JP2004213302A - Error monitoring device, error monitoring method, computer-readable storage medium, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To collectively manage an effective and proper coping method to an application software error due to combination of a plurality of factors for clearly showing an error coping method flexibly coping with various and complicated application software errors occurring in a plurality of monitored devices to a system manager. <P>SOLUTION: Databases 29-1 to 29-4, to which a single/plurality of error log coping method/methods is/are related, are constructed. On the basis of an error log file acquired from the monitored device via a network by means of an error log monitoring part 24, a DB retrieval part 25 retrieves an effective coping method by referring to the databases 29-1 to 29-4, and then, the retrieved result is informed to a predetermined notification destination. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an error monitoring device and an error monitoring method for monitoring error logs of a plurality of data processing devices that can communicate via a network, a computer-readable storage medium, and a program.
[0002]
[Prior art]
2. Description of the Related Art In recent years, personal computers have rapidly become widespread due to price reductions and many other application softwares have been developed and sold.
[0003]
Many application softwares do not operate independently, but cooperate with an operating system, and also cooperate with other software and hardware.
[0004]
Therefore, even if an error occurs while using certain application software, not only the application used at the front desk but also other related software, network and hardware, etc., various factors are conceivable. Takes a lot of time.
[0005]
As a method of coping with such an error, a user himself / herself voluntarily connects to a support site such as the Internet to obtain a solution.
[0006]
On the other hand, the support site is designed to return answers to inquiries, but inquiries also require knowledge of each product and familiarity with the installed system environment. In addition, it is not unusual to take a lot of trouble and time to actually respond.
[0007]
JP-A-8-314763 proposes a log information analysis device that analyzes the contents of a log file and notifies necessary information according to a person who refers to the log information with easy-to-understand contents when necessary. I have.
[0008]
[Patent Document 1]
JP-A-8-314763
[0009]
[Problems to be solved by the invention]
However, in the above method, the time when an error occurs in a plurality of software is considered. In an environment where a plurality of software and hardware operate in conjunction with each other as described above, the cause of the error may be considered. Difficult to identify.
[0010]
In addition, it is necessary to register a possible error handling method in advance, and when a handling method cannot be obtained, there is a problem that there is no further solution means, and it is not possible to shift to an error elimination operation.
[0011]
The present invention has been made to solve the above problems, and an object of the present invention is to deal with a single or a plurality of error logs in an error log file obtained from a monitored device via a network. By constructing a database associated with the method, based on the obtained error log file, search for an effective coping method by referring to the database, and by notifying the searched result to a predetermined notification destination, Effectively and appropriately dealing with application software errors consisting of a combination of multiple factors in a unified manner to flexibly handle various and complex application software errors that occur in multiple monitored devices A convenient error monitoring device and an error monitoring method capable of clearly indicating a method to a system administrator, and Computer to provide a readable storage medium, and program.
[0012]
[Means for Solving the Problems]
A first invention according to the present invention is an error monitoring device (error monitoring device 5 shown in FIG. 1) for monitoring error logs of a plurality of data processing devices communicable via a network, wherein each data processing device An acquisition unit (the error log monitoring unit 24 shown in FIG. 6) for periodically acquiring the accumulated error log file, and a single or a plurality of error log handlings for the error log file acquired by the acquisition unit Databases associated with the methods (keyword DB 29-1 (FIG. 2), coping method DB 29-2 (FIG. 3), combination log DB 29-3 (FIG. 4), Web server DB 29-4 (FIG. 5) shown in FIG. ) And search means for searching for an effective countermeasure by referring to the database based on the error log file acquired by the acquisition means (DB search shown in FIG. 6). 25) and a notifying unit for notifying a result notified by the searching unit to a predetermined notification destination (the control unit 22 shown in FIG. 6 notifies the processing result notification screen shown in FIG. 15 via the communication unit 21). And characterized in that:
[0013]
According to a second aspect of the present invention, when a valid coping method cannot be searched by the search means, a predetermined Web server is searched based on the acquired log file via the network, and a valid coping file is searched for. It is characterized by having Web server reference means for acquiring (the control unit 22 shown in FIG. 6 performs reference processing via the communication unit 21).
[0014]
A third invention according to the present invention is characterized in that the notifying means notifies a predetermined notification destination of information on a valid response file acquired by the Web server reference means.
[0015]
According to a fourth aspect of the present invention, in any one of the databases, one or a plurality of error log handling methods can be newly registered or the content can be updated (the registration screen shown in FIG. 11 and the log shown in FIG. 12). Input screen).
[0016]
A fifth invention according to the present invention relates to an error monitoring method in an error monitoring device for monitoring error logs of a plurality of data processing devices communicable via a network, wherein an error log stored in each data processing device is provided. An acquisition step (steps S301 and S302 in FIG. 7) for periodically acquiring a file and a database in which one or a plurality of error log handling methods are associated with the error log file acquired in the acquisition step. A search step (steps S303 to S312 in FIG. 7) for referencing and searching for an effective coping method, and a notification step (steps S313 and S315 in FIG. 7) for notifying a predetermined notification destination of the result searched by the search step. 316).
[0017]
According to a sixth aspect of the present invention, when an effective coping method cannot be searched in the search step, a predetermined Web server is searched based on the acquired log file via the network, and an effective coping file is searched for. It is characterized by having a Web server reference step of acquiring (steps S401 to S410 in FIG. 9).
[0018]
A seventh invention according to the present invention is characterized in that the notifying step notifies a predetermined notification destination of information on a valid response file acquired in the Web server reference step.
[0019]
An eighth invention according to the present invention is characterized in that any one of the databases enables a plurality of error log handling methods to be newly registered or updated (steps S501 to S506 in FIG. 10).
[0020]
A ninth invention according to the present invention is characterized in that a program for executing the error monitoring method according to any one of claims 5 to 8 is stored in a computer-readable storage medium.
[0021]
A tenth invention according to the present invention is a program for executing the error monitoring method according to any one of claims 5 to 8.
[0022]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 1 is a system configuration diagram showing an example of a data processing system to which the error monitoring device according to the first embodiment of the present invention can be applied.
[0023]
In FIG. 1, reference numerals 1 to 3 denote manufacturer Web servers which are individually managed by manufacturers who develop and sell various applications, and are configured to be able to communicate with an error monitoring device 5 via the Internet 4.
[0024]
The error monitoring device 5 is configured to be able to communicate with monitored devices 7 and 8 via a local network 6.
[0025]
A keyword database 11 manages log files and keywords for each keyword ID in a data structure shown in FIG. Reference numeral 12 denotes a coping method database which manages information on coping methods for each coping method ID in a data structure shown in FIG.
[0026]
A combination log database 13 manages combinations of a plurality of coping methods for each combination ID in a data structure shown in FIG. Reference numeral 14 denotes a Web server database which manages information on a URL file for acquiring a coping method for each URL_ID in a data structure shown in FIG. Each of the databases 11 to 14 is composed of, for example, a storage unit constituted by a hard disk and a computer which responds to a data request. The error monitoring device 5 refers to each of the databases 11 to 14 to determine an error handling method on the network. To an administrator PC (not shown).
[0027]
Reference numerals 7 and 8 denote monitored devices, which start various applications installed on a hard disk or the like by a predetermined OS and perform desired data processing. The monitored device 7 stores and manages the log file 9 on a hard disk (not shown) or the like. Similarly, the monitored device 8 stores and manages the log file 10 on a hard disk (not shown) or the like.
[0028]
FIG. 6 is a block diagram illustrating the configuration of the error monitoring device 5 shown in FIG. Although the system shown in FIG. 1 shows a case where the databases 11 to 14 are configured as external devices, in the present embodiment, the databases 11 to 14 are constructed in an external storage device (storage unit) 29 connected via an I / F. Here is an example.
[0029]
In FIG. 6, a communication unit 21 communicates with the monitored devices 7 and 8 via the network 6 and communicates with the manufacturer Web servers 1 to 3 or a commercial server (not shown) via the Internet 4 by a predetermined protocol. Perform communication processing. A control unit 22 includes a CPU, a RAM, and a ROM, loads an OS stored in a storage unit 29 onto the RAM, and loads various applications from the storage unit 29 onto the RAM to perform various data processing and processing. An error monitoring process according to the present invention is performed.
[0030]
In the storage unit 29, the keyword database 29-1 is equivalent to the database 11 shown in FIG. 1, and manages log files and keywords for each keyword ID in the data structure shown in FIG.
[0031]
Reference numeral 29-2 denotes a coping method database, which manages information on coping methods for each coping method ID in a data structure shown in FIG.
[0032]
Reference numeral 29-3 denotes a combination log database, which manages combinations of a plurality of coping methods for each combination ID in a data structure shown in FIG. Reference numeral 29-4 denotes a Web server database, which manages information on a URL file for acquiring a coping method for each URL_ID in a data structure shown in FIG.
[0033]
Each of the databases 29-1 to 29-4 is composed of, for example, a hard disk, and the control unit 22 obtains an error log file from the monitored device 7 or the monitored device 8, and the respective databases 29-1 to 29-4. , An error handling method is notified to an administrator PC (not shown) on the network.
[0034]
Here, each database is described as a separate database, but may be configured as one database that can manage items for each ID.
[0035]
An acquisition information storage area 29-5 temporarily stores an error log file from the monitored device 7 or 8.
[0036]
Reference numeral 28 denotes a storage control unit that controls a database reference request to the storage unit 29 and updates the database. An input unit 30 includes a keyboard, a pointing device, and the like.
[0037]
Reference numeral 24 denotes an error log monitoring unit that performs a process of acquiring the error log files 9 and 10 from the monitored device 7 or the monitored device 8 on the network 6 at a preset timing or a designated timing. Reference numeral 25 denotes a DB search unit. The DB search unit 25 searches the databases 29-1 to 29-4 from the monitored device 7 or the monitored device 8 on the network 6 based on the error log files 9 and 10. Then, the search result is notified to the administrator PC of the administrator on the network 6 via the communication unit 21. Reference numeral 26 denotes a display control unit which controls data display on the display unit 27.
[0038]
FIG. 7 is a flowchart illustrating an example of a first data processing procedure in the error monitoring apparatus according to the present invention. The control unit 22 illustrated in FIG. 6 loads a monitoring processing program from the storage unit 29 or the like onto the RAM. Corresponds to the procedure to be performed. In addition, S301 to S316 indicate each step.
[0039]
First, in step S301, it is monitored according to a preset schedule, for example, whether or not an error log file exists in a history area managed in a storage device in the monitored device 7, and in step S302, an error is detected. Whether there is a log or not is determined for the log file written in the log file name of the keyword DB shown in FIG. For example, if a log file is of a type that can be created when an error occurs, the presence or absence of the error log is determined based on whether or not the error log file exists. When an error occurs, an error is written to an existing file as shown in FIG. If the type of the error log file is the type in which the content is added, the presence or absence of the error log is determined based on whether or not the error log file exists and a newly written portion exists. If it is determined that there is no error log, the process returns to step S301, and the error log file is monitored again according to the schedule interval.
[0040]
On the other hand, if it is determined in step S302 that there is an error log, the process proceeds to step S303, in which the DB search unit 25 searches the keyword DB 29-1 for a keyword that has been set, and proceeds to step S304. To determine whether the keyword has been hit.
[0041]
In this embodiment, since most log files are written in text, a text-based search can be easily performed. If the text format is not used, a separate searchable program or the like is used. In this embodiment, “?” In the keyword column shown in FIG. 2 is an arbitrary single character.
[0042]
On the other hand, if it is determined in step S304 that the keyword has been hit, the process proceeds to step S305, where the DB search unit 25 searches the coping method DB 29-2 of the data structure shown in FIG. It is determined whether an error message corresponding to is present.
[0043]
For example, in step S304, SoftA @ apl. If there is an error message “err.200” in the log, the keyword “Err. ???” is hit, so it becomes “keyword hit” and the coping method DB is searched.
[0044]
In this case, SoftA @ apl. Since only “err.204” is registered in the log, no error message is hit in step S306.
[0045]
On the other hand, if it is determined in step S304 that the keyword has not been hit, it is an unknown problem, so the process proceeds to step S315, and the fact is notified to the administrator PC (not shown) via the network 6, The process moves to step S308.
[0046]
If it is determined in step S306 that no error message has been hit, it means that the error message is an unknown error message. Therefore, in step S314, a Web server reference processing routine is executed, and the process proceeds to step S308.
[0047]
On the other hand, if it is determined in step S306 that the error message has been hit, in step S307, the corresponding coping method ID is obtained from the coping method DB 29-2 having the data structure shown in FIG. Store at -5.
[0048]
Next, in step S308, it is determined whether or not all the keywords in the error log file obtained in step S302 have been processed. If it is determined that keywords that have not been searched remain, the process returns to step S303. The same processing is performed again.
[0049]
On the other hand, if it is determined in step S308 that all the keywords have been processed, it is determined in step S309 whether all the error log files obtained in step S301 have been processed. If it is determined that is left, the process returns to step S302, and the same process is performed again.
[0050]
As a result, the processing has been performed for all error log files and keywords.
[0051]
On the other hand, if it is determined in step S309 that the search for all error log files has been completed, it is determined in step S310 whether the number of coping method IDs acquired in step S307 is plural (two or more). If it is determined that the number is two or more, in step S311, the DB search unit 25 searches the combination log DB 29-3 having the data structure shown in FIG.
[0052]
Then, in step S312, it is determined whether or not there is a combination of the same IDs in the coping method IDs indicated by the number of the obtained coping method IDs.
[0053]
For example, when it is determined that the coping method IDs acquired in step S307 are “th001” and “th002” shown in FIG. 3, “ku001” in the combination log DB 29-3 having the data structure shown in FIG. Since “ku004” is hit, the four ID numbers (“th001”, “th002”, “ku001”, and “ku004”) are notified to the manager PC (not shown) via the network 6 in step S313. Then, the present process ends.
[0054]
Here, a configuration may be adopted in which other necessary items (for example, countermeasures, etc.) are notified together with the ID number.
[0055]
If the acquired coping method IDs are “th001” and “th004”, there is no combination of the same IDs, so the determination in step S312 is NO, the process proceeds to step S316, and the corresponding ID number (“th001”). "Th004") to the administrator PC of the administrator (not shown) via the network 6, and the process ends.
[0056]
Here, a configuration may also be adopted in which other necessary items (for example, countermeasures, etc.) are notified together with the ID number.
[0057]
Also, in step S310, when it is determined that the number of coping method IDs is less than two, the process proceeds to step S316, the same processing is performed, and the processing ends.
[0058]
FIG. 9 is a flowchart illustrating an example of a second data processing procedure in the error monitoring device according to the present invention. The control unit 22 illustrated in FIG. 6 loads the monitoring processing program from the storage unit 29 or the like onto the RAM. This corresponds to the detailed procedure of the Web server reference processing routine of step S314 shown in FIG. 8 to be executed. S401 to S412 indicate each step.
[0059]
First, in step S401, the Web server DB 29-4 having the data structure shown in FIG. 5 is referred to.
[0060]
Then, in step S402, by referring to the log file item on the Web server DB 29-4, it is determined whether there is a corresponding reference URL. If it is determined that the corresponding reference URL does not exist, it is determined as an error. The process proceeds to step S412, in which the error is notified to the administrator PC (not shown) via the network 6 as a result (S411), and the process ends.
[0061]
On the other hand, if it is determined in step S402 that the corresponding reference URL exists, in step S403, the communication unit 21 performs a connection process to the Web server of the URL set via the Internet 4, and in step S404, the connection is performed. It is determined whether or not confirmation (connection OK) has been taken. If the connection is unsuccessful, the process proceeds to step S412 as an error, and the result is transmitted to the administrator PC (not shown) via the network 6 as a result. And terminates the present process.
[0062]
On the other hand, if it is determined in step S404 that the connection has been confirmed (connection OK), in step S405, the coping method is searched based on the keyword on the connected site (the same keyword as in step S305 shown in FIG. 7). Search processing).
[0063]
Then, in step S406, it is determined whether there is a countermeasure corresponding to the keyword. If it is determined that there is a countermeasure corresponding to the keyword, in step S407, the acquired information storage area of the storage unit 29 of the error monitoring apparatus is determined. Then, the process proceeds to step S408.
[0064]
In the present embodiment, as the determination method in step S406, there is a method of searching whether or not there is a portion in the Web server DB 29-4 that includes the coping method keyword.
[0065]
In other words, an html file containing the keyword may be downloaded by ftp or the like, or all information linked from the corresponding site may be collected for the administrator to respond later. The information may be registered in the reference URL of the Web server DB 29-4. When the storage capacity is insufficient, the URL itself may be stored.
[0066]
On the other hand, if it is determined in step S406 that there is no coping method, the process proceeds to step S408.
[0067]
Then, in step S408, it is searched whether there is patch information such as a software correction program. In step S409, it is determined whether there is a patch file corresponding to the keyword. If it is determined that there is a patch file, In step S410, the data is stored in the obtained information storage area 29-5 of the storage unit 29 of the error monitoring device, and the process proceeds to step S411.
[0068]
In the present embodiment, as the determination method in step S409, since many manufacturers often name patch files according to a certain rule, a patch file keyword in the Web server DB that sets the file name is included. There is a method to search whether there is a part that has been done. The corresponding patch file may be downloaded by ftp or the like, or only the URL may be stored.
[0069]
On the other hand, if it is determined in step S409 that there is no patch information, the process proceeds to step S411.
[0070]
In step S411, the result of the processing performed in steps S401 to S410 and step S412 is notified as a result to the manager PC (not shown) via the network 6, and the process ends.
[0071]
FIG. 10 is a flowchart showing an example of a third data processing procedure in the error monitoring device according to the present invention, and corresponds to the database registration acceptance processing procedure by the storage control unit 28 shown in FIG. In addition, S501 to S506 indicate each step.
[0072]
11 and 12 are views showing an example of a database update menu screen displayed on the display unit 27 shown in FIG. 6, wherein FIG. 11 corresponds to the main update menu screen, and FIG. Corresponding to the combination log data update menu screen selected on the main update menu screen.
[0073]
In FIG. 11, SB1 to SB4 are selection bars, and when the selection bar SB1 is selected, an update menu screen (not shown) for the keyword database 29-1 is displayed on the display unit 27. When the selection bar SB2 is selected, an update menu screen (not shown) for the coping method database 29-2 is displayed on the display unit 27. When the selection bar SB3 is selected, an update menu screen (shown in FIG. 12) for the combination log database 29-3 is displayed on the display unit 27. When the selection bar SB4 is selected, an update menu screen (not shown) for the Web server database 29-4 is displayed on the display unit 27.
[0074]
In FIG. 11, B1 indicates an enter button, and B2 indicates an end button. In FIG. 12, B11 indicates an enter button, B12 indicates a cancel button, and B13 indicates an end button.
[0075]
First, in step S501, the storage control unit 28 displays a database update menu (not shown) on the display unit 27, and instructs which of the databases 29-1 to 29-4 shown in FIG. (S502), and if it is determined that the end button B2 provided in the database update menu shown in FIG. 11 has been pressed, for example, the present process is terminated.
[0076]
On the other hand, if it is determined in step S502 that any of the selection bars SB1 to SB4 shown in FIG. 11 has been selected, in step S503, an input menu screen corresponding to the selected selection bar, for example, as shown in FIG. An input menu screen is displayed on the display unit 27.
[0077]
Then, in the example shown in FIG. 12, after inputting items such as a terminal number, a status, a coping method, a coping date, and a coping result from the input unit 30, at step S504, the button B11 shown in FIG. It is determined whether or not an instruction to determine the input content has been issued. If it is determined that the button B11 has been pressed, in step S505, in this case, the button B11 is registered in the combination log data 29-3. Update the contents of the database and end the process.
[0078]
On the other hand, in step S504, it is determined whether the button B11 is not pressed and the button B12 for instructing cancellation or the button B13 for instructing termination is instructed. In step S506, it is determined whether or not termination is instructed. If it is determined that the button B13 has been pressed, the process is terminated.
[0079]
On the other hand, if it is determined in step S506 that the button B12 has been instructed to be pressed, the process returns to step S501, and the other databases are updated continuously.
[0080]
Thus, the administrator who has received the notification in the flowcharts of FIGS. 7 and 8 updates the contents of the databases 29-1 to 29-4 shown in FIG. Can be optimized. 13 and 14 show the update status of the coping method database and the combination log database.
FIG. 13 is a diagram showing an updated state of the coping method database shown in FIG.
[0081]
FIG. 14 is a diagram showing an updated state of the combination log database shown in FIG.
[0082]
FIG. 15 is a schematic diagram illustrating an example of a processing result notification screen from the monitoring server 5 to the administrator.
[0083]
In the present embodiment, the notification to the administrator may be configured to notify the administrator PC of the administrator (not shown) via the network 6 of the processing result notification screen shown in FIG. The same contents as those shown in FIG. 15 may be transmitted by e-mail to the registered e-mail address of the administrator, or a site registered in advance (permitted by the administrator on a regular basis). 15) may be configured to notify the administrator by writing the contents shown in FIG.
[0084]
Hereinafter, the configuration of the data processing program that can be read by the error monitoring device according to the present invention will be described with reference to the memory map shown in FIG.
[0085]
FIG. 16 is a diagram illustrating a memory map of a storage medium that stores various data processing programs that can be read by the error monitoring device according to the present invention.
[0086]
Although not shown, information for managing a group of programs stored in the storage medium, for example, version information, a creator, and the like are also stored, and information dependent on the OS or the like on the program reading side, for example, a program is identified and displayed. Icons and the like may also be stored.
[0087]
Further, data dependent on various programs is also managed in the directory. In addition, a program for installing various programs on a computer or a program for decompressing a program to be installed when the program to be installed is compressed may be stored.
[0088]
The functions shown in FIG. 7, FIG. 9, and FIG. 10 in the present embodiment may be performed by a host computer by a program installed from the outside. In this case, the present invention is applied even when a group of information including a program is supplied to the output device from a storage medium such as a CD-ROM, a flash memory, or an FD, or from an external storage medium via a network. Things.
[0089]
As described above, the storage medium storing the program codes of the software for realizing the functions of the above-described embodiments is supplied to the system or the apparatus, and the computer (or CPU or MPU) of the system or the apparatus stores the storage medium in the storage medium. It goes without saying that the object of the present invention is also achieved by reading and executing the program code thus obtained.
[0090]
In this case, the program code itself read from the storage medium implements the novel function of the present invention, and the storage medium storing the program code constitutes the present invention.
[0091]
As a storage medium for supplying the program code, for example, a flexible disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, magnetic tape, nonvolatile memory card, ROM, EEPROM, or the like may be used. it can.
[0092]
When the computer executes the readout program code, not only the functions of the above-described embodiments are realized, but also an OS (Operating System) running on the computer based on the instruction of the program code. It goes without saying that a part or all of the actual processing is performed and the functions of the above-described embodiments are realized by the processing.
[0093]
Further, after the program code read from the storage medium is written into a memory provided on a function expansion board inserted into the computer or a function expansion unit connected to the computer, the function expansion is performed based on the instruction of the program code. It goes without saying that a CPU or the like provided in the board or the function expansion unit performs part or all of the actual processing, and the processing realizes the functions of the above-described embodiments.
[0094]
The present invention is not limited to the above embodiments, and various modifications (including organic combinations of the embodiments) are possible based on the spirit of the present invention, and those are excluded from the scope of the present invention. is not.
[0095]
According to the above-described embodiment, since a method of coping with an error is acquired in advance, the trouble and time of a search when actually coping with the error are reduced.
[0096]
In addition, a manufacturer's support site can provide a method of coping with an error that is difficult to obtain and that occurs due to a combination of specific applications.
[0097]
Also, by accepting the result of the action, useful information can be accumulated and notified at the beginning of the error handling.
[0098]
【The invention's effect】
As described above, according to the present invention, a database to which a single or a plurality of error log countermeasures are related is constructed, and based on the obtained error log file, an effective countermeasure is performed by referring to the database. And a notification of the searched result to a predetermined notification destination. Therefore, an effective and appropriate countermeasure for an error of the application software composed of a combination of a plurality of factors is managed in a unified manner, and the error is generated in a plurality of monitored devices. It is possible to clearly indicate to the system administrator an error handling method that flexibly copes with various and complicated application software errors.
[0099]
In addition, the effective and appropriate countermeasures against application software errors consisting of a combination of multiple factors are centrally managed to flexibly cope with various and complicated application software errors occurring in a plurality of monitored devices. It is possible to freely construct a convenient error handling system that can clearly indicate an error handling method to a system administrator.
[Brief description of the drawings]
FIG. 1 is a system configuration diagram showing an example of a data processing system to which an error monitoring device according to a first embodiment of the present invention can be applied.
FIG. 2 is a diagram illustrating a data structure of a keyword database shown in FIG.
FIG. 3 is a diagram illustrating a data structure of a coping method database illustrated in FIG. 1;
FIG. 4 is a diagram illustrating a data structure of a combination database illustrated in FIG. 1;
FIG. 5 is a diagram illustrating a data structure of a Web server database illustrated in FIG. 1;
FIG. 6 is a block diagram illustrating a configuration of the error monitoring device illustrated in FIG. 1;
FIG. 7 is a flowchart illustrating an example of a first data processing procedure in the error monitoring device according to the present invention.
FIG. 8 is a diagram illustrating an example of an error log file stored in the monitored device illustrated in FIG. 1;
FIG. 9 is a flowchart illustrating an example of a second data processing procedure in the error monitoring device according to the present invention.
FIG. 10 is a flowchart illustrating an example of a third data processing procedure in the error monitoring device according to the present invention.
11 is a diagram showing an example of a database update menu screen displayed on the display unit shown in FIG.
12 is a diagram showing an example of an input menu screen for updating a database displayed on the display unit shown in FIG. 6;
FIG. 13 is a diagram showing an updated state of the coping method database shown in FIG. 3;
FIG. 14 is a diagram showing an updated state of the combination log database shown in FIG. 4;
FIG. 15 is a schematic diagram illustrating an example of a processing result notification screen from a monitoring server to an administrator.
FIG. 16 is a diagram illustrating a memory map of a storage medium that stores various data processing programs that can be read by the error monitoring device according to the present invention.
[Explanation of symbols]
21 Communication unit
22 Control part
23 System bus
24 Error log monitoring unit
25 DB search unit
26 Display control unit
27 Display
28 Memory control unit
29 storage unit
29-1 Keyword Database
29-2 Solution database
29-3 Combination log database
29-4 Web log database
29-5 Acquisition Information Storage Area
30 Input section

Claims (10)

An error monitoring device that monitors error logs of a plurality of data processing devices communicable via a network,
Acquiring means for periodically acquiring an error log file accumulated in each data processing device;
A database with one or more error log actions associated with it,
Search means for searching for an effective coping method by referring to the database based on the error log file obtained by the obtaining means,
Notification means for notifying a predetermined notification destination of a result searched by the search means,
An error monitoring device comprising: When a valid coping method cannot be retrieved by the retrieval means, a web server reference means for retrieving a predetermined Web server based on the obtained log file via the network and acquiring a valid coping file is provided. The error monitoring device according to claim 1, wherein: The error monitoring device according to claim 1, wherein the notification unit notifies a predetermined notification destination of information on a valid response file acquired by the Web server reference unit. 2. The error monitoring apparatus according to claim 1, wherein the database allows a single or a plurality of error log handling methods to be newly registered or updated. An error monitoring method in an error monitoring device that monitors an error log of a plurality of data processing devices communicable via a network,
An acquisition step of periodically acquiring an error log file accumulated in each data processing device;
For the error log file obtained by the obtaining step, a search step of searching for an effective countermeasure by referring to a database associated with a single or a plurality of error log countermeasures,
A notification step of notifying a result notified by the search step to a predetermined notification destination,
An error monitoring method comprising: In a case where an effective coping method cannot be searched by the searching step, a web server reference step of searching a predetermined Web server based on the obtained log file and obtaining a valid coping file via the network is provided. The error monitoring method according to claim 5, wherein: 7. The error monitoring method according to claim 5, wherein the notifying step notifies a predetermined notification destination of information on a valid response file acquired by the Web server reference step. 6. The error monitoring method according to claim 5, wherein the database allows a single or a plurality of error log handling methods to be newly registered or updated. A computer-readable storage medium storing a program for implementing the error monitoring method according to claim 5. A program for realizing the error monitoring method according to claim 5.

Images