JP2007287042A - System trouble monitoring device and trouble information distribution system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system trouble monitoring device capable of rapidly coping with trouble when the trouble occurs in a computer system under operation and restoring the computer system in a short time, and to provide a trouble information distribution system. <P>SOLUTION: The system trouble monitoring device 200 for monitoring trouble which occurs in the computer system comprises a trouble information storage section 230 storing known trouble information and trouble solution information showing the solution, correspondingly; a trouble information retrieval section 220 determining whether the trouble information shown in a log file is stored in the trouble information storage section 230 when acquiring the log file showing trouble contents, from the computer system, and retrieving the corresponding trouble solution information when the trouble information is stored; and a trouble information communication section 224 notifying a system management terminal 13 of the retrieved trouble solution information. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a system fault monitoring apparatus and a fault information distribution system for monitoring a fault occurring in an operating computer system and notifying a system administrator of information related to the fault.

  Conventionally, when a failure occurs in an operating computer system, the system failure monitoring apparatus detects the failure, and the content of the detected failure, that is, the date and time of occurrence and the location of the failure manages the computer system. Had been notified. Upon receiving the notification, the system administrator examines the investigation method to identify the failure from the content of the notification and searches for a solution to solve the identified failure.

  The system administrator investigates the failure based on the investigation method, identifies the cause and location of the failure, eliminates the cause and repairs the failure location based on the solution, and restores the computer system. It was. Accordingly, the notification contents notified to the system administrator are required to be necessary and useful for examining the investigation method and formulating a solution.

In Patent Document 1, the status of a job input to a computer system is monitored, and even when the same failure occurs, the job input status, that is, only when a failure occurs during processing of an automatically executed job. Judged that it is necessary to notify the system administrator of the failure. Thus, even if the same failure message is a job submitted by an operator, it is not recognized as a failure, so a failure identification method is disclosed in which unnecessary notifications are not made to the system administrator.
JP 2001-125808 A

However, the conventional system failure monitoring apparatus has the following problems. That is,
1) When a failure occurs in an operating computer system, a system administrator who has received a notification of the failure content from the system failure monitoring apparatus independently examines the countermeasure against the failure based on the notification content, and a method for investigating the investigation Since a solution has been formulated, it may take a long time to resolve the failure and restore the computer system.

2) A system administrator who has received a notification from a system failure monitoring apparatus for which no information relating to the solution has been stored, even though a failure whose solution has already been known has occurred in the computer system, Because we collected information on failures that occurred without knowing the problem, and designed a solution based on the collected information, it took a long time to recover the computer system.

3) In addition, when a failure that has already occurred in another computer system and the solution has been established occurs in the own computer system, there is no information communication between system administrators and the solution is not transmitted. there were. In that case, a system administrator who does not know the solution gathers information on the failure and examines the solution based on the collected information. For this reason, a lot of time may be spent until the computer system is restored.

  Accordingly, an object of the present invention is to provide a system failure monitoring device and a failure information distribution system that can promptly cope with a failure when a failure occurs in an operating computer system and can restore the computer system in a short time. It is in.

The present invention adopts the following configuration in order to solve the above points.
<Configuration 1>
In a system fault monitoring apparatus that monitors faults occurring in a computer system, a fault information storage unit in which known fault information and fault resolution information indicating the resolution are stored in association with each other, and a log indicating the fault contents from the computer system When the file is acquired, it is determined whether or not the failure information indicated in the log file is stored in the failure information storage unit, and if stored, the failure information search unit that searches for the corresponding failure solution information, and the failure information search A failure information communication unit for notifying the system management computer of the failure solution information retrieved by the unit.
<Configuration 2>
In a failure information distribution system having a plurality of system failure monitoring devices and having a distribution device to which each system failure monitoring element is connected, the distribution device is managed by a management computer used for managing any of the system failure monitoring devices. When fault information indicating the content of a new fault for the monitored computer is received, temporary fault resolution information is generated based on the fault information, and the fault information analysis section for sending the information to the management computer and the new fault resolution are indicated. And a transmitter that transmits the generated fault solution information to another system fault monitoring device when the signal is received. The system fault monitoring device stores the received fault solution information in the fault information storage unit in association with the new fault. It has the writing part which performs.

  According to the system fault monitoring apparatus of the present invention, a fault information storage unit in which known fault information and fault solution information indicating the solution are stored in association with each other is provided, and a log file indicating the fault contents is obtained from the computer system. Then, it is determined whether or not the failure information indicated by the log file is stored in the failure information storage unit. If the failure information is stored, the corresponding failure solution information is retrieved, and the retrieved failure solution information is managed by the system management. By notifying the operating computer, when a failure occurs in the operating system, the failure can be promptly dealt with, and the computer system can be recovered in a short time.

  According to the failure information distribution system of the present invention, the failure information distribution system includes a plurality of system failure monitoring devices, each having a distribution device to which each system failure monitoring element device is connected. When fault information indicating the content of a new fault for the monitored computer is received from the management computer used to manage the system fault monitoring device, temporary fault resolution information is generated based on the fault information, and the information is sent to the management computer When the signal indicating the resolution of the new fault is received, the generated fault resolution information is transmitted to another system fault monitoring apparatus, and the system fault monitoring apparatus stores the fault information in association with the received fault resolution information corresponding to the new fault. Can be added to each system failure monitoring device to enhance the failure resolution information corresponding to the new failure. .

  Embodiments of the present invention will be described in detail with reference to the drawings. In the following description, the same components are denoted by the same reference numerals in the drawings used in the embodiments.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 2 is a configuration diagram of the system failure monitoring system 10.
Prior to the description of the system fault monitoring apparatus 200 according to the first embodiment, the fault monitoring system 10 including the system fault monitoring apparatus 200 and the computer 100 will be described.
In the system failure monitoring system 10, the computer 100 performs information processing of a financial institution, and the system failure monitoring apparatus 200 monitors a failure that occurs in the computer 100.
The computer 100 and the system failure monitoring apparatus 200 are connected to each other via a LAN (Local Area Network) 11.
The system failure monitoring system 10 is managed by the system administrator A, and the system failure monitoring apparatus 200 and the system management terminal 13 used for management by the system administrator A are connected to be communicable via the IP network 12. Has been.
The system management terminal 13 may be a personal computer.

  The computer 100 includes an IO interface 110 for communicating with the system failure monitoring apparatus 200, a program unit 120 that stores an OS and application software programs, a CPU 130 that performs arithmetic processing and data transfer, and a memory 140 that temporarily stores data. A DISK 150 that holds a large amount of data, an event information collection unit 160 that collects information indicating a state change of each part of the computer 100, a self-diagnosis part 170 that self-diagnose the state of each part of the computer 100, and a self-diagnosis part And a log file holding unit 180 that holds the log file in the text format generated in 170.

  The event information collecting unit 160 is a log that records data changes caused by state changes in each unit of the computer 100, such as a log of the IO interface 110, a log of the program unit 120, a log of the CPU 130, a log of the memory 140, and a log of the DISK 150. Logs are collected when there is data change in each log. The event information collection unit 160 outputs the collected logs of each unit of the computer 100 to the self-diagnosis unit 170.

  The self-diagnosis unit 170 performs self-diagnosis of the state of each part of the computer 100 based on the self-diagnosis program. When the log of each part of the computer 100 is received from the event information collection unit 160, the state of the corresponding part is based on the log. And a text-format log file for recording the state change of the corresponding part based on the diagnosis result. That is, the self-diagnosis unit 170 generates a log file including error records. The log file is output to the log file holding unit 180.

  When the log file holding unit 180 receives the log file in the text format from the event information collecting unit 160, the log file holding unit 180 holds the log file in the text format. When the log file holding unit 180 receives a transmission request from the system failure monitoring apparatus 200, the log file holding unit 180 transmits a log file in a text format held in response to the transmission request to the system failure monitoring apparatus 200.

Next, the system failure monitoring apparatus 200 according to the first embodiment will be described.
FIG. 1 is a functional block diagram of a system failure monitoring apparatus 200 according to the first embodiment.
The system fault monitoring apparatus 200 detects known fault information indicating the content of a known fault whose resolution is known, fault resolution information indicating a summary of the known fault and its resolution, and a fault occurring in the computer 100. A failure information storage unit 230 that accumulates detection procedure information indicating a failure detection procedure and determination criterion information indicating a determination operation criterion for determining whether or not the detected failure is a known failure, and the failure information storage unit 230, a failure information management unit 210 that performs access authentication and manages failure information, a failure monitoring unit 220 that monitors a failure that occurs in the computer 100, and searches for failure resolution information corresponding to the failure that has occurred. A failure information communication unit 224 that notifies the system management terminal 13 of the failure solution information that has been issued.

Here, the known fault information, fault solution information, detection procedure information, and determination criterion information accumulated in the fault information storage unit 230 will be described.
The known fault information is created based on the known fault information collected by the system administrator A. That is, failure information whose solution has been confirmed among failures that have occurred in the computer 100 and failures that may occur in the future is collected by the system administrator A, and further contacted by other system administrators. The fault information that was present is also collected. Then, the known fault information is created based on the collected fault information.

FIG. 4 shows an example of the data structure of the fault solution information.
The failure solution information is generated based on the known failure information by the failure solution information generation unit 211 of the failure information management unit 210, and shows an outline of the failure and its solution means.
The outline of the fault includes a fault number given in the order of generation, an occurrence date and time indicating the date and time when the fault occurred, and a fault name indicating the name of the fault. The failure name is, for example, “Disk Error”, “Cpu Error”, “Memory Error”, “IO Error”, and the like.

  The information indicating the solution means includes investigation information for identifying the failure that has occurred and solution information for recovering the computer 100. As an example, in the case of “Memory Error” as the investigation information, “whether or not a SSingle bit error has occurred” is investigated based on the log information. If it is a SSingle bit error, more errors occur. It is shown to investigate whether or not. Corresponding to the result of the investigation, solution information for recovery is shown. That is, 1) MEMORY is exchanged when an error of more than double bit occurs 2) MEMORY is exchanged when SINGLE bit error occurs frequently 3) When SINGLE bit error occurs several times Shows a procedure such as continuing the operation with care without exchanging the MEMORY.

  The detection procedure information is software that is imported into the failure detection unit 221 of the failure monitoring unit 220, and indicates a detection procedure for detecting a failure that occurs in the computer 100. A log file is acquired from the computer 100, The log file acquired to detect the failure is checked by the check software for the “ERROR” keyword. For example, the detection procedure includes a step of checking whether each line from the first line to the last line of the acquired log file starts with “ERROR:”, and if there is a line starting with “ERROR:”, “ The method includes a step of extracting a line starting with “ERROR:” and a step of analyzing the extracted line starting with “ERROR:” to generate an error message.

The determination criterion information is software that is imported into the failure determination unit 222 of the failure monitoring unit 220 and indicates an operation criterion for determining whether or not the detected failure is a known failure.
Specifically, as a failure that may occur in the computer 100, for example, as shown in FIG. 3, a DISK failure that occurs in the DISK 150, a PROG failure that occurs in the program unit 120, and a CPU that occurs in the CPU 130 There are a failure, a memory failure occurring in the memory 140, and an IO failure occurring in the IO interface 110. When receiving the error message generated by the failure detection unit 221, the failure determination unit 222 according to the present embodiment determines whether or not the failure detected based on the error message and the determination criterion information is a known failure. . As an example, in the line starting with “ERROR:”, the failure determination unit 222 follows “ERROR:” followed by “Disk Error”, “Prog Error”, “Cpu Error”, “Memory Error”, and “IO Error”. Etc., it is determined that “the detected fault is a known fault”.

The failure information management unit 210 generates a failure solution information that associates the outline of the failure with the solution means, and the generated information and the updated information to the failure information storage unit 230. A failure information writing unit 212 for writing.
The failure information management unit 210 performs access authentication to the failure information storage unit 230 based on a password to prevent unauthorized access. When access is authenticated, the authentication date and time of access and the name of the person who has accessed And whether the purpose of the access is to generate information, to update information, to write information, or to delete information. Management information indicating the purpose is generated. The failure information management unit 210 activates the failure resolution information generation unit 211 when the access is for information generation, and the failure information writing unit 212 when the access is for the purpose of writing failure information or updating the failure information. Start up.

  When the system administrator A inputs a summary of the failure in the known failure information and its solution means, the failure solution information generation unit 211 generates the failure solution information (see FIG. 4). The generated failure solution information is sent to the failure information writing unit 212 and stored in the failure information storage unit 230.

  When the failure information writing unit 212 receives the failure solution information generated from the failure solution information generating unit 211, the failure information writing unit 212 stores the failure information in a predetermined address of the failure information storage unit 230.

  The failure monitoring unit 220 acquires a log file in text format from the computer 100, detects a failure occurring in the computer 100 based on the log file and the failure detection procedure, and generates an error message indicating the detected failure A failure detection unit 221 that performs error determination from the failure detection unit 221, a failure determination unit 222 that determines whether or not a failure detected based on the determination operation criterion is a known failure, and a determination by the failure determination unit 222 A fault information search unit 223 that searches the fault information storage unit 230 to extract fault solution information corresponding to the fault detected based on the result.

  The failure detection unit 221 periodically requests the computer 100 to transmit a log file as shown in FIG. 5, and transmits the text format log file held in the log file holding unit 180 via the LAN 11 to the failure information communication unit. Via 224. The failure detection unit 221 acquires a log file, and checks the acquired log file to detect a failure using check software for the “ERROR” keyword. As an example, the failure detection unit 221 reads from the first line to the last line of the acquired log file, and extracts lines starting with “ERROR:” based on the detection procedure information read from the failure information storage unit 230. The failure detection unit 221 generates an error message indicating the detected failure based on the sentence described after “ERROR:” in the extracted line starting with “ERROR:”. For example, the error message is generated as “Memory Error detected as Double bit error occurs”.

  Further, in the extracted line starting with “ERROR:”, when the sentence described after “ERROR:” is blank like “” in the extracted line starting with “ERROR:” Error message is generated. The generated error message is output to the failure determination unit 222.

  In the present embodiment, an example of the failure detection unit 221 that periodically requests the computer 100 to transmit a log file will be described. However, when a data change occurs due to a change in state, the computer 100 detects a system failure monitoring device. The log file may be transmitted to 200.

Upon receiving an error message from the failure detection unit 221, the failure determination unit 222 reads the determination criterion information from the failure information storage unit 230, and detects the failure detected based on the determination operation criterion indicated by the determination criterion information and the error message. Is a known fault. Specifically, if the failure determination unit 222 is described as “Disk Error”, “Cpu Error”, “Memory Error”, etc. following the determination operation criterion, that is, “ERROR:”, the detected failure is described. Is determined to be a known failure. For example, the failure determination unit 222 may detect the error message “Memory detected as a double bit error”.
When “Error occurs”, it is determined that “the failure is a known failure (Memory Error)”, and the determination result is “failure is a known failure“ Memory Error ”and a double bit error has been detected”. The information is output to the information search unit 223.
Further, upon receiving the error message “Unidentified failure detected”, the failure determination unit 222 determines that the failure is not a known failure. As a determination result, “failure is not a known failure” is output to the failure information search unit 223.

When the failure information search unit 223 receives, for example, a determination result from the failure determination unit 222 that “the failure is“ Memory Error ”of a known failure and a double bit error has been detected”, the failure information search unit 223 is known based on the determination result. The fault information storage unit 230 is searched to extract the fault solution information corresponding to the fault, specifically, the fault information search unit 223 reads “Memory”.
The failure information stored in the failure information storage unit 230 is searched using “Error” and “Double bit error” as keywords, and the failure resolution information corresponding to “Memory Error” of the known failure in which “Double bit error is detected” is obtained. Extract. The extracted failure solution information shows an overview of the failure and its solution. The solving means includes investigation information for identifying the detected failure and solution information for recovery. These pieces of information are output to the failure information communication unit 224.
When the failure information communication unit 224 receives the failure solution information retrieved by the failure information retrieval unit 223, the failure information communication unit 224 transmits the failure solution information to the system management terminal 13 via the IP network 12 based on the IP address.

In addition, when the failure information search unit 223 receives the determination result that the “failure is not a known failure” from the failure determination unit 222, the failure information search unit 223 does not search for the failure information stored in the failure information storage unit 230, and “ “The failure solution information corresponding to the failure is not accumulated” is output to the failure information communication unit 224.
When the failure information communication unit 224 receives from the failure information search unit 223 that “the failure solution information corresponding to the failure is not accumulated”, “the failure is that the failure solution information is not accumulated in the failure information storage unit 230. “New failure” is transmitted to the system management terminal 13 via the IP network 12.

  The failure information communication unit 224 has a reception function in addition to transmission, and when receiving a log file from the computer 100 via the LAN 11, outputs the log file to the failure detection unit 221.

FIG. 6 is a flowchart of the system failure monitoring apparatus 200 according to the first embodiment.
The operation of the system failure monitoring apparatus 200 according to the first embodiment will be described with reference to FIG.
An example will be described in which a memory failure in which “Single bit error” occurs frequently occurs in the computer 100.

The failure detection unit 221 periodically requests the computer 100 to transmit a log file, and acquires the text-format log file held in the log file holding unit 180 via the failure information communication unit 224 via the LAN 11. (Step S401)
The failure detection unit 221 checks a log file acquired to detect a failure using check software for the “ERROR” keyword. For example, the failure detection unit 221 reads from the first line to the last line of the log file, and extracts lines starting with “ERROR:” based on the failure detection procedure. (Step S402)

  The failure detection unit 221 generates an error message indicating a failure that has occurred in the computer 100 based on a sentence described after “ERROR:” in the extracted line starting with “ERROR:”. For example, an error message when a MEMORY failure occurs is “A memory error detected as a multiple single bit error”, and the error message is output to the failure determination unit 222.

  When receiving the error message from the failure detection unit 221, the failure determination unit 222 determines whether or not the failure that has occurred based on the error message and the determination operation criterion is a known failure (step S403). That is, the failure determination unit 222 determines that the failure that has occurred is a known failure if there is a description such as “Disk Error”, “Cpu Error”, and “Memory Error” in the error message. In the present embodiment, the determination result is output to the failure information search unit 223 that “the failure is“ Memory Error ”of a known failure and a multiple single bit error has been detected”.

  For example, when the failure information search unit 223 receives a determination result from the failure determination unit 222 that “the failure is“ Memory Error ”of a known failure and multiple single bit errors have been detected”, “Memory Error”. The failure information stored in the failure information storage unit 230 is searched using “Single bit error” and “Frequent occurrence” as keywords, and corresponds to “Memory Error” of the known failure “Frequent occurrence of single bit error” is detected. Extract failure resolution information. The extracted failure solution information indicates the solution means for the failure, and includes investigation information for identifying the failure and solution information for recovery, for example, “exchange MEMORY”. When the failure solution information corresponding to the failure is extracted, the failure information search unit 223 outputs the failure solution information corresponding to the failure to the failure information communication unit 224.

When receiving the failure resolution information from the failure information search unit 223, the failure information communication unit 224 transmits the information to the system management terminal 13 via the IP network 12 based on the IP address. (Step S404)
When the failure information communication unit 224 receives from the failure information search unit 223 that “the failure solution information corresponding to the failure has not been accumulated”, “the failure has the failure solution information corresponding to the failure accumulated in the failure information storage unit 230. Is transmitted to the system management terminal 13 via the IP network 12.

  According to the system failure monitoring apparatus 200 of the first embodiment, the failure information in which the known failure information indicating the content of the known failure whose solution means is known and the failure solution information indicating the solution means are stored in association with each other. A storage unit 230, the failure monitoring unit 220 acquires a log file indicating the failure content from the computer 100, determines whether the failure information indicated by the log file is stored in the failure information storage unit 230, and is stored If there is a failure in the operating computer 100, the corresponding failure solution information is retrieved and the failure information communication unit 224 notifies the system management personal computer of the retrieved failure solution information. The system can be quickly recovered and the system can be restored in a short time.

FIG. 7 is a configuration diagram of the failure information distribution system 1 according to the second embodiment.
The failure information distribution system 1 according to the second embodiment includes three system failure monitoring systems 10, 20, and 30 and a distribution device 90. The system failure monitoring systems 10, 20, and 30 and the distribution device 90 are communicably connected via an IP network 80.
The system fault monitoring system 10 is managed by a system manager A, the system fault monitoring system 20 is managed by a system manager B, and the system fault monitoring system 30 is managed by a system manager C.

  Each of the three system fault monitoring systems 10, 20, and 30 includes a system fault monitoring device connected to a computer to be monitored. That is, the system failure monitoring system 10 includes a system failure monitoring device 200, and the computer 100 and the failure monitoring device 200 are connected to be communicable via the LAN 11. The system failure monitoring system 20 includes a system failure monitoring device 400, and the computer 300 and the failure monitoring device 400 are connected to be communicable via a LAN 21. The system failure monitoring system 30 includes a system failure monitoring device 600, and the computer 500 and the failure monitoring device 600 are connected to be communicable via a LAN 31.

The system failure monitoring apparatus 200 and the system administrator A used as a system management computer by the system administrator A are communicably connected via the IP network 12, and the system failure monitoring apparatus 400 and the system administrator of the system failure monitoring system 20 are connected. The system management terminal 23 used by B is communicably connected via the IP network 22. The system fault monitoring device 600 of the system fault monitoring system 30 and the system management terminal 33 used by the system administrator C are connected to the IP network 32. Are connected so that they can communicate with each other.
The system management terminals 13, 23 and 33 may be personal computers.

  In this embodiment, a computer and a system fault monitoring apparatus having the same configuration and the same performance are used. In the following description, the computer 100 and the fault monitoring apparatus 200 to be monitored of the system fault monitoring system 10 will be described, and the description of the computer and fault monitoring apparatus of other system fault monitoring systems will be omitted.

  The computer 100 includes an IO interface 110 for communicating with the system failure monitoring device 200 and other devices, a program unit 120 for storing the OS and application software programs, a CPU 130 for performing arithmetic processing and data transfer, and temporarily holding data. Memory 140, DISK 150 that holds a large amount of data, event information collection unit 160 that collects a log file in a text format that indicates a change in the state of each part of the computer 100, and self-diagnosis that self-diagnose the state of each part of the computer 100 Unit 170 and a log file holding unit 180 that holds a log file in a text format generated by the self-diagnosis unit 170.

  The system fault monitoring apparatus 200 performs a fault information storage unit 230 for accumulating known fault information, fault solution information, detection procedure information, and judgment criterion information, and performs access authentication to the fault information storage unit 230 and manages fault information. A failure information management unit 210 to be performed and a failure monitoring unit 220 for monitoring a failure occurring in the computer 100 are provided, and have the same configuration as that of the first embodiment.

  The distribution device 90 has a distribution operation unit 91 operated and input by a service provider who has received a notification that a new failure has occurred from the system management terminal, and a new failure based on the input information input from the distribution operation unit 91. Analyzing, generating a temporary failure solution information in which a summary of a new failure and its solving means are associated based on the analysis result, and transmitting the information to the system management terminal, a failure information analysis unit 92; Upon receipt of the signal indicating the resolution of the new fault, the fault resolution information registration unit 93 registers temporary fault resolution information as fault resolution information, and transmits the fault resolution information to each system fault monitoring element device based on a transmission instruction. A failure information transmission / reception unit 94.

  The distribution operation unit 91 inputs information for analyzing a new failure based on the content of the contact by the service provider who has received a notification that a new failure has occurred from the system management terminal. Further, the service provider that has received a notification from the system management terminal that the new failure has been resolved issues a registration instruction to register temporary failure solution information as failure solution information based on the content of the communication. Further, the service provider issues a transmission instruction to transmit the failure solution information to each of the system failure monitoring apparatuses 200, 400, and 600.

By the way, the service provider is engaged in failure recovery work of the system failure monitoring systems 10, 20, and 30, and collects a lot of information on failures of the system failure monitoring systems 10, 20, and 30. In particular, the service provider also collects information on solutions for troubles that may occur in the future.
When the service provider receives notification from the system management terminal that a new failure has occurred, the service provider refers to the accumulated failure information and inputs to the distribution operation unit 91 to analyze the new failure.

When the failure information analysis unit 92 receives the input information by the service provider from the distribution operation unit 91, the failure information analysis unit 92 analyzes the new failure based on the input information, and based on the analysis result, an overview of the new failure and its solution means The associated temporary failure solution information is generated. The generated failure solution information is transmitted to the system management terminal via the failure information transmission / reception unit 94.
Further, when there is a registration instruction for registering temporary failure solution information in the distribution operation unit 91, the failure information analysis unit 92 outputs the failure solution information to the failure solution information registration unit 93.

  Upon receiving the failure solution information from the failure information analysis unit 92, the failure solution information registration unit 93 registers the failure solution information and outputs the failure solution information to the failure information transmission / reception unit 94.

  When the failure information transmission / reception unit 94 receives a notification that a new failure has occurred from the system management terminal, the failure information transmission / reception unit 94 sends the communication content to the distribution operation unit 91. Further, when the failure information transmission / reception unit 94 receives temporary failure solution information from the failure information analysis unit 92, the failure information transmission / reception unit 94 transmits the failure solution information to the system management terminal based on the IP address. Further, when the failure information transmission / reception unit 94 receives a transmission instruction of failure solution information from the distribution operation unit 91, the failure information transmission / reception unit 94 receives the failure solution information received from the failure solution information registration unit 93 based on the transmission instruction via the IP network 80. Sent to the system fault monitoring device.

The operations of the system fault monitoring apparatus 200 and the distribution apparatus 90 in the fault information distribution system 1 according to the second embodiment will be described.
An example in which a new failure has occurred in the computer 100 of the system failure monitoring system 10 will be described.

The system failure monitoring apparatus 200 transmits a notification to the system management terminal 13 (system administrator A) that “a failure has occurred and a new failure has occurred whose failure solution information is not stored in the failure information storage unit 230”. To do.
Upon receiving the notification, the system management terminal 13 contacts the service provider based on the notification content. When the service provider receives a notification from the system management terminal 13 that a new failure has occurred, the service provider sends information for analyzing the new failure to the distribution operation unit 91 of the distribution device 90 based on the content of the communication. input.

  When receiving the input from the service provider by the distribution operation unit 91, the distribution device 90 sends the input information to the failure information analysis unit 92, and the failure information analysis unit 92 analyzes the new failure based on the input information. Based on the analysis result, temporary fault solution information in which the outline of the new fault and its solution means are associated is generated. The generated failure resolution information is transmitted to the system management terminal 13 via the failure information transmission / reception unit 94.

When the system management terminal 13 receives the fault solution information of the new fault from the distribution apparatus 90, the system management terminal 13 takes measures to solve the new fault based on the solution means indicated by the fault resolution information, and the response result is sent to the distribution apparatus 90. Sent. When the service provider receives a notification from the system management terminal 13 that "the computer 100 has been restored as a result of the action taken based on the fault solution information", the service provider registers the fault solution information in the distribution operation unit 91. Instruct the registration as much as possible.
When the distribution operation unit 91 receives a failure resolution information registration instruction from the service provider, the distribution operation unit 91 notifies the failure information analysis unit 92 to output the failure resolution information to the failure resolution information registration unit 93.

  Upon receiving the notification, the failure information analysis unit 92 outputs the failure solution information to the failure solution information registration unit 93. Upon receiving the failure solution information from the failure information analysis unit 92, the failure solution information registration unit 93 registers the failure solution information and sends the failure solution information to the failure information transmission / reception unit 94 to transmit the failure solution information to the system failure monitoring apparatus 200. Output.

  Upon receiving a failure resolution information transmission instruction from the distribution operation unit 91, the failure information transmission / reception unit 94 receives the failure resolution information from the failure resolution information registration unit 93 based on the transmission instruction via the IP network 80. 200. Further, the failure information transmission / reception unit 94 also transmits the failure solution information to the system failure monitoring device 400 and the system failure monitoring device 600 based on the transmission instruction from the distribution operation unit 91.

  When receiving the failure resolution information from the distribution device 90, the system failure monitoring device 200 of the system failure monitoring system 10 stores the failure solution information in the failure information storage unit 230 in association with the new failure. Similarly, when the system failure monitoring device 400 of the system failure monitoring system 20 and the system failure monitoring device 600 of the system failure monitoring system 30 receive the failure solution information from the distribution device 90, the failure solution information is stored in each failure information storage unit. Store each one.

  According to the failure information distribution system 1 of the second embodiment, the system failure monitoring system 10, 20, 30 and the distribution device 90 are provided, and the system failure monitoring devices 200, 400, 600 of each system failure monitoring system are: When failure resolution information for the failure that has occurred is not accumulated in the failure information storage unit, the system management terminal (system administrator) is notified that the failure is a new failure. The terminal informs the service provider that the failure is a new failure. The distribution device 90 analyzes the new failure by the failure information analysis unit 92 based on the input information from the service provider that has received the communication, and the outline of the new failure and the solution means are based on the analysis result. Corresponding provisional failure resolution information is generated, the generated failure resolution information is notified to the system management terminal, and the system management terminal that has received the failure resolution information uses the new failure based on the information After the response, the service provider is informed of the response result, and when the service provider receives notification from the system management terminal that the new failure has been resolved as the response result, the failure resolution information registration unit 93 provides a communication content. The failure solution information is registered based on the failure information, and the failure information transmission / reception unit 94 sends the failure solution information to the failure of each system failure monitoring device 200, 400, 600 based on the transmission instruction. By transmitting to the broadcast storage unit, stores the failure resolution data to correspond to the new failure to the failure information storage unit, it is possible to enhance the fault resolution information of each failure information storage unit.

1 is a functional block diagram of a system failure monitoring apparatus according to Embodiment 1. FIG. It is a block diagram of a system failure monitoring system. It is a figure which shows the example of classification | category of the failure which may generate | occur | produce in a computer. It is a figure which shows the data structure of fault solution information. It is a figure which shows one example of a log file. It is a flowchart of the system failure monitoring apparatus of Example 1. It is a block diagram of the failure information delivery system of Example 2.

Explanation of symbols

1 Fault Information Distribution System 10 System Fault Monitoring System 11 LAN
12 IP Network 13 System Management Terminal 100 Computer 110 IO Interface 120 Program Unit 130 CPU
140 memory 150 DISK
160 Event information collection unit 170 Self-diagnosis unit 180 Log file holding unit 200 System fault monitoring device 210 Fault information management unit 211 Fault solution information generation unit 212 Fault information writing unit 220 Fault monitoring unit 221 Fault detection unit 222 Fault determination unit 223 Fault Information search unit 224 Fault information communication unit 230 Fault information storage unit

Claims (3)

In a system fault monitoring apparatus for monitoring faults occurring in a computer system,
A failure information storage unit in which known failure information and failure solution information indicating the solution are stored in association with each other;
When the log file indicating the failure content is acquired from the computer system, it is determined whether or not the failure information indicated by the log file is stored in the failure information storage unit. A fault information search unit that searches for
A system fault monitoring apparatus comprising: a fault information communication unit for notifying the system management computer of fault solution information searched by the fault information search unit.   2. The system according to claim 1, wherein the failure information communication unit notifies the system management computer that the failure information indicated by the log file is a new failure if the failure information is not stored in the failure information storage unit. System fault monitoring device. A failure information distribution system comprising a plurality of system failure monitoring devices according to claim 1 and having a distribution device to which the respective system failure monitoring element devices are connected.
When the distribution device receives failure information indicating the content of a new failure with respect to the monitored computer from the management computer used to manage any of the system failure monitoring element devices, the distribution device generates temporary failure solution information based on the failure information. A failure information analysis unit that generates and transmits the information to the management computer;
When receiving a signal indicating the solution of the new failure, a transmission unit that transmits the generated failure solution information to another system failure monitoring device,
The system fault monitoring apparatus includes a writing unit that stores the received fault solution information in the fault information storage unit in association with the new fault.

Images