JP2007087232A - Policy creation method for facilitating policy correction accompanying system configuration change and policy management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To facilitate policy rule correction when changing a system configuration. <P>SOLUTION: A reason for applying a policy rule is set together when the policy rule is created, and it is discriminated whether this reason is satisfied or not when the system configuration is changed. In order to determine influences upon the policy rules of configuration changes, a policy management device preliminarily defines and stores information which associates detailed information of a system configuration management target object with comparison contents of reasons for applying the policy rules and defines the degrees of influences. When detailed information of the management target object is changed by a system configuration change, a configuration management device extracts difference information. The policy management device performs discrimination processing of discriminating whether reasons for applying policy rules which the policy management device itself manages are satisfied or not on the basis of the difference information and lists up policy rules which are influenced by the configuration change, with detailed causes and the degrees of influences, whereby user's policy correction is facilitated. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a policy rule creation method for managing and managing a computer system, and a policy rule management method.

  When operating a computer system, it is common to define a behavior by describing a policy rule. The policy rule is described as a series of actions to be taken when an event indicating the occurrence of a failure occurs, and is used for the purpose of automating operation management. In current computer systems, these policy rules are defined and applied according to the configuration and operating policy unique to each system, and are repeatedly applied to the system during system construction. Is a big one.

  So far, several methods have been devised for creating policy rules that reduce the burden on the administrator. For example, Patent Document 1 proposes a method for creating an access control policy. In this method, the draft of recommended policy is automatically generated and displayed for each type of software, and the policy rule is created while the user makes corrections as necessary, thereby reducing the effort of applying the policy rule. .

  In addition, after starting the operation of the system to which the policy rule is applied, various hardware and software resources are added and updated for the purpose of increasing processing capability and adding functions, and the system configuration may be changed. In such a case, it is necessary to review the policy rules that have been defined and function in advance as resources are added or updated, and add or update them as necessary.

  Patent Document 2 proposes a method of acquiring a list of policy rules related to inventory information of system configuration devices from a policy rule providing server and automatically setting the policy rules. According to this method, the difference in inventory information due to the system configuration change is obtained, the list of policy rules affected by the configuration change is obtained from the policy rule providing server, and the policy rules necessary for the local system are automatically set. Therefore, it is possible to reduce the trouble of adding and updating policy rules by the administrator.

JP 2004-145528 A JP 2004-192601A

  However, in order to realize sophisticated policy rules for system operation management such as failure notification, backup, and scale-out in a computer system having a complicated configuration, operation based on the judgment of the administrator is indispensable. In particular, whether or not policy rules are reviewed appropriately after configuration changes after system operations start depends largely on whether the system administrator knows detailed system information and has sufficient operational management experience. High dependence on the person.

  In the methods of Patent Literature 1 and Patent Literature 2, policy rules are created and modified by a method of automatically generating a policy rule draft or a method of automatically obtaining a policy list from a policy rule providing server and applying it. However, the policy rules described above are uniquely defined for each computer system operation, and the parameters such as application conditions and operation targets must be set by the administrator through repeated design and testing. It is difficult to create and modify policies with this method.

  Therefore, in view of the above problems, the present invention has an object to provide a method for facilitating detection of policy rules that need to be reviewed when a system configuration is changed, and for allowing an administrator to easily grasp the contents of correction. And

  In order to solve the above problems, in the present invention, the reason for applying the policy rule is also set when creating the policy rule, and it is determined whether the reason is satisfied and the effectiveness is maintained when the system configuration is changed. Thus, a technique is provided that makes it possible to list policy rules that are affected by a configuration change from policy rules defined in the system with an impact level.

  The policy rule application reason in the present invention is a conditional sentence composed of a target object, comparison contents, and conditions. For example, suppose that the reason for applying the policy rule “add an AP server when the response time of business A exceeds the limit value” is “because the processing capacity of the computer on which the AP server operates is low”.

  In this case, the target object is “computer on which the AP server operates”, the comparison content is “processing capability”, and the condition is “low”. If the “computer on which the AP server operates” is replaced with a high-performance computer, the condition part “low” is not satisfied, so it can be determined that the effectiveness of the policy rule is reduced.

  Further, it is necessary to determine whether the comparison contents and conditions of the policy application reason are satisfied from the managed object actually changed by the configuration change and the detailed information value. In the present invention, the details of the managed object are required. By providing a mechanism for associating information with the contents of comparison and predefining information defining the degree of influence, it is possible to determine the validity of the reason for application at the time of configuration change.

  In the above example, the comparison of the reason for application is “Processing capacity”. However, if the “Computer on which the AP server operates” is changed to a high-performance computer, the “Computer on which the AP server operates” “CPU clock count” and “memory capacity”, which are detailed information of “,” are influential factors. Here, the definition that “the number of CPU clocks” and “memory capacity” are related to “processing capacity” is set in advance, and this is referred to when the configuration is changed.

  As a result, the policy rules that are affected by the configuration change are listed with a degree of influence from the policy rules defined in the system, so the administrator pays attention to them and adjusts the system as necessary. It is possible to modify the policy rule so that the In addition, to set the reason for application to the policy rule, the administrator must explain why the policy rule listed as being less effective due to changes in the system configuration has become less effective. It becomes possible to grasp easily.

  Embodiments of the present invention will be described below.

  FIG. 1 is a configuration diagram of an operation management system according to an embodiment of the present invention. As shown in the figure, the system according to the present embodiment includes a policy management device 100 that manages policy rules, a configuration management device 110 that manages a system configuration, and a system configuration device group 120 that is a management target of these devices. Become. The system configuration device group 120 includes a load distribution device 130 and a business processing computer 140. These devices are connected via a network 150 such as the Internet for communication.

  The policy management apparatus 100 includes a communication unit 101, a policy rule management unit 102, an event reception unit 103, an influence policy search unit 104, a user interface unit 105, and a storage unit 106. The communication unit 101 controls communication processing with the configuration management device 110 and the system configuration device group 120. The policy rule management unit 102 controls processing for registering a policy rule defined by the user in the storage unit 106 and processing for referencing, updating, and deleting the policy rule registered in the storage unit 106. The event reception unit 103 performs processing for receiving an event message from the configuration management apparatus 104. The influence policy search unit 104 performs a process of searching for a policy rule that is affected by the system configuration change based on the system configuration difference information generated from the system configuration information managed by the configuration management apparatus. The user interface unit 105 performs a process for providing a user with a function included in the policy management apparatus. The storage unit 106 stores a policy rule 107 and a configuration change influence level definition 108. Details of the system configuration information and the system configuration difference information will be described later.

  Hereinafter, objects, event messages, and policy rules used in the embodiment of the present invention will be described.

  The object refers to the system configuration device group 120 to be managed by the system, the program that operates in the device, and those that are grouped in a specific unit, etc. Detailed object information is held by those objects Device information and setting information. The configuration management apparatus 110 of this embodiment manages information in units of objects.

  An event message is when an operation management agent operating in each device of the system management target device group 120 monitors or detects various events that occur in the management target object of the configuration management device 110, or when the configuration management device 110 This refers to a message that is created and transmitted when a predetermined operation is completed for the policy management apparatus 100.

  A policy rule is a rule that defines a process to be executed for each event when a predetermined event occurs in a managed computer system. The configuration change impact level definition 108 defines in stages how much the change of the detailed information affects the policy rule when the detailed information of the object managed by the system is changed. .

  The configuration management apparatus 110 includes a communication unit 111, an event processing unit 112, a configuration information collection unit 113, a configuration information management unit 114, a system difference information extraction unit 115, and a storage unit 116. The communication unit 111 controls communication processing with the policy management device 110 and the system configuration device group 120. The event processing unit 112 receives an event message transmitted by an operation management agent operating on each device of the system configuration device group 120, analyzes the content, and executes a predetermined process corresponding to the event content. The configuration information collection unit 113 performs a process of collecting detailed information of various objects from the operation management agent that operates on each device of the system configuration device group 120. The configuration information management unit 114 registers the detailed information of various objects collected by the configuration information collection unit 113 in the storage unit 116 as system configuration information 117, and refers to the system configuration information 117 registered in the storage unit 116. , Control to update, delete. When a system configuration change occurs, the system difference information extraction unit 115 compares the configuration information before the change with the configuration information after the change, extracts the changed contents, and creates the system configuration difference information . System configuration information 117 is stored in the storage unit 116.

  The load distribution device 130 is a device having a function of distributing and assigning processes so that the loads of the devices connected in parallel are equalized. The load distribution apparatus 130 includes a communication unit 131, an operation management agent 132, and a load distribution processing unit 133. The communication unit 131 controls communication processing with the policy management device 100, the configuration management device 110, and another system configuration device group 120. The operation management agent 132 receives instructions from the configuration management device 110 and executes various operations. The load distribution processing unit 133 distributes and assigns processes so that the loads of the devices connected to the load distribution device 130 are equalized.

  When the operation management agent 132 receives the message transmitted from the configuration management apparatus 110, the operation management agent 132 executes the command according to the content. For example, when the content of the message is system configuration information collection, processing such as transmitting configuration information of the device on which the program operates to the configuration management device 110 is performed.

  The business processing computer 140 is a device for executing various programs for realizing a business intended by the computer system. The business processing computer 140 includes a communication unit 141, an operation management agent 142, and a business program 143. The communication unit 141 controls communication processing with the policy management device 100, the configuration management device 110, and another system configuration device group 120. The operation management agent 142 receives various instructions from the configuration management apparatus 110 in the same manner as 132 described above, and executes various operations. The business processing program 143 is a program for realizing the business of the computer system, and is an AP server, a DB server, or the like. The AP server is a program that executes business processing, and the DB server is a program that provides data required by the AP server.

  FIG. 2 shows a hardware configuration of a computer that implements the policy management device 100, the configuration management device 110, and the system configuration device group 120. As shown in the figure, these computers include a CPU 201, a memory 202, an external storage device 203, an input device 204 such as a keyboard and a mouse, a communication device 205 for communicating with other devices, and an output device such as a display and a printer. 206, and a bus 207 for connecting these devices. The configuration management device 110 collects detailed information (CPU type, number of clocks, memory capacity, external storage device capacity) of these components as part of the system configuration information.

  FIG. 3 shows an example of the system configuration information 117 stored in the storage unit 116 of the configuration management apparatus 110. The system configuration information 117 includes tables 300 to 340 for storing detailed information values for various managed objects managed by the configuration management apparatus 110, and dependency relationship information 350 that is a table for indicating dependency relationships between objects. Have. The load balancer information 300 stores an object name 300A, a load distribution destination object 300B, and the like as detailed information. In the figure, an example is shown in which “load balancer” is stored in the object name, “AP server machine 1”, “AP server machine 2”, etc. are stored in the load balance destination object name.

  The business processing computer information 310 stores an object name 310A, a CPU clock speed 310B, a memory capacity 310C, a communication destination object name 310D, and the like as detailed information. In the figure, the object name is “AP server machine 1”, the CPU clock speed is “2.0 GHz”, the memory capacity is “256 M Byte”, the communication destination object name is “load balancer”, “DB server machine 1”, etc. An example of storing is shown. The AP server information 320 stores object name 320A, program name 320B, version 320C, and the like in detailed information. In the figure, an example is shown in which “AP server 1” is stored as the object name, “AP server program” is stored as the program name, “6.5” is stored as the version, and the like. The DB server information 330 stores the object name 330A, program name 330B, version 330C, etc. in the detailed information. In the figure, an example is shown in which “DB server 1” is stored as the object name, “DB server program” is stored as the program name, “7.0” is stored as the version, and the like.

  The logical system information 340 stores an object name 340A and the like in detailed information. In the figure, an example is shown in which “system 1” or the like is stored in the object name. The dependency relationship information 350 stores the relationship between the upper object name 350A and the lower object name 350B. In the figure, an example is shown in which “AP server 1” is stored in the upper object name, “AP server machine 1” and the like are stored in the lower object name.

  FIG. 4 shows the dependency relationship of the system configuration management target object and the communication destination of the object mentioned in this embodiment. The solid line in the figure represents the object dependency. The logical system “system 1” is located in the highest hierarchy, and the AP server “AP server 1”, “AP server 2”, and the DB server “DB server 1” exist in the lower hierarchy. And the application server “AP server machine 1” and “AP server machine 2” are in the lower hierarchy of the AP server “AP server 1” and “AP server 2” respectively, and the database server “DB server 1” is in the lower hierarchy Business processing computer "DB server machine 1" exists.

  Moreover, the wavy line in the figure represents the communication destination of the object. The load balancer “load balancer” communicates with the two business processing computers “AP server machine 1” and “AP server machine 2” on which the AP servers “AP server 1” and “AP server 2” operate. The business processing computers “AP server machine 1” and “AP server machine 2” also communicate with the business processing computer “DB server machine 1” on which the DB server operates.

  FIG. 5 shows a table configuration of the policy rule 107 stored in the storage unit 106 of the policy management apparatus 100. The policy rule defines the process to be performed for each event when the specified event occurs in the managed system (condition part) (operation part), and defines the reason for applying it (application reason part). It is a written rule. The policy rule of this embodiment includes the details of the condition part, the table of the policy rule main body 500 showing the details of the operation name and application reason part, and the table of the operation details 510 showing the specific contents of the operation. It consists of two.

  The policy rule body 500 includes a policy ID 500A, an event monitoring target object 500B, an event content 500C, an operation name 500D, and a policy rule application reason 500E. Policy ID 500A stores an identifier assigned to a policy rule managed by policy management apparatus 100. The event monitoring target object 500B is a part of the condition part of the policy rule, and stores an object to be monitored as a source of an event as a condition. The event content 500C is a part of the condition part of the policy rule, and stores the content of the event as a condition. The operation name 500D stores the name of the operation part of the policy rule, and specific processing corresponding to the operation name 500D is stored in the operation details 510. Policy rule application reason 500E is composed of target object 500E-1, comparison content 500E-2, and condition 500E-3, and stores a value for describing the reason why the policy rule is applied as a conditional statement. In the figure, the policy ID is “0001”, the event monitoring target object is “system 1”, the event content is “response time limit exceeded”, the operation name is “scale out 1”, and the policy rule application reason target object is “AP” In this example, “server machine 1”, “AP server machine 2”, “processing capability” is stored in the comparison contents of the policy rule application reason, and “low” is stored in the policy rule application reason condition.

  The operation details 510 indicate specific processing to be executed when the condition part of the policy rule is satisfied. The operation details 510 include an operation name 510A, an execution order 510B, an operation target object 510C, an operation content 510D, and an argument 510E. The operation name 510A matches the operation name 500D of the policy rule body 500, and stores the name of a specific operation collected in a specific unit. The execution order 510B stores a numerical value indicating the execution order of specific operations having the same operation name 510A. The operation target object 510C stores an object that is a target for executing the operation content 510D. The operation content 510D stores the processing content to be performed on the operation target object 510C. The argument 510E stores an argument when executing the operation content 510D. In the figure, an example of storing “scale out 1” as the operation name, “1” as the execution order, “AP server 2” as the operation target object, “program start” as the operation content, “AP server program” as the argument, etc. Is shown.

  FIG. 6 shows a table configuration of the configuration change influence definition 108 stored in the storage unit 106 of the policy management apparatus 100. The configuration change influence degree definition 600 indicates the degree of influence that the detailed information of the object has on the comparison content part of the policy rule application reason when the configuration change occurs in various system management target objects. This configuration change influence definition 600 is assumed to be stored in advance in the storage unit 106 of the policy management apparatus 100 by a policy management apparatus, a vendor of the system configuration management apparatus, or the like. The configuration change impact definition 600 includes an object type 600A, detailed information 600B, comparison content 600C, and an impact 600D.

  The object type 600A stores the type of object managed by the system configuration information shown in FIG. The detailed information 600B stores detailed information held by the object managed by the system configuration information. The comparison content 600C stores a value set at the time of policy rule definition as the comparison content 500E-2 of the policy rule definition reason, and indicates which comparison content the detailed content of various objects relates to. The degree of influence 600D stores a value indicating how much influence the detailed information 600B has on the related comparison content 600C. The degree of influence shall be evaluated in five stages from “1” to “5”, with “5” representing the maximum. In the drawing, an example is shown in which “business processing computer” is stored as the object type, “memory capacity” is stored as the detailed information, “processing capacity” is stored as the comparison content, and “4” is stored as the influence level.

  FIG. 7 shows a table configuration of the system configuration difference information that is extracted by the system difference information extraction unit 115 based on the system configuration information 117 of the configuration management device 110 and transmitted to the policy management device 100 when the system configuration is changed. It is. The system configuration difference information 700 is a table that stores addition / deletion of managed objects and details of change of detailed information values (value increase and value decrease). The influence policy search unit 104 searches for an affected policy rule based on the system configuration difference information 700. The system configuration difference information 700 includes a difference information ID 700A, an object name 700B, an object type 700C, a detailed information name 700D, an old detailed information value 700E, a new detailed information value 700F, and a change content 700G. The differential information ID 700A stores an identifier that is assigned to each object that has undergone a configuration change, or for each change in detailed information. The object name 700B stores the object name of the object whose configuration has been changed. The object type 700C stores the object type of the object whose configuration has been changed. The detailed information name 700D stores the detailed information name of the object whose configuration has been changed. The detailed information name 700D is omitted when an object is added or deleted. The old detailed information value 700E stores the detailed information value of the object before the configuration change, and the new detailed information value 700F stores the detailed information value of the object after the configuration change. The change content 700G stores the change content of the object or the detailed information value due to the configuration change. In the figure, the difference information ID is “0001”, the object name is “AP server machine 1”, the object type is “business processing computer”, the detailed information name is “memory capacity”, the old detailed information value is “256M Byte”, An example is shown in which “512 M Byte” is stored in the new detailed information value, “value increase” is stored in the change content, and the like.

  FIG. 8 shows a table configuration of an influence policy list representing a result of searching for a policy affected by the system configuration change by the influence policy search unit 104 of the policy management apparatus 100. The influence policy list 800 has a policy ID 800A, a cause 800B, and an influence degree 800C. The policy ID 800A stores the policy ID of the affected policy rule. The cause 800B is composed of the target object 800B-1, the comparison content 800B-2, and the change content 800B-3, and indicates why the policy rule application reason condition 500E-3 is not satisfied. The target object 800B-1 stores an object that is used in the policy rule specified by the policy ID 800A and is affected by the configuration change. The comparison content 800B-2 stores a value corresponding to the detailed information of the policy rule application reason comparison content 500E-2. The change content 800B-3 stores a value corresponding to the change content 700G of the system configuration difference information 700. When the change content is “add object” or “delete object”, the comparison content is omitted. In the figure, the policy ID is “0001”, the cause target object is “AP server machine 1”, “AP server machine 2”, the cause comparison content is “memory capacity”, the cause change content is “value increase”, etc. The example which stored is shown.

  Next, the flow of policy rule definition processing of the policy management apparatus 100 will be described.

  FIG. 9 shows a processing flow when the user defines a policy rule related to system operation management using the policy management apparatus 100. The policy rule is created by this policy rule definition process. This process is based on the assumption that the policy management apparatus 100 has acquired the system configuration information 117 from the configuration information management unit 114 of the configuration management apparatus 110 and is able to provide system configuration information to the user through the user interface unit 105. To do.

  In step 900, the user inputs an operation name for the policy operation. In step 901, the user inputs each detailed item of the policy operation 510. In step 902, the user selects an event monitoring target object from the system configuration information 117, and in step 903, the event content is input. In step 904, the user selects a policy rule application reason target object 500E-1 from the system configuration information 117. In step 905, the user selects the policy rule application reason comparison content 500E-2 provided by the policy management apparatus. The policy rule application reason comparison content 500E-2 is an item defined in the comparison content 600C of the configuration change impact definition 600, and is provided in advance by the vendor of the policy management apparatus 100 or the like. In step 906, the user selects the policy rule application reason condition 500E-3 provided by the policy management apparatus 100. The policy rule application reason condition 500E-3 is provided in advance by the vendor of the policy management apparatus 100 or the like as in the comparison content 500E-2. When all items are input and the policy rule is completed, the policy rule is stored in the storage unit 106 by the policy rule management unit 102 of the policy management apparatus 100 in step 907.

  Next, the process flow of the configuration management apparatus 110 will be described.

  FIG. 10 shows a processing flow for collecting system configuration information of the configuration management apparatus 110. When the event processing unit 112 receives a configuration change event from the system configuration device group 120 in step 1000, the process proceeds to step 1001, and the configuration information management unit 114 stores the current system configuration information in the storage unit 115 as old system configuration information. . Note that the event processing unit 112 is in a waiting state until an event message is received. Thereafter, in step 1002, the configuration information collection unit 113 collects configuration information from the system configuration device group. In step 1003, the configuration information management unit stores the configuration information collected in step 1002 as new system configuration information. When step 1003 ends, the process proceeds to step 1004, where the event processing unit 112 transmits a configuration information collection completion event to the policy management apparatus 100.

  The policy management apparatus 100 that has received the configuration information collection completion event requests system configuration difference information from the configuration management apparatus 110 in order to identify a policy rule that is affected by the configuration change.

  FIG. 11 is a system configuration information difference extraction process flow of the configuration management apparatus 110. The configuration management apparatus 110 receives a request for system configuration difference information from the policy management apparatus 100 in step 1100, and acquires old system configuration information and new system configuration information through the configuration information management unit 114 in step 1101. In step 1102, the system difference information extraction unit 115 extracts the system configuration difference information 700 from the old system configuration information and the new system configuration information.

  The system configuration difference information extraction process of the system difference information extraction unit 115 is as follows. Each object stored in the old system configuration information is compared with that in the new system configuration information. If there is an object addition / deletion or an increase / decrease in the detailed information value of the object, the system configuration difference shown in FIG. Data is stored in the difference information ID 700A, the object name 700B, the object type 700C, the detailed information name 700D, the old detailed information value 700E, the new detailed information value 700F, and the changed content 700G of the information 700.

  When the system configuration difference information 700 is extracted in step 1102, the configuration management apparatus 110 stores the new system configuration information as the current system configuration information in step 1103, and the system configuration difference information 700 for the policy management apparatus 100 in step 1104. Send.

  Next, the flow of the influence policy specifying process of the policy management apparatus 100 will be described.

  FIG. 12 is an influence policy search processing flow executed by the influence policy search unit 104 of the policy management apparatus 100. Based on the system configuration difference information 700 extracted by the configuration management device 110, the policy rule affected by the configuration change is searched from the policy rules managed by the policy management device 100, and the policy ID 800A and the cause 800B are affected. A process of obtaining the degree 800C together and storing it in the influence policy list 800 is shown.

  In step 1200, the policy management apparatus 100 receives the system configuration difference information 700 from the configuration management apparatus 110.

  In step 1201, an unprocessed line of the system configuration difference information 700 is stored in the variable L. In Step 1202, the value of the “change” 700G of the variable L is checked. If the value is “Delete Object”, go to Step 1203. If the value is “Add Object”, go to Step 1204. If the value is “decrease”, the process proceeds to step 1208.

  In Step 1203, “Influence Policy Search Process by Object” is called with the “object name” 700B of the variable L as an argument, and after completion, the process proceeds to Step 1207. The “influence policy search process by object” will be described later.

  In step 1204, the user is notified of “add object” through the user interface unit 105. If it is determined in step 1205 that the user searches for an affected policy, the process proceeds to step 1206; otherwise, the process proceeds to step 1207.

  In step 1206, the user selects an object for specifying the influence range from the system configuration information 117, and invokes “impact policy search processing by object” using the object name as an argument. After step 1206 is completed, the process proceeds to step 1207.

  In step 1207, if there is an unprocessed line in the system configuration difference information 700, the process proceeds to 1201. If there is no unprocessed line, the influence policy search process is terminated.

  In step 1208, the “object type” 700C and the “detailed information name” 700D of the variable L are stored in the variable M. In step 1209, from the configuration change impact definition 600 stored in the storage unit 106 of the policy management apparatus 100, all the comparison contents 600C and the impact 600D that are related by using each value of the variable M as a key are obtained as a list type Store in variable N.

  In step 1210, an unprocessed value of variable N is stored in variable P, and in step 1211, “object name” 700B of variable L, “comparison content” 600C of variable P, “change content” 700G of variable L Then, the “impact policy search process using detailed information” is called with the “impact degree” 600D of the variable P as an argument. The “influence policy search process using detailed information” will be described later.

  After step 1211 is completed, the process proceeds to step 1212. In step 1212, if the variable N has an unprocessed value, the process proceeds to step 1210, and if there is no unprocessed value, the process proceeds to step 1207.

  FIG. 13 is an influence policy search process flow by an object called in the influence policy search process flow. If the object name and the change content are arguments, and the object name specified by the argument is included in the policy rule, the policy rule is always stored in the influence policy list 800 as the influence level “5”.

  In step 1300, the object name of the argument is stored in the variable X, and the change content is stored in the variable Y. In step 1301, the policy rule body 500 stored in the storage unit 106 is acquired.

  In step 1302, an unprocessed row of policy rule body 500 is stored in variable L. In step 1303, “event monitoring target object” 500B of variable L and “target object” 500E−1 of “policy rule application reason” 500E are stored. The object names stored in are obtained and stored in variables P and Q, respectively.

  In step 1304, if either of the variables P or Q matches the variable X, the process proceeds to step 1305, and if both are different, the process proceeds to step 1306.

  In step 1305, the policy ID 800A of the influence policy list 800 is set to the "policy ID" 500A of the variable L, the value of the variable X is set to the target object 800B-1, the value of the variable Y is set to the change 800C-3, and the degree of influence is 800C. Is stored as “5”. When step 1305 ends, the process moves to step 1306.

  In step 1306, if there is an unprocessed line in the policy rule body 500, the process proceeds to step 1302, and if there is no unprocessed line, the process proceeds to step 1307.

  In step 1307, the policy rule operation details 510 are acquired.

  In step 1308, the unprocessed row of the operation details 510 is stored in the variable L. In step 1309, the object names stored in the “operation target object” 510C and the “argument” 510E of the variable L are obtained, and the variable P , Store in Q.

  In step 1310, if either of the variables P or Q matches the variable X, the process proceeds to step 1311. If both are different, the process proceeds to step 1312.

  In step 1311, the policy ID 800A of the influence policy list 800 is set to the "policy ID" 500A of the variable L, the value of the variable X is set to the target object 800B-1, the value of the variable Y is changed 800B-3, and the degree of influence is 800C. Is stored as “5”. When step 1311 ends, the process moves to step 1312.

  In step 1312, if there is an unprocessed line in the policy rule body 500, the process proceeds to step 1308. If there is no unprocessed line, the influence policy search process by the object is terminated.

  FIG. 14 is an influence policy search process flow based on detailed information called in the influence policy search process flow. Using the object name, comparison content, change content, and impact level as arguments, the corresponding policy rule is searched, and if the change content violates the policy rule application reason condition, it is stored in the impact policy list 800.

  In step 1400, the object name of the argument is stored in variable X, the comparison content is stored in variable Y, the change content is stored in variable Z, and the influence is stored in variable V. In step 1401, policy rule body 500 of the policy rule is acquired. .

  In step 1402, an unprocessed row of policy rule body 500 is stored in variable L. In step 1403, an object name corresponding to “target object” 500E−1 of “policy rule application reason” 500E of variable L is obtained, Store in variable P.

  In step 1404, the variable P matches the variable X, and the “comparison contents” 500E-2 of the “policy rule application reason” 500E of the variable L matches Y, and Z is the “policy rule application” of the variable L. If the “reason” 500E “condition 500E-3” is not satisfied, the process proceeds to step 1405; otherwise, the process proceeds to step 1406.

  In step 1405, the policy ID 800A of the influence policy list 800 is set to the "policy ID" 800A of the variable L, the value of the variable X is set to the target object 800B-1, the value of the variable Y is set to the comparison content 800B, and the change content 800B-3 is set. The variable Z is stored in the variable Z, and the variable V is stored in the influence degree 800C. When step 1405 ends, the process moves to step 1406.

  In step 1406, if there is an unprocessed line in the policy rule body 500, the process proceeds to step 1402. If there is no unprocessed line, the influence policy search process based on detailed information is terminated.

  The above is the influence policy search processing flow.

  FIG. 15 is an example of an influence policy list display screen that displays data registered in the influence policy list 800 after execution of the influence policy search process flow. This screen is created by the user interface unit 105 and output to the display. Since the policy rules that are affected by the configuration change are listed on the screen, the administrator can easily grasp the policy to be corrected. When policy correction button 1501 is pressed, a policy rule correction confirmation screen shown in FIG. 16 is displayed.

  FIG. 16 shows an example of a policy rule correction confirmation screen for confirming correction execution to the user when selecting one from the policy rules displayed in the influence policy list on the screen of FIG. 15 and correcting the policy rule. It is. This screen is created by the user interface unit 105 and output to the display. Since the detailed cause and the degree of influence that the policy rule application reason is no longer satisfied are displayed on the screen, the user can determine the necessity for correction according to the content. When the OK button 1601 displayed on the screen is pressed, the policy rule correction screen is displayed and the policy rule can be corrected. When the cancel button 1602 is pressed, the correction screen is not displayed. Returning to the influence policy list display screen 1500 of FIG.

  The embodiment has been described above.

  As described above, in the present embodiment, the reason for application is set at the time of policy rule definition, and the degree to which the detailed information of the system configuration management target object affects the policy application reason is defined in advance. Thus, it is possible to determine whether the reason for application is satisfied when the system configuration is changed, and it is possible to determine whether the policy is valid.

  The above-described embodiments can be changed or combined as appropriate without departing from the spirit of the present invention.

1 is an overall configuration diagram of a system to which an embodiment of the present invention is applied. The figure which shows the apparatus structural example of each apparatus. The figure which shows an example of the system configuration information of a management object system. The figure which shows an example of the management object dependence relationship and communication destination of a management object system. The figure which shows an example of a policy rule. The figure which shows an example of a structure change influence degree definition. The figure which shows an example of system structure difference information. The figure which shows an example of an influence policy list. Policy rule definition processing flowchart. The system configuration information collection processing flowchart. The system configuration information difference extraction processing flowchart. The influence policy search processing flowchart. The influence policy search processing flowchart by an object. The influence policy search processing flowchart by detailed information. The figure which shows an example of an influence policy list display screen. The figure which shows an example of a policy correction confirmation screen.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Policy management apparatus 110 Configuration management apparatus 120 System configuration apparatus group 130 Load distribution apparatus 140 Business processing computer 150 Network 200 Computer 201 CPU
202 Memory 203 External Storage Device 204 Input Device 205 Communication Device 206 Output Device 300 Load Balancing Device Information 310 Business Processing Computer Information 320 AP Server Information 330 DB Server Information 340 Logical System Information 350 Dependency Information 500 Policy Rule Body 510 Operation Details 600 Configuration Change impact definition 700 System configuration difference information 800 Impact policy list 1500 Impact policy list display screen 1600 Policy modification confirmation screen

Claims (3)

  In policy rule creation / modification in system operation management, the policy rule application reason is set at the time of policy rule creation, and it is determined whether the policy rule application reason is satisfied by the configuration change at the time of system configuration change. A policy rule management method, characterized in that a policy rule determined to be affected by a configuration change is assigned with an influence level and displayed.   A policy rule management method, which defines in advance how much the configuration change contents of a managed object affect the policy rule application reason when the system configuration is changed. When the policy rule is created, the reason for applying the policy rule is set, the step of determining whether the policy rule application reason is satisfied by the configuration change when the system configuration is changed, and the determination step is affected by the configuration change. A policy rule management method comprising: assigning a degree of influence to the determined policy rule.

Images