JP2000231500A - Fault analyzer - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable even a person having no considerable knowledge about analysis of trace information to analyze the trace information. SOLUTION: Intrinsic difference in trace information of each piece of package software is removed by an intrinsic difference removing means 11 and information to be analyzed from which the intrinsic difference is removed is stored in an information to be analyzed storage means 12. The information to be analyzed is analyzed by using information for analysis stored in a information storage means 13 for analysis by an analyzing means 14. Thus, the analysis of trace information can be automated. The trace information can be analyzed by the person having no knowledge about the analysis of the trace information and the analysis of the trace information is not necessarily entrusted to an engineer at a development origin.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus for analyzing a failure in a computer system, and more particularly to an apparatus for efficiently analyzing trace information of package software.

[0002]

2. Description of the Related Art A conventional technique in the technical field to which the invention belongs will be described below with reference to the drawings.

FIG. 8 schematically shows a conventional failure analysis procedure. Most package software has a trace function in case a failure occurs. Each package software has trace information obtained as a result of the trace function. In FIG. 8, the system 100 includes, for example,
Package software A, B and C are installed. Each software package A, B and C are created each trace information T _A, the T _B and T _C.

When a failure has occurred in each package software, the cause of the failure is investigated by analyzing each trace information. For example, if a failure occurs in the package software A, the trace information T _{A of the} package software _A
Is analyzed. The analysis of the trace information is difficult, and the person who analyzes the trace information needs to have considerable knowledge of the package software. For this reason, the analysis of the trace information T _A is often left to the engineer of the developer of the package software A. The developer engineer manually analyzes the trace information T _A based on his own experience. Analyzing a huge amount of character-based trace information manually is time consuming.

[0005] By the way, failures of package software are not limited to those requiring program modification by a developer of the developer for recovery. For example, failures caused by inadequate definition information for normal operation of package software, failures in modules, but failures that can be dealt with by the latest module that have already been resolved and can be dealt with simply by replacing the module. There are also some relatively minor failures. In some cases, such a failure can be solved without being a developer engineer.

For example, the package software is provided with definition information in a special file so that the user of the package software can customize the operation of the package software. The fact that the definition information does not meet the usage conditions required by the package software is one of the causes of the failure.

An example in which the definition information does not meet the use conditions will be described. Assume that there is package software that can customize the memory usage in the definition information. It is assumed that the usage condition of the package software is 3 MB or more as a memory usage. However, if the memory usage is 1 MB in the definition information, a failure may occur due to insufficient memory. Such deficiency of definition information is a relatively minor cause of failure, and does not require a program change by a technician who is the developer of the package software.
Once the cause of the failure is known, it can often be dealt with immediately.

[0008]

As described above, the analysis of the trace information is performed manually, which takes time. An object of the present invention is to automate the analysis of trace information.

As described above, analysis of trace information requires considerable knowledge of package software. Therefore, even if the failure is caused by a relatively minor failure, the trace information cannot be analyzed by anyone who has no experience with the actual failure or trace information analysis. There was a problem that can not be.

When the analysis of trace information is entrusted to a technician having considerable knowledge of the developer of the package software, it takes time to exchange information between the user of the package software and the technician of the developer. Many. As a result, there is a problem that even if the failure is caused by a relatively minor failure and the solution does not take much time, system recovery is delayed.

The present invention further enables trace information to be analyzed by a person who does not have considerable knowledge of trace information analysis. It is another object of the present invention to allow an analyst to understand a countermeasure for solving a failure.

Another object of the present invention is to prevent time-consuming exchange of information with a technician of a developer, and to enable quick recovery of a system from a failure.

[0013]

According to the present invention, in order to solve the above-mentioned problems, a failure analysis apparatus removes a unique difference of trace information of each package software and removes a unique difference as information to be analyzed. Means, analyzed information storage means for storing the analyzed information, analysis information storage means for storing analysis information that is information used for failure analysis,
An analysis unit is provided for analyzing the analyzed information stored in the analyzed information storage unit based on the analysis information stored in the analysis information storage unit.

An inherent difference in trace information of each package software is removed, and the analyzed information from which the inherent difference has been removed is stored. When a failure occurs, the analyzed information is analyzed using the analysis information.

Thus, the analysis of the trace information can be automated. A person who has no knowledge of the analysis of the trace information can analyze the trace information, so that the analysis of the trace information does not necessarily have to be left to a developer engineer.

Further, since the failure analyzer removes the inherent difference of the trace information of each package software and creates the analyzed information, it is possible to analyze the trace information of any package software. When introducing new package software, it is possible to make the failure analysis apparatus according to the present invention compatible with the new package software only by modifying a part of the failure analysis apparatus according to the present invention.

According to the present invention, the fault analysis device includes a countermeasure storage means for storing a countermeasure for each fault occurrence cause, an analysis result by the analysis means, and an output means for outputting a countermeasure corresponding to the analysis result. Further provision.

Thus, it becomes possible for an analyst to know a countermeasure. In the case of a failure caused by a relatively minor cause of failure, the analyst can solve the failure based on his / her own measures. Even if the failure is caused by a relatively minor cause of the failure and it does not take long to resolve the failure, it takes time to exchange information between the user and the developer. The problem of delayed recovery is eliminated.

Further, even in the case of a fault that cannot be solved by the developer of the developer, the analysis result is notified to the developer of the developer, so that it is possible to promptly deal with the fault.

[0020]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will be described below with reference to the drawings. The same elements as those in the conventional example are denoted by the same reference numerals, and description thereof will be omitted. The same reference numerals are given to the same elements in each drawing used in the description of the embodiments.

FIG. 1 is a diagram showing the principle configuration of a failure analysis device according to the present invention. As shown in FIG. 1, a failure analysis device 1 according to the present invention includes an inherent difference removing unit 11, an analyzed information storage unit 12, an analysis information storage unit 13, and an analysis unit 1.
4, a measure storage means 15, an analysis result storage means 16, and an output means 17 are provided.

The unique difference removing means 11 removes the unique difference of the trace information of each package software to obtain analyzed information. Since there is no unified standard for the trace function, the trace information of each package software differs for each package software. Therefore, in order to enable the trace information of each package software to be handled by the failure analysis device according to the present invention, a part different from each trace software by each package software, that is, a specific part that can be analyzed by removing the unique difference from each trace software. The format information, that is, the information to be analyzed.

After the inherent difference of the trace information of each package software is removed by the inherent difference removing means 11, the trace information of all package software is centrally managed as the analyzed information by storing it in the analyzed information storage means 12 described later. It becomes possible to do.

Further, since the analyzed information is created by removing the inherent difference of the trace information of each package software, it is possible to analyze the trace information of any package software.

Further, when new package software is introduced, the unique difference removing means 1 of the failure analyzer according to the present invention is used.
By simply modifying a part of the software, the fault analysis device according to the present invention can be made compatible with the new package software.

The analyzed information storage means 12 stores the analyzed information, which is the trace information from which the unique difference has been removed by the unique difference removing means 11. More specifically, the analyzed information storage means 12 functions as a database for centrally managing the analyzed information.

The analysis information storage means 13 stores analysis information which is information for analyzing the analyzed information.
The analysis information predefines how to analyze the trace information so that even those who do not have considerable knowledge about the package software can analyze the trace information.

More specifically, the analysis information is a query for searching for the analyzed information stored in the analyzed information storage means 12 which is a database. The query is a specification of a database name, a table name, a search condition, and the like, which are created for processing data in the database. The information for analysis is a general database management system operation language, for example, SQL (Structured).
Query Language).

Trace information on a fault that has occurred in the past has a certain type for each fault cause. That is, a unique feature / typical form appears in the trace information for each cause of failure. The information for analysis is information on the characteristic and fixed form unique to each failure occurrence cause that appears in the trace information. Therefore, analysis information is provided for each failure mode, and each analysis information completely depends on the content of the failure. As a result of searching the analyzed information stored in the analyzed information storage unit 12 using the analyzed information, if the analyzed information is present, it indicates that a failure corresponding to the analyzed information has occurred. Will be.

In other words, the analysis information plays a role as know-how for analyzing the information to be analyzed and determining what is the cause of the currently occurring failure. For example, the function name is function X of package software A.
_1, there is trace data error code of X ₂ comments are displayed, and the error code in the process Y ₁ of process name suite B within 5 seconds of the trace data, the comment that Y ₂ It is assumed from the past experience and the like that it is known from the past experience or the like that the presence of the trace data indicated by indicates that a failure has occurred in the communication module of the package software A and B.

This know-how is defined in the information for analysis. More specifically, the analysis information, "module Y ₁ of process name package software B, and a trace data error code of Y ₂ comments are displayed within 5 seconds before the output of the trace data , the function name is a function X ₁ software packages a, providing a query that trace data "error code that X ₂ in the comments are displayed. Further, as a result of searching the analyzed information using the query for the analysis information, a determination is made that "if the corresponding trace data exists, it indicates the occurrence of a failure in the communication module of the package software A".

By providing such analysis information, even those who do not have considerable knowledge about package software can analyze the trace information. In addition, it is possible to increase the number of faults that can be handled by adding the information for analysis without modifying the entire fault analysis device.

The analyzing means 14 includes the analyzed information storing means 12
The information to be analyzed stored in the analysis information storage means 1
The analysis is performed on the basis of the above-mentioned analysis information stored in 3. More specifically, the analysis unit 14 functions as a database management system that is a unit that maintains and operates the analyzed information storage unit 12 that is a database. The analysis information is used as a query for searching the analyzed information storage unit 12.

The countermeasure storage means 15 stores countermeasures necessary for solving the fault for each fault occurrence cause. The analysis result storage means 16 stores detailed analysis results.

The output means 17 outputs a fault management number for identifying the cause of the failure found by the analysis and the countermeasures and the like stored in the countermeasure storage means 15 for the found cause of the failure.

The fault management number is a number used by the developer of the package software to manage the fault. The developer of the package software stores data relating to faults that have occurred in the past and manages them by assigning a fault management number to each fault. Therefore, when the failure management number is found, the developer can quickly respond to the failure based on the past data.

As a result, as a result of analyzing the trace information, the analyst can know the necessary countermeasures for solving the detected fault. In addition, even in the case where the analyst cannot cope with the problem, the trouble management number is notified to the developer of the package software, so that the trouble can be promptly dealt with.

FIG. 2 is a diagram showing a device configuration of a fault analysis device according to the present invention. In FIG. 2, a failure analysis device 1
Is a CPU (Central Processing)
(Unit) 21, a memory 22, an input device 23, an output device 24, an external storage device 25, and a network interface 26. Each device is connected via a bus 27.

The CPU 21 controls the operation of each device such as the memory 22 connected via the bus 27. CPU2
Reference numeral 1 denotes a unique difference removing unit 11 and an analyzing unit 14 shown in FIG.
It realizes the function of.

The memory 22 stores programs being executed, data being processed, and the like. For example, RAM (Rando
m Access Memory), ROM (Read
Only Memory) or the like. A program for causing each device to execute the function of the failure analysis device 1 according to the present invention is read from the external storage device 25,
It can also be obtained by downloading from a network via the network interface 26.

The input device 23 is used by an analyst who analyzes using the failure analysis device 1 to input instructions, data, and the like. For example, a mouse, a keyboard, and the like are conceivable. The output device 24 is a device for outputting a result processed by the failure analysis device 1 to an analyst. The function of the output unit 17 is realized. For example, a display, a projector, a printer, and the like can be considered.

The external storage device 25 stores programs and data. As a storage medium, HD (Hard Dis
k) and FD (Floppy Disk) and other MD (M
magnetic disk), CD (Compact)
Disk) and MO (Magneto Optical)
optical disks and magnetic tapes such as disks).

The above-mentioned memory 22 and external storage device 25
Stores a program for realizing the functions of the unique difference removing unit 11 and the analyzing unit 14 shown in FIG. 1, and stores the analyzed information storage unit 12, the analysis information storage unit 13, the countermeasure storage unit 15, and the analysis result. For example, the function of the storage unit 16 is realized.

The network interface 26
It is for connecting to a network and exchanging data with devices connected via the network. The present invention can be used to obtain trace information of package software to be analyzed for a failure or to obtain a program for causing each apparatus to execute the function of the failure analysis apparatus according to the present invention.

FIG. 3 is a diagram showing the configuration of one embodiment of the failure analysis device according to the present invention. As shown in FIG.
The system 30 and the failure analysis device 1 are connected via a network 31. The system 30 includes one or more package software. Here, as an example, package software A, B, and C are installed.
Each software package A, B and C are created each trace information T _A, the T _B and T _C.

The network 31 is, for example, a public line network, a WAN (Wide Area Network),
LAN (Local Area Network), C
ATV (Cable TeleVision), the Internet, and the like.

The failure analysis device 1 provides the trace information T _A , T _B
And T _C to obtain over the network 31. Fault analysis device 1, the trace information T _A, obtained, T _B and T
_C is analyzed through the above process.

FIG. 3 is merely an example, and it goes without saying that the configuration of the device to which the fault analysis device according to the present invention is applied is not limited to this example. For example, there may be more than one system 30. Although the system 30 and the failure analyzer 1 according to the present invention are connected to a network 31,
It may be provided in the system 30. Failure analysis device 1
May not be connected to the system 30. In this case, the trace information to be analyzed can be stored in a portable storage medium, and the external storage device 25 shown in FIG. 2 can be loaded with the portable storage medium to obtain the trace information. .

FIG. 4 is a diagram showing the configuration of the unique difference removing means of the failure analyzer according to the present invention. As shown in FIG. 4, the eigen-difference removing unit 11 includes an A-specific unit 41 and a B-specific unit 4.
2, a C-specific unit 43 and a common unit 44.

As described above, as an example, three package software A, B and C are installed in the system 30. Each package software is provided with a trace function. Each software package A, B and C, to create a trace information T _A, T _B and T _C.

[0051] A specific part 41, respectively B specific part 42, and C-specific part 43 is provided corresponding to the trace information T _A, T _B and T _C. Each package software is provided with a trace function. Each package software A,
B and C, to create a trace information T _A, T _B and T _C.

Since many package softwares are often developed individually, the format of the trace information created by each package software often differs. FIG. 5 is an example of a format of trace information created by the package software. The outline of the contents of the trace information shown in FIG. 5 will be described. The first two digits of the trace number 51 indicate the number of the trace data in the trace information. The next six-digit character string, process ID 52, indicates the process that is outputting the trace data. Next 2
The digit number and the module identifier 53 are unique to the trace information, and indicate each module constituting the package software. The one-digit number next to the “/” symbol and the module location identifier 54 are also unique to this trace information. It indicates which part of the module, and specifies in more detail which process the trace data was output.

The portion shown on the right side has two patterns. The pattern 55 is a format called a memory dump, in which information stored in the memory by the program is output as it is as trace data. The pattern 56 displays the output date / time information of the trace data, the function name, and all or some of the parameters passed to the function.

As shown in FIG. 5, it can be seen that considerable analysis is required to analyze the trace information as it is. FIG. 5 is only an example of trace information. As described above, the format of the trace information differs depending on the package software, and may include information unique to the package software. The information provided in the trace information differs depending on the package software. Even if similar information is provided, there may be a difference in the amount of the information.

For example, the package software A provides only time information and an error code as trace information.
The package software B provides the process name instead of the process ID in the trace information. The package software C provides time information in the trace information, and the unit of the time information is millisecond. Such a difference in the format of the trace information for each package software is called a unique difference.

The method of obtaining trace information from the system to the failure analysis means is as described above. In order to store such trace information in a common database, it is necessary to remove this inherent difference.

The A unique unit 41, the B unique unit 42, and the C unique unit 43 remove an inherent difference derived from the uniqueness of each package software included in each trace information. The removal of the inherent difference is performed by preparing a standard format and adjusting the format of the trace information of each packaged software to the standard format.

FIG. 6 shows one item of information provided in the standard format. In FIG. 6, the standard format includes date / time information, process information,
Has a function name and comment.

The date / time information 61 is information necessary for arranging trace information of each package software in time series. When adjusting each trace information to the standard format, differences in time units are also removed.

The process name 62 is information necessary for specifying the process outputting the trace data.
If the trace information does not provide a process name, a process ID or the like is substituted.

The function name 63 is information necessary for specifying which process the trace information was output during. If the function name is not provided in the memory dump format, specify whether it is transmission processing or reception processing.

The date / time information 61, process name 62
The (or process ID) and the function name 63 (or the specification of transmission processing or reception processing) are provided in most trace information.

The comment 64 is information other than the information items of the standard format. This is an item for storing information unique to each trace information that does not match the information item of the standard format as a result of removing the inherent difference.

Each unique part removes a unique difference between the trace information by adjusting the format of each trace information to a standard format. Each unique unit uses each trace information as a database data in a highly versatile data format, for example, a CSV format (Comma Separa).
ted Value).

The CSV format is a format for storing data of a database or spreadsheet software, and is a format in which the contents of each item or cell are listed by separating them with commas. C
The SV format file is stored as a text file and is a general-purpose format that can be handled by many package software.

The trace information of each package software converted into the standard format by each of the unique units 41, 42, and 43 has a different context as it is, and therefore, the history of the failure is unclear.

The common unit 44 rearranges the trace information of each package software converted into the standard format in a time series based on the time information to obtain analyzed information. The analyzed information is stored in the analyzed information storage unit 12. The analyzed information storage means 12 functions as a database for centrally managing the analyzed information.

FIG. 7 is a flowchart of a failure analysis process performed by the failure analysis device according to the present invention. First, the analyst starts the failure analysis device 1 (step S10).

Subsequently, the analyst specifies trace information to be analyzed (step S11). Specifically, the trace information of the failed package software is specified. The unique difference removing means 11 removes the unique difference of the designated trace information and stores the same in the analyzed information storage means 12 (step S12).

The analyst specifies analysis information (query) to be used for failure analysis among the analysis information stored in the analysis information storage means 13 (step S13).
When the cause of the failure can be identified to some extent from the failure status currently occurring in the system 30, the time required for the failure analysis can be reduced by specifying the analysis information in this way.

It is also possible to perform a failure analysis on all the analysis information without specifying the analysis information. The analysis means 14 analyzes the analyzed information using the information for analysis (step S14). More specifically, the analyzed information stored in the analyzed information storage unit 12 which is a database is searched using the analysis information which is a query.

As a result of the analysis, when information corresponding to the analysis information exists in the analyzed information, the cause of the failure corresponding to the analysis information has occurred in the package software (step S15, Yes). ). Accordingly, the cause of the failure can be specified. The analyzing means 14 outputs the fault management number of the cause of the fault and the countermeasure.
Output to If it is determined from the cause of the failure that the analyst himself can cope, a specific countermeasure for the cause of the failure stored in the countermeasure storage unit 15 is output to the output unit 17 (step S16). ). If not, it outputs a message such as inquiring the developer engineer.

When there are a plurality of faults corresponding to the analysis information, the analyzing means 14 outputs the fault management numbers and countermeasures of all the faults to the output means 17 as described above. As an example of a specific countermeasure, an analyst specifies a part to be confirmed, a module to be replaced, and the like.

From this output, the analyst knows a countermeasure for solving the fault. As described above, it is possible to analyze the trace information even if the developer does not have considerable knowledge. As a result of the analysis, if it is determined that the failure can be dealt with by the analyst himself, the failure can be quickly resolved.

Therefore, even if it does not take much time to solve the fault itself, the problem of the conventional problem that the recovery of the system is delayed because the exchange with the technician of the developer takes time is a problem. Will be resolved.

As a result of the output, if it is determined that the failure is caused by a failure that cannot be dealt with by the analyst such that the program must be corrected by the developer of the developer, the analyst determines the failure management number and the analysis. Communicate the result to the developer engineer. As a result, it is possible to promptly respond to the engineer of the developer.

Subsequently, the analysis means 14 stores the failure analysis result in the analysis result storage means 16 (step S17).
As a result of the analysis, when the information corresponding to the analysis information does not exist in the analyzed information (step S15, No), the fact that the information corresponding to the specified analysis information does not exist is output to the output device 24 (step S15). S18).

Subsequently, if the analysis information has been specified in step S13, the analysis means 14 determines whether or not the analyzed information has been analyzed for all the analysis information. This determination may take the form of asking the analyst whether or not the analyzed information has been analyzed for all the analysis information (step S19).

As a result of the determination in step S19, when the analyzed information has not been analyzed for all the analysis information, or when it is determined that there is still analysis information that the analyst considers to be used (step S19, No) ), And return to step S13 described above.

As a result of the determination in step S19, if the analyzed information has been analyzed for all the analysis information, or if it is determined that there is no more analysis information to be used by the analyst (step S19, Yes), the analysis is performed. Is output to the output device 24 to the effect that there is no failure corresponding to the application information (step S
20), and proceed to step S17 described above.

As described above, according to the fault analysis device according to the present invention, it is possible to automate the analysis of the trace information. Although the embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, and various other modifications can be made within the technical idea of the present invention.

For example, in FIG. 1, the unique difference removing means 11, the analyzed information storage means 12, the analysis information storage means 13, the analysis means 14, the countermeasure storage means 1 of the failure analysis apparatus 1
5. Each means of the analysis result storage means 16 and the output means 17 is provided in one device. However, it is also possible to provide the above means in a plurality of devices connected via a network.

[0083]

According to the present invention, the analysis of trace information can be automated. A person who has no knowledge of the analysis of the trace information can analyze the trace information, so that the analysis of the trace information does not necessarily have to be left to a developer engineer.

Further, since the failure analyzer removes the inherent difference of the trace information of each package software and creates the analyzed information, it is possible to analyze the trace information of any package software. When introducing new package software, it is possible to make the failure analysis apparatus according to the present invention compatible with the new package software only by modifying a part of the failure analysis apparatus according to the present invention.

The analyst can know the countermeasure.
In the case of a failure caused by a relatively minor cause of failure, the analyst can solve the failure based on his / her own measures.

Further, even in the case of a fault that cannot be solved by a developer of the developer, it is possible to promptly deal with the fault by notifying the engineer of the analysis result of the analysis.

[Brief description of the drawings]

FIG. 1 is a principle configuration diagram of a failure analysis device according to the present invention.

FIG. 2 is a device configuration diagram of a fault analysis device according to the present invention.

FIG. 3 is a configuration diagram of an embodiment of a failure analysis device according to the present invention.

FIG. 4 is a configuration diagram of a unique difference removing unit of the failure analysis device according to the present invention.

FIG. 5 is a diagram illustrating an example of a format of trace information created by package software.

FIG. 6 is a diagram showing an example of information items provided in a standard format.

FIG. 7 is a flowchart of a failure analysis process performed by the failure analysis device according to the present invention.

FIG. 8 is a schematic diagram of a conventional failure analysis method.

[Explanation of symbols]

REFERENCE SIGNS LIST 1 failure analysis device 11 unique difference removing means 12 analyzed information storage means 13 analysis means 14 analysis information storage means 15 output means 16 analysis result storage means 17 output means 21 CPU 22 memory 23 input device 24 output device 25 external storage device 26 Network interface 27 Bus 30 System 31 Network 41 A unique unit 42 B unique unit 43 C unique unit 44 Common unit 51 Trace number 52 Process ID 53 Module identifier 54 Module location identifier 55, 56 Pattern 61 Date / time information 62 Process name 63 the function name 64 comments A, B, C package soft T _A, T _B, T _C trace information

Claims (2)

[Claims] 1. A failure analysis device for automatically performing a failure analysis, wherein a unique difference in trace information of each package software is removed.
Eigen-difference removing means as analyzed information; analyzed-information storing means for storing the analyzed information; analyzing-information storing means for storing analysis information that is information used for failure analysis; Analysis means for analyzing the analyzed information stored in the information storage means based on the analysis information stored in the analysis information storage means. 2. The apparatus according to claim 1, further comprising: a countermeasure storage unit configured to store a countermeasure for each fault occurrence cause; an analysis result by the analysis unit; and an output unit configured to output a countermeasure corresponding to the analysis result. Item 2. The failure analysis device according to item 1.