JP2006338305A - Monitor and monitoring program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To output an incident considering correlation between individual events. <P>SOLUTION: This monitor 1 has: rule definition data 21 wherein an event identifier of the event that is a monitoring target, a filtering rule associated to the event identifier, and a correlation rule showing relation of a plurality of event identifiers are associated to a correlation rule identifier, becoming a condition for outputting the incident; an event acquisition means 12 acquiring the event from a monitoring target device group 4; an event processing means 13 analyzing the event acquired by the event acquisition means 12, deciding whether the analyzed event accords with the correlation rule or not when the analyzed event accords with the filtering rule, and storing a state when the event does not accord with the correlation rule; and an incident output means 14 outputting the incident when it accords with the correlation rule in the event processing means 13. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a monitoring apparatus and a monitoring program for monitoring an event output from a monitoring target apparatus and outputting an incident.

  In recent years, with the development of information devices such as computers and communication control devices, such information devices have been utilized in business activities. In these information devices, failures and accidents may occur due to various factors such as aging and environmental changes. When an accident occurs, the information device outputs failure information in the form of an error message or system log. Therefore, the administrator of the information device can grasp the accident such as a failure or failure of the information device by monitoring the error message or the system log.

  2. Description of the Related Art Conventionally, there is a monitoring device that collects error messages and system logs output from information devices and monitors information device failures and failures. This monitoring apparatus extracts a single event (such as an error message or a system log) generated from a monitoring target element and monitors a failure or failure of the monitoring target element.

There is also an autonomic computing log trace analyzer that analyzes and correlates log data (see Non-Patent Document 1, page 15, first paragraph). In the technique described in Non-Patent Document 1, a common format, a log are read, the logs are correlated based on various criteria such as a time base and a field base (URL, etc.), and an associated log record is displayed. Is possible.
http://www-6.ibm.com/jp/autonomic/pdf/acwp_apd_j.pdf

  However, with such a conventional technique, it is difficult to extract a sufficient incident (any event that has occurred in a monitoring target device that needs to be notified).

  For example, in the above monitoring device, a single event is a monitoring target. Therefore, if an incident is output for each trivial event, there is a risk that the volume of the incident will be enormous and sufficient failure countermeasures may not be performed. Therefore, it is impossible to grasp a sign of failure or failure.

  Further, in the technique described in Non-Patent Document 1, since events having the same time and field are extracted as related ones, it is difficult to grasp the secular change that occurs using the apparatus on a regular basis. is there.

  Accordingly, an object of the present invention is to provide a monitoring apparatus and a monitoring program for outputting an incident in consideration of the correlation between individual events.

  In order to solve the above problems, a first feature of the present invention relates to a monitoring device that monitors an event output from a monitoring target device and outputs an incident. That is, the monitoring device according to the first aspect of the present invention includes a correlation rule identifier including an event identifier of an event to be monitored, a filtering rule associated with the event identifier, and a correlation rule indicating a relationship between a plurality of event identifiers. A rule definition data storage means for storing rule definition data in a storage device as a condition for outputting an incident associated with the event, an event acquisition means for acquiring an event from a monitored device, and the stored rule definition data Then, the event acquired by the event acquisition means is analyzed, and if the analyzed event matches the filtering rule, it is determined whether or not it matches the correlation rule. Event processing means to save and event processing If it meets the correlation rule in means comprises an incident output means for outputting an incident.

  According to the present invention as described above, the correlation between a plurality of events, which is a combination of filtering rules, is performed using a correlation rule specified by an operator or the like, and a complex event targeted for a plurality of events output from a plurality of devices. Incident can be output using rule definition.

  Here, it is preferable that the filtering rule has a variable, and the event processing unit determines whether or not the numerical value corresponding to the filtering rule variable matches the correlation rule, and stores the state.

  According to the present invention, by using variables, even if the same filtering rule and correlation rule are stored, the state is saved for each variable. Therefore, the filtering rule and the correlation rule are matched for each variable. Judgment can be made and an incident can be output. Specifically, in the case of a rule that expresses a disk number or the like as a variable, it can be output as a separate incident for each disk number.

  Here, when the analyzed event matches the filtering rule, the event processing means determines whether or not the correlation event matches the correlation rule with reference to the stored state data. It is preferable to store the matching state of the correlation rule as state data.

  According to the present invention as described above, the rule matching status is stored as status data for each correlation rule and variable, so even if the monitoring device is rebooted, it retains the status related to the event received before rebooting, Events can be monitored continuously. Thereby, it is possible to monitor the monitoring target device without depending on the machine state.

  Here, it is preferable that the correlation rule has a number of times or a time, and the event processing unit further determines whether or not the correlation rule matches in consideration of the number of times or the time.

  According to the present invention, it is possible to extract a plurality of events that match the number of times or time of a specified condition. Incidents can be prevented. Further, it is possible to eliminate the same event that occurs between the same number of times or in time, and to prevent the duplicate of the output of incidents.

  Here, the rule definition data storage means further stores in the storage device rule definition data associated with the correlation rule identifier and an action when the correlation rule matches, and the event processing means matches the correlation rule. When it is determined, it is preferable to further include an execution action control means for controlling the execution of the action based on the rule definition data from the storage device.

  According to the present invention as described above, it is possible to set and execute in advance what should be processed after an incident is output.

  The second feature of the present invention relates to a monitoring program for monitoring an event output from a monitoring target device and outputting an incident. That is, the monitoring program according to the second aspect of the present invention provides a correlation rule identifier that indicates an association between an event identifier of an event to be monitored, a filtering rule associated with the event identifier, and a plurality of event identifiers. Referring to the rule definition data, a rule definition data storage unit that stores rule definition data that is a condition for outputting an incident associated with the event in the storage device, an event acquisition unit that acquires an event from the monitored device, an event Event processing that analyzes the event acquired by the acquisition means, determines whether it matches the correlation rule if the analyzed event matches the filtering rule, and saves the state if it does not match the correlation rule Means and event processing means If you meet the relations rule, to execute an incident output means for outputting an incident to the computer.

  ADVANTAGE OF THE INVENTION According to this invention, the monitoring apparatus and monitoring program which output an incident in consideration of the correlation of each event can be provided.

  Next, embodiments of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals.

(Best Embodiment)
(Monitoring system)
The monitoring system 10 according to the preferred embodiment of the present invention monitors an event output from the monitoring target device group 4 and outputs an incident, and a management system 3 that collects information from the monitoring device 1 The monitoring target device group 4 which is a monitoring target device of the monitoring device 1 is provided. The monitoring device 1 and the management system 3 are connected by a communication network 2a such as the Internet, and the monitoring device 1 and the monitoring target device group 4 are connected by a communication network 2b such as an in-house LAN. Here, the communication network 2a and the communication network 2b are described as different networks, but they may be the same communication network. Here, the incident output by the monitoring device 1 is estimated based on a small error that can be corrected without causing a failure, and an event or management system that may cause an accident if appropriate processing is not performed 3, all events that have occurred on the monitoring target devices 41 a, 41 b, 41 c that need to be notified to 3.

  The management system 3 includes maintenance knowledge data 31 and operation rule data 32. The management system 3 grasps the status of the monitoring target device group 4 based on the incident information input from the monitoring device 1, refers to the maintenance knowledge data 31, and responds to the manager of the monitoring target device group 4. Measures are notified.

  The monitoring target device group 4 is a set of devices that are monitored by the monitoring device 1 according to the preferred embodiment of the present invention and notify the management system 3 of the results. The monitoring target device group 4 includes all monitoring target devices 41a, 41b, and 41c such as computers, communication control devices, and manufacturing devices. The monitoring target devices 41a, 41b, and 41c are not limited to devices, and may include programs, applications, middleware, and the like that operate on a computer. Each of the monitoring target devices 41a, 41b, and 41c includes agents 42a, 42b, and 42c, respectively.

  The agent 42a transmits an event output from the monitoring target device 41a to the monitoring device 1 via the communication network 2b. Here, the event output from the monitoring target device 41a is the system log or event log of the operation system, the log of middleware or application, the message or packet flowing through the network or bus, the SNMP event, the CBE event, the mail, the news, Various forms such as a CIM event that is a notification event are included. Further, by setting for the agent 42a, it is possible to set so as to extract only a predetermined event and time.

  Although the monitoring target device 41a and the agent 42a have been described here, the same applies to the monitoring target device 41b and the agent 42b, the monitoring target device 41c, and the agent 42c.

(Monitoring device)
As shown in FIG. 2, the monitoring device 1 according to the best mode of the present invention includes a central processing control device 101, a ROM (Read Only Memory) 102, a RAM (Random Access Memory) 103, and an input / output interface 109. They are connected via a bus 110. An input device 104, a display device 105, a communication control device 106, a storage device 107, and a removable disk 108 are connected to the input / output interface 109.

  The central processing control device 101 reads and executes a boot program for starting the monitoring device 1 from the ROM 102 based on an input signal from the input device 104, and further reads an operating system stored in the storage device 107. Further, the central processing control device 101 controls various devices based on input signals from the input device 104 and the communication control device 106, and reads out programs and data stored in the RAM 103 and the storage device 107. The processor is a processor that loads the RAM 103 and implements a series of processes to be described later, such as data calculation or processing, based on a program command read from the RAM 103.

  The input device 104 includes input devices such as a keyboard and a mouse through which an operator inputs various operations. The input device 104 generates an input signal based on the operation of the operator, and inputs via the input / output interface 109 and the bus 110. It is transmitted to the central processing control apparatus 101. The display device 105 is a CRT (Cathode Ray Tube) display, a liquid crystal display, or the like. The display device 105 receives an output signal to be displayed on the display device 105 from the central processing control device 101 via the bus 110 and the input / output interface 109. It is a device that displays the processing result of the control device 101 and the like. The communication control device 106 is a device such as a LAN card or a modem, and is a device that connects the monitoring device 1 to a communication network such as the Internet or a LAN. Data transmitted / received to / from the communication network via the communication control device 106 is transmitted / received to / from the central processing control device 101 via the input / output interface and bus 110 as an input signal or an output signal.

  The storage device 107 is a semiconductor storage device or a magnetic disk device, and stores programs and data executed by the central processing control device 101. The removable disk 108 is an optical disk or a flexible disk, and signals read / written by the disk drive are transmitted / received to / from the central processing control apparatus 101 via the input / output interface 109 and the bus 110.

  The storage device 107 of the monitoring device 1 according to the preferred embodiment of the present invention stores a monitoring program and, as shown in FIG. 1, rule definition data 21, parameter definition data 22, status data 23, log Data 24 is stored. Further, a monitoring program stored in a storage medium such as a CD-ROM or the storage device 107 is installed in the monitoring device 1 and is read and executed by the central processing control device 101 of the monitoring device 1 as shown in FIG. In addition, a rule definition update unit 11, an event acquisition unit 12, an event processing unit 13, an incident output unit 14, and an execution action control unit 15 are mounted on the monitoring device 1.

  In the rule definition data 21, an event identifier of an event to be monitored, a filtering rule associated with the event identifier, and a correlation rule indicating the association of a plurality of event identifiers are associated with the correlation rule identifier, It is the data of the condition to output. In the rule definition data 21, a variable may be included in the filtering rule. The rule definition data 21 may further include the number of times or time as a correlation rule. The rule definition data 21 may further be associated with an action when the correlation rule matches the correlation rule identifier. Rule definition data created in advance by the management system 3 or the like may be acquired by the monitoring device 1 and stored as the rule definition data 21 in the storage device 107.

  The rule definition data 21 has an example of a data structure and data as shown in FIG. The rule definition data 21 includes a filtering rule and a correlation rule. The filtering rule describes a rule for extracting an event that occurs from a single monitoring target. As a filtering rule, a character string pattern for extracting an appropriate event is described. This string pattern can include variables, and regular expressions such as “. * Memory Error. *” Are described, and “.” (Arbitrary character), “*” (repeat one character immediately before), “{ |} "(Character string selection). Furthermore, it can be described using a variable such as “$ a> 10” or “$ m =“ read ”” as a filtering rule variable. Correlation rules describe the correlation rules for multiple events output from multiple monitored devices using operators such as "and", "or", "not", "(", ")". Yes. For example, when an operator in which both the event “E1” and the event “E2” appear is represented by “and”, the correlation rule is described as “M1 and M2.” As for the correlation rule, it is possible to define a rule for multiple occurrences of the same event by specifying the number of events. For example, a rule that matches when the event “E1” occurs twice is described as “E1 * 2”. For example, in the rule with the correlation rule identifier “R101”, the conditions “E1 and E2 and E3” occur at least twice a month with the same address and the same bit for the events E1, E2, and E3 defined in the filtering rule. In this case, the condition is met. The filtering condition for event E1 is “Device-A: error issued and corrected”, the filtering condition for event E2 is “error address $ ADDRESS”, and the filtering condition for event E3 is “error bit $ BIT”. Here, the character string starting with “$” indicates a variable name, and it is determined whether or not the correlation rule matches for each variable name set here. The rule with the correlation rule identifier “R101” holds the correlation status of the correlation rule for each numerical value set in the variable “$ ADDRESS” of the event E2 and the variable “$ BIT” of the event E3.

  Specifically, the device A is composed of a number of elements, and each element may generate an error. The element causing the error is specified by an address ($ ADDRESS) and a bit ($ BIT). The device A is designed to be self-corrected when an error occurs. At this time, an event described in each filtering rule of event identifiers E1, E2, and E3 of the correlation rule identifier R101 in FIG. 3 is output. Although the output of these events is normal, it is determined that the occurrence of an error in the same element of device A at least twice a month is a sign of abnormality. At this time, it is normal for an error to occur at a different address and bit, but if an error occurs twice or more per month at the same address and the same bit, it is detected as an abnormal incident and the device A is normal An instruction can be output to switch to a new device.

  The correlation rule related to the correlation rule identifier “R102” is determined to meet the condition when the conditions “E1 and E2” occur within 5 minutes for the events E1 and E2 defined in the filtering rule. . The filtering condition for event E1 is “Program-X error”, and the filtering condition for event E2 is “Program-Y fail”. Specifically, the correlation rule relating to the correlation rule identifier “R102” is an error of the program X and the program Y. The E1 filtering rule “Program-X error” is a program X error, and the E2 filtering rule “Program-Y fail” is a program Y error. The program X and the program Y are basically independent programs. However, depending on the error status of the program X, the program Y is also affected and an error occurs. If the event “E2” occurs within 5 minutes after the event “E1” occurs, the event “E2” is considered to have been affected by the event “E1”. This correlation rule outputs an incident in such a case.

  The correlation rule related to the correlation rule identifier “R103” matches the conditions for the events E1 and E2 defined in the filtering rule when the conditions “E1 and E2” occur within the same element within 24 hours. It is said. The filtering condition for event E1 is “Device-B: $ ELEMENT type-1 error”, and the filtering condition for event E2 is “Device-B: $ ELEMENT type-2 error”. Specifically, the correlation rule related to the correlation rule identifier “R103” is a rule related to the device B. Device B generates various types of errors, but is designed to be self-correcting in device B. If both Type 1 and Type 2 errors occur within 24 hours for the same element, an instruction can be output to replace device B. In the example shown in FIG. 3, filtering rules are set based on events from a single device. However, filtering rules are set across a plurality of devices, and the events extracted by those filtering rules are copied. Relation rules may be defined.

  Further, the rule definition data 21 may be given a priority of the correlation rule in order to determine whether or not it matches the correlation rule. In this case, when an event related to a plurality of correlation rules is detected, if the correlation rule matches a high priority correlation rule, an incident related to the matching correlation rule is output, and the state of the correlation rule is cleared. On the other hand, a correlation rule with a low priority is held as it was before the event was detected.

  The parameter definition data 22 stores various parameters for controlling the operation specifications of the event processing means 13 of the monitoring device 1. The parameter definition data created in advance by the management system 3 or the like may be acquired by the monitoring device 1 and stored as the parameter definition data 22 in the storage device 107.

  The state data 23 holds the matching status of the correlation rule conditions stored in the rule definition data 21.

  The log data 24 stores various information, processing results, and the like executed by the event processing unit 13.

  The rule definition update unit 11 is a unit that acquires a rule input from the input device 104, inserts it into the rule definition data 21, and stores it in the storage device 107. The rule definition update unit 11 may acquire the operation rule data 32 from the management system 3 and insert it into the rule definition data 21. This operation rule acquisition may be executed in response to a request from the monitoring device 1 or may be executed at a predetermined timing. Further, the rule definition updating unit 11 may acquire rule definition data created in advance by the management system 3 or the like and store it as the rule definition data 21 in the storage device 107. By storing the rule definition data in the storage device 107 in advance, the monitoring device 1 can perform independent monitoring without the administrator's input.

  The event acquisition unit 12 is a unit that acquires an event from the monitoring target device group 4. An event may be transmitted as needed from the agents 42a, 42b, 42c... Of the monitoring target device group 4, or the event acquisition unit 12 may acquire the event at a predetermined timing.

  The event processing unit 13 reads the rule definition data and the parameter definition data 22 from the storage device 107, analyzes the event acquired by the event acquisition unit 12, and if the analyzed event matches the filtering rule, the state data 23 Is read out from the storage device, and it is determined whether or not the correlation rule is met. If the correlation rule is not met, the state is stored in the state data 23. Here, the state holding method is implemented by an existing state machine. Further, the event processing unit 13 determines whether or not the numerical value corresponding to the filtering rule variable matches the correlation rule, and stores the state in the state data 23. Further, the event processing means determines whether or not the correlation rule matches in consideration of the number of times or time. Specifically, in the state data 23, the time when an event that matches the filtering rule occurs is stored, and based on the stored time, the number of times and the time are taken into account to determine whether the correlation rule matches. The

  The incident output unit 14 outputs an incident to the management system 3 or the like when the event processing unit 13 matches the correlation rule.

  When the event processing unit 13 determines that the correlation rule matches the correlation rule, the execution action control unit 15 reads the rule definition data 21 from the storage device and controls the execution of the action. This action includes an external command for control for controlling other devices, an information collection command for collecting information, and the like.

  Next, the event processing means 13 of the monitoring device 1 according to the preferred embodiment of the present invention will be described using a specific example with reference to FIGS.

  The examples illustrated in FIGS. 4 and 5 are specific examples of events related to the correlation rule identifier “R101” illustrated in FIG. 3. FIG. 4 shows a case where an error occurs in the address “129” and the bit “7” 24 days after the error occurs in the address “129” and the bit “7”. In this case, the monitoring apparatus 1 outputs an incident because it matches the correlation rule with the correlation rule identifier “R101” shown in FIG. On the other hand, in FIG. 5, an error occurred at address “132” and bit “5” 24 days after the error occurred at address “129” and bit “7”. In this case, since the correlation rule with the correlation rule identifier “R101” illustrated in FIG. 3 does not match, the monitoring apparatus 1 does not output an incident and stores the state in the state data 23.

  The example illustrated in FIGS. 6 and 7 is a specific example of an event related to the correlation rule identifier “R103” illustrated in FIG. FIG. 6 shows a case where a type 2 error has occurred in the element “blue-chip” about 7 hours after the type 1 error has occurred in the element “blue-chip”. In this case, the monitoring apparatus 1 outputs an incident because it matches the correlation rule with the correlation rule identifier “R103” shown in FIG. On the other hand, in FIG. 7, a type 2 error occurs in the element “red-chip” about 9 hours after the type 1 error occurs in the element “blue-chip”. In this case, since the correlation rule with the correlation rule identifier “R103” illustrated in FIG. 3 does not match, the monitoring apparatus 1 does not output an incident.

Next, update of the state data 23 by the event processing unit 13 will be described with reference to FIGS. The correlation rule identifiers “R301” and “R302” will be described. Here, the events “E1” and “E2” have the same filtering condition, the correlation rule of the correlation rule identifier “R301” is “E1 and E2 and E3”, and the correlation rule identifier “R302”. The correlation rule is “E1 and E3”. The correlation rule identifiers “R301” and “R302” will be described assuming that there is no variable definition, repetition, and time definition. In the example illustrated in FIGS. 8 to 12, the priority of the correlation rule identifier “R301” is assumed to be higher than the priority of the correlation rule identifier “R302”.
First, FIG. 8 shows a state in which none of the events included in the correlation rule identifiers “R301” and “R302” is received in the state data 23a. Here, when the event “E3” is received, the event “E3” is received in the state data 23b for each state of the correlation rule identifiers “R301” and “R302” as shown in FIG. Indicated. Next, when the event “E2” is received, as shown in FIG. 10, it is indicated that the event “E2” is received for the state of the correlation rule identifier “R301” in the state data 23c. Further, when the event “E1” is received, as shown in FIG. 11, it is indicated that the event “E1” is received in the state data 23d for the states of the correlation rule identifiers “R301” and “R302”. . At this time, since the correlation rule with the correlation rule identifier “R301” matches, an incident related to the correlation rule R301 is output. When the incident is output, as shown in FIG. 12, in the state data 23e, the state of the correlation rule identifier “R301” is cleared, while the state data of the correlation rule identifier “R302” having a low priority is It is held in the same state as the state data 32d.

  Further, when time and repetition are included in the correlation rule, the state data 23 has time and repetition attributes, and each time an event occurs, it is determined whether or not the condition is met in consideration of those attributes. Is done.

(Monitoring program)
Next, processing of the monitoring program according to the best embodiment of the present invention will be described with reference to FIG.

  First, in step S101, the rule definition data 21 is read from the storage device 107, and in step S102, the parameter definition data 22 is read from the storage device 107. In step S103, the event acquisition unit 12 waits for an event input. When an event is input, the process proceeds to step S104.

In step S104, the processing from step S105 to step S114 is performed for all the correlation rules.
Specifically, Steps S105 to S107 are repeated for all the filtering rules of the correlation rule. Here, in step S105, it is determined whether the event input in step S103 matches the filtering rule. If they do not match, the next filtering rule is processed. On the other hand, if they match, the matched event information is stored in step S106, and the state related to the rule is stored in the state data 23 in step S107. When the determination regarding all the filtering rules is completed, in step S108, it is determined whether or not the correlation rule is matched. If there is no match, the next correlation rule is processed.

  On the other hand, if there is a match, it is determined in step S109 whether or not an action is specified for the correlation rule. If specified, the action is executed in step S110, and a result is acquired as necessary. On the other hand, if no action is specified, an incident is output by the incident output unit 14 and a log is output to the log data 24 by the event acquisition unit 12 in step S111. In step S113, the state of the correlation rule is cleared in the state data 23 by the event acquisition unit 12. If the correlation rule includes a variable, only the state of the correlation rule related to this variable is cleared. When the state of the correlation rule is cleared, the process exits the loop for “all correlation rules”, returns to step S103, and waits until a new event is input.

  Next, referring to FIG. 14, in the monitoring device 1 according to the preferred embodiment of the present invention, the rule definition update unit 11 displays a rule definition screen displayed on the display device 105 when the rule definition data 21 is updated. Will be described. In the rule definition screen, a rule number (correlation rule identifier) is set for each correlation rule. Further, for each event referenced by this correlation rule, the filtering rule for that event is stored as an event format. Furthermore, when a variable name is input to the event format, a plurality of words can be specified as a variable condition. Further, as a condition, a correlation for each event is input using operators such as and and or. As the condition establishment interval, a time interval from when the first event is detected until the last event is detected is input. Numerical values are entered in the text box, and numerical units such as “seconds”, “minutes”, “hours”, “days”, “weeks”, and “months” are selected in the combo box. As an action, an action command to be executed by the execution action control means 15 when the correlation rule is matched is input. Furthermore, the explanation of the rule and countermeasures are also input.

  As described above, in the past, only simple event extraction mainly generated from a single monitoring target could be handled. However, according to the monitoring apparatus 1 according to the best embodiment of the present invention, a plurality of monitoring events can be handled. Can handle multiple events that occur from the target. Furthermore, according to the monitoring device 1 according to the preferred embodiment of the present invention, even when a plurality of events generated from a plurality of monitoring targets have a correlation, the correlation between the plurality of events is represented by various operators and variables. This can be determined by defining a correlation rule using, for example.

(Modification)
As shown in FIG. 15 in a simplified manner, the monitoring system 10 according to the preferred embodiment of the present invention includes monitoring target devices 41a and 41b and a monitoring device 1 at a monitoring target side site, and a management device 30 at a management side site. I have. The monitoring target devices 41 a and 41 b include agents 42 a and 42 b that transmit events to the monitoring device 1, respectively, and the agent 1 a included in the monitoring device 1 receives them. Here, the agent 1a corresponds to each element of the monitoring device 1 shown in FIG. The agent 1a of the monitoring device 1 transmits the event received from the monitoring target devices 41a and 41b to the management tool 30a of the management device 30. In this case, the monitoring device 1 and the management device 30 are connected so as to be able to communicate with each other using a protocol such as TCP / IP.

  Next, a monitoring system 10 according to a modification of the best embodiment of the present invention will be described with reference to FIGS.

  The monitoring system 10 according to the first modification of the best mode of the present invention shown in FIG. 16 is different from the monitoring system 10 shown in FIG. The agent 1a of the monitoring device 1 transmits mail to the management device 30 via the mail server 6a provided at the monitoring target site and the mail server 6b provided at the management site. In this case, the monitoring apparatus 1 and the management apparatus 30 are communicably connected by a mail protocol such as SMTP and POP.

  The monitoring system 10 according to the second modification of the preferred embodiment of the present invention shown in FIG. 17 is different from the monitoring system 10 shown in FIG. In this case, each element of the monitoring device 1 described with reference to FIG. 1 is mounted on the agents 42a and 42b provided in the monitoring target devices 41a and 41b, respectively. The agents 42a and 42b of the monitoring target devices 41a and 41b are connected to the management device 30 so as to be able to communicate with each other using a protocol such as TCP / IP.

  The monitoring system 10 according to the third modification of the best mode of the present invention illustrated in FIG. 18 does not include the monitoring device 1 as compared to the monitoring system 10 illustrated in FIG. 15, and includes mail servers 6a and 6b. Is different. In this case, each element of the monitoring device 1 described with reference to FIG. 1 is mounted on the agents 42a and 42b provided in the monitoring target devices 41a and 41b, respectively. The agents 42a and 42b of the monitoring target devices 41a and 41b transmit mail to the management device 30 via the mail server 6a provided at the monitoring target site and the mail server 6b provided at the management site. In this case, the monitoring target devices 41a and 41b and the management device 30 are connected so as to be able to communicate with each other by a mail protocol such as SMTP and POP.

(Other embodiments)
Although the present invention has been described with reference to the preferred embodiment and its modifications as described above, it should not be understood that the description and drawings constituting a part of this disclosure limit the present invention. From this disclosure, various alternative embodiments, examples, and operational techniques will be apparent to those skilled in the art.

  For example, the monitoring device described in the best mode of the present invention may be configured on one piece of hardware as shown in FIG. 1, or on a plurality of pieces of hardware according to the functions and the number of processes. It may be configured. Moreover, you may implement | achieve on the existing information system.

  It goes without saying that the present invention includes various embodiments not described herein. Therefore, the technical scope of the present invention is defined only by the invention specifying matters according to the scope of claims reasonable from the above description.

1 is a system configuration diagram of a monitoring system according to a best embodiment of the present invention. It is a hardware block diagram of the monitoring apparatus which concerns on the best embodiment of this invention. It is a figure explaining an example of the data structure and data of rule definition data of the monitoring apparatus concerning the best embodiment of the present invention. In the monitoring apparatus which concerns on the best embodiment of this invention, it is a figure explaining the case where it matches conditions about correlation rule identifier "R101". It is a figure explaining the case where it does not match conditions about correlation rule identifier "R101" in the monitoring apparatus which concerns on the best embodiment of this invention. In the monitoring apparatus which concerns on the best embodiment of this invention, it is a figure explaining the case where it matches conditions about correlation rule identifier "R103". It is a figure explaining the case where it does not match conditions about correlation rule identifier "R101" in the monitoring apparatus which concerns on the best embodiment of this invention. It is a figure explaining the transition of the state data when no event has occurred in the monitoring device according to the preferred embodiment of the present invention. It is a figure explaining transition of state data when event "E3" occurs in the monitoring apparatus concerning the best embodiment of the present invention. It is a figure explaining transition of state data when event "E2" occurs in the monitoring apparatus according to the best embodiment of the present invention. It is a figure explaining transition of state data when event "E1" occurs in the monitoring apparatus concerning the best embodiment of the present invention. In the monitoring apparatus which concerns on the best embodiment of this invention, it is a figure explaining transition of the state data when an incident is output about rule R301. It is a flowchart explaining the process of the monitoring program which concerns on best embodiment of this invention. In the monitoring apparatus which concerns on the best embodiment of this invention, it is an example of the rule definition screen which sets rule definition data from an input device. 1 is a simplified system configuration diagram of a monitoring system according to a best embodiment of the present invention. It is a simple system block diagram of the monitoring system which concerns on the modification 1 of the best embodiment of this invention. It is a simple system block diagram of the monitoring system which concerns on the modification 2 of the best embodiment of this invention. It is a simple system block diagram of the monitoring system which concerns on the modification 3 of best embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Monitoring apparatus 1a ... Agent 2a, 2b ... Communication network 3 ... Management system 4 ... Monitoring object apparatus group 6a, 6b ... Mail server 10 ... Monitoring system 11 ... Rule definition update means 12 ... Event acquisition means 13 ... Event processing means 14 ... incident output means 15 ... execution action control means 21 ... rule definition data 22 ... parameter definition data 23, 23a, 23b, 23c, 23d ... status data 24 ... log data 30 ... management device 30a ... management tool 31 ... maintenance knowledge data 32 ... Operation rule data 41a, 41b, 41c ... Monitoring target devices 42a, 42b, 42c ... Agent 101 ... Central processing control device 102 ... ROM
103 ... RAM
104 ... Input device 105 ... Display device 106 ... Communication control device 107 ... Storage device 108 ... Removable disk 109 ... Input / output interface 110 ... Bus

Claims (6)

In a monitoring device that monitors events output from monitored devices and outputs incidents,
It becomes a condition for outputting the incident in which the correlation rule identifier is associated with the event identifier of the event to be monitored, the filtering rule associated with the event identifier, and the correlation rule indicating the association of the plurality of event identifiers. Rule definition data storage means for storing rule definition data in a storage device;
Event acquisition means for acquiring the event from the monitored device;
Analyzing the event acquired by the event acquisition means with reference to the stored rule definition data, and if the analyzed event matches the filtering rule, whether or not it matches the correlation rule An event processing means for determining and storing the state if the correlation rule does not match,
A monitoring apparatus comprising: an incident output means for outputting the incident when the event processing means matches the correlation rule. Has a variable as the filtering rule,
The monitoring apparatus according to claim 1, wherein the event processing unit determines whether or not the numerical value corresponding to the variable of the filtering rule matches the correlation rule, and stores the state. If the analyzed event matches the filtering rule, the event processing unit determines whether the correlation rule is met by referring to the stored state data, and does not match the correlation rule. The monitoring apparatus according to claim 1 or 2, wherein a matching state of the correlation rule is stored as the state data. As the correlation rule, it has a number of times or time,
The monitoring apparatus according to any one of claims 1 to 3, wherein the event processing unit further determines whether or not the correlation rule matches in consideration of the number of times or time. The rule definition data storage means further stores, in the storage device, the rule definition data associated with an action when the correlation rule matches the correlation rule identifier,
The execution action control means which controls execution of the action based on the rule definition data when the event processing means determines that the correlation rule is matched, further comprising: The monitoring device according to claim 1. In a monitoring program that monitors events output from monitored devices and outputs incidents,
It becomes a condition for outputting the incident in which the correlation rule identifier is associated with the event identifier of the event to be monitored, the filtering rule associated with the event identifier, and the correlation rule indicating the association of the plurality of event identifiers. Rule definition data storage means for storing rule definition data in a storage device;
Event acquisition means for acquiring the event from the monitored device;
Referring to the rule definition data, analyze the event acquired by the event acquisition means, and if the analyzed event matches the filtering rule, determine whether it matches the correlation rule, Event processing means for saving the state if the correlation rule does not match;
A monitoring program that causes a computer to execute an incident output means for outputting the incident when the event processing means matches the correlation rule.

Images