JP2005141467A - Monitoring device and method for computer system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology for detecting a failure caused in a monitoring objective system based on a message about the monitoring objective system. <P>SOLUTION: An integrated monitoring device monitoring a computer system is provided with a message receipt part 13 receiving a message about the system to be monitored, a display control part 18 controlling a display device 4, a message storage part 17 storing the message displayed on the display device 4 by the display control part 18, a message replacement processing part 14 extracting a replacement candidate message from the received messages received by the message receipt part 13 and replaces the replacement candidate message according to a predetermined rule, and a filtering processing part 15 storing received messages excepting the replacement candidate in a message storage part 17 and storing a replaced message in the message storage part 17 if a message equal to the replaced message is not stored in the message storage part 17. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a technique for monitoring a computer system, and more particularly to a technique for performing fault isolation based on a large number of messages.

  In recent years, with the diversification of computer software and the improvement of hardware performance, system operation requirements have become more complex. For this reason, a monitoring apparatus that monitors the operation of a computer system has to acquire more information, such as information messages and failure messages, from each software and hardware. As a result, the number of messages that need to be processed becomes enormous, which may cause problems such as a decrease in the processing speed of the monitoring apparatus or an oversight of messages due to an increase in the burden on the operation operator. This becomes even more prominent when individual operation management tools are introduced for each software and hardware, and tools (integrated monitoring system) for monitoring these tools in an integrated manner are introduced.

  In order to avoid such a situation, some monitoring apparatuses have a message filtering function that discards unnecessary messages and extracts only necessary messages. (For example, Non-Patent Document 1).

http://www-6.ibm.com/jp/software/tivoli/products/systems_mgr.html

  However, when one failure occurs, a plurality of error messages may be output due to the failure. For example, if a node of the monitored system goes down, errors may occur in a plurality of processes that use the computer, or a network error may occur that the computer cannot be accessed.

  The objective of this invention is providing the technique for detecting the failure which generate | occur | produced in the monitoring object system based on the message regarding the monitoring object system.

  A monitoring device for a computer system according to one aspect of the present invention includes a receiving unit that receives a message related to a monitored system, a display control unit that controls a display device, and a display control unit that causes the display device to display the message. A storage unit that stores a message, a message extraction unit that extracts a replacement candidate message from received messages received by the reception unit, and the received message that is not a replacement candidate that has not been extracted by the message extraction unit to the storage unit When the received message storage processing unit to store, the replacement processing unit for replacing the replacement candidate message according to a predetermined rule, and the same message as the replaced message replaced by the replacement processing unit are not stored in the storage unit A replacement message storage processing unit for storing the replaced message in the storage unit; Provided.

  In a preferred embodiment, the replacement processing unit confirms the operation status of the monitoring target system related to the content indicated by the replacement candidate message, and replaces the replacement candidate message based on the confirmation result. Also good.

  In a preferred embodiment, the receiving unit receives a message related to the monitored system from each of a plurality of other monitoring devices. Then, the replacement processing unit can inquire of any of the plurality of other monitoring devices about the operation status of the monitoring target system related to the content indicated by the replacement candidate message.

  In a preferred embodiment, the storage unit includes an area for storing the message to be displayed and an area for storing a time when the message is stored. The received message storage processing unit stores the received message that is not the replacement candidate and the current time in the storage unit, and the replacement message storage processing unit stores the storage between a predetermined time before the current time and the current time. If the message stored in the section does not contain the same message as the replaced message, the replaced message and the current time may be stored in the storage section.

  Hereinafter, a computer integrated monitoring system according to an embodiment of the present invention will be described with reference to the drawings.

  The overall structure of this system is shown in FIG. This system includes an integrated monitoring device 1, a storage device 2, an external operation management device 3, and a display device 4 such as a CRT (Cathode Ray Tube) or a liquid crystal display device. The integrated monitoring device 1 and the external operation management device 3 are connected by a network 9 such as a LAN (Local Area Network) or the Internet.

  The integrated monitoring device 1 and the external operation management device 3 are both configured by, for example, a general-purpose computer system, and individual components or functions in the devices 1 and 3 described below execute, for example, a computer program Is realized.

  The integrated monitoring apparatus 1 monitors a computer system (not shown) to be monitored. At this time, in the present embodiment, the integrated monitoring device 1 monitors via the external operation monitoring device 3. That is, each external operation monitoring device 3 monitors the computer system that is the monitoring target.

  For example, the external operation management apparatus 3 individually monitors the software and hardware of the nodes included in each monitoring target system. Then, the external operation management device 3 acquires information indicating the operation status of each node, for example, the operation status of the application program (whether it has been normally or abnormally ended), the network communication status, the database update status, and the like. . Therefore, the external operation management apparatus 3 uses, for example, a job schedule tool that manages the operation of commercially available jobs, a network monitoring tool that monitors network failures, or a database monitoring tool that monitors the operating status of a database. it can.

  Each external operation monitoring device 3 transmits a message 50 relating to the monitoring target computer to the integrated monitoring device 1 based on the information indicating the operating state of the monitoring target computer.

  The integrated monitoring device 1 receives the message 50 sent from the external operation monitoring device 3 and displays it on the display device 4. Here, the integrated monitoring apparatus 1 analyzes the received message 50, and organizes the message, such as replacing the message or discarding an unnecessary message based on the analysis result. Then, the sorted message is displayed on the display device 4. Details of the message replacement process will be described later.

  The storage device 2 stores failure isolation information used for the above-described failure isolation. As the storage device 2, for example, a hard disk or a CD-ROM can be used. The storage device 2 may be a storage device of another computer connected via a network.

  As shown in FIG. 1, the integrated monitoring apparatus 1 includes a fault isolation information acquisition unit 11, a fault isolation information storage unit 12, a message reception unit 13, a message replacement processing unit 14, a filtering processing unit 15, and a buffer 16. A message storage unit 17 and a display control unit 18.

  The fault isolation information acquisition unit 11 acquires fault isolation information for replacing a message stored in the storage device 2. The fault isolation information acquired here is stored in the fault isolation information storage unit 12. In order to perform the message replacement process described below, the fault isolation information is stored in the fault isolation information storage unit 12 in advance.

  The fault isolation information storage unit 12 has, for example, a data structure as shown in FIG. That is, for each determination condition 120 of the replacement candidate message, when the replacement determination rank 121, the confirmation item 122 for confirming the situation, the replacement condition 123 for determining whether to perform replacement, and the replacement condition are satisfied And a replacement process 124 to be performed as a data item. Then, as shown in the figure, the failure isolation information storage unit 12 stores a plurality of records having items from the replacement determination rank 121 to the replacement process 124 for one replacement candidate message determination condition 120. The The confirmation item 122 includes an external operation monitoring device 122a to be inquired and confirmation content 122b to be confirmed.

  The replacement candidate message determination condition 120 is a condition for extracting a replacement candidate message to be subjected to replacement determination from received messages. That is, replacement determination as described later is performed on a message that matches the replacement candidate message determination condition 120.

  The replacement determination order 121 indicates the order in which replacement determination is performed by applying the replacement condition 123 to the replacement candidate message. That is, the replacement determination is performed in order from the one having the replacement determination rank 121 of “1”.

  The confirmation item 122 is a confirmation item for inquiring the operation status of the monitoring target system related to the content indicated by the replacement candidate message. In other words, the confirmation item 122 includes an external operation monitoring device 122a indicating an inquiry destination and a confirmation content 122b to be specifically confirmed.

  The replacement condition 123 is a condition indicating whether or not to replace a replacement candidate message based on the operation status of the monitoring target system confirmed according to the confirmation item 122.

  The replacement process 124 indicates a replacement process performed on a replacement candidate message that matches the replacement condition 123.

  Referring to FIG. 1, the message receiving unit 13 receives a message 50 sent from the external operation monitoring device 3 via the network 9. The message 50 received by the message receiving unit 13 is temporarily stored in the buffer 16.

  An example of the format of the message 50 received by the message receiving unit 13 is shown in FIG. The message 50 includes a message ID 51, a system name 52, a source node ID 53, a source AP name 54, a severity 55, a date and time 56, a message type 57, and a message text, as shown in FIG. 58 as data items.

  The message ID 51 is information for uniquely identifying a message. The system name 52 is the name of the system being monitored. The source node ID 53 is information for identifying the node in which the event notified by this message has occurred. The source AP name 54 is information for identifying an AP (application program) in which an event notified by this message has occurred. The severity 55 indicates the severity of the event notified by this message. The severity 55 is indicated by a numerical value corresponding to the magnitude of the severity, for example. Occurrence date and time 56 indicates the occurrence date and time of the event notified by this message. The message type 57 indicates the type of message such as error (E), warning (W), information (I), and the like. The message text 58 is an area for storing a character string. Each external operation monitoring device 3 can be set freely.

  A message replacement processing unit (hereinafter simply referred to as a replacement processing unit) 14 extracts a message that becomes a replacement candidate from the received message, and replaces the replacement candidate message according to a predetermined rule. For example, the extraction of the replacement candidate message and the replacement of the replacement candidate message are both performed according to the fault isolation information stored in the fault isolation information storage unit 12. No processing is performed on a message that is not a replacement candidate, and the message is output to the filtering processing unit 15.

  The replacement processing unit 14 acquires messages one by one from the buffer 16. Each time one message is acquired, a message replacement determination is performed according to a predetermined rule, for example, the fault isolation information stored in the fault isolation information storage unit 12. A specific processing procedure at this time is shown in FIG.

  First, the replacement processing unit 14 acquires one message from the buffer 16 (S11). Then, the replacement processing unit 14 applies all the fault isolation information stored in the fault isolation information storage unit 12 to this message, and determines whether or not the replacement determination has been performed (S12). If all the fault isolation information has been applied (S12: Yes), the process skips to step S18. When there is fault isolation information that has not been applied yet (S12: No), the subsequent processing is sequentially performed on the fault isolation information that has not been applied.

  The replacement processing unit 14 determines whether or not the processing target message acquired in step S11 is a message that is a replacement candidate in the fault isolation information for the unapplied fault isolation information (S13). That is, the replacement processing unit 14 determines whether the processing target message matches the replacement candidate message determination condition 120. If the message to be processed is not a replacement candidate message (S13: No), the process returns to step S12. When the processing target message is a replacement candidate message (S13: Yes), a replacement determination process is sequentially performed on a plurality of records associated with the replacement candidate message determination condition 120.

  That is, the replacement processing unit 14 determines whether or not replacement determination has been performed for all records with respect to the replacement candidate message (S14). When the replacement determination has been completed for all (S14: Yes), the process returns to step S12.

  When all the replacement conditions are not applied (S14: No), the replacement determination is sequentially performed according to the replacement determination rank 121. That is, the replacement processing unit 14 confirms the status of the monitoring target system according to the confirmation item 122 (S15). For example, the replacement processing unit 14 transmits a command for inquiring the status shown in the confirmation content 122b to the external operation monitoring device 122a to check the operation status of the monitoring target system.

  The replacement processing unit 14 determines whether or not the replacement condition 123 is satisfied based on the result of the above situation check (S16). That is, the replacement processing unit 14 determines whether the information acquired by the operation status inquiry of the monitoring target system matches the replacement condition 123. If the replacement condition 123 is not met (S16: No), the process returns to step S14. When the replacement condition 124 is met (S16: Yes), a process for replacing the message specified in the replacement process 124 is executed (S17).

  The replacement processing unit 14 performs (1) a message determined not to be a replacement candidate by the above-described processing procedure, (2) a message that is not a replacement candidate and does not meet any replacement condition 123, and (3 ) The replaced message after replacement is output to the filtering processing unit 15 (S18).

  By performing message replacement according to the fault isolation information as described above, a message indicating a true fault occurring in the monitored system can be obtained.

  When the filtering processing unit 15 receives the messages (1) to (3) described above from the replacement processing unit 14, the filtering processing unit 15 applies the filtering processing to the received message. Then, the message that has passed the following filtering process is stored in the message storage unit 17.

  For example, as illustrated in FIG. 5, the message storage unit 17 includes a message area 171 that stores a message and a writing time area 172 that stores a time when the message is written. When the filtering processing unit 15 writes a message to the message storage unit 17, the message region 171 and the time region 172 are written together.

  Here, for example, the filtering processing unit 15 may store only messages that satisfy (or do not satisfy) a predetermined condition in the message storage unit 17 and perform filtering.

  For example, when the same message as the message received from the replacement processing unit 14 is already stored in the message storage unit 17, the filtering condition may be that no writing is performed. Further, for example, when the same message is written after the time when the filtering processing unit 15 refers to the writing time 172 and goes back a predetermined time (for example, 60 seconds, 3 minutes, 5 minutes, etc.) from the current time. , You may not write.

  According to the present embodiment, even when a large number of messages are generated from a single failure that has occurred in the monitoring target system, only one message for notifying the occurrence of the single failure is stored in the message storage unit 17. It will be. As a result, the operator of the integrated monitoring system 1 can immediately identify the cause of the failure.

  The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the gist of the present invention.

  For example, the plurality of external operation monitoring devices 3 can be realized intensively with a single computer machine, or can be separately realized with separate computer machines.

It is a figure which shows the structure of the integrated monitoring system concerning one Embodiment of this invention. It is a figure which shows an example of the data structure of the fault isolation information storage part. 4 is a diagram illustrating an example of a data structure of a message 50. FIG. 4 is a flowchart illustrating a processing procedure of a message replacement processing unit 14. 4 is a diagram illustrating an example of a data structure of a message storage unit 17. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Integrated monitoring apparatus, 2 ... Storage apparatus, 3 ... External operation monitoring apparatus, 4 ... Display apparatus, 9 ... Network, 12 ... Fault isolation information storage part, 14 ... Message replacement process part, 15 ... Filtering process part, 50 ... message.

Claims (6)

A receiver that receives messages about the monitored system;
A display control unit for controlling the display device;
A storage unit for storing a message for the display control unit to display on the display device;
A message extraction unit that extracts a replacement candidate message from the received message received by the reception unit;
A received message storage processing unit that stores the received message that is not a replacement candidate that was not extracted by the message extraction unit in the storage unit;
A replacement processing unit that replaces the replacement candidate message according to a predetermined rule;
A replacement message storage processing unit that stores the replaced message in the storage unit when the same message as the replaced message replaced by the replacement processing unit is not stored in the storage unit. Monitoring device.   The computer system monitoring according to claim 1, wherein the replacement processing unit confirms an operation status of the monitoring target system related to contents indicated by the replacement candidate message, and replaces the replacement candidate message based on the confirmation result. apparatus. The receiving unit receives a message about the monitored system from each of a plurality of other monitoring devices,
The computer system according to claim 2, wherein the replacement processing unit makes an inquiry about an operation status of the monitoring target system related to the content indicated by the replacement candidate message to any one of the plurality of other monitoring devices. Monitoring device. The storage unit includes an area for storing the message to be displayed and an area for storing a time when the message is stored,
The received message storage processing unit stores the received message that is not the replacement candidate and the current time in the storage unit,
The replacement message storage processing unit, after there is no message that is the same as the message after replacement in the message stored in the storage unit between a predetermined time before the current time and the current time, after the replacement The computer system monitoring apparatus according to claim 1, wherein the message and the current time are stored in the storage unit. Receive messages about monitored systems,
Extracting a replacement candidate message from the received received message;
Storing the received message that is not a replacement candidate that was not extracted as the replacement candidate message in a message storage unit;
The replacement candidate message is replaced according to a predetermined rule, and when the same message as the replaced message is not stored in the message storage unit, the replaced message is stored in the message storage unit,
A monitoring method for a computer system, wherein a message stored in the message storage unit is displayed on a display device. When executed on a computer,
Receive messages about monitored systems,
Extracting a replacement candidate message from the received received message;
Storing the received message that is not a replacement candidate that was not extracted as the replacement candidate message in a message storage unit;
The replacement candidate message is replaced according to a predetermined rule, and when the same message as the replaced message is not stored in the message storage unit, the replaced message is stored in the message storage unit,
A computer program for monitoring a computer system, wherein a message stored in the message storage unit is displayed on a display device.

Images