JP2004355650A - Object management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To manage objects by various methods such as a method of immediately collecting only log data relating to an event selected by a user, in a system for collecting a log from a computer in each site. <P>SOLUTION: A method is provided which converts events and logs issued from applications to a common format to manage them and prepares and manages managing objects which are managed by not only an information exchange means between an integrated management support part and management objects but also another means, for example, log data. Events and log data are made to correspond to each other by common keys, so that logs can be retrieved from events. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a system in which an integrated management unit collects, via a network, management information of a management target managed by an integrated management support unit using objects. In particular, it relates to the following two technical fields.

(1) Object management technology for managing an object that manages a management target object from another object. (2) Associating an event output by the management target object with log data, and searching for log data, which is detailed information, from the event. Log management technology to collect

(1) Object management technology Generally, an object manages an object to be managed and is not managed.

(2) Log management technology The OS or AP executed by the information processing device outputs various types of log information. Several methods for collecting output log information are known. For example, Japanese Patent Application Laid-Open No. 5-250229 discloses a log data collection method that preferentially transmits log data from a computer in an error state by detecting an error code in the log data in collecting log data from a plurality of computers. Is disclosed. Japanese Patent Application Laid-Open No. 5-28008 discloses that when an information processing system collects a failure log, it detects that the number of pieces of log information stored in a storage unit has reached a certain number, and suppresses log registration. A log information collection method for preventing loss of important failure information is disclosed.

JP-A-5-250229 JP-A-5-28008

  2. Description of the Related Art In a distributed processing system in which a plurality of computers are connected via a network and a computer performs processing while communicating with other computers, a system management system or a network management system uses objects to be managed (such as an operating system and hardware) as objects. A plurality of computers are centrally managed by common management. However, information exchange between the managed object and the integrated management support unit that manages the object is usually performed by a single means, and there are cases where monitoring cannot be performed depending on the state of the monitored object or the program, which poses a problem. Was. Conventionally, the log data of the computer on which the integrated management support unit operates is transferred to the integrated management unit one by one. Therefore, the disk capacity for storing the log data of the integrated management unit and the network load for transfer are problems. Was.

  The present invention has been made in view of the above circumstances, and has as its object to manage objects by various methods.

  Another object of the present invention is to immediately collect only log data related to an event selected by a user in a method of collecting logs from computers at each site.

  In order to achieve the above object, the present invention includes a unit for exchanging information with a management target, and a unit for managing an object from log data output from an AP, an OS, or the like, which is a management target. The object that manages the management target is a management target monitoring unit that is updated immediately when the management information of the management target changes, and an instantaneous event that occurs in the integrated management support unit as an event. And means for reflecting the object information to the system topology of the integrated management unit.

  Further, the present invention is characterized by a computer having means for searching and collecting log data accumulated in the integrated management support unit from events notified from the integrated management support unit to the integrated management unit via a network as processing means of the integrated management unit. And

  As described above, according to the present invention, an object that manages a managed object not only directly exchanges information with the managed object, but also stores an AP-related log and an AP that an OS (operating system) outputs to a system log file. Since there is provided a means for managing and obtaining management information from other means such as log data output to the AP log file, the management target can be managed regardless of the state of the management target (AP or the like).

  Also, of the events issued by the management target to the integrated management support unit and the log data output by the management target (such as the AP) to the log file, only the immediate ones are notified to the integrated management unit as events. Since the information can be displayed on the integrated management unit viewer, there is an effect that the monitoring of the management target such as the AP operating on the plurality of computers can be unified.

  Furthermore, in the integrated management unit viewer, when referring to a log, which is detailed information on an event, logs stored in a plurality of computers can be searched and collected, so that the log can be distributed and the load on the network can be reduced. effective.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a system configuration diagram showing an example of a communication network to which the present invention is applied. The network is connected to a plurality of LANs 1 and 3 and a WAN (Wide Area Network) 2. The integrated management unit 10 and the integrated management unit viewer 30 are programs on the management side that are stored in the main storage device of the computer and run under the OS 60. The integrated management support unit 20 is a program on the managed side that is stored in a main storage device of a computer such as a server and runs under the OS 60. The integrated management unit 10 can communicate with the integrated management support unit 20 and the integrated management unit viewer 30 via the LAN 1, 3, or WAN 2. As shown in FIG. 1, a computer that executes the integrated management support unit 20 can execute another AP (application program) 70 in parallel with the integrated management support unit 20. The computer executed by the integrated management unit 10 and the integrated management unit viewer 30 can execute another AP in parallel with the integrated management unit 10 and the integrated management unit viewer 30. Other configurations will be described with reference to FIGS. 20, 3, and 4.

  FIG. 2 is a diagram showing an outline of processing operations performed by the integrated management unit 10, the integrated management support unit 20, and the integrated management unit viewer 30. The AP 70 runs under the OS 60, and operates (1) while the OS monitors a process or the like, and outputs a log to the system log file 80 when an abnormality occurs in the process or the like (3). Further, the AP 70 outputs various events (start, end, abnormal end, etc.) that occur with the execution of the business to the AP log file 90 (4). The integrated management support unit 20 monitors the AP 70 using the object 25 (2), inputs a log (5, 6), extracts only necessary logs, and converts them into a common format. At this time, the object 25 is managed based on these pieces of log information. Among the log information, an event with immediacy is notified as event information to the integrated management unit viewer 30 via the integrated management unit 10 (7) (8), and the log information is stored in the common log (database or file) 50. It is stored (9). Further, the object 25 reflects the changed object information (15) to the system topology 40 of the integrated management unit 10 (16). When the system administrator operating the integrated management unit viewer 30 selects the notified event information, a log search process as detailed information is performed (10). Upon receiving the log search (10) request from the integrated management unit viewer 30, the integrated management unit 10 requests the integrated management support unit 20 to perform a log search process (11). At this time, the integrated management unit 10 associates the event and the log data with a common key. The integrated management support unit 20 searches the log for log data that matches the requested condition (12), and transfers the log information to the integrated management unit viewer via the integrated management unit 10 (13) (14).

  FIG. 3 is a functional block diagram illustrating a configuration of the integrated management unit 10. The system topology 40 is a database that stores the system topology and events, and is stored in a storage device. The outline of the function of each function module constituting the integrated management unit 10 will be described below.

  The data communication 100 is a program that performs communication control when the object management 110, the event management 120, and the log search 130 communicate with the integrated management support unit 20 and the integrated management unit viewer 30.

  The object management 110 is a program for managing objects of system information and event information stored in the system topology 40.

  The event management 120 is a program that requests the database management 140 to store the event received from the integrated management support unit 20 or transfers the event to the integrated management unit viewer 30.

  The log search 130 is a program that determines the location and type of a log related to an arbitrary event in response to a log search request from the integrated management unit viewer 30 and issues a log search request to the corresponding integrated management support unit 20.

  The database management 140 stores in the system topology 40 the system information collected by the object management 110 from the integrated management support unit 20 and the event information received by the event management 120 from the integrated management support unit. The system topology is searched or extracted by a reference request from the object management 110, and event information is extracted by a reference request from the event management 120.

  FIG. 4 is a functional block diagram showing the configuration of the integrated management support unit 20. The object 25 manages the AP 70 via the AP monitor 210, and is managed by the log file monitor 230. The outline of the function of each function module constituting the integrated management support unit 20 will be described below.

  The data communication 200 is a program that performs communication control when the AP monitor 210, the event management 220, and the common log management 240 communicate with the integrated management unit 10.

  The AP monitor 210 is a program for monitoring the AP 70 using the object 25.

  The event management 220 notifies the integrated management unit 10 of only information having an immediate property among the information input from the AP monitor 210 and the log file monitor 230 as an event. In addition, the program notifies the AP monitor 210 of an event detected by the log file monitor 230.

  The log file monitor 230 inputs log data from the system log file 80 and the AP log file 90, extracts only those related to the AP 70, and converts them into a common format. The log data manages the object 25 and notifies the event management 220 of event information. The program is a program that outputs log data converted to a common format to the common log management 240 in order to store the log data in the common log 50. Further, an API (application programming interface) can be provided to log events that the AP 70 notifies the AP monitor 210.

  The common log management 240 stores the log data input from the log file monitor 230 in the common log 50. The program is a program that extracts and transfers a relevant log in accordance with a log search request from the log search 130 of the integrated management unit 10.

  FIG. 5 is a diagram showing conditions under which an AP can be monitored before application of the present invention.

  FIG. 6 is a diagram showing AP monitoring possible conditions after application of the present invention. By managing the object 25 by the log file monitoring 230, it becomes possible to monitor other than the stopped state of the AP, so that the system administrator can monitor the AP widely.

  FIG. 7 is a diagram showing a system of the object 25. The object 25 includes a system object 500, a log object 800, and an event object 850.

  FIG. 8 is a diagram showing the hierarchy of the system object 500. The system object 500 is an object hierarchized in the order of the IP object 600 and the AP object 700.

  FIG. 9 is a diagram showing attributes of the system object 500. The system object 500 has attributes indicating the outline of lower-level objects, and includes a system object identifier (Sys_Obj_ID) 510, a system object name (Sys_Obj_Name) 520, a total number of integrated management units (Manager_Num) 530, and a total number of integrated management support units ( Agent_Num) 540, the total number of managed APs (Managing_Ap_Num) 550, the total number of used DBs (DB_Num) 560, and a flag (isSys_Obj) 570 for identifying a system object.

  FIG. 10 is a diagram showing attributes of the IP node object 600. The IP node object 600 indicates the attribute of the IP node on which the integrated management unit 10 and the integrated management support unit 20 operate, and includes an IP node object identifier (IP_Obj_ID) 610, an IP node object name (IP_Obj_Name) 612, and a host name (IP_Hostname) 614. , An IP address (IP_Address) 616, a flag (isIP_Node) 618 for identifying an IP node object, a flag (isMgr_Node) 620 for identifying the presence of an integrated management unit at the IP node, and an integrated management unit at the IP node. The state (Mgr_Status) 622 in the case of operation, a flag (isAgt_Node) 624 for identifying the presence of the integrated management support unit at the IP node, and the integrated management support unit at the IP node The state (Agt_Status) 626 when the operation is performed, the overall state (isAP_Obj_Status) 628 of the AP object when the integrated management support unit is operating on the IP node, the presence or absence of the DB used by the IP node (IsDB) 630 for identifying the database, the type of the used DB (DB_Type) 632, the state of the used DB (DB_Status) 634, and the total number of integrated management units (Managing_Mgr_Num) managing the IP node 636, a table (Managing_Mgr_Table) 638 for recording integrated management unit information, the total number of managed APs (Managed_AP_Num) 646 managed by the integrated management support unit, and a table (Man) for identifying managed AP objects ged_AP_Table) consists of 648. The integrated management unit table 638 includes an integrated management unit entry (Managing_Mgr_Entry) 640. The integrated management unit entry 640 includes an index (Index) 642 for identifying the entry and an IP node object identifier (IP_Obj_ID) 644 where the integrated management unit exists. Is done. The AP table 648 includes an AP entry (Managed_AP_Entry) 650, and the AP entry 650 includes an index (Index) 652 for identifying the entry and an AP object identifier (AP_Obj_ID) 654.

  FIG. 11 is a diagram showing attributes of the AP object 700. The AP object 700 indicates an attribute of the AP 70 which is a management target, and includes an AP object identifier (AP_Obj_ID) 710, an AP object name (AP_Obj_Name) 712, and an IP object identifier (Managing_IP_Obj_ID) indicating a higher-level integrated management support unit that manages the AP. ) 714, AP version (AP_Version) 716, AP name (AP_Name) 718, time (Installed_Time) 720 at which the AP was installed in the IP node, overall state of the AP (isAP_Status) 722, AP and integrated management support unit Status (isAP_Interface_Status) 724 obtained by the information exchange means between the devices and the status of the AP (isAP_L) obtained from the OS and AP logs g_Status) 726, a flag for identifying the AP object (isManaged_AP) 728, the number of jobs that are scheduled (Job_Num) 730, composed of a table (Job_Table) 732 that records the job information. The job table 732 includes a job entry (Job_Entry) 734. The job entry 734 includes an index (Index) 736 for identifying the entry, a job name (Job_Name) 738, a business name (Business_Name) 740, and a job execution cycle (Execution_Cycle). 742, the scheduled execution time (Schedule_Time) 744 of the scheduled job, the user name (User_Name) 746 for executing the job, the file name (File_Name) 748 of the job to be executed, and the end code (Exit_Code) 750 of the previous job. Is done.

  FIG. 12 is a diagram showing the hierarchy of the log object 800. The log object 800 is an object hierarchized in the order of the log file monitoring object 810 and the log data object 820. The log object 800 has an attribute indicating the outline of the lower-level object, and is configured from information on the common log 50 that stores the total number of log file monitoring objects and the value of the log data object. The log file monitoring object 810 exists for each log file, and includes a log file name to be monitored, a monitoring interval, a (filtering) condition for extracting only necessary log data, and a regular for converting to a common format. It is composed of conversion conditions. The log data object 820 represents the data stored in the common log 50 after normalizing (converting) the log data input by the log file monitor 230 into an attribute having a common format shown in FIG.

  FIG. 13 is a diagram showing the hierarchy of the event object 850. The event object 850 is an object hierarchized in the order of the external event object 860 and the internal event object 870. The external event object 860 is an event transferred to the integrated management unit 10, and the internal event object 870 is an event exchanged between each function module in the integrated management support unit.

FIG. 14 is a diagram showing attributes of the log data object 820 and the event object 850. Event and log data
Message originating host name 901 or message originating IP address 902
Date of message occurrence 903
Message serial number 904
Correspond by the combination of The distinction between an external event and an internal event is determined by the value of the importance 908. In other words, importance 908 is
-High: Save to external event, common log-Normal: Save to internal event, common log-Low: Process separately from saving to common log only.

  FIG. 15 is a diagram showing the contents of the attributes of the log object 800 and the event object 850.

  FIG. 16 is a PAD diagram showing a flow of processing of the log file monitoring 230 of the integrated management support unit 20. The log file monitor 230 performs initialization (step 1000), acquires attributes from the log object 800 (step 1001), loops by the number of log file monitor objects 810 (step 1002), and sets attributes from the log file monitor object 810. (Step 1003), monitoring is started for each log file (Step 1004), and the process loops until an end request comes (Step 1005) and waits for an event (Step 1006). The event includes a log data input request for notifying that log data has been input from the log file monitoring function, which is a sub-function of the log file monitoring 230 (step 1007), and an object addition request from the integrated management unit 10 (step 1007). (Step 1016), an object deletion request (Step 1018), an attribute change request (Step 1020), and an end request (Step 1022).

  When a log data input request (1007) is received, log data is input from the system log file 80 or the AP log file 90 (step 1008), and filtering processing is performed. The filtering process checks whether the input log data is non-target data (step 1009). If the input log data is non-target data (YES), the input log data is cleared (step 1010). If the input log data is the target data (NO), after normalizing the data to the format shown in FIG. 14 (step 1011), only the data that needs to be notified to the integrated management unit 10 is set as an external event object 860 as an event. It notifies the management 220 (step 1012), normalizes the input log data (step 1013), manages the AP object (step 1014), and sends the input log data to the common log management 240 to store the log data in the common log 50. A storage request is issued (step 1015). The normalization processing (steps 1011 and 1013) determines whether or not the message text of the input log data includes a predefined condition (character string, set of character strings, etc.), and In this case, a value corresponding to the condition or a character string in the message text is set as an attribute value.

  When an object addition request (1016) is received from the integrated management unit, it means that the number of log files to be newly monitored has increased, and a log file monitoring object 810 is generated under the log object 800 (step 1017).

  When an object deletion request (1018) is received from the integrated management unit, it means that monitoring of the monitored log file is stopped, and the corresponding log file monitoring object 810 under the log object 800 is deleted (step 1019).

  When an attribute change request (1020) is received from the integrated management unit, the attribute of the corresponding log file monitoring object 810 is changed (step 1021).

  The log file monitor 230 updates the value of the attribute of the log object 800 when an object is created or added or the attribute is changed.

  If an end request has been received (step 1022), the process exits the loop (step 1023) and performs end processing (step 1024).

  FIG. 17 is a PAD diagram showing a flow of AP object management processing, which is one of the processing of the log file monitoring 230 of the integrated management support unit 20. The isAP_Log_Status 726 of the corresponding AP object 700 is searched from the message originating host name 901 and the control name 907 (step 1050), and the job status (start, end, abnormal end, etc.) among the normalized attributes shown in FIG. The status of the corresponding AP 70 is determined from the values of the message type 914 and the end code 912 expressing the process information output by the OS 60 and the value of the isAP_Log_Status 726 after updating the isAP_Log_Status 726 (step 1051). Is notified to the AP monitor 210 via the server (step 1052).

  FIG. 18 is a PAD showing the flow of processing of the common log management 240 of the integrated management support unit 20. The common log management 240 performs initialization (step 1100), loops until an end request comes (step 1101), and waits for an event (step 1102). The event includes a storage request for the normalized log data from the log file monitor 230 (step 1103), a log search request from the log search 130 of the integrated management unit 10 (step 1105), and a termination request (step 1107). ).

  When a log data storage request (step 1103) is received from the log file monitor 230, the log data is stored in the common log 50 in the form of a log data object 820.

  When a log search request (step 1105) is received from the integrated management unit 10, a log data object 820 matching the specified condition is returned (step 1106).

  If an end request has been received (step 1107), the process exits the loop (step 1108) and performs end processing (step 1109).

  FIG. 19 is a PAD showing a flow of processing of the event management 220 of the integrated management support unit 20. The event management 220 performs initialization (step 1200), loops until an end request comes (step 1201), and waits for an event (step 1202). The events include an event information transfer request (step 1203) and a termination request (step 1208) issued by the AP monitor 210 and the log file monitor 230.

  If an event information transfer request (step 1203) is received, event information is input (step 1204), and whether the event is an external event or an internal event is determined (step 1205). If the event is an external event (YES), integrated management is performed. An event is issued to the unit 10 (step 1206). If the event is an internal event (NO), the event is notified to the AP monitor 210 (step 1207).

  If an end request has been received (step 1208), the process exits the loop (step 1209) and performs end processing (step 1210).

  FIG. 20 is a PAD showing the flow of the process of the AP monitor 210 of the integrated management support unit 20. The AP monitor 210 performs initial settings (step 1300), acquires IP node object information from the OS 60, reflects the information on attributes (step 1301), establishes an information exchange means with the AP 70 (step 1302), and monitors the AP object. (Step 1303) is performed, and the process loops until an end request comes (Step 1304) and waits for an event (Step 1305). During the loop (step 1304), event processing (step 1306) and AP object monitoring (step 1307) are performed. If an end request has been received (step 1359), the process exits the loop (step 1360) and performs end processing (step 1308).

  FIG. 21 is a PAD diagram showing a flow of an AP object monitoring process which is one of the processes of the AP monitoring 210 of the integrated management support unit 20. The AP object monitoring loops for the number of APs (step 1330), acquires AP object information from the AP 70, reflects it on the attributes of the AP object 700 (step 1331), and determines whether the object has changed (step 1332). If the object is changed (YES), the changed object information is notified to the event management 220 as an external event (step 1333).

  FIG. 22 is a PAD illustrating a flow of an event process which is one of the processes of the AP monitor 210 performed by the integrated management support unit 20. The event includes an event notification from the AP 70 (step 1350), an internal event notification from the event management 220 (step 1353), an object reference request from the integrated management unit 10 (step 1357), and an end request (step 1359). There is.

  When the event notification (step 1350) is received from the AP 70, the AP object information is acquired from the AP 70 and reflected on the attribute of the corresponding AP object 700 (step 1351). Further, the changed object information (attribute and value) is notified to the event management 220 as an external event (step 1352).

  When the internal event notification (step 1353) is received from the event management 220, it means that the log file monitoring 230 has changed the AP object 700 as shown in FIG. It is confirmed whether or not is possible (step 1354). If possible (YES), execute object processing 1 (step 1355); otherwise (NO), execute object processing 2.

  When the object reference request (step 1357) is received from the integrated management unit 10, the requested object information and its value are responded (step 1358).

  When the end request (step 1359) is received, the process exits the loop (step 1304) (step 1360).

  FIG. 23 is a PAD diagram showing a flow of a process of the object process 1 which is one of the processes of the AP monitor 210 performed by the integrated management support unit 20. The status is acquired from the corresponding AP 70 by the information exchange unit, and is set in the isAP_Interface_Status 724 of the corresponding AP object 700. Further, “interface: OK” and the value of isAP_Interface_Status 724 are set in isAP_Status 722 of the corresponding AP object 700 (step 1371). Thereafter, the process loops by the value of Managed_AP_Num 646 of the corresponding IP node object (step 1372), and counts the number of AP objects 700 for which the value of isAP_Status 722 is “Interface: OK” and the value of isAP_Interface_Status 724 is normal (step 1373). The number x of the counted AP object 700 is compared with the value of, for example, a, b (b <a) set by the user (step 1374). When a = <x, “normal” is set in the isAP_Obj_Status 628 of the IP node object 600. Is set (step 1375). If b <x <a, “attention” is set in isAP_Obj_Status 628 (step 1376), and if x = <b, “abnormal” is set in isAP_Obj_Status 628 (step 1377). At this time, it is confirmed whether or not the value of the object has been changed (step 1378). If there has been a change (YES), the object information is notified to the integrated management unit 10 as an external event to the event management 220 (step 1379). ).

FIG. 24 is a PAD diagram showing a flow of a process of the object process 2 which is one of the processes of the AP monitoring 210 performed by the integrated management support unit 20. This is the case where the information exchange means with the corresponding AP 70 cannot be used, and the value of “interface: NG” and the value of isAP_Log_Status 726 are set in the isAP_Status 722 of the corresponding AP object 700 (step 1390). Thereafter, the process loops by the value of Managed_AP_Num 646 of the corresponding IP node object (step 1391), and counts the number of AP objects 700 for which the value of isAP_Status 722 is “interface: NG” and is normal (step 1392). The number x of the counted AP objects 700 is compared with, for example, the values of a and b (b <a) set by the user (step 1393). If a = <x, the isAP_Obj_Status 628 of the IP node object 600 indicates “normal”. Is set (step 1394), if “b <x <a”, “attention” is set in isAP_Obj_Status 628 (step 1395), and if x = <b, “abnormal” is set in isAP_Obj_Status 628 (step 1396). At this time, it is confirmed whether or not the value of the object has been changed (step 1397). If there has been a change (YES), the object information is notified to the integrated management unit 10 as an external event to the event management 220 (step 139).
8).

  FIG. 25 is a PAD illustrating a flow of a process of the log search 130 performed by the integrated management unit 10. The log search 130 performs initialization (step 1400), loops until an end request is received (step 1401), and waits for an event (step 1402). The events include a log search request from the integrated management unit viewer 30 (step 1403), a log search result from the common log management 240 of the integrated management support unit 20 (step 1405), and a termination request (step 1407).

  When a log search request (step 1403) is received, an event / log correspondence process (step 1404) is performed, and a request for log data search is made to the common log management 240 of the integrated management support unit 20.

  When the log search result (step 1405) is received, the search result is sorted in chronological order and then transferred to the integrated management unit viewer 30 (step 1406).

  If an end request has been received (step 1407), the process exits the loop (step 1408) and performs end processing (step 1409).

  FIG. 26 is a PAD diagram illustrating a flow of an event / log correspondence process, which is one of the processes of the log search 130 performed by the integrated management unit 10. The system administrator operating the integrated management unit viewer 30 acquires the log data of the event from the common log management 240 of the message source host name 901 or the message source IP address 902 of the specified event (step 1450). Determine whether the log search specified by the system administrator is a job unit (one executed on one computer) or a business unit (a set of jobs executed across multiple computers) (Step 1451) is performed.

  If the job is a job unit, the execution cycle 742 of the job is acquired from the object management 110 (step 1452), and the same job name 910 or job number 909 and the same A search request for the log data executed in the execution cycle of is issued (step 1453).

  In the case of a job unit, the job execution host name 614 or the IP address 616 of the job having the value of the job name 915, the job name 738, the job execution period 742, etc. are obtained from the object management 110 using the job name 740 as a key. (Step 1454). In addition, the execution order of the job having the job name is acquired from the job definition information (stored in the system topology 40 or a file) (step 1455). Thereafter, the process loops for the number of the corresponding host names or IP addresses (step 1456), and sends the same job name to the common log management 240 of the integrated management support unit 20 operating with the corresponding host name or IP address. A search request for log data relating to business is issued (step 1457).

As described above, according to the present embodiment,
By managing the object that manages the management target, the monitoring conditions of the management target can be expanded and the management information can be managed in detail.

  The log search 130 can search and collect only log data, which is detailed information of an arbitrary event, and display it on the integrated management unit viewer 30, so that log distribution and network load can be reduced.

  Since the integrated management unit viewer 30 is connected to the integrated management unit 10 via a network, objects can be managed from any location regardless of location.

  And so on.

It is a lineblock diagram of a network system of an embodiment. It is a figure which shows the outline of the processing operation | movement which the integrated management part, integrated management support part, and integrated management part viewer of embodiment perform. FIG. 2 is a functional block diagram illustrating a configuration of an integrated management unit 10 according to the embodiment. FIG. 3 is a functional block diagram illustrating a configuration of an integrated management support unit 20 according to the embodiment. FIG. 11 is a diagram showing conditions under which objects can be monitored before the present invention is applied. FIG. 14 is a diagram showing conditions under which objects can be monitored after application of the present invention. It is a figure showing the object system of an embodiment. FIG. 4 is a diagram illustrating a relationship among a system object, an IP node object, and an AP object according to the embodiment. FIG. 4 is a diagram illustrating attributes of a system object according to the embodiment. FIG. 4 is a diagram illustrating attributes of an IP node object according to the embodiment. FIG. 4 is a diagram illustrating attributes of an AP object according to the embodiment. FIG. 4 is a diagram illustrating a relation between log objects according to the embodiment. FIG. 4 is a diagram illustrating an association of an event object according to the embodiment. FIG. 4 is a diagram illustrating attributes of an event object and a log object according to the embodiment. FIG. 4 is a diagram illustrating contents of attributes of an event object and a log object according to the embodiment. FIG. 9 is a PAD diagram illustrating a flow of a log file monitoring process performed by the integrated management support unit of the embodiment. FIG. 9 is a PAD diagram illustrating a flow of an AP object management process which is one of the log file monitoring processes performed by the integrated management support unit of the embodiment. It is a PAD figure showing the flow of processing of common log management which the integrated management support part of an embodiment performs. FIG. 9 is a PAD diagram illustrating a flow of an event management process performed by the integrated management support unit of the embodiment. FIG. 9 is a PAD diagram illustrating a flow of an AP monitoring process performed by the integrated management support unit of the embodiment. FIG. 9 is a PAD diagram illustrating a flow of an AP object monitoring process, which is one of the AP monitoring processes performed by the integrated management support unit of the embodiment. FIG. 9 is a PAD diagram illustrating a flow of event processing, which is one of the AP monitoring processes performed by the integrated management support unit of the embodiment. FIG. 9 is a PAD diagram illustrating a flow of a process of an object process 1 which is one of the processes of the AP monitoring performed by the integrated management support unit of the embodiment. FIG. 8 is a PAD diagram illustrating a flow of a process of an object process 2 which is one of AP monitoring processes performed by the integrated management support unit of the embodiment. FIG. 9 is a PAD diagram illustrating a flow of a log search process performed by the integrated management unit according to the embodiment. FIG. 8 is a PAD diagram illustrating a flow of a process of an event / log correspondence process, which is one of log search processes performed by the integrated management unit according to the embodiment.

Explanation of reference numerals

10: integrated management unit, 20: integrated management support unit,
25: object, 30: integrated management unit viewer,
40: system topology, 50: common log,
60 ... Operating system (OS),
70 application programs (AP),
80: System log file, 90: AP log file

Claims (6)

The management method of the management server that manages at least one computer includes:
An abnormality that occurred in a process executed by the computer is stored in a system log, an event that occurs during a business execution by an application is collected and stored in an AP log,
The log information obtained by converting the information extracted from the system log and the AP log into a common format is stored in a common log file, the event information is notified and stored in a storage device,
By a common key including information specifying a message generation source, the log information and the event information are associated,
The location and type of the log relating to the event that matches the requested condition are extracted from the common log file,
A computer management method, wherein event information is extracted from the storage device by a reference request.   If the log information extraction request is a job unit, a request is made to extract log data executed in the same execution period of the job.If the log information extraction request is a job unit, the job execution order of the job 2. The computer management method according to claim 1, wherein a request is made to extract log data having the same job name and relating to the job at the same time.   The application state is determined and notified based on a message type and an end code indicating a job state and process information from an operating system included in the log information converted into a common format. The computer management method described in item 1.   2. The computer management method according to claim 1, wherein the common format is set as a value including a predefined condition or a character string as an attribute value. An integrated management support unit that manages a management target including an application program that operates in a computer system; an integrated management unit that collects management information of the management target from a plurality of the integration support units; and views the collected management information. In the system in which the integrated management support unit, the integrated management unit and the integrated management unit viewer each operate on a computer, and the computers are connected by a communication network,
The integrated management support unit holds the state of the management target using an AP monitor that monitors an application program,
The object management method, wherein the AP monitoring complements the latest state of the application program by monitoring a log file output by the application program. When supplementing the latest state of the application program, a log search request from the integrated management unit viewer is used to request a log search from the common log, which is log data converted into a common format held by the integrated management support unit. 6. The object management method according to claim 5, wherein information is referred to by the integrated management unit viewer.

Images