the degree information and the relationship information (S423), the influence information and the relationship information are transmitted to the called screen display module (430 of FIG. 5) (S424).

9 shows the flow of the fault event / effect screen display module 430 of FIG. 5 in detail.

The fault event / effect screen is divided into a map screen and a screen that is not. As shown in Fig. 10, the map type screen includes a service status diagram, an IT overall status diagram, a network status diagram, a system configuration diagram, a work flow diagram, and the like. The map management function of FIG. 22 can be registered / modified / deleted. The map template for each type is stored in the map template table 3 of FIG. 6, and the created map information is stored in the map table 5 of FIG.

First, when the user selects the monitoring screen (S431 of FIG. 9), the user views the map component information stored in XML form by referring to the map table of the database (map 5 of FIG. 6) based on the map identifier. In operation S432, the identifiers of the individual monitoring items included in the map elements and the map information are mapped (S433), and compared with the information on the failure reception (failure status 26 of FIG. 6) using the monitoring item identifiers. To determine the fault and store it in memory. After this process is performed on the entire map component (S435), the monitoring map information is processed to modify the existing map XML information (S436), and then displayed on the screen using the modified map XML information (S437).

10 is a detailed flowchart of a fault event processing flow from a fault event reception to an inquiry screen.

Failure events are classified into M / F infrastructure failure (1), M / F application failure (2), server infrastructure failure (3), server application failure (4), and network failure (5). Each resource (or monitoring item) is mapped to the CI identification code (Fig. 10 step 6). The fault event is stored in the event status table 27 of FIG. 6, the monitoring item information is stored in the configuration master table 2 of FIG. 6, and the cross-reference key is a CI identification code.

Business impact analysis only handles failures with high severity of failures (e.g., failures 1 and 2 of severity 1-5 (1: highest, 5: lowest)) Step 7 of FIG. 10.

The next step is to distinguish between the task-related and non-working faults for the fault event (step 7 of Figure 10). This indicates whether there is a relationship record between the monitoring item identifier included in the failure event and the application CI identifier among the relationship information stored in the CI relationship table 1 of FIG. 6 (fault related to the task) or not (not related to the task, Or not related).

Monitoring-related items include server, application, program, transaction code, and IMSDB. Monitoring items not related to work include network, tandem port, M / F channel, address space, are, PSB, DB2, and table. Space, storage volumes, and so on. In the case of work-related disability, all application identifiers included in the CI relationship table 1 of FIG. 6 are read (8 in FIG. 10), mapped to map configuration items (9 in FIG. 10), and displayed in the corresponding map. (11, 12, 13, 14, 15, 19 in Fig. 10). In the case of an unrelated (or unrelated) fault, the monitoring item identifier and the map configuration item are directly mapped (10 in FIG. 10) and then displayed in the corresponding map (16, 17, 18, and 20 in FIG. 10).

5, the database 303 shows the main database configuration of the business impact analysis system, and the detailed structure thereof is shown in FIG. Tables 2 and 3 below describe each table in the database.

Table number Table name Explanation Include field One CI relationship Relationship between monitoring items (CI) Source CI serial number, Target CI serial number, Source type identification code, Target type identification code, CI relation identification code 2 Configuration Master Monitoring Item Basic Information CI serial number, CI name, registration date, registered employee number, modified date, modified employee number, whether to delete, CI status code, staff number, date of deletion, CI configuration type code, ISM region code, CI description, Operation department code, administrative staff number, administrative staff number, administrative department code, administrative staff number, secondary administrative staff number, operating time number, article classification number, article unique number 3 Map template Template Information by Map Map template serial number, ISM map type identification code, file serial number, template name, template description 4 Application Subject Relationship Relationship between application and subject Application code, business initial code, subject code, application CI serial number, application name, subject name, management staff name, date of creation 5 Map Created map information Map serial number, ISM map type classification code, application CI serial number, map template serial number, date of creation, date of modification, whether or not it was completed, employee number, XML contents 6 program Detailed Information (Program) CI serial number, application CI serial number, business initial code, subject code, transaction identification code, transaction assistance code, secondary menu name, screen name 7 application Detailed Information (Application) CI serial number, application group code, CI business division code, customer service status, configuration management, application monitoring status, application monitoring tool name, DR implementation status, maintenance contractor identification code, maintenance contract date, SLA target status, CS Application 8 Application Server Transaction Relationship Application, Server Transaction Relationship Information Course code, Transaction code, Transaction code, Transaction code, Date of creation 9 server Detailed Information (Server) CI serial number, ISM server manufacturer identification code, model name, server management number, installation date, maintenance contract year, maintenance contract vendor identification code, OS classification code, OS version name, CPU speed, CPU count, CPUTPMC, memory Capacity, Internal Disk Capacity, External Disk Capacity, ITSM Management Code, ITSM Server Classification Code, Task Name, Detailed Task Name, CPU Usage, Memory Usage, Swap Usage 10 software Details (Software) CI serial number, software version name, software type identification code, software use name, product serial number, software license name, software contents, software manufacturer identification code, patch year 11 Tandem pot Detailed Information (Tantum Pot) CI serial number, tandem CI serial number 12 Bank Outer System Detailed Information (External Bank System) CI serial number, tandem port CI serial number, line name  13 channel Details (mainframe channel) CI serial number, mainframe Elpa CI serial number  14 Storage volume Details (storage volume) CI serial number, storage CI serial number

Table number Table name Explanation Include field 15 storage Details (storage) CI serial number, volume address contents, ISM region classification code, system environment name, task name, detailed task name, storage manufacturer identification code, control model name, cache configuration contents, cache capacity, drive configuration contents, physical capacity, RAID configuration contents , Usage, Port Configuration Content, Main Frequency, Date of Installation, Controller Class Classification Code, Microcode Content, Modem Number, Purchase Date, Supplier Name, Contract Date, Contract Name, Maintenance Contract Date, Maintenance Contractor Code 16 Mainframe box Details (Mainframe Box) CI serial number, date of purchase, main frame manufacturer identification code, supplier name, contract number, contract date, contract name, maintenance contract date, maintenance contractor identification code, use name, model name, product serial number, MIPS Memory capacity, Parallel channel count, ESCON channel count, FICON channel count, OSA card EX count, OSA card GB count, ICB count, ISM management code 17 Mainframe elpa Details (Mainframe Elpa) Main frame box CI serial number, main frame box CI serial number, MIPS, memory capacity, CPU utilization, page utilization, CSA utilization 18 PSB Detailed Information (PSB) CI serial number, DBPCB sequence number, PSB type classification code, PSB type classification code, PSB processing option classification code, MSDB status, multi-PCB status, PSB language classification code 19 Transaction code Details (transaction code CI serial number, PSBCI serial number, mainframe Elpa CI serial number, transaction type identification code, course code, transaction identification code 20 IMSDB Detailed Information (IMSDB) CI serial number, main frame alpha CI serial number, DB access type classification code, AREA number, segment number, RM type classification code, RM name 21 Area Details CI serial number, data set CI serial number, IMSDBCI serial number, AREA number, date of creation 22 DB2 Detailed Information (DB2) CI serial number, mainframe Elpa CI serial number 23 AddressSpace Details (AddressSpace) CI serial number, main frame alpha CI serial number, application name, application initial name, ADDRESSAPACE 24 Tablespace / table Details (Tablespace / Table) CI serial number, DB2CI serial number, storage volume CI serial number, table name, table space type classification code 25 Disability Propagation Status Disability Propagation Information Disability file number, Disability serial number, Radio system classification code, Radio classification code, Radio media classification code, Sending employee number, Receiving employee number, Recipient details, Disturbance contents, Transmission date, Load date 26 Disability Status Fault Reception and Treatment Status Information Disability Serial Number, Disability Status Classification Code, Disability Classification Code, Disability Classification Code, Disability Classification Code, Reception Path Name, Disability Critical Tool Code, ISM Disability Impact Tool Code, ISM Disability Type Classification Code, Requested Employee Number, Requested Employee Name , Requesting employee department code, requesting employee team code, requesting employee's job title, requesting employee's phone number, event serial number, event occurrence date, CI serial number, counselor's name, counselor's phone number, error occurrence date, disability termination date, disability Hours minutes, Disability Receipt Date, Escalation Date, Disability Staff Receipt Date, Department Code, Problem Serial Number, Application CI Serial Number, Disability Title, Disability Description, Satisfaction Measure 27 Event Status Event Status Information Host Name, Event Occurrence Date, Event Name, Event Critical Tool Separation Code, Fault Status, Application CI Serial Number, Event Description 28 Treatment history Disaster Action History Information Comprehensive disability treatment identification code, Comprehensive disability treatment serial number, Disability serial number, Problem serial number, Change serial number, Disposal staff number, Disposal staff name, Disposal staff department code, Disposal staff team code, Disposition staff name, Phone number of handling staff, details of action, date of processing

FIG. 11 is a diagram illustrating a connection relationship between monitoring items stored in the CI relationship information table 1 of FIG. 6, which is the most important information of the business impact analysis system 300. The individual items shown in FIG. 11 represent monitoring items, each of which has a 13-digit unique identifier (CI serial number). As shown in the CI relationship table field items of Table 2, the source CI serial number, It is stored as a pair of records such as the target CI serial number.

Hereinafter, the overall operation of the present invention will be described.

Failure generation step-If a failure occurs in the managed computer resource 800 of FIG. 4, a failure event is automatically transmitted to the individual failure monitoring tool 700 by a failure monitoring tool agent pre-installed in each computer resource 800. The failure monitoring management tool 700 may use, for example, a system failure detection zone, a network failure detection zone, an application failure detection zone, and the like.

Failure Event Integration Step-The individual failure monitoring management tool 700 of FIG. 4 automatically transmits the failure event to the central event integration management tool 500 in order to integrate management of the received failure event.

Fault internal notification step-Events sent to the event integration tool 500 is notified to the relevant staff through a short message (SMS) or e-mail by the alarm function set in advance in the event integration tool 500, the display board, situation room screen The event content is transmitted to the service desk system 600 and the like, and a trouble ticket is transmitted in a predefined format.

Fault reception phase-Service desk system 600 compares the received critical event with a pre-set importance condition, and analyzes the failure event when the failure event is more than the importance corresponding to the delivery target to the impact analysis system 300 Transmit to system 300.

Fault propagation phase-The event transmitted to the impact analysis system 300 is determined the failure severity and failure notification medium (SMS, portal site, billboard, etc.) according to the policy / rule predefined in the system, the corresponding event (or transformation) Failure message) is transmitted to the failure notification medium. The situation room (or a person with equivalent emergency response authority) checks the events received through the electronic signboard, SMS, etc., identifies the failure situation, and promptly identifies the failure situation through hot-line or in-house broadcasting, if necessary. By disseminating, business users, such as service desks, counter staff, and customer response organizations, are aware of the failure situation. Influence analysis system 300 provides a variety of functions for faster failure identification, such as failure impact analysis, failure history inquiry, system configuration inquiry, configuration information inquiry, change history inquiry.

Failover Phase-The situation room manager checks the emergency failure notification message received through the display board of the situation room and responds to the subsequent failover. The person in charge of the failover is notified of the failure situation through a mobile phone short message (SMS) and an e-mail message automatically transmitted from the event integration tool 500 and responds to the subsequent failover. The service desk receptionist detects the failure situation through the failure event inquiry screen of the failure management system and responds to the subsequent failover.

Failure Termination Step-When the failover handler completes the failure, the status of the failure event record of the service desk system 600 changes to failure completion, and the service desk system 600 changes the status of the failure event record to the completion status. Automatically transmit the failure termination message to the impact analysis system 300. The impact analysis system 300 changes the fault record state in the relevant database to the end state as soon as the failure end message is received, and at the same time, the screen processor treats the state of the monitoring screen as a normal state so that the user recognizes that the failure is over.

The configuration of the present invention described above can be realized by a computer program. In other words, each component module can be implemented as a program, stored in a recording medium to build a payment processing system, and installed in a user's mobile phone terminal. At this time, the technical scope of the present invention also extends to the recording medium on which these programs are recorded.

According to the present invention, by establishing an EA-based business monitoring system, it is possible to establish a customer-oriented service system and to secure business competitiveness for preoccupation of the market in the convergence era. Specifically, business impact analysis and response system for IT obstacles, investment prioritization according to the analysis of weak areas of work, IT ROI implementation through effective linkage with EA, ITSM, EA utilization, and enterprise-wide utilization through practical use In addition, it can be expected to continuously find high value-added services such as standardization of response management system for business monitoring and control, information analysis and strategic management support.

Claims (10)

Management tool means for detecting failures occurring in the organization's computing resources such as mainframes, servers, databases, applications, communication equipment, networks, and transmitting failure event messages; Service desk means for receiving and analyzing the failure event message to determine a failure severity level and transmitting a failure message; And an impact analysis means for receiving the failure message, comparing the failure event included in the message with the component resource information and the impact information stored in the integrated database in real time, and outputting the result data. The impact analysis means includes an application including a fault event processing module, an impact analysis processing module, and a fault event / effect screen display module; A monitoring unit for providing a user with impact analysis data processed by the application; And a database storing data processed by the monitoring unit and the application. The method of claim 1, wherein the management tool means Individual failure monitoring tools, including tools for detecting system failures in the organization, network failure detection tools, and application failure detection tools; And Comprising a system failure detection tool, a network failure detection tool, an integrated event processing tool for generating a failure event message by integrally processing the failure signal output from the application failure detection tool, business impact analysis system due to computer failure. The method of claim 1, wherein the monitoring unit of the impact analysis means In addition, the service status display screen that displays the status of what kind of work of the organization is affected by the failure of the computer resources, In addition, you can view the status of the disability actions on each disability at a glance. Work impact inquiry screen that displays the impact-related information so that you can grasp the severity of the disability and the scope of impact on the work-related disability, Work flow diagram inquiry screen for inquiring work flow that shows functions and input / output elements of work for the work-related obstacles, and the fault status of each item in the work flow diagram. A business impact analysis system due to computer failure, including a connection relationship inquiry screen indicating a relationship between items related to the monitoring item. The method according to claim 1, wherein the application of said application in impact analysis means. The fault event processing module analyzes the fault reception message received from the service desk means, compares and searches the monitoring items in the database, determines / maps the event identifier and the monitoring item, and stores the fault reception contents and the fault event status. Including, The impact analysis processing module extracts basic information and impact information stored in the master information of the database as the identifier of the monitoring item, and extracts identifiers of related items based on the relationship information between the monitoring items stored in the relationship information table. And a means for transferring the impact information and the relationship information to the fault event / effect screen display module by merging / processing the impact information and the relationship information. Receives the failure message generated from the organization's computer resources such as mainframe, server, database, application, communication equipment, and network, and compares the failure event included in this message with the configuration resource information and impact information stored in the integrated database in real time. A device that analyzes and outputs the resulting data, This device includes a monitoring unit that provides various services of impact analysis to the user through an impact analysis system implemented in the Internet environment, a fault event processing module, an impact analysis processing module, and a fault event / impact display module. And a database storing data processed by the monitoring unit and the application. The method of claim 5, wherein the monitoring unit In addition, the service status display screen that displays the status of what kind of work of the organization is affected by the failure of the computer resource, and In addition, you can view the status of the disability actions on each disability at a glance. Work impact inquiry screen that displays the impact-related information so that you can grasp the severity of the disability and the scope of impact on the work-related disability, Work flow diagram inquiry screen for inquiring work flow that shows functions and input / output elements of work for the work-related obstacles, and the fault status of each item in the work flow diagram. Apparatus for analyzing the business impact due to computer failure, including a connection relationship inquiry screen showing the relationship between the items related to the monitoring items. The method of claim 5, wherein the application of The fault event processing module analyzes the fault reception message received from the service desk means, compares and searches the monitoring items in the database, determines / maps the event identifier and the monitoring item, and stores the fault reception contents and the fault event status. Including, The impact analysis processing module extracts basic information and impact information stored in the master information of the database as the identifier of the monitoring item, and extracts identifiers of related items based on the relationship information between the monitoring items stored in the relationship information table. And a means for transferring the impact information and the relationship information to the fault event / effect screen display module by merging / processing the impact information and the relationship information. Receives the failure message generated from the organization's computer resources such as mainframe, server, database, application, communication equipment, network, and analyzes the failure event included in this message, and analyzes the component resource information and impact information stored in the integrated database. It is a method of comparing and analyzing in real time through the device and outputting the result data. When a failure occurs in the computer resource to be managed, a failure event is automatically transmitted by a failure monitoring tool agent pre-installed in each computer resource, Incorporating fault events received from individual computing resources, The integrated alarm event is notified to the staff in charge through SMS or e-mail by using the preset alarm function, the content of the event is transmitted to the billboard, the situation room screen, and the trouble ticket in the predefined format. Fault internal notification step for transmitting Ticket, A failure reception step of comparing the received criticality event with a preset criticality condition and transmitting the corresponding failure event to the impact analysis system when the criticality level is greater than or equal to the delivery target to the impact analysis device; According to the fault severity and fault notification medium, the event sent to the impact analysis device is transmitted to the fault notification medium according to the fault severity and fault notification medium, so that business users can recognize and respond to the fault situation. A method of analyzing business impact of computer disturbances, including a disability propagation step. The method of claim 8, When the user who checks the failure notification message received by the failure propagation step changes the status of the failure event record to failure completion in order to take a countermeasure, the failure termination message is further transmitted to the impact analysis device. Including, business impact analysis method due to computer failure. A computer recording medium having recorded thereon a program for implementing the method of claim 8 or 9.

Images