JP2007207117A - Performance monitor, performance monitoring method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To select and formulate a most proper countermeasure to a phenomenon occurring in a various form. <P>SOLUTION: A monitor part 101 acquires state information related to states of AC (Autonomic Computing) environment and non-AC environment, and an analysis part 103 or a model diagnostic part 106 decides a state of a device of the AC environment on the basis of the acquired state information. A simulation part 108 refers to a countermeasure list corresponding to a decision result, and executes simulation processing by at least one countermeasure included in the countermeasure list to evaluate effect of each the countermeasure. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a performance monitoring apparatus, a performance monitoring method, and a program applicable to so-called autonomous computing in which a computer manages the state of a target external device, for example.

In order to reduce the burden of computer management by humans, so-called autonomous computing is being realized. In autonomous computing, a computer autonomously repairs its own failure based on a predetermined operation guideline (see, for example, Non-Patent Document 1). This self-management is realized by repeating the following procedure.
(1) First, monitor the computer system and aggregate hardware and software behavior as log data. (2) Analyze the aggregated data to understand the situation. (3) Establish measures to achieve the objective. (4) Plan Execute and control

  For example, the CPU usage rate is monitored (1), and when the usage rate suddenly increases (2), measures are taken to distribute the load to other resources (3). The computer autonomously executes the process (4) of distributing to machines.

  By the way, the autonomous computing technology proposed today is operated in the above cycles (1) to (4), but the planning process (3) is intended to follow the operation guidelines originally set by humans. It has been. Therefore, when implementing autonomous computing, designers prepare various operational guidelines for events that can be predicted. The computer decides whether it can continue to operate according to the operation guidelines set at the beginning, and takes necessary actions. Hereinafter, the autonomous computing in the text will be described as synonymous with autonomic computing (AC) in Non-Patent Document 1.

“Blueprint on Autonomic Computing Architecture”, Internet <URL: http://www-6.ibm.com/jp/autonomic/pdf/acbp2_2005-06_v7.pdf>

  However, in a computer system, it is easy to assume an event that can occur on a daily basis, for example, an increase in load, but the system configuration is changed from the middle, or an unexpected event such as a failure due to human error occurs. There is. Even if no problem has occurred at this time, there may be signs of a problem that may occur in the future. In the first place, it is not without saying that the initially set policy is wrong.

  In this way, an event that makes it difficult to apply the operation guideline occurs, or there is no abnormality at the moment, so operation based on the normal operation guideline is performed, or operation with a better operation guideline that is actually better changed is hidden. If you continue, the computer will perform autonomous control based on the wrong operation guidelines, such as "autonomous computing is the original purpose," autonomous optimal processing, changes without human intervention Will not be able to achieve that.

  Therefore, an object of the present invention is to make it possible to select and formulate the most appropriate countermeasure against events that occur in various forms or may occur in the future.

The performance monitoring device of the present invention is a performance monitoring device connected to at least one external device via a communication line, and obtains status information related to the status of the external device, and is obtained by the obtaining device The determination means for determining the state of the external device based on the state information, and the countermeasure list corresponding to the determination result by the determination means, and the at least one countermeasure information included in the countermeasure list And simulation means for executing a simulation process related to the state of the external device and evaluating the effect of the countermeasure indicated by each countermeasure information.
The performance monitoring method of the present invention is a performance monitoring method by a performance monitoring device connected to at least one external device via a communication line, and obtains status information related to the status of the external device; and At least one countermeasure included in the countermeasure list with reference to a determination step for determining the state of the external device based on the state information acquired in the acquisition step, and a countermeasure list corresponding to a determination result in the determination step A simulation step of executing a simulation process related to the state of the external device based on each piece of information and evaluating the effect of the countermeasure indicated by each countermeasure information.
The program according to the present invention causes a computer to execute the performance monitoring method.

In the present invention, the current / future status of the external device is analyzed / diagnosed (determined) based on the status information of the external device or a model created by status information described later, and the countermeasure list corresponding to the determination result is displayed. A simulation process is performed by each countermeasure included, and the effect of the countermeasure shown in each countermeasure information included in the countermeasure list is evaluated. That is, according to the present invention, even if the external device falls into various event states, the effect of each measure can be evaluated by performing a simulation using a measure list corresponding to the state.
Therefore, according to the present invention, it is possible to select and formulate the most appropriate countermeasure against the event of the external device that occurs in various forms based on the evaluation result.

First, before describing embodiments of the present invention, the terms used in the following description are defined.
The “policy” is a guideline regarding the operation of an autonomic computing environment (hereinafter referred to as an AC environment) described later. As an example of the policy, “If the CPU usage rate is 0 to 10%, it is surplus, normal if the CPU usage rate is 11 to 80%, overload if the CPU usage rate is 81% or more. Yes, “If the CPU usage rate is overloaded, run a simulation to select the countermeasure that left the best results”, “If there is no system response, restart immediately”, etc. .
The “countermeasure list” is a set of countermeasures associated with each event that can occur in the devices in the AC environment, and the event and the countermeasure are associated with each other by m: n. Note that m = n or m ≠ n. An example of the countermeasure list is “Countermeasure 1. Addition of one CPU, Countermeasure 2. Addition of two CPUs, Countermeasure 3. Load distribution by adding servers” for the event “CPU usage rate exceeds the threshold”. ”And other measures list.
The “model” is a characteristic extracted for each device in the AC environment based on monitoring data acquired from the AC environment and a non-AC environment described later. As an example, when monitoring data indicating the CPU usage rate is acquired from an AP server in the AC environment, the following model representing the time series change of the CPU usage rate can be extracted by obtaining the linear approximation formula.
f (t) = at + b
f (t): CPU usage rate, t: time, a, b: actual value

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments to which the invention is applied will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a block diagram showing a functional configuration of an AC performance monitoring apparatus 100 according to an embodiment of the present invention. As shown in FIG. 1, an AC performance monitoring apparatus 100 according to this embodiment includes an AC environment that is an information processing system including servers 1001, storages 1002, network (NW) devices 1003, and the like, and non- The AC environment is connected to a communication line such as a LAN (Local Area Network), and the state of each device can be monitored via this communication line.

  The AC environment is an environment to which the autonomic computing technology according to the present embodiment is applied. In the example of FIG. 1, the servers 1001, the storage devices 1002, and the network devices 1003 are used. On the other hand, the non-AC environment is an environment that is not applied to the autonomic computing technology in the present embodiment, and the monitoring data acquired from the non-AC environment is used for autonomic computing for the AC environment. It is also possible.

  The servers 1001 described above are various servers such as a Web server and an AP server, and the storages 1002 are devices capable of recording information such as a DB. The network device 1003 is a communication network such as a LAN that connects the servers 1001 and the storage devices 1002.

  The monitor unit 101 acquires the following monitoring data indicating the state of each device in the AC environment and the non-AC environment. From the Web server, AP server, and DB server in the AC environment, as the monitoring data, the resource usage status data such as the data indicating the memory usage and the data indicating the CPU usage rate, and the processing history of each device in the AC environment are shown. Get log data. In addition, the monitor unit 101 receives, as monitoring data from each communication line (network device) connecting the Web server, the AP server, and the DB server in the AC environment, the throughput and processing name of transactions communicated through these communication lines. Get transaction data indicating etc. The monitor unit 101 converts the acquired monitoring data into a standard format and stores it in an event information storage unit 102 described later. The conversion to the standard format is not always necessary, but is performed in order to efficiently analyze and diagnose (determine) a wide variety of information. In the following, only an embodiment using CBE (Common Base Event), which is a typical standard format, will be described, but it is needless to say that the format is not limited to CBE as long as it is a format used for standardization for processing. No.

  Furthermore, the monitor unit 101 acquires monitoring data from a non-AC environment. As monitoring data acquired from a non-AC environment device, for example, a non-AC environment device that accesses the AC environment is monitored, and the number of accesses made to each device of the AC device is acquired as monitoring data. Or obtaining temperature data as monitoring data from a thermometer that is a device in a non-AC environment that measures the temperature in the AC environment. In addition, time information for which the number of accesses to devices in the AC environment is predicted to increase rapidly can be acquired as monitoring data from devices in the non-AC environment. In the following, autonomic computing using only monitoring data acquired from the AC environment will be described, but more accurate autonomic computing is realized by further adding monitoring data that can be acquired from these non-AC environments. It becomes possible.

  The analysis unit 103 analyzes whether there is a problem in the CBE data converted by the monitor unit 101 based on the policy 1041 read from the knowledge information storage unit 104. For example, when the CPU usage rate indicated by the CBE data exceeds 80%, an event that the CPU usage rate is overloaded is analyzed based on the policy 1041. An example of the policy 1041 has been described in the above description. For example, when analyzing the CPU usage rate as described above, the policy closest to the numerical value indicated by the CBE data to be analyzed is “CPU usage rate is 80% of threshold value”. A policy 1041 is read from the knowledge information accumulating unit 104.

  Further, for example, when the CBE data to be analyzed is the amount of memory used and the CBE data indicates 90%, the policy corresponding to the data closest to the analysis target “the usage rate in the memory exceeds 85% of the threshold value. "The memory is excessively consumed" is read from the knowledge information storage unit 104. In this case, the memory usage indicated by the CBE data exceeds 85%. The event of being consumed is analyzed.

  Further, for example, when the CBE data to be analyzed is transaction data indicating throughput and the CBE data indicates 120 transactions / second, the policy “throughput is less than 100 transactions / second” corresponding to the data closest to the analysis target. If there is a service level within a predetermined range, a policy 1041 that reads “the service level does not fall within the predetermined range if the throughput is 100 transactions / second or more” is read. In this case, the throughput indicated by the CBE data is 100. The event that the system is overloaded because it exceeds transactions / second is analyzed.

  The event information storage unit 102 stores the CBE data converted by the monitor unit 101. In addition, the event information storage unit 102 periodically performs statistical processing on the stored CBE data to reduce the amount of stored CBE data. Examples of statistical processing include a method for obtaining the maximum / minimum value of CBE data accumulated during a certain period, a method for obtaining an average value of CBE data accumulated during a certain period, and the like.

  As information stored in the event information storage unit 102, configuration information is stored in addition to the resource usage information data, log data, and transaction data described above. The configuration information is information indicating the configuration of an information processing system to be monitored (for example, the information processing system to be monitored is composed of 6 Web servers, 2 AP servers, and 1 DB server). Information indicating how each device constituting the information processing system is connected, and what transfer rate the network for connecting each device has, hardware in each device And information indicating the specifications of the software. As the specifications of each hardware and software, it is preferable to register not only the specifications at the time of purchase but also the firmware and software versions. The accumulated configuration information may be acquired and input by the AC performance monitoring apparatus 100 via a network as well as a method of being input by an operator, for example.

  The model extraction unit 105 extracts a model 1042 of the corresponding AC environment device based on the CBE data stored in the event information storage unit 102. For example, the model extraction unit 105 can sequentially acquire CBE data indicating the CPU usage rate of a certain device in an AC environment, and extract a model 1042 representing a time-series change in the CPU usage rate by linearly approximating the CBE data. .

  Further, the model extraction unit 105 can sequentially extract CBE data indicating the throughput of a certain device in an AC environment, and extract a model 1042 representing a time-series change in throughput by linearly approximating the CBE data.

  Further, when the model extraction unit 105 extracts the model 1042 that linearly approximates the time series change of the CPU usage rate and the throughput as described above, the model extraction unit 105 calculates the correlation between the CPU usage rate and the throughput from the model 1042. The model 1042 shown can also be extracted. A method for extracting such a model 1042 will be described in detail later. Each extracted model 1042 is stored in the knowledge information storage unit 104.

  The model diagnosis unit 106 refers to the model 1042 stored in the knowledge information storage unit 104 and the policy 1041 corresponding to the model 1042, and diagnoses the model 1042 based on the policy 1041.

  For example, if the referenced model 1042 represents a time-series change in the CPU usage rate, the policy 1041 corresponding to the model 1042 is “a CPU usage rate that is redundant if the CPU usage rate is 0 to 10%. The policy 1041 is referred to as “normal if the CPU is 11 to 80% and overloaded if the CPU usage rate is 81% or more”. If a predicted value at a future time is predicted to exceed a predetermined threshold, an event is diagnosed that a future problem with respect to CPU utilization may occur.

An example in which a problem event is diagnosed by the model diagnosis unit 106 will be described in detail with reference to FIG. The model representing the time-series change in the CPU usage rate is f _a (x) = αx + β, and the policy associated with the model is “the CPU usage rate is 11 if the CPU usage rate is 0 to 10%. If it is ˜80%, it is normal, and if the CPU usage rate is 81% or more ”, as shown in FIG. 6, the value of the CPU usage rate f _a (x) after one month Is over 80%. In such a case, the model diagnosis unit 106 diagnoses that a problem may occur because the CPU usage rate is overloaded after one month.

  Further, if the referenced model 1042 represents a time-series change in throughput, the policy 1041 corresponding to the model 1042 is “throughput that the service level falls within a predetermined range if the throughput is 100 transactions / second or more”. If the service level is 100 transactions / second or more, the service level does not fall within a predetermined range. If a predicted value at a future time is predicted to exceed a predetermined threshold, an event is diagnosed that a future problem may occur with respect to throughput.

Referring to FIG. 7, another example in which a problem event is diagnosed by the model diagnosis unit 106 will be described in detail. Models representing time-series changes in throughput of the processing A and the processing B are respectively f _A (x) = α ₁ x + β ₁ , f _B (x) = α ₂ x + β ₂ , and the policy associated with these models is “if the throughput is less than 100 transactions / second, the service level falls within a predetermined range, and the throughput is 100 If the service level does not fall within the predetermined range if it is greater than or equal to transactions / second ", as shown in FIG. 7, the value of throughput f _A (x) of process A after one month is 100 transactions / second. It is over. In such a case, the model diagnosis unit 106 diagnoses that a problem may occur in the throughput of the process A after one month. On the other hand, since the value of the throughput f _B (x) of the process B until one month later is less than 100 transactions / second, it is not diagnosed that there may be a problem in the throughput of the process B by one month later.

  Further, if the referenced model 1042 is a model indicating the correlation between the CPU usage rate and the throughput, the policy 1041 corresponding to the model 1042 is “the correlation between the CPU usage rate and the throughput has an error 10 Policy 1041 that should be within% "is referenced. If it is predicted that the correlation between CPU usage and throughput at a certain time in the future will not maintain a predetermined balance, analyze the event that these correlations may cause problems in the future Is done.

A further example in which a problem event is diagnosed by the model diagnosis unit 106 will be described in detail with reference to FIG. 8. Each model indicating the correlation between the CPU usage rate and the throughput of the process a is f _TA (x ) = Ρ ₁ x + θ ₁ , f _TB (x) = ρ ₂ x + θ ₂ , f _TA (x) is based on the data of _{January 1} , 2006, and f _TB (x) is based on the data of 2006/01/02. This is the model created. When the policy associated with these models is “the correlation between the CPU usage rate and the throughput should be within 10% of error in the previous and next day”, as shown in FIG. 8, f _TA (x ₁ ) And f _TB (x ₁ ) have an error of 10% or more, the CPU usage rate and the throughput are out of balance, and the system is diagnosed as being in an abnormal state.

  The planning unit 107 is associated with an event analyzed as having a problem as a result of analysis of the CBE data by the analysis unit 103 or an event diagnosed as a future problem by the model diagnosis unit 106. The countermeasure list 1043 is selected from the knowledge information storage unit 104, and a simulation process according to each countermeasure included in the countermeasure list 1043 is requested to the simulation unit 108 described later.

For example, when the target event is an event such that “the CPU usage rate after one month exceeds 80%”, the following (1) to (6) are shown as examples of the countermeasure list 1043 linked to the event. Such a countermeasure list 1043 is exemplified.
(1) Add one CPU (2) Add two CPUs (3) Load distribution by adding servers (processing distribution pattern A)
(4) Load distribution by adding servers (processing distribution pattern B)
(5) Load distribution by adding servers (processing distribution pattern C)
(6) Load distribution by adding servers (processing distribution pattern D)

  As shown in FIG. 5 (a), the process distribution pattern A is originally a process in which two types of processes A and B are processed by one server, but the process is performed by the server and the added server. This is a processing distribution pattern in which A and processing B are distributed one by one.

  As shown in FIG. 5B, the process distribution pattern B is originally a process where two types of processes A and B are processed by a single server. The processing distribution pattern reduces the processing burden on the processing A of the server that was originally processed by causing the additional server to execute processing A.

  As shown in FIG. 5C, the process distribution pattern C originally has two types of processes A and B processed by a single server, but the servers A and B are similarly processed. And the additional server execute the process B to reduce the processing load related to the process B of the server that was originally processed.

  As shown in FIG. 5 (d), the process distribution pattern D is originally a process where two types of processes A and B are processed by one server. The processing distribution pattern reduces the processing load related to processing A and processing B of the server that was originally processed by causing the additional server to execute both processing A and processing B.

  The simulation unit 108 refers to the countermeasure list 1043 selected by the planning unit 107 from the knowledge information storage unit 104, and executes a simulation process using the countermeasure list 1043.

  The simulation unit 108 can be configured by a tool called a simulator for quantifying the effect of the configuration change of a device (or a system composed of a plurality of devices). The simulator can predict the performance value by inputting the device (or system) configuration and processing characteristics. Here, examples of information input as the apparatus (or system) configuration include the number of servers, the number of CPUs, and the like. Examples of information input as a feature of the process include a processing time in the CPU of each process, an occurrence frequency of each process, and the like. Information predicted as the performance value includes a CPU usage rate, a response time for each process, and the like. Since these input data are information obtained by calculation based on the model read from the knowledge information storage unit 104, the model may be given to the simulator as a parameter.

For example, when the target event is the above-mentioned event “the CPU usage rate after one month exceeds 80%”, the simulation process is executed for the countermeasure list 1043 including the countermeasures (1) to (6) above. The effects of implementing each measure are quantified as follows.
Result of measure (1): CPU usage rate 85%
Result of measure (2): No CPU usage rate (because it was determined that the configuration was not feasible)
Result of measure (3): CPU usage rate 40%
Result of measure (4): CPU usage rate 55%
Result of measure (5): CPU usage rate 55%
Result of measure (6): CPU usage rate 65%

  Also, if the target event is an event that has been analyzed by the analysis unit 103, for example, that the current CPU usage rate has already exceeded 80%, the countermeasure list 1043 corresponding to the event is also referred to. The effect is quantified for each countermeasure in the countermeasure list 1043 by the simulation process.

  The planning unit 107 refers to the policy 1041 corresponding to the event from the knowledge information storage unit 104 and determines a measure that has led to a result satisfying the policy 1041 among the evaluation results of the simulation processing performed by the simulation unit 108. For example, if the policy 1041 corresponding to the event is the policy 1041 “if the CPU usage rate is overloaded, select a countermeasure that performs simulation and leaves an optimal result”. Countermeasure (3) will be determined. When the planning unit 107 determines the countermeasure in this way, for example, the planning unit 107 schedules the execution of the countermeasure, such as executing the countermeasure (3) after one week.

  The plan execution unit 109 executes countermeasures according to the schedule created by the planning unit 107.

  If all the results of the simulation processing by the simulation unit 108 do not satisfy the policy 1041 corresponding to the event, the measure search unit 110 is not linked to the event among the measures stored in the knowledge information storage unit 104. A measure is selected, and a simulation process according to the selected measure is requested to the simulation unit 108. The simulation unit 108 refers to the selected countermeasure from the knowledge information storage unit 104, executes simulation processing for each countermeasure, and quantifies the effect when each countermeasure is implemented.

  In the case where there is a countermeasure that leads to a result satisfying the policy 1041 among the results of the simulation processing for the countermeasure not associated with the event, the countermeasure search unit 110 performs the countermeasure in the knowledge information storage unit 104. Is added to the countermeasure list 1043 associated with the event, and a countermeasure corresponding to the result satisfying the policy 1041 is passed to the planning unit 107.

  In this way, when the countermeasure search unit 110 finds a countermeasure that satisfies the policy and the countermeasure search section 110 passes the countermeasure, the planning unit 107 similarly schedules the execution of the countermeasure.

  FIG. 2 is a block diagram illustrating a hardware configuration of the AC performance monitoring apparatus 100. The CPU 201 comprehensively controls each device and controller connected to the system bus. The ROM 203 or the HD 207 has a BIOS (Basic Input / Output System) or an operating system program that is a control program of the CPU 201, a program for the processing shown in FIG. 3A and FIG. Is remembered.

  In the example of FIG. 2, the hard disk (HD) 207 is configured to be arranged inside the AC performance monitoring apparatus 100. However, as another embodiment, a configuration corresponding to the HD 207 is arranged outside the AC performance monitoring apparatus. It is good also as a structure. Also, for example, the program for performing the processing shown in FIGS. 3A and 3B according to the present embodiment is recorded on a computer-readable recording medium such as a flexible disk (FD) 206 or a CD-ROM. The recording medium may be supplied from a recording medium, or may be supplied via a communication medium such as the Internet.

  The RAM 202 functions as a main memory, work area, and the like for the CPU 201. The CPU 201 implements various operations by loading a program necessary for execution of processing into the RAM 202 and executing the program.

  The disk controller 205 controls access to external memories such as the HD 207 and the FD 206. The communication IF controller 204 is connected to the Internet or a LAN, and controls communication with the outside by, for example, TCP / IP.

  The display controller 208 controls image display on the display 209.

  The KB (keyboard) controller 210 receives an operation input from the keyboard (KB) 211 and transmits it to the CPU 201. Although not shown, in addition to the keyboard 211, a pointing device such as a mouse can also be applied to the AC performance monitoring apparatus 100 according to the present embodiment as a user operation means.

  The monitor unit 101, the analysis unit 103, the model extraction unit 105, the model diagnosis unit 106, the planning unit 107, the simulation unit 108, the plan execution unit 107, and the countermeasure search unit 110 are stored in the HD 207, for example, and stored in the RAM 202 as necessary. The configuration corresponds to the program to be loaded and the CPU 201 that executes the program.

  The knowledge information storage unit 104 and the event information storage unit 102 have a configuration corresponding to a partial storage area in the HD 207 or the RAM 202, for example. The knowledge information storage unit 104 and the event information storage unit 102 may be configured externally in addition to the configuration provided inside the AC performance monitoring apparatus 100.

  Next, the operation of the AC performance monitoring apparatus 100 according to the present embodiment will be described with reference to the flowcharts of FIGS. 3-1, 3-2, 10 and 11.

  First, a process for accumulating CBE data in the event information accumulation unit 102 from an acquisition process for monitoring data by the monitor unit 101 will be described with reference to FIG. In FIG. 10, the monitor unit 101 acquires monitoring data from each device in the AC environment and the non-AC environment, and converts the acquired monitoring data into CBE data (steps S1001 and S1002). Next, the monitor unit 101 stores the CBE data in the event information storage unit 102 (step S1003). In this way, the monitor unit 101 repeatedly executes the processing of steps S1001 to S1003 and accumulates CBE data in the event information accumulation unit 102. In the event information storage unit 102, for example, the maximum / minimum value or average value of the stored CBE data is calculated every predetermined period, and the data amount to be stored is stored by holding only that value. Reduction is planned.

  Next, using FIG. 3A and FIG. 3B, AC environment diagnosis processing is performed using a model based on the CBE data stored in the event information storage unit 102. Processing until execution will be described. 3A, the model extraction unit 105 acquires CBE data corresponding to each device in the AC environment and the non-AC environment from the event information storage unit 102, and extracts a model 1042 (steps S301 and S302).

Here, a method of extracting the model 1042 will be specifically described with reference to FIG.
First, in FIG. 4A, a predetermined time has elapsed from the time (time 2) when the previous model 1042 was extracted, and the model extraction unit 105 newly adds monitoring data for time 3 together with monitoring data for time 1 and time 2. Get this time. As shown in FIG. 4A, the monitoring data acquired here is monitoring data indicating the CPU usage rate and monitoring data indicating the throughput.

Next, the model extraction unit 105 plots the monitoring data from time 1 to time 3 in a coordinate system representing the relationship of the CPU usage rate with respect to time, and linear approximation formula (f _a (x)) for each plotted monitoring data. = Αx + β) is extracted to extract a model 1042 representing a temporal change in the CPU usage rate. The model extraction unit 105 stores the extracted model 1042 in the knowledge information storage unit 104.

Further, as shown in FIG. 4B, the model extraction unit 105 plots monitoring data from time 1 to time 3 indicating the throughput for each of the processing A and the processing B in the coordinate system representing the relationship of the throughput with respect to time. For each of the processing A and the processing B, a linear approximation expression (f _A (x) = α ₁ x + β ₁ , f _B (x) = α ₂ x + β ₂ ) of each monitoring data is obtained, so that the time series of the throughput is obtained. A model 1042 representing a change is extracted. The model extraction unit 105 stores the extracted model 1042 in the knowledge information storage unit 104.

Next, the model extraction unit 105 performs correlation analysis and multivariate analysis on these two models 1042, and as shown in FIG. A model 1042 that obtains a linear approximation expression (f _TA (x) = ρ ₁ x + θ ₁ , f _TB (x) = ρ ₂ x + θ ₂ ) representing the correlation between the usage rate and the throughput and indicates the correlation between the CPU usage rate and the throughput. Is extracted (step S303). The model extraction unit 105 stores the extracted model 1042 in the knowledge information storage unit 104.

  Subsequently, the model diagnosis unit 106 refers to each of the plurality of models 1042 stored in the knowledge information storage unit 104 and the policy 1041 corresponding to each model 1042, and performs diagnosis based on the corresponding policy 1041 for each model 1042. Execute (Step S304). For example, for the model 1042 representing the time series change of the CPU usage rate, “CPU usage rate is 0 to 10% is surplus, and CPU usage rate is 11 to 80%, normal. A policy 1041 is applied that indicates that the usage rate is 81% or more, an overload occurs. The future CPU usage rate can be predicted from the model 1042 extracted this time. The CPU usage rate is increasing due to the trend of the model 1042 extracted this time. For example, when the CPU usage rate after one month is predicted to exceed 80%, the CPU usage rate is set to the future (after one month). Diagnose a potential problem.

  Further, for example, for the model 1042 representing a time-series change in throughput, the service level is within a predetermined range if the throughput is 100 transactions / second or more, and the service level if the throughput is 100 transactions / second or more. Is not within the predetermined range ”policy 1041 is applied. Similarly, the throughput can be predicted from the model 1042 extracted this time. Throughput increases due to the trend of the model 1042 extracted this time. For example, if it is predicted that the throughput will exceed 100 transactions / second after 3 weeks, there is a possibility that problems will occur in the future (after 3 weeks). Diagnose that there is.

  Further, for example, for the model 1042 representing the correlation between the CPU usage rate and the throughput, the policy 1041 that “the correlation between the CPU usage rate and the throughput should be within 10% error in the preceding and following day” is provided. Applied. Since the model 1042 can determine the tendency of the throughput with respect to the CPU usage rate, for example, based on the policy 1401, the throughput is 10% or more lower (or higher) than the previous year with respect to the CPU usage rate. ), It is diagnosed that there is a problem.

  Here, after extracting the model 1042 indicating the temporal change of the CPU usage rate and the model 1042 indicating the temporal change of the throughput, the flow of extracting the model 1042 indicating the correlation between the CPU usage rate and the throughput is extracted. However, the model 1042 showing the time series change of the CPU usage rate, the model 1042 showing the time series change of the throughput, and the model 1042 showing the correlation between the CPU usage rate and the throughput are independent of each other. Can be done. That is, the model extraction process in the present embodiment is not limited to the flow shown in FIG. 3A, and each model extraction process is performed at an arbitrary timing. Further, without extracting all of the model 1042 indicating the time series change of the CPU usage rate, the model 1042 indicating the time-based change of the throughput, and the model 1042 indicating the correlation between the CPU usage rate and the throughput, a part of them is extracted. A model can also be extracted. That is, without extracting the model 1042 indicating the correlation between the CPU usage rate and the throughput, only the two models, that is, the model 1042 indicating the time series change in the CPU usage rate and the model 1042 indicating the time series change in the throughput are extracted. It is also possible to extract only one of the model 1042 indicating the time-series change in the CPU usage rate and the model 1042 indicating the time-series change in the throughput.

  Subsequently, when the model diagnosis unit 106 diagnoses that the model 1042 has a problem, the planning unit 107 selects a countermeasure list 1043 associated with the problem event in the knowledge information storage unit 104 (step S305 / YES). , S306). For example, when the target event is an event in which the CPU usage rate after one month exceeds 80%, the countermeasure list 1043 including the countermeasures (1) to (6) described above is selected.

  Here, the planning unit 107 determines whether to request a simulation process from the simulation unit 108 based on the policy 1041 (step S307). For example, if the policy 1041 is “restart immediately if there is no system response”, the simulation unit 108 is not requested to perform a simulation process, and the execution of countermeasures is immediately scheduled (step S307 / NO, S312). If the target event is determined in advance in the policy 1041 as requiring an urgent action, the contents of the event having the problem and the countermeasure list 1043 associated with the event are displayed to the user. You may alert | report. As a result, the user can select a desired countermeasure from the notified countermeasure list 1043 and execute the countermeasure.

  On the other hand, for example, when the policy 1041 is “if the CPU usage rate is overloaded, a simulation is executed to select a countermeasure that leaves an optimal result”, the planning unit 107 is included in the countermeasure list 1043. A simulation process for each countermeasure is requested to the simulation unit 108 (steps S307 / YES, S308). The simulation unit 108 refers to the countermeasure list 1043 selected by the planning unit 107, and executes a simulation process for each countermeasure included in the countermeasure list 1043 (step S309).

  Subsequently, the planning unit 107 refers to the policy 1041 corresponding to the event from the knowledge information storage unit 104, and there is a countermeasure that has led to a result satisfying the referenced policy 1041 among the simulation processing results by the simulation unit 108. It is determined whether or not (step S310).

  When there is only one measure that has led to the result satisfying the policy 1041, the planning unit 107 determines the execution of the measure and schedules the execution of the measure (steps S310 / YES, S311, and S312). In addition, when there are a plurality of countermeasures that have led to a result satisfying the policy 1041, the planning unit 107 executes a policy 1041 “if the CPU usage rate is overloaded, execute a simulation and perform a countermeasure that leaves an optimal result. Based on “select”, the execution of the countermeasure that has led to the optimum result among the plurality of countermeasures is determined, and the execution of the countermeasure is scheduled (steps S310 / YES, S311, and S312).

  The plan execution unit 109 executes countermeasures according to the schedule created by the planning unit 107 (step S313). For example, when the planning unit 107 creates a countermeasure schedule “add one CPU after one month”, the plan execution unit 109 becomes a target one month after the date when the plan is created by the planning unit 107. Control is performed so that one CPU is added to an AC environment device.

  On the other hand, when it is determined that there is no countermeasure that led to the result satisfying the policy 1041 among the results of the simulation processing by the simulation unit 108 (the countermeasure that leads the result satisfying the policy 1041 to the countermeasure list 1043 associated with the event). If not included, the measure search unit 110 refers to measures other than the measure list 1043 from the knowledge information storage unit 104, and sequentially requests the simulation processing unit 108 to perform simulation processing for the referenced measures (step S310 / NO, S314).

  The simulation processing unit 108 executes a simulation process for the countermeasure requested by the countermeasure searching unit 110 (step S315).

  Subsequently, when the countermeasure search unit 110 requests a simulation process for all the countermeasures other than the countermeasure list 1043, the countermeasure search unit 110 compares the result of the simulation process for each countermeasure by the simulation unit 108 with the policy 1041, and satisfies the policy 1041. It is determined whether there is a countermeasure that has led to the result (steps S316 / NO, S317). In the present embodiment, the countermeasure search unit 110 uses a full search method for searching all countermeasures other than the countermeasure list stored in the knowledge information storage unit 104. However, as another embodiment, the countermeasure search unit 110 It is also possible to use a random search method for randomly searching for measures other than the list, an optimization methodology for stopping the search when a measure satisfying a certain policy (condition) is found, or the like.

  When there is only one countermeasure that has led to the result satisfying the policy 1041, the countermeasure searching unit 110 determines the execution of the countermeasure and requests the planning unit 107 to schedule the execution of the countermeasure (Step S317 / YES, S318). Further, when there are a plurality of countermeasures that have led to the result satisfying the policy 1041, the countermeasure searching unit 110 determines execution of the countermeasure that has led to the optimum result among the plurality of countermeasures, and schedules the execution of the search. Request is made to the unit 107 (steps S317 / YES, S318). On the other hand, if there is no countermeasure that has led to the result satisfying the policy 1041 (step S317 / NO), the process returns to step S301.

  Subsequently, the countermeasure searching unit 110 adds the countermeasure requested for scheduling to the planning unit 107 to the countermeasure list 1043 of the event and links the countermeasure (step S319). In this way, the countermeasure searched this time by the countermeasure searching unit 110 is added to the countermeasure list 1043. Therefore, next time, when the same event is analyzed by the analysis unit 103 or diagnosed by the model diagnosis unit 106, it is possible to perform the simulation process for the countermeasure searched this time without performing steps S314 to S319. Become.

  Subsequently, the planning unit 107 schedules execution of the countermeasure requested from the countermeasure searching unit 110 (step S312).

  The plan execution unit 109 executes countermeasures according to the schedule created by the planning unit 107 (step S313).

  Next, with reference to FIG. 10 and FIG. 3-2, processing until CBE data obtained directly from the monitor unit 101 is analyzed and when there is a problem in the analysis result will be described. Note that FIG. 3-2 is also used to describe the flow including the diagnosis process of the AC environment as described above. In the flow including the analysis processing described below, the same processing as that in FIG. 3-2 is performed, and thus the description of the processing corresponding to FIG. 3-2 will be omitted as appropriate.

  In FIG. 11, the analysis unit 103 acquires CBE data from the monitor unit 101, refers to the policy 1041 corresponding to the CBE data from the knowledge information storage unit 104, and has a problem with the CBE data based on the referenced policy 1041. It is analyzed whether there is any (steps S1101 and S1102). As described above, the CBE data is data indicating the usage rate of the CPU, and “if the CPU usage rate is 0 to 10%, it is redundant, and if the CPU usage rate is 11 to 80%, it is normal. If the policy 1041 is “If the CPU usage rate is 81% or more”, the policy 1041 indicates that the CPU usage rate indicated by the CBE data exceeds 80%, and that there is a problem with the CBE data. On the contrary, if the CPU usage rate indicated by the CBE data is less than 80%, it is analyzed that there is no problem in the CBE data.

  Subsequently, when the analysis unit 103 analyzes that there is a problem in the CBE data, the planning unit 107 selects a countermeasure list 1043 associated with the problem event in the knowledge information storage unit 104 (step S1102 / YES, S1103).

  Next, the planning unit 107 determines whether to request a simulation process from the simulation unit 108 based on the policy 1041. For example, if the policy 1041 is “restart immediately if there is no system response”, the simulation unit 108 is not requested to perform a simulation process, and the execution of countermeasures is immediately scheduled (step S1104 / NO, S312). If the target event is determined in advance in the policy 1041 as requiring an urgent action, the contents of the event having the problem and the countermeasure list 1043 associated with the event are displayed to the user. You may alert | report. As a result, the user can select a desired countermeasure from the notified countermeasure list 1043 and execute the countermeasure. Since the processing after step S312 is the same as the flow including the AC environment diagnosis processing, the description thereof will be omitted.

  On the other hand, for example, when the policy 1041 is “if the CPU usage rate is overloaded, a simulation is executed to select a countermeasure that leaves an optimal result”, the planning unit 107 is included in the countermeasure list 1043. A simulation process for each countermeasure is requested to the simulation unit 108 (steps S1104 / YES, S308). The simulation unit 108 refers to the countermeasure list 1043 selected by the planning unit 107, and executes a simulation process for each countermeasure included in the countermeasure list 1043 (step S309). Note that the processing after step S310 is the same as the flow including the AC environment diagnosis processing, and thus the description thereof is omitted.

  As described above, in this embodiment, the current problem event is analyzed (determined) from the policy corresponding to the monitoring data (CBE data), or the model is extracted from the history of the monitoring data (CBE data). Diagnose (determine) current and future problem events from the model and the policy corresponding to that model, and perform simulation processing using the countermeasure list corresponding to the event based on the above determination results to evaluate the effectiveness of each countermeasure Like to do. That is, according to the present embodiment, even when each device in the AC environment falls into various events, the effect of each countermeasure can be evaluated by simulation processing using a countermeasure list corresponding to the event.

  Therefore, according to the present embodiment, it is possible to select and formulate the most appropriate countermeasure for various events of each device in the AC environment based on the evaluation result regarding the effect of each countermeasure.

  Further, in the present embodiment, the planning unit 107 can determine the countermeasure that has led to the optimum effect and schedule the execution of the countermeasure, and the plan executing unit 109 can automatically execute the countermeasure according to the scheduling.

  Furthermore, in the present embodiment, even when an optimal countermeasure cannot be found from the countermeasure list corresponding to a certain event, the range of countermeasures to be applied to the event is determined in advance by searching for other countermeasures. It is possible to further expand from.

In the above, the case where the model showing the time series change of the CPU usage rate, the time series change of the throughput, and the correlation between the CPU usage rate and the throughput has been described. In addition to these, for example, as shown in FIG. 9, monitoring data of the throughput of the process A and the throughput of the process B is acquired in the previous and next day, and the throughput of the process A and the throughput of the process B are obtained based on these data. It is also possible to extract a model f _TAB1 (x) = ρ _AB1 x + θ _AB1 and f _TAB2 (x) = ρ _AB2 x + θ _AB2 representing the correlation to diagnose a problem event. That is, when the policy associated with these models is “the correlation between the throughput of process A and the throughput of process B should be within 10% of error in the previous and next day”, as shown in FIG. , F _TAB1 (x ₁ ) and f _TAB2 (x ₁ ) are analyzed or diagnosed that there is a possibility that the balance between the throughput of process A and the throughput of process B may be lost if there is an error of 10% or more. Thereafter, similarly, a simulation process is executed using a countermeasure list corresponding to the event of this problem, and a countermeasure that has led to an optimum result is performed.

  In the present invention, various models can be extracted based on monitoring data that can be acquired from the AC environment in addition to the models described above. In addition to monitoring data obtained from the same device, it is also possible to obtain monitoring data from a plurality of different devices and extract a model or the like representing the correlation of the monitoring data between the devices.

It is a block diagram which shows the functional structure of the AC performance monitoring apparatus which concerns on embodiment of this invention. It is a block diagram which shows the hardware constitutions of AC performance monitoring apparatus. It is a flowchart which shows operation | movement of the AC performance monitoring apparatus which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the AC performance monitoring apparatus which concerns on embodiment of this invention. It is a figure for demonstrating the extraction method of a model concretely. It is a figure for demonstrating a some process distribution pattern. It is a figure for demonstrating concretely the example in which the phenomenon of a problem is analyzed by an analysis part, or is diagnosed by a model diagnosis part. It is a figure for demonstrating concretely the example in which the phenomenon of a problem is analyzed by an analysis part, or diagnosed by a model diagnosis part. It is a figure for demonstrating concretely the example in which the phenomenon of a problem is analyzed by an analysis part, or diagnosed by a model diagnosis part. It is a figure for demonstrating the example of analysis or diagnosis of the problem phenomenon based on the extraction example of another model, and its model. It is a flowchart which shows operation | movement of the AC performance monitoring apparatus which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the AC performance monitoring apparatus which concerns on embodiment of this invention.

Explanation of symbols

100: AC performance monitoring device 101: Monitor unit 102: Event information storage unit 103: Analysis unit 104: Knowledge information storage unit 105: Model extraction unit 106: Model diagnosis unit 107: Planning unit 108: Simulation unit 109: Plan execution unit 110 : Countermeasure search unit 1001: Servers 1002: Storages 1003: Network devices 1004: Non-AC environment 1041: Policy 1042: Model 1043: Countermeasure list

Claims (8)

A performance monitoring device connected to at least one external device via a communication line,
Obtaining means for obtaining state information relating to the state of the external device;
Determination means for determining the state of the external device based on the state information acquired by the acquisition means;
Referring to the countermeasure list corresponding to the determination result by the determination means, execute a simulation process related to the state of the external device by each of at least one countermeasure information included in the countermeasure list, and A performance monitoring apparatus comprising a simulation means for evaluating an effect. Storage means for storing the status information acquired by the acquisition means in an external or internal recording medium;
Model extraction means for extracting model information representing the state of the external device based on the history of the state information stored in the recording medium;
The performance monitoring apparatus according to claim 1, wherein the determination unit determines a state of the external device based on the model information.   3. The determination unit according to claim 2, wherein the determination unit determines the state of the external device based on the model information and policy information related to the operation of the external device according to the type of the state information. The performance monitoring device described.   4. The apparatus according to claim 1, further comprising countermeasure determining means for determining one countermeasure information from the countermeasure list based on an evaluation result of the effect of each countermeasure by the simulation means. 5. Performance monitoring device. When one measure information cannot be determined from the measure list based on the evaluation result by the measure determining unit, the measure determining unit further includes search means for searching for other measure information not included in the measure list,
5. The performance according to claim 4, wherein the simulation means executes a simulation process related to the state of the external device based on the other countermeasure information, and evaluates the effect of the countermeasure indicated by the other countermeasure information. Monitoring device.   When the measure determining means determines the other measure information based on the evaluation result of the effect of the measure indicated by the other measure information, the searching means associates the other measure information with the determination result. 6. The performance monitoring apparatus according to claim 5, wherein A performance monitoring method by a performance monitoring device connected to at least one external device via a communication line,
An acquisition step of acquiring state information relating to the state of the external device;
A determination step of determining a state of the external device based on the state information acquired by the acquisition step;
Referring to the countermeasure list corresponding to the determination result of the determination step, execute a simulation process related to the state of the external device by each of at least one countermeasure information included in the countermeasure list, and the countermeasure list indicated by each countermeasure information And a simulation step for evaluating the effect.   A program for causing a computer to execute the performance monitoring method according to claim 7.

Images