JP2005182622A - Alarm output system, computer system, alarm output method, and alarm output program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system which is made to notify even while alarm does not occur, integrates same kinds of alarms or same alarms, and improves user's convenience. <P>SOLUTION: An alarm output determination means 102 of this system checks whether an alarm event continues or not by an alarm occurrence recording means 103 when receiving notice from an alarm detection means 101. When there is no record of alarm, the final occurrence time is updated to current time, an alarm notice creating means 105 creates alarm notice, and an alarm notice output means 106 outputs the alarm notice. When there is a record and the condition is agreed, the final occurrence time is updated to current time and the alarm notice is suppressed. An event termination determination means 107 checks the termination of alarm event periodically by the alarm occurrence recording means 103, and the alarm notice creating means 105 creates the alarm notice. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an alarm output system, a computer system, an alarm output method, and an alarm output program, and in particular, an alarm output system that collects similar or identical alarms and notifies them even when no alarm is generated. , A computer system, an alarm output method, and an alarm output program.

  In a system having an operation monitoring function of an apparatus, a network, or a program, or an environment, a large number of similar alarms are often detected due to an unauthorized system intrusion via the network, a virus, a user operation error, or the like. At that time, the administrator is required to suppress and compress the same type of alarm in order to properly grasp the situation, but in order to deal with the cause of the problem, it is possible to acquire additional information of each alarm without delay or to leak it as a record. An alarm history with no error may be required.

  An example of a conventional alarm output system is described in Patent Document 1. This conventional alarm output system includes alarm detection means, storage means for storing alarm occurrences in time series, investigation means for examining time intervals of each alarm, investigation means for examining alarm suppression status, and determination of alarm suppression. Determination means, an output means for finally outputting an alarm, and a storage means for storing the suppressed alarm.

  The conventional alarm output system described in Patent Document 1 stores detected alarms in the order of time of occurrence, and each time an alarm is detected, the interval between the occurrence of the previous alarm of the same number is checked and is equal to or greater than a predetermined value. Or a new detection only if the elapsed time since the alarm notification of the same number was output is greater than or equal to a predetermined value, or the number of times the alarm is suppressed is greater than or equal to a predetermined value Notify the alarm.

  This conventional technology also collects the information of each alarm from the alarm records stored in time series, and notifies the alarm suppression count stored in the alarm output, so that a continuous alarm history can be obtained. It can also be used for required alarm output systems.

  There is also another invention that suppresses the same kind of alarm (for example, Patent Document 2).

Japanese Patent Application Laid-Open No. 11-024742 Japanese Patent Laid-Open No. 10-027290

  In the alarm output system that suppresses the same kind of alarm notification described in Patent Document 1, it is determined whether or not the alarm should be notified only when the occurrence of the alarm is detected, and therefore the same kind of alarm is generated again for the information of the suppressed alarm. There was a problem that was not notified until.

  That is, when this prior art is applied to an alarm output system that also requires a history of continuous alarms, there are the following problems.

  The first problem is that it does not know when the information of the suppressed alarm is notified. The number of alarm occurrences including the suppressed alarm is notified after the next occurrence of the alarm of the same number.

  The reason is that alarm notification is output only at the alarm detection timing.

  A second problem is that when a re-notification of an alarm that has been suppressed once has occurred more than once due to the elapse of a predetermined time or the occurrence of a predetermined number of times, it is not notified when successive alarms have started.

  The reason is that the alarm generation start time is not held until the continuous generation of alarms ends.

  In the invention described in Patent Document 2, there is a problem that notification of the suppressed history is delayed. In addition, the end of a series of alarm events is not known at the time of receiving an alarm notification that is finally transmitted from the outside, and the recipient must observe and determine the subsequent alarm notification outside the system.

  An object of the present invention is to solve the above-mentioned problems and to collect the same or the same alarms so as to notify them even when no alarm is generated, thereby improving the usability of the user.

  The first alarm output system of the present invention stores the same or similar alarm information that occurs continuously in the storage means, and suppresses the alarm notification while suppressing the same or the same alarm that has been suppressed at the end of the continuous occurrence. It has means for reading out all histories of the same type of alarm from the storage means and outputting an alarm notification.

  The second alarm output system of the present invention stores the alarm identification information and the last alarm occurrence time in the first storage means as alarm occurrence records for each of the same or similar alarms that occur continuously, and detects an alarm. , If there is no same or similar alarm occurrence record in the first storage means, or if there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is greater than the preset event duration It is determined that there is no alarm event, the alarm last occurrence time is updated to the current time, information about the alarm is recorded in the second storage means, an alarm notification is output, and the same or the same type in the first storage means If there is an alarm occurrence record and the difference between the current time and the last occurrence time is equal to or less than the event duration, the alarm event It determines that continued medium, and updates the alarm last occurrence time to the current time, characterized by having a means for recording information about the alarm in the second storage means.

  A third alarm output system of the present invention is the second alarm output system, wherein an alarm event having a difference between a current time and a last occurrence time greater than the event duration is determined at a predetermined time interval based on a timer. If detected, it is regarded as an alarm event end, and means for outputting an alarm end notification process is provided.

  The fourth alarm output system of the present invention stores the alarm identification information and the last alarm occurrence time in the first storage means as an alarm occurrence record for each of the same or similar alarms that occur continuously, and detects an alarm. , If there is no same or similar alarm occurrence record in the first storage means, or if there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is greater than the preset event duration The alarm last occurrence time is updated to the current time, information about the alarm is recorded in the second storage means, an alarm notification is output, and the alarm notification time is added to the alarm occurrence record. The first storage means has the same or similar alarm occurrence record, and the difference between the current time and the last occurrence time is the event If the duration is equal to or less than the duration, it is determined that the alarm event is continuing, the alarm last occurrence time is updated to the current time, the information about the alarm in the second storage means is recorded, and the first event is recorded at a predetermined cycle. An alarm occurrence record in the storage means is checked, and when the difference between the current time and the notification time is larger than a predetermined re-notification time, there is provided means for outputting an alarm continuation notification.

  A fifth alarm output system of the present invention is the fourth alarm output system, wherein an alarm event having a difference between a current time and a last occurrence time greater than the event duration is determined at a predetermined time interval based on a timer. If detected, it is regarded as an alarm event end, and means for outputting an alarm end notification process is provided.

  The sixth alarm output system of the present invention includes an alarm detection means, an alarm output determination means, an alarm occurrence recording means, an alarm information accumulation buffer, an alarm notification creation means, an alarm notification output means, and an event end determination means. The alarm detection means detects an alarm occurrence and passes an alarm classification code and an alarm start time or detailed alarm information attached to the alarm to the alarm output determination means. The alarm output determination means The alarm information is recorded in the alarm information accumulation buffer based on the alarm classification code from the alarm detection means and the occurrence time or the detailed alarm information attached to the alarm, and a new alarm from the alarm occurrence recording means Event, ongoing, or end According to the information on whether or not the alarm notification is created, the alarm notification creation means is instructed to create an alarm start notification or an alarm end notification. The alarm occurrence recording means is instructed by the alarm output determination means to generate an alarm classification code and an alarm start The alarm occurrence record including the time and the last occurrence time is held, and if there is no alarm occurrence record of the same alarm classification code according to the instruction of the alarm output determination means, it is assumed that it is a new alarm event, the alarm occurrence record exists, When the difference between the time and the last occurrence time is greater than the event duration, the ongoing alarm event is considered to be terminated, and there is an alarm occurrence record, and the difference between the current time and the last occurrence time is equal to or less than the event duration The alarm event is ongoing, and the alarm notification creating means In response to a request from the alarm output determination unit and the event end determination unit, the alarm information recorded in the alarm information accumulation buffer is referred to and edited to create an alarm start notification or an alarm end notification, and the alarm notification output unit The alarm information included in the alarm end notification is deleted from the alarm information accumulation buffer, and the alarm notification output means outputs the alarm start notification or the alarm end notification passed from the alarm notification creation means. The event end judging means checks the end of all alarm events included in the alarm occurrence record using the alarm occurrence recording means at a predetermined cycle, and when the alarm event has ended, the alarm end Instructing the notification creation means to create an alarm end notification To do.

  A seventh alarm output system according to the present invention is the sixth alarm output system, wherein an alarm is generated including an alarm classification code, an alarm start time, a last occurrence time, and an alarm notification time according to an instruction from the alarm output determination means. When the difference between the current occurrence time and the notification time is larger than a predetermined re-notification time, the alarm occurrence recording means is used to set the alarm notification time content of the alarm occurrence record to the current time. Alarms recorded in the alarm information accumulation buffer at the request of the alarm output determination means for instructing the alarm notification generation means to create an alarm continuation notification, the alarm output determination means, and the event end determination means. Refer to and edit information, alarm start notification, alarm end notification, or alarm The alarm notification creation means for creating a continuation notification, passing it to the alarm notification output means, and deleting the alarm information included in the alarm end notification from the alarm information accumulation buffer, and the alarm start passed from the alarm notification creation means The alarm notification output means for sending a notification, an alarm end notification, or an alarm continuation notification to an output destination.

  The computer system according to the present invention includes one or more of the first, second, third, fourth, fifth, sixth, or seventh alarm output systems.

  In the first alarm output method of the present invention, the computer stores information on the same or similar alarms that occur continuously in the storage means, and suppresses alarm notification while suppressing the alarm occurrence. And reading out all histories of the same or similar alarm from the storage means and outputting an alarm notification.

  According to a second alarm output method of the present invention, the computer stores the alarm identification information and the last alarm occurrence time in the first storage means as an alarm occurrence record for each of the same or similar alarms that occur continuously. When the computer detects an alarm, there is no same or similar alarm occurrence record in the first storage means, or there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is set in advance Determining that there is no ongoing alarm event if greater than the event duration, updating the alarm last occurrence time to the current time, recording information about the alarm in the second storage means, and outputting an alarm notification; The computer has the same or the same type of alarm occurrence record in the first storage means, and the current time and the last alarm occurrence are recorded. If the difference from the time is equal to or smaller than the event duration, it is determined that the alarm event is continuing, the alarm last occurrence time is updated to the current time, and the information about the alarm in the second storage means is recorded; It is characterized by including.

  The third alarm output method of the present invention is the third alarm output method, wherein the computer determines that the difference between the current time and the last occurrence time is greater than the event duration time at a predetermined time interval based on a timer. When a large alarm event is detected, it is regarded as the end of the alarm event, and a step of outputting an alarm end notification process is included.

  According to a fourth alarm output method of the present invention, the computer stores the alarm identification information and the last alarm occurrence time in the first storage means as an alarm occurrence record for each of the same or similar alarms that occur continuously. When the computer detects an alarm, there is no same or similar alarm occurrence record in the first storage means, or there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is set in advance If it is longer than the event duration, it is determined that there is no ongoing alarm event, the last alarm occurrence time is updated to the current time, information about the alarm is recorded in the second storage means, an alarm notification is output, and the alarm is generated. Adding an alarm notification time to the record, wherein the computer is stored in the first storage means; If there is an alarm occurrence record of the same type and the difference between the current time and the last occurrence time is equal to or smaller than the event duration time, it is determined that the alarm event is continuing, the alarm last occurrence time is updated to the current time, and the second Recording information related to alarms in the storage means, and the computer examines the alarm occurrence record in the first storage means at a predetermined cycle, and the difference between the current time and the notification time is a predetermined re-notification time. If larger, a step of outputting an alarm continuation notification is included.

  The fifth alarm output method of the present invention is the fourth alarm output method, wherein the computer determines that the difference between the current time and the last occurrence time is greater than the event duration time at a predetermined time interval based on a timer. When a large alarm event is detected, it is regarded as the end of the alarm event, and a step of outputting an alarm end notification process is included.

  The first alarm output program of the present invention stores the same or similar alarm information that occurs continuously in the storage means, and suppresses the alarm notification while suppressing the same or the same alarm that has been suppressed at the end of the continuous occurrence. A step of reading out all histories of the same type of alarm from the storage means and outputting an alarm notification is executed by the computer.

  The second alarm output program of the present invention stores the alarm identification information and the alarm last occurrence time in the first storage means as alarm occurrence records for each of the same or similar alarms that are continuously generated, Upon detection, if there is no same or similar alarm occurrence record in the first storage means, or if there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is greater than the preset event duration, Determining that there is no ongoing alarm event, updating the alarm last occurrence time to the current time, recording information about the alarm in the second storage means, and outputting an alarm notification; and in the first storage means There are the same or similar alarm occurrence records, and the difference between the current time and the last occurrence time is equal to or smaller than the event duration. If no, it is determined that continuing alarm events, and updates the alarm last occurrence time to the current time, characterized in that to execute a step of recording information about the alarm of the second storage unit, to the computer.

  A third alarm output program according to the present invention is the second alarm output program, wherein an alarm event having a difference between a current time and a last occurrence time greater than the event duration is determined at a predetermined time interval based on a timer. When detected, it is regarded as the end of an alarm event, and includes a step of outputting an alarm end notification process.

  A fourth alarm output program according to the present invention includes a step of storing alarm identification information and an alarm last occurrence time in the first storage means as an alarm occurrence record for each of the same or the same type of alarms continuously generated; Upon detection, if there is no same or similar alarm occurrence record in the first storage means, or if there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is greater than the preset event duration, It is determined that there is no ongoing alarm event, the alarm last occurrence time is updated to the current time, information about the alarm is recorded in the second storage means, an alarm notification is output, and the alarm notification time is set in the alarm occurrence record. The step of adding, the same or similar alarm occurrence record in the first storage means, the current time and the last occurrence If the difference from the time is equal to or smaller than the event duration, it is determined that the alarm event is continuing, the alarm last occurrence time is updated to the current time, and the information about the alarm in the second storage means is recorded; The alarm occurrence record in the first storage means is checked at a predetermined cycle, and if the difference between the current time and the notification time is larger than a predetermined re-notification time, an alarm continuation notification is output to the computer. It is characterized by making it.

  A fifth alarm output program according to the present invention is the fourth alarm output program, wherein an alarm event having a difference between a current time and a last occurrence time greater than the event duration is determined at a predetermined time interval based on a timer. When detected, it is regarded as the end of an alarm event, and includes a step of outputting an alarm end notification process.

  The effect of the present invention is that a series of previous alarm events can be notified collectively even when no alarm occurs.

  The reason is to periodically check the end of the alarm event.

  Next, a first best mode for carrying out the present invention will be described in detail with reference to the drawings.

  In the first best mode for carrying out the present invention, an alarm having the same alarm classification code (character string for identifying an alarm) and continuously occurring within a predetermined time interval is referred to as one alarm event, The predetermined time interval is called an event duration.

  FIG. 1 is a block diagram showing the configuration of the first best mode for carrying out the present invention.

  Referring to FIG. 1, the first best mode of the present invention comprises a computer 100 that operates under program control. The computer 100 includes an alarm detection unit 101, an alarm output determination unit 102, an alarm generation recording unit 103 (including a storage unit such as a memory and a hard disk), and an alarm information accumulation buffer 104 (for example, a register or a memory). Or a storage means such as a hard disk), an alarm notification creation means 105, an alarm notification output means 106, and an event end determination means 107.

  Each of these means generally operates as follows.

  The alarm detection means 101 detects the occurrence of an alarm on the computer 100 or from a device or program outside the computer 100, and generates an alarm classification code, an occurrence time, or alarm detailed information attached to the alarm (alarm detailed information). Are part of the alarm classification code) to the alarm output determination means 102.

  The alarm output determination unit 102 records alarm information in the alarm information accumulation buffer 104 for the alarm notified from the alarm detection unit 101, and the alarm event recording unit 103 continues the same type of alarm event (same alarm classification code). Find out if you have. The alarm output determination unit 102 updates the alarm occurrence record, and instructs the alarm notification generation unit 105 to create an alarm notification when the alarm event does not continue.

  FIG. 9 is an explanatory diagram showing an example of the configuration of alarm occurrence recording.

  Referring to FIG. 9A, the alarm occurrence record includes an alarm classification code, an alarm start time, and a last occurrence time for each alarm event.

  The alarm occurrence recording means 103 holds an alarm occurrence record as shown in the configuration of the alarm occurrence record in FIG. 9A, and from the alarm last occurrence time according to the request of the alarm output determination means 102 and the event end determination means 107. Check if an alarm event is ongoing, and add, update, or delete alarm records. Further, the alarm occurrence recording means 103 is in progress if there is no alarm occurrence record of the same alarm classification code as the alarm that has occurred or if there is a record and the difference between the current time and the last occurrence time is greater than the event duration time. If there is no alarm event or it is regarded as an end, there is an alarm occurrence record, and the difference between the current time and the last occurrence time is equal to or smaller than the event duration, it is considered that the alarm event is continuing.

  In the alarm information accumulation buffer 104, alarm information is added by the alarm output determination means 102, and the alarm information is referred to and deleted by the alarm notification creation means 105. The alarm notification creation unit 105 creates an alarm notification by referring to and editing the alarm information recorded in the alarm information accumulation buffer 104 in response to a request from the alarm output determination unit 102 and the event end determination unit 107. The alarm notification output unit 106 To pass. The alarm notification creation unit 105 deletes the alarm information included in the alarm notification from the alarm information accumulation buffer 104.

  The alarm notification output unit 106 sends the alarm notification passed from the alarm notification creation unit 105 to an output destination determined by a method designated in advance. The event end judging means 107 checks the end of all alarm events included in the alarm occurrence recording using the alarm occurrence recording means 103 at a predetermined end check timer cycle, and when the event is ended, the alarm notification creating means Instruct 105 to create an alarm notification.

  The simplest alarm information may be a message consisting only of a numerical value or character string predetermined (programmed) for each type of alarm, and may not have detailed alarm information. In that case, the occurrence date and time is the detection date and time, and the alarm classification code is all the alarm information.

  More complicated alarm information includes alarm details (such as the location and location of alarms) that are fixed parts (alarm numbers, character strings of alarm types, etc.) that are predetermined according to the type of alarm, or variable parts that change depending on the alarm occurrence status. In some cases, a target object [broken file name list, generated user name,...], A state at the time of occurrence [disk remaining amount, number of requests staying,. In this case, the alarm information may include an occurrence date and time. The alarm classification code can only be a fixed part (for example, for each alarm number), only a variable part (for example, each place where it occurred), or a combination of a fixed part and a variable part (for example, type and user [" The user who caused the “file destruction” can have three modes such as A]).

  FIG. 10 is an explanatory diagram showing an example of the contents of the alarm information accumulation buffer 104.

  Referring to FIG. 10 (a), there is a method of collecting and saving all generated alarms in time series. The alarm information can include all relevant information such as the date and time of the alarm and a message.

  Referring to FIG. 10 (b), there is a method in which the alarms generated are classified according to classification, and only information necessary for alarm notification is extracted and stored later.

  Next, the operation of the first best mode for carrying out the present invention will be described with reference to the drawings.

  FIG. 2 is a flowchart showing the operation of the first best mode for carrying out the present invention.

  FIG. 3 is a detailed flowchart of the alarm start notification process of FIG.

  FIG. 4 is a detailed flowchart of the alarm end notification process of FIG.

  FIG. 5 is a flowchart showing the operation of the first best mode for carrying out the present invention.

  Referring to FIG. 2, first, the alarm detection means 101 detects an alarm (step A1 in FIG. 2). Next, in response to a request from the alarm output determination means 102, the alarm occurrence recording means 103 checks whether there is an alarm occurrence record using the alarm classification code as a key (step A2).

  If there is no alarm occurrence record (step A2 / NO), the alarm output determination means 102 considers that a new alarm event has started and performs alarm start notification processing (step A3). In the alarm start notification process, the alarm occurrence recording means 103 adds the contents of the alarm start time and the last occurrence time to the alarm occurrence record as the current time, and the alarm information accumulation buffer 104 adds the alarm detailed information (FIG. 3). Step B1).

  Next, the alarm notification creation unit 105 refers to the alarm information accumulation buffer 104 and creates an alarm start notification for notifying the start of the alarm event. The contents of the alarm start notification may include an alarm classification code, an alarm start time, detailed alarm information, etc. (step B2). Then, the alarm notification output means 106 outputs an alarm start notification (step B3).

  Returning to step A2, if there is an alarm occurrence record (step A2 / YES), the alarm occurrence recording means 103 checks whether the alarm event continues (step A4).

  When the difference between the current time and the last occurrence time is larger than the event duration (step A4 / NO), the alarm that has been continued is considered to have ended and a new alarm has started. The previous alarm end notification process is performed (step A5).

  In the alarm end notification process, the alarm notification creating means 105 refers to the alarm information accumulation buffer 104 and creates an alarm end notification for notifying the end of the alarm event (step C1 in FIG. 4). The contents of the alarm end notification can include an alarm classification code, an alarm start time, an alarm end time (last occurrence time), or a list of alarm detailed information. Alarm detailed information may be processed to add the number of alarms and alarm detailed information.

  Next, the alarm notification output means 106 outputs an alarm end notification (step C2). Then, the alarm occurrence recording means 103 deletes the record relating to the current alarm in the alarm occurrence record, and also deletes the alarm detailed information relating to the current alarm in the alarm information accumulation buffer 104 (step C3).

  Following step A5, the alarm output determination means 102 performs alarm start notification processing for the current alarm (step A3). The alarm start notification process is as described above.

  When the difference between the current time and the last occurrence time is equal to or smaller than the event duration (step A4 / YES), the alarm output determination unit 102 considers that the alarm event is continuing. The alarm output determination means 102 uses the alarm occurrence recording means 103 to update the content of the last occurrence time of the alarm occurrence record with the current time, and adds the detailed alarm information to the alarm information accumulation buffer 104 (step A6). The alarm occurrence recording means 103 does not issue an alarm notification at this point. Thereafter, when an alarm is detected again, the process is repeated from step A1.

  In parallel with the above, an operation as shown in FIG. 5 is performed. The event end determination means 107 uses the alarm occurrence recording means 103 to check whether all alarm events included in the alarm occurrence record continue (step E1 in FIG. 5). For the alarm whose difference between the current time and the last occurrence time is smaller than the event duration, the alarm end process is not performed.

  When the event end determination unit 107 detects an alarm in which the difference between the current time and the last occurrence time is greater than the event duration (step E1 / NO), the event end determination unit 107 regards that the alarm event has ended, and uses the alarm notification generation unit 105 to perform alarm end notification processing. (Step E2). The alarm end notification process is the same as in step A5. When the operation is completed for all alarm events (step E1 / YES), the process waits for a predetermined end check timer (step E3). After waiting, the process is repeated again from step E1.

  Next, the effect of the first best mode for carrying out the present invention will be described.

  The first best mode is configured to determine the start and end of an alarm event and output a notification, and accumulate detailed information instead of the alarm notification during that time. Therefore, one alarm start notification is output for one alarm event, and then no alarm is output until the alarm event ends, and all alarms from the start to the end are gathered together as an alarm end notification at the end. Be notified.

Next, a second best mode for carrying out the present invention will be described in detail with reference to the drawings.
The configuration of the second best mode for carrying out the present invention is the same as that of the first best mode for carrying out the present invention, and reference is made to FIG. 1 for the description.

  Each means in FIG. 1 is generally operated as follows.

  The alarm detection means 101 has the same function as that of the first best mode.

  The alarm output determination unit 102 adds the function of the first best mode to the alarm notified from the alarm detection unit 101 when it is found that the same kind of alarm event continues using the alarm occurrence recording unit 103. In addition, it has a function to check the elapsed time since the previous alarm notification. The alarm output determination unit 102 instructs the alarm notification creation unit 105 to create an alarm notification when a predetermined re-notification time has elapsed. The alarm output determination means 102 also has a function of recording the notification time when the first best mode updates the alarm occurrence record.

  The alarm occurrence recording means 103 is different from the first best mode in that an alarm occurrence record as shown in FIG. 9 (b) configuration of alarm occurrence record is held.

  Referring to FIG. 9B, the alarm occurrence record includes an alarm classification code, an alarm start time, a last occurrence time, and a notification time for each alarm event.

  In addition to the function of the first best mode, the alarm occurrence recording means 103 is a function for examining the elapsed time from the notification time to the previous alarm notification in response to a request from the alarm output determination means 102 and the event end determination means 107. Have The alarm information accumulation buffer 104 is the same as in the first best mode. The alarm notification creation means 105 is the same as in the first best mode. The alarm notification output means 106 is the same as in the first best mode. The event end determination means 107 is the same as in the first best mode.

  Next, the operation of the second best mode for carrying out the present invention will be described with reference to the drawings.

  FIG. 6 is a flowchart showing the operation of the second best mode for carrying out the present invention.

  FIG. 7 is a detailed flowchart of the alarm start notification process of FIG.

  FIG. 8 is a detailed flowchart of the alarm continuation notification process of FIG.

  The operation of the second best mode for carrying out the present invention shown in steps A1 to A6 in FIG. 6 is the same as the operation of the first best mode shown in steps A1 to A6 in FIG. Therefore, explanation is omitted. However, the operation of the alarm start notification process in step A3 of FIG. 6 is different. Referring to FIG. 7, in the alarm start notification process, when the alarm occurrence recording means 103 adds an alarm occurrence record, in addition to the alarm start time and the last occurrence time, the contents of the notification time are also added at the current time. Then, the alarm output determination stage 102 adds the detailed alarm information to the alarm information accumulation buffer 104 (step B1 in FIG. 7). Subsequent steps B2 to B3 are the same as the operations in steps B2 to B3 in FIG.

  By the process up to step A6 in FIG. 6, it is determined that the alarm event is continuing (step A4 / YES in FIG. 6), the alarm information is added to the alarm information buffer, and the last occurrence time of the alarm occurrence record is updated (step A6). ) Will be described.

  First, the alarm output determination means 102 checks the elapsed time from the previous alarm notification using the alarm occurrence recording means 103 (step A7). If the difference between the current time and the notification time is smaller than the re-notification time (step A7 / NO), the process returns to step A1. When the difference between the current time and the notification time is equal to or greater than the re-notification time (step A7 / YES), the alarm output determination means 102 performs an alarm continuation notification process (step A8).

  In the alarm continuation notification process, the alarm output determination means 102 uses the alarm occurrence recording means 103 to update the contents of the notification time with the current time in the alarm occurrence record (step D1 in FIG. 8). Next, the alarm notification creation means 105 creates an alarm continuation notification for notifying the continuation of the alarm event with reference to the alarm information accumulation buffer 104 (step D2). The alarm continuation notification content can include an alarm classification code, an alarm start time, an alarm continuation confirmation time (last occurrence time), a list of alarm detailed information, and the like. Alarm detail information may be processed to add the number of alarms and detailed information.

  Then, the alarm notification output unit 106 outputs an alarm continuation notification (step D3). At this time, the detailed alarm information regarding the current alarm in the alarm information accumulation buffer 104 may be deleted. For example, this is effective in preventing an alarm event from prolonging and an information amount in the alarm information accumulation buffer 104 from increasing excessively.

  Thereafter, when an alarm is detected again, the process is repeated from step A1.

  In parallel with the above, the operation as shown in FIG. 5 is performed, but since it is the same as the operation of the first best mode, the description is omitted.

  Next, the effect of the second best mode for carrying out the present invention will be described.

  The second best mode for carrying out the present invention is configured to check an alarm notification interval when an alarm event is continuing, and to output a continuation notification when a predetermined period has passed. Alarm continuation notification can be output when the event is long.

  The present invention can be applied to applications such as devices, networks, alarm output devices and programs for programs, and alarm output programs for systems that monitor them. Further, the present invention can also be applied to uses such as a monitoring center or a call center alarm control device or a program that receives and collectively processes alarms from various systems. In addition, a computer system including one or more computers 100 to which the present invention is applied can be constructed.

It is a block diagram which shows the structure of the 1st best form for implementing this invention. It is a flowchart which shows operation | movement of the 1st best form for implementing this invention. It is a detailed flowchart of the alarm start notification process of FIG. 3 is a detailed flowchart of alarm end notification processing of FIG. 2. It is a flowchart which shows operation | movement of the 1st best form for implementing this invention. It is a flowchart which shows the operation | movement of the 2nd best form for implementing this invention. It is a detailed flowchart of the alarm start notification process of FIG. It is a detailed flowchart of the alarm continuation notification process of FIG. It is explanatory drawing which shows one example of a structure of alarm generation recording. It is explanatory drawing which shows one example of the content of the alarm information accumulation buffer.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Computer 101 Alarm detection means 102 Alarm output determination means 103 Alarm generation recording means 104 Alarm information accumulation buffer 105 Alarm notification preparation means 106 Alarm notification output means 107 Event end determination means

Claims (18)

Information on alarms of the same or the same type that are continuously generated is stored in the storage means, and all the history of the same or the same type of alarms that have been suppressed at the end of the continuous occurrence is suppressed while the alarm notification is suppressed. An alarm output system comprising means for outputting an alarm notification read from the alarm. The alarm identification information and the alarm last occurrence time are stored in the first storage means as the alarm occurrence record for each of the same or similar alarms that are continuously generated, and when the alarm is detected, the same or the same alarm information is stored in the first storage means. If there is no alarm occurrence record of the same type, or if there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is greater than the preset event duration, it is determined that there is no ongoing alarm event and the last alarm Updates the occurrence time to the current time, records information about the alarm in the second storage means, outputs an alarm notification, and has the same or similar alarm occurrence record in the first storage means, the current time and the last occurrence When the difference from the time is equal to or smaller than the event duration, it is determined that the alarm event is continuing, and the alarm last occurrence time is set. Alarm output system updating in time, characterized by having a means for recording information about the alarm in the second storage means. When an alarm event is detected at a predetermined time interval based on a timer and the difference between the current time and the last occurrence time is greater than the event duration, the alarm event is ended, and an alarm end notification process is output. The alarm output system according to claim 2. The alarm identification information and the alarm last occurrence time are stored in the first storage means as the alarm occurrence record for each of the same or similar alarms that are continuously generated, and when the alarm is detected, the same or the same alarm information is stored in the first storage means. If there is no alarm occurrence record of the same type, or if there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is greater than the preset event duration, it is determined that there is no ongoing alarm event and the last alarm Update the occurrence time to the current time, record information about the alarm in the second storage means, output an alarm notification, add the time of the alarm notification to the alarm occurrence record, and the same or the same in the first storage means If there is an alarm occurrence record of the same type and the difference between the current time and the last occurrence time is equal to or less than the event duration, It is determined that the alarm event is continuing, the alarm last occurrence time is updated to the current time, the information about the alarm in the second storage means is recorded, and the alarm occurrence record in the first storage means is recorded at a predetermined cycle. An alarm output system comprising means for outputting an alarm continuation notification when the difference between the current time and the notification time is greater than a predetermined re-notification time. When an alarm event is detected at a predetermined time interval based on a timer and the difference between the current time and the last occurrence time is greater than the event duration, the alarm event is ended, and an alarm end notification process is output. The alarm output system according to claim 4. An alarm detection means, an alarm output determination means, an alarm occurrence recording means, an alarm information accumulation buffer, an alarm notification creation means, an alarm notification output means, and an event end determination means;
The alarm detection means detects an alarm occurrence, and passes an alarm classification code and an alarm start time or detailed alarm information attached to the alarm to the alarm output determination means,
The alarm output determination means records alarm information in the alarm information accumulation buffer based on an alarm classification code from the alarm detection means and an occurrence time or detailed alarm information attached to the alarm, and the alarm occurrence record Instructing the alarm notification creating means to create an alarm start notification or an alarm end notification according to information on whether it is a new alarm event from the means, whether it is ongoing, or ended,
The alarm occurrence recording means retains an alarm occurrence record including an alarm classification code, an alarm start time, and a last occurrence time according to an instruction from the alarm output determination means, and the same alarm classification code according to an instruction from the alarm output determination means. If there is no alarm occurrence record, it is assumed that it is a new alarm event, and if there is an alarm occurrence record and the difference between the current time and the last occurrence time is greater than the event duration, the ongoing alarm event is considered to have ended and an alarm has occurred. If there is a record and the difference between the current time and the last occurrence time is less than or equal to the event duration, then the alarm event is ongoing,
The alarm notification creating unit creates an alarm start notification or an alarm end notification by referring to and editing the alarm information recorded in the alarm information accumulation buffer according to the request of the alarm output determining unit and the event end determining unit. The alarm information included in the alarm end notification is deleted from the alarm information accumulation buffer.
The alarm notification output means sends an alarm start notification passed from the alarm notification creation means or an alarm end notification to an output destination,
The event end determination means checks the end of all alarm events included in the alarm occurrence record using the alarm occurrence recording means at a predetermined cycle, and when the alarm event has ended, Instruct to create alarm end notification,
An alarm output system characterized by that. The alarm occurrence recording means for holding an alarm occurrence record including an alarm classification code, an alarm start time, a last occurrence time, and an alarm notification time according to an instruction of the alarm output determination means;
When the difference between the current time and the notification time is larger than a predetermined re-notification time, the alarm occurrence recording means is used to update the content of the alarm notification time of the alarm occurrence record with the current time, and the alarm notification creating means is notified of the alarm. The alarm output determination means for instructing creation of a continuation notification;
In response to a request from the alarm output determination unit and the event end determination unit, the alarm information recorded in the alarm information accumulation buffer is referred to and edited to create an alarm start notification, alarm end notification, or alarm continuation notification, The alarm notification creating means for transferring the alarm information to the alarm notification output means and deleting the alarm information included in the alarm end notification from the alarm information accumulation buffer;
The alarm notification output means for sending an alarm start notification, an alarm end notification, or an alarm continuation notification passed from the alarm notification creation means, to an output destination;
The alarm output system according to claim 6, further comprising: A computer system comprising one or more alarm output systems according to claim 1, 2, 3, 4, 5, 6 or 7. The computer stores information on the same or similar alarms that occur continuously in the storage means, suppresses alarm notifications, and records all the history of the same or similar alarms that were suppressed at the end of the continuous occurrence. An alarm output method comprising the step of outputting a read alarm notification from the storage means. A step of storing the alarm identification information and the alarm last occurrence time in the first storage means as an alarm occurrence record for each of the same or similar alarms that are continuously generated;
When the computer detects an alarm, there is no same or similar alarm occurrence record in the first storage means, or there is an alarm occurrence record and an event in which the difference between the current time and the last alarm occurrence time is set in advance Determining that there is no ongoing alarm event if greater than the duration, updating the alarm last occurrence time to the current time, recording information about the alarm in the second storage means, and outputting an alarm notification;
If the computer has the same or similar alarm occurrence record in the first storage means, and the difference between the current time and the last occurrence time is equal to or smaller than the event duration, it is determined that the alarm event is continuing, Updating the alarm last occurrence time to the current time, and recording information relating to the alarm in the second storage means;
An alarm output method comprising: When the computer detects an alarm event at a predetermined time interval based on a timer and the difference between the current time and the last occurrence time is greater than the event duration, the computer regards the alarm event as being ended and outputs an alarm end notification process. The alarm output method according to claim 11, further comprising: A step of storing the alarm identification information and the alarm last occurrence time in the first storage means as an alarm occurrence record for each of the same or similar alarms that are continuously generated;
When the computer detects an alarm, there is no same or similar alarm occurrence record in the first storage means, or there is an alarm occurrence record and an event in which the difference between the current time and the last alarm occurrence time is set in advance If it is greater than the duration, it is determined that there is no ongoing alarm event, the last alarm occurrence time is updated to the current time, information about the alarm is recorded in the second storage means, an alarm notification is output, and the alarm occurrence record Adding alarm notification time to
If the computer has the same or similar alarm occurrence record in the first storage means, and the difference between the current time and the last occurrence time is equal to or smaller than the event duration, it is determined that the alarm event is continuing, Updating the alarm last occurrence time to the current time, and recording information relating to the alarm in the second storage means;
The computer examines the alarm occurrence record in the first storage means at a predetermined cycle, and outputs the alarm continuation notification if the difference between the current time and the notification time is greater than a predetermined re-notification time;
An alarm output method comprising: When the computer detects an alarm event at a predetermined time interval based on a timer and the difference between the current time and the last occurrence time is greater than the event duration, the computer regards the alarm event as being ended and outputs an alarm end notification process. The alarm output method according to claim 12, further comprising: Information on alarms of the same or the same type that are continuously generated is stored in the storage means, and all the history of the same or the same type of alarms that have been suppressed at the end of the continuous occurrence is suppressed while the alarm notification is suppressed. An alarm output program for causing a computer to execute a step of outputting an alarm notification read from the computer. Storing the alarm identification information and the alarm last occurrence time in the first storage means as alarm occurrence records for each of the same or similar alarms that occur continuously;
When an alarm is detected, there is no same or similar alarm occurrence record in the first storage means, or there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is greater than the preset event duration Determining that there is no ongoing alarm event, updating the alarm last occurrence time to the current time, recording information about the alarm in the second storage means, and outputting an alarm notification;
When the same or same type of alarm occurrence record is present in the first storage means and the difference between the current time and the last occurrence time is equal to or smaller than the event duration, it is determined that the alarm event is continuing, and the alarm last occurrence time Updating the current time and recording information about the alarm in the second storage means;
An alarm output program for causing a computer to execute. A step of outputting an alarm end notification process when an alarm event is detected at a predetermined time interval based on a timer, and an alarm event having a difference between the current time and the last occurrence time greater than the event duration is detected. The alarm output program according to claim 15. Storing the alarm identification information and the alarm last occurrence time in the first storage means as alarm occurrence records for each of the same or similar alarms that occur continuously;
When an alarm is detected, there is no same or similar alarm occurrence record in the first storage means, or there is an alarm occurrence record and the difference between the current time and the last alarm occurrence time is greater than the preset event duration If there is no ongoing alarm event, the alarm last occurrence time is updated to the current time, information about the alarm is recorded in the second storage means, an alarm notification is output, and the alarm notification is recorded in the alarm occurrence record. Adding time,
When the same or same type of alarm occurrence record is present in the first storage means and the difference between the current time and the last occurrence time is equal to or smaller than the event duration, it is determined that the alarm event is continuing, and the alarm last occurrence time Updating the current time and recording information about the alarm in the second storage means;
Checking the alarm occurrence record in the first storage means at a predetermined cycle, and outputting the alarm continuation notification if the difference between the current time and the notification time is greater than a predetermined re-notification time;
An alarm output program for causing a computer to execute. A step of outputting an alarm end notification process when an alarm event is detected at a predetermined time interval based on a timer, and an alarm event having a difference between the current time and the last occurrence time greater than the event duration is detected. The alarm output program according to claim 17.

Images