JP2008171104A - Monitoring apparatus, monitoring system, monitoring method and monitoring program for monitoring business service and system performance - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To always properly report an alert in monitoring a device to monitor metrics for business service metrics and system performance, by eliminating the difference between the result of determining an alert for the business service metrics and that for the system performance. <P>SOLUTION: A physical influence relationship between the business service metrics and system performance items is set in a metric map storage part 304 as a metric map. Based on the result of determining an alert for the business service metrics that is determined to be normal by an alert determining means 102, and on a system performance value of a system performance item associated with the business service metrics in the metric map, a threshold value deriving means 105 mechanically calculates, through regression analysis, a system performance value when the result of determining the alert for the business service metrics is normal; the result calculated is stored in a threshold value storage part 303. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a monitoring technology for determining whether or not a business service and system performance problem occurs in a monitoring target device such as an information processing device, and in particular, an alert determination result of a business service metric and an alert determination result of a system performance The present invention relates to a monitoring device, a monitoring system, a monitoring method, and a monitoring program having a function of appropriately notifying an alert and eliminating the difference.

  A general monitoring device that determines whether a business service and system performance problem has occurred in a monitoring target device such as an information processing device. Determine if a problem has occurred.

  For example, a general monitoring device that determines whether or not a system performance problem has occurred has a plurality of predetermined system performance items (CPU usage rate, memory usage rate, network usage rate, disk usage rate, System performance values such as continuous operation time, number of active processes, number of execution processes, number of connected users, number of connected connections, etc.) are acquired from the monitoring target device. Then, by comparing each acquired system performance value with a threshold value of each system performance item set by the system administrator, it is determined whether or not a system performance problem has occurred.

  Similarly, a general monitoring device that determines whether or not a business service problem has occurred also has a plurality of predetermined business service metrics (response time from user terminal, occurrence of application error). Business service metric values such as frequency, timeout count, average recovery time, average failure interval, business service availability, business service provision period, etc.) are acquired from the monitored device. Then, by comparing each acquired business service metric value with the threshold value of each business service metric set by the business manager, it is determined whether or not a problem in the business service has occurred.

  In the above general monitoring apparatus, each threshold value must be set based on experience by the system manager and the business manager. Therefore, there is a problem that the system administrator and the business manager are burdened and there is a possibility that an appropriate threshold value may not be set.

  Monitoring devices for solving such problems have been proposed (see, for example, Patent Documents 1 and 2).

  The conventional monitoring device described in Patent Document 1 is a monitoring device that determines whether or not a system performance problem has occurred, and is one system that is collected during a sampling period designated by a system administrator. The system performance item threshold value is calculated from the average value and standard deviation of the performance item. For example, the CPU usage rate is measured for a certain period, an average value of the measurement results is calculated, and the average value is set as an expected threshold value of the CPU usage rate. Further, a standard deviation is calculated from the measurement result of the CPU usage rate, and the standard deviation is set as an error of an expected threshold value of the CPU usage rate.

  The conventional monitoring device described in Patent Document 2 is a monitoring device that determines whether or not a business service problem has occurred, and is based on the actual execution time of one business service so far. The expected execution time of the business service is calculated as a threshold value. For example, the response time from the user terminal is measured for a certain period, the average value of the measurement results is calculated, and the average value is used as the threshold value for the response time from the user terminal.

JP 2003-263342 A JP 2004-362140 A

  According to the conventional monitoring device described in Patent Documents 1 and 2, and a device that combines them, the threshold of the system performance item and the threshold of the business service metric can be set automatically. Is possible. However, the threshold for system performance items is set automatically from the perspective of the system administrator, and the threshold for business service metrics is set automatically from the perspective of the business manager. The value and the threshold of the business service metric cannot be matched. This is because, from the viewpoint of the system administrator, it is automatically set only from the measurement result of the target system performance item, and from the viewpoint of the business manager, it is automatically set only from the measurement result of the business service metric.

  Note that when the system performance item and the business service metric cannot be matched, the business service metric alert determination result may differ from the system performance alert determination result. Specifically, an alert occurs in the system performance item, but an alert may not occur in the business service metric, and an alert occurs in the business service metric, but an alert may not occur in the system performance item .

  As a result, it is unclear which alert determination result is correct, and the alert is not properly notified. If the alert is not properly notified, the system administrator cannot grasp the system performance problem, and the business manager is difficult to identify the business service problem.

  Therefore, the present invention relates to a monitoring device, a monitoring system, a monitoring method, and a monitoring program that monitor business service metrics to system performance metrics. The difference between the alert determination result in the business service metric and the alert determination result in the system performance is determined. The goal is to be able to notify alerts appropriately.

  The monitoring device according to the present invention is transmitted from the metric value acquisition means for acquiring one or more system performance values and one or more business service metric values of the monitoring target device according to the metric definition information stored in the metric definition information storage unit. The system performance value or business service metric value is stored in the metric value storage unit, and the system performance is monitored in the monitored device according to the business service metric threshold value and the system performance item threshold value stored in the threshold value storage unit. And a metric map that stores a metric map indicating a relationship between one business service metric and one or more system performance items. Business services that are determined to be normal by the map storage unit and the alert determination means The system performance when the alert judgment result of the business service metric is normal based on the alert judgment result by the metric, the system performance item associated with the business service metric in the metric map, and the system performance value of the system performance item Threshold value deriving means for calculating a value by regression analysis and storing the calculation result in a threshold value storage unit is provided.

  The monitoring device further includes a positive prediction ratio indicating the rate at which the business service metric alert judgment result is normal and the system performance alert judgment result is normal, and the business service metric alert judgment. A definition information storage unit that stores a negative prediction ratio indicating how often the result is abnormal and the system performance alert determination result is also abnormal, and a positive prediction stored in the definition information storage unit You may provide the threshold value change determination means which determines whether the threshold value of the system performance item memorize | stored in the threshold value memory | storage part is changed according to a ratio and a negative prediction ratio.

  In the monitoring apparatus, the threshold deriving means displays the calculated threshold on the screen of the management terminal, and when the setting of a new threshold is instructed on the screen, the calculated threshold is newly set. The threshold value storage unit may be configured to store the value as a value.

  A monitoring system according to the present invention includes a plurality of monitoring target devices, a monitoring device connected to be able to communicate with the plurality of monitoring target devices, a management terminal communicatively connected to the monitoring device, and a communication with the monitoring device and the management terminal. A monitoring system including a storage device connected to the metric definition information storage unit that stores metric definition information, one or more system performance values of the monitoring target device, and one or more business services A metric value storage unit for storing a metric value, a threshold storage unit for storing a threshold value of a system performance item and a threshold value of a business service metric, one business service metric, and one or more system performance items A metric map storage unit that stores a metric map indicating the relationship, and the monitoring device stores the metrics stored in the metric definition information storage unit. Metric value acquisition means for acquiring one or more system performance values and one or more business service metric values of the monitoring target device, and the system performance value or business service metric value transmitted from the metric value acquisition means according to the definition information Alert determination means that stores in the value storage unit and determines whether there is a problem with system performance and business service in the monitored device, and the alert determination result of the system service metric that the business service metric alert determination result is normal and the system performance alert determination result The percentage of positive predictions that indicate the rate of occurrence of normal service and the rate at which the alert judgment result of the business service metric is abnormal and the alert judgment result of the system performance is also abnormal Definition information storage unit that stores a negative prediction ratio indicating whether or not to perform threshold value storage Threshold change determination means for determining whether or not to change the threshold value of the system performance item stored in the message, the alert determination result by the business service metric determined to be normal by the alert determination means, and the metric map Based on the system performance item associated with the business service metric and the system performance value of the system performance item, the system performance value when the alert judgment result of the business service metric is normal is calculated by regression analysis. And a threshold value deriving unit that stores the threshold value in the threshold value storage unit.

  In the monitoring system, the threshold deriving means transmits the calculated threshold value to the management terminal to display it on the management terminal screen, and when the threshold setting is instructed on the screen, the threshold value is calculated. You may comprise so that it may memorize | store in a threshold value memory | storage part as a new threshold value.

  The monitoring method according to the present invention is a method of monitoring a monitoring target device by a computer that is communicably connected to a plurality of monitoring target devices, wherein the computer uses a threshold of business service metrics and a threshold of system performance items. According to the value, it is determined whether there is a problem in system performance and business service in the monitored device, the alert determination result is stored in the storage unit, and the business service metric determined as normal stored in the storage unit Based on the alert judgment result, the system performance item associated with the business service metric, and the system performance value of the system performance item, the system performance value when the business service metric alert judgment result is normal is calculated by regression analysis To store the calculation results, output the calculation results to the management terminal, and give instructions from the management terminal. Therefore, the new threshold value output to the management terminal is set as the threshold value of the system performance item stored in the storage unit, and the system performance value and business service metric value transmitted from the monitored device are received. It is memorized.

  When calculating the system performance value by regression analysis, how often does it occur when the business service metric alert judgment result stored in the storage unit is normal and the system performance alert judgment result is also normal? Threshold of system performance items according to the negative prediction ratio indicating how often the alert prediction result of business service metrics and the alert judgment result of system performance metrics are abnormal and the alert judgment result of system performance is also abnormal It may be configured to determine whether or not to change the value.

  In a monitoring target device whose metrics from business service metrics to system performance are monitored, if a certain business service metric and a certain system performance item are measurement items on the same physical monitoring device, Some system performance items are subject to the same physical influence. Focusing on this point, in the present invention, the physical influence relationship between the business service metric and the system performance item is set as a metric map, and the alert judgment result of this metric map and the business service metric determined to be normal Based on the system performance value of the system performance item associated with the business service metric in the metric map, the system performance value when the business service metric alert judgment result is normal is mechanically calculated by regression analysis. The result is stored in the threshold storage unit.

  According to the present invention, when monitoring a monitoring target device using a metric from a business service metric to a system performance as a monitoring target, the difference between the business service metric alert judgment result and the system performance alert judgment result is eliminated, and the alert is sent. It becomes possible to notify appropriately. The reason is that when the business service metric alert judgment result and the system performance alert judgment result are different, the business service metric alert judgment result determined to be normal and the system associated with the business service metric by the metric map Based on the system performance value of the performance item, the system performance value when the alert judgment result of the business service metric is normal is subjected to regression analysis, and the calculation result is stored in the threshold value storage unit. This is to make it a value.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a configuration example of a first embodiment (Embodiment 1) of a monitoring system according to the present invention. The monitoring system shown in FIG. 1 monitors a monitoring target device 2 on which a business application is operating, and includes a monitoring device 1 having a CPU, a memory, a network connection device, etc., a storage device 3 such as a disk device, And a management terminal 4 having an input device such as a console and an output device such as a display. The management terminal 4 is communicably connected to the monitoring device 1, and the storage device 3 is communicably connected to the monitoring device 1 and the management terminal 4.

  The storage device 3 includes a metric definition information storage unit 301, a metric value storage unit 302, a threshold value storage unit 303, and a metric map storage unit 304. The metric definition information storage unit 301 stores information regarding metric definitions for collecting system performance values and business service metric values from the monitoring target device 2. Each metric definition information stored in the metric definition information storage unit 301 includes information for specifying the monitoring target device 2 to be monitored, and information for specifying a system performance item and a business service metric. The information stored in the metric definition information storage unit 301 may further include other information such as information indicating an acquisition interval.

  FIG. 2 shows an example of metric definition information stored in the metric definition information storage unit 301. For example, the metric definition information having the identifier Monitor_001 in the first line indicates that the CPU usage rate is acquired at 30-second intervals from the monitoring target device 2 having Dev_001 as the identifier.

  The metric value storage unit 302 stores metric value information such as system performance values or business service metric values acquired by the monitoring device 1 from the monitoring target device 2. The individual metric value information stored in the metric value storage unit 302 includes information for specifying the monitoring target device 2 to be monitored, information for specifying the system performance item and the business service metric, and the monitoring device 1 for the monitoring target device. 2 includes information indicating the metric value acquired from 2 and information indicating the acquisition time.

  FIG. 3 shows an example of metric value information stored in the metric value storage unit 302. In this example, individual metric value information is stored with the acquired metric value added with the identifier of the monitoring target apparatus 2 as the acquisition destination, the acquired metric item, and the acquisition time.

  The threshold storage unit 303 stores threshold information on system performance items and threshold information on business service metrics. The individual threshold information stored in the threshold storage unit 303 includes information for identifying each metric definition information stored in the metric definition information storage unit 301 and information indicating the threshold.

  FIG. 4 shows an example of threshold information stored in the threshold storage unit 303. For example, the threshold information whose identifier is threshold_001 on the first line indicates that the threshold of Monitor_001, which is the identifier of the metric definition information, is 70%. The metric map storage unit 304 stores a metric map indicating the relationship between one business service metric and one or more system performance items.

  Each metric map stored in the metric map storage unit 304 includes information specifying one business service metric and information specifying one or more system performance items related to the business metric.

  FIG. 5 shows an example of a metric map stored in the metric map storage unit 304. For example, the metric map having Map_001 as the identifier in the first line indicates that the business service metric having Monitor_002 as an identifier includes a system performance item having Monitor_001 as an identifier and a system performance item having Monitor_003 as an identifier.

  The monitoring device 1 includes a metric value acquisition unit 101, an alert determination unit 102, a definition information storage unit 103, a threshold value change determination unit 104, and a threshold value derivation unit 105. The metric value acquisition unit 101, the alert determination unit 102, the threshold value change determination unit 104, and the threshold value derivation unit 105 can be realized by a hardware circuit, but execute processing according to a program for realizing these units. It can also be realized by a CPU and a peripheral circuit. That is, the monitoring device 1 can be realized by a computer.

  The metric value acquisition unit 101 acquires a system performance value and a business service metric value according to the metric definition information of the monitoring target device 2 stored in the metric definition information storage unit 302. In addition, the metric value acquisition unit 101 passes the acquired system performance value and business service metric value to the alert determination unit 102 with information indicating the acquisition time.

  The alert determination unit 102 sends the system performance value to the monitoring target device 2 based on the system performance value and business service metric value acquired by the metric value acquisition unit 101 and the threshold value stored in the threshold value storage unit 303. In addition, it is determined whether or not a business service problem has occurred, and the alert determination result is passed to the threshold value change determination means 104. The alert determination unit 102 stores the system performance value and business service metric value acquired by the metric value acquisition unit 101, information indicating the acquisition time, and the alert determination result in the metric value storage unit 302.

  The definition information storage unit 103 stores a positive prediction ratio and a negative prediction ratio. The positive predictive ratio indicates the ratio of occurrence when the business service metric alert determination result is normal and the system performance alert determination result is also normal. The negative prediction ratio indicates the rate at which the case where the alert determination result of the business service metric is abnormal and the alert determination result of the system performance is also abnormal occurs. For example, the positive prediction ratio is stored as 90% and the negative prediction ratio is stored as 85%.

  The threshold value change determination unit 104 refers to the metric map stored in the metric map storage unit 304 and associates the business service metric alert determination result determined by the alert determination unit 102 with the business service metric. Based on the alert judgment result of the system performance, a positive prediction ratio and a negative prediction ratio are calculated. Then, when the calculated positive prediction ratio is compared with the positive prediction ratio stored in the definition information storage unit 103, and the calculated positive prediction ratio is smaller than the positive prediction ratio stored in the definition information storage unit 103, The threshold deriving means 105 is activated. Alternatively, when the calculated negative prediction ratio is compared with the negative prediction ratio stored in the definition information storage unit 103, and the calculated negative prediction ratio is smaller than the negative prediction ratio stored in the definition information storage unit 103, The threshold deriving means 105 is activated. For example, if the calculated positive prediction ratio is 80% and the positive prediction ratio stored in the definition information storage unit 103 is 90%, the calculated positive prediction ratio is small, and the threshold value derivation unit 105 is activated. The

  The threshold value derivation unit 105 refers to the metric map stored in the metric map storage unit 304 and is acquired by the business service metric alert determination result stored in the metric value storage unit 302 and the metric value acquisition unit 101. Based on the system performance value of the system performance item associated with the business service metric, a new threshold value of the system performance item is calculated, and the calculated threshold value is stored in the threshold value storage unit 303.

  Specifically, the threshold value derivation unit 105 refers to the business service metric in the metric map stored in the metric map storage unit 304 and the system performance item associated with the business service metric, and alerts the business service metric. Multivariate regression analysis is performed to calculate the system performance value of the system performance item when the alert determination result of the business service metric is normal, using the determination result as the explanatory variable and the system performance value of the system performance item as the objective variable.

  Further, the threshold deriving unit 105 transmits the metric definition information, metric value information, threshold information, and metric map stored in the storage device 3 to the management terminal 4. The management terminal 4 displays the metric definition information, metric value information, threshold information and metric map received from the threshold deriving means 105 on a screen as shown in FIG. 6, for example.

  In this example, metric definition information whose identifier is Monoto_001 is displayed in the region 41, and the acquisition time of the metric definition information whose identifier is Monitor_001, the metric value at that time, and the threshold value storage unit 303 are displayed in the region 42. And the threshold values (predicted threshold values) calculated by the threshold value deriving means 105 as a set, are listed in time series.

  When the button 43 displayed on the management terminal 4 is pressed, the management terminal 4 transmits information to that effect to the monitoring device 1. When threshold deriving means 105 receives information to that effect, threshold deriving means 105 calculates the threshold stored in threshold storage section 303 (predicted threshold). Update with. That is, the threshold value deriving unit 105 stores the calculated threshold value in the threshold value storage unit 303 when an instruction to set a new threshold value is given on the screen.

Next, the overall operation of the present embodiment will be described.
In order to eliminate the difference between the business service metric alert judgment result and the system performance alert judgment result, the system administrator or the business manager must reset a new threshold for the corresponding system performance item or When reviewing the threshold value of the set system performance item, the positive prediction ratio and the negative prediction ratio are stored in the definition information storage unit 103 through the management terminal 4 before starting the monitoring device 1. .

  In addition, the metric definition information stored in the metric definition information storage unit 301, the threshold information stored in the threshold storage unit 303, and the metric stored in the metric map storage unit 304 through the management terminal 4 Check the map, and add, change, or delete new metric definition information, threshold information, and metric maps as necessary.

  When the monitoring device 1 is activated by the system administrator or the business manager, the monitoring device 1 starts the processing shown in FIG. Assume that the initial values of set A, set B, set C, and variables S, T, U, V, X, and Y are zero. For variables S, T, U, and V, different variables S, T, U, and V are prepared for each system performance item ID.

  First, the metric value acquisition unit 101 in the monitoring device 1 acquires the system performance value and the business service metric value from the monitoring target device 2, and the alert determination unit 102 has a problem in the system performance and business service of the monitoring target device 2. Determine whether it has occurred. Note that the alert determination means 102 compares the acquired value with the threshold value stored in the threshold value storage unit 303, and if the acquired value exceeds the threshold value, a problem has occurred. (Step S101).

  Next, the threshold value change determination unit 104 stores the metric map in the metric map storage unit 304 in the set A (step S102), and extracts one metric map from the set A (step S103). If the retrieval of the set A has succeeded, the process proceeds to step S105, and if it has failed, the process returns to step S101 (step S104).

  In step S105, the threshold value change determination unit 104 stores a plurality of system performance item IDs associated with one business service metric in the extracted one metric map in the set B. Further, S, T, U, and V are set as one variable set for each system performance item ID, and a variable set for the system performance item ID stored in the set B is stored in the set C. If there is a system performance item ID in the set B, the process proceeds to step S107, and if not, the process returns to step S103 (step S106).

  In step S107, the threshold value change determining unit 104 extracts one system performance item ID from the set B. In addition, a variable set of S, T, U, and V corresponding to the system performance item ID extracted from the set B is extracted from the set C. If a problem has occurred in the business service metric associated with the system performance item ID extracted in step S107, the process proceeds to step S109, and if not, the process proceeds to step S110 (step S108).

  In step S109, the threshold value change determination unit 104 proceeds to step S111 if a problem has occurred in the system performance item ID extracted in step S107, and proceeds to step S112 if no problem has occurred. In step S111, the threshold value change determination unit 104 adds 1 to S of the variable set extracted in step S107, and proceeds to step S115. In step S112, 1 is added to T of the variable set extracted in step S107, and the process proceeds to step S115.

  In step S110, the threshold value change determination means 104 proceeds to step S113 if a problem has occurred in the system performance item ID extracted in step S107, and proceeds to step S114 if it has not occurred. In step S113, 1 is added to U of the variable set extracted in step S107, and the process proceeds to step S115. In step S114, 1 is added to V of the variable set extracted in step S107, and the process proceeds to step S115.

  In step S115, the threshold value change determination unit 104 calculates a positive prediction ratio and a negative prediction ratio using the variable set extracted in step S107 and the variables added in the processes in steps S111 to S114. Then, the positive prediction ratio is X, and X stores the number obtained by dividing S by the number obtained by adding S and U. The negative prediction ratio is Y, and Y stores the number obtained by dividing V by the number obtained by adding T and V.

  Next, the threshold value change determination unit 104 stores the positive prediction ratio stored in the definition information storage unit 103 in X ′, and stores the negative prediction ratio stored in the definition information storage unit 103 in Y ′. (Step S116). Then, X and X 'are compared. If X is larger than X', the process proceeds to step S120, and if X is smaller, the process proceeds to step S118. Alternatively, Y and Y 'are compared, and if Y is larger than Y', the process proceeds to step S120, and if smaller, the process proceeds to step S118 (step S117).

  In step S118, the threshold value deriving unit 105 newly calculates a threshold value having the system performance item ID extracted in step S107, and stores the calculated threshold value in the threshold value storage unit 303.

  Next, the threshold value derivation unit 105 stores zero in all of the S, T, U, and V variable sets corresponding to the calculated system performance item ID, and proceeds to step S120 (step S119). In step S120, the S, T, U, and V variable sets corresponding to the system performance item ID extracted in step S107 are stored in set C, and the process returns to step S106.

  In the present embodiment, it is possible to always appropriately notify the alert itself by eliminating the difference between the business service metric alert judgment result and the system performance alert judgment result. The reason is that a new threshold value can be reset to a system performance item different from the alert determination result of the business service metric.

  Further, in the present embodiment, when a new threshold value is reset or when a threshold value of a system performance item that has already been set is reviewed, the positive prediction ratio or negative value stored in the definition information storage unit 103 By setting the prediction ratio to a very large value, the process can be forcibly advanced from step S117 to step S118, and the threshold value of the already set system performance item can be reviewed. Such processing is an effective means when it is clear to review the already set system performance item when a new business service metric or system performance item is set.

Embodiment 2. FIG.
Next, a second embodiment (Embodiment 2), which is a modification of the first embodiment, will be described. FIG. 8 is an explanatory diagram showing a usage form of operation and maintenance consulting using the second embodiment.

  The form shown in FIG. 8A includes a customer system 10, an operation and maintenance system 20, and an operation and maintenance consulting system 30. The customer system 10 and the operation and maintenance system 20 are connected via a communication network 40. The operation and maintenance system 20 and the operation and maintenance consulting system 30 are connected via a communication network 40. Note that data transmitted and received between the systems may be encrypted.

  The customer 200 owns the customer system 10. A person who provides an operation and maintenance service (hereinafter referred to as an operation and maintenance service provider) 100 owns the operation and maintenance system 20. A person who consults operation and maintenance (hereinafter referred to as an operation and maintenance consulting provider) 300 owns the operation and maintenance consulting system 30. As shown in FIG. 8B, the customer receives an operation and maintenance service of the customer system by the operation and maintenance system 20. In the operation and maintenance service, when a system performance or business service problem occurs, the customer system 10 is notified that the problem has occurred. The customer pays for the operation and maintenance service.

  As shown in FIG. 8B, the operation and maintenance service provider provides the operation and maintenance service to the customer. The operation and maintenance service provider receives an operation and maintenance consulting service for improving the operation and maintenance service by the operation and maintenance consulting system 30. In the operation and maintenance consulting service, new threshold information is provided for system performance items different from the alert judgment result of the business service metric. The operation / maintenance service provider pays for the operation / maintenance consulting service.

  The operation and maintenance consulting provider provides the operation and maintenance consulting service to the operation and maintenance service provider.

  FIG. 9 is a block diagram illustrating a configuration example of the second embodiment of the monitoring system. The same constituent elements as those of the first embodiment are denoted by the same reference numerals as those in FIG.

  The customer system 10 includes a monitoring target device 2 and a management terminal 4a. The management terminal 4a uses the metric definition information stored in the metric definition information storage unit 301 of the storage device 3a, the threshold value information stored in the threshold storage unit 303, and the alert determination transmitted from the alert determination unit 102. Display the results on the screen.

  The operation and maintenance system 20 includes a monitoring device 1a, a storage device 3a, and a management terminal 4b. The monitoring device 1a includes a metric value acquisition unit 101 and an alert determination unit 102. The alert determination unit 102 performs other operations in addition to the operations of the first embodiment. The storage device 3 a includes a metric definition information storage unit 301 and a threshold storage unit 303.

  The management terminal 4b is stored in the metric definition information stored in the metric definition information storage unit 301 of the storage device 3a, the threshold information stored in the threshold storage unit 303, and the metric value storage unit of the storage device 3b. The metric value information, the threshold information stored in the threshold storage unit 303 of the storage device 3b, and the metric map stored in the metric map storage unit 304 of the storage device 3b are displayed on the screen.

  The operation and maintenance consulting system 30 includes a monitoring device 1b, a storage device 3b, and a management terminal 4c. The monitoring device 1b includes a definition information storage unit 103, a threshold value change determining unit 104, and a threshold value deriving unit 105. The storage device 3b includes a metric value storage unit 302, a threshold value storage unit 303, and a metric map storage unit 304.

  The management terminal 4c includes metric value information stored in the metric value storage unit 302 of the storage device 3b, threshold information stored in the threshold value storage unit 303 of the storage device 3b, and a metric map storage unit of the storage device 3b. The metric map stored in 304 is displayed on the screen.

  Each of the metric value acquisition unit 101, the alert determination unit 102, the definition information storage unit 103, the threshold value change determination unit 104, and the threshold value derivation unit 105 performs the same operation as that in the first embodiment.

  As in the case of the first embodiment, the alert determination unit 102 stores the system performance value and business service metric value acquired by the metric value acquisition unit 101 and the threshold storage unit 303 of the storage device 3a. Based on the threshold value, it is determined whether there is a problem in system performance and business service in the monitoring target apparatus 2. In the present embodiment, the alert determination result is passed to the threshold value change determination means 104 and further passed to the management terminal 4a in the customer system 10.

  In this embodiment, in addition to the effect of the first embodiment, there is an effect that an operation and maintenance consulting service can be provided to a plurality of operation and maintenance systems with one operation and maintenance consulting system. This is because, in this embodiment, the monitoring system is divided into a monitoring device 1a that provides an operation and maintenance service and a monitoring device 1b that provides an operation and maintenance consulting service.

  The present invention is not limited to the above embodiments, and various other additions and changes can be made. For example, the monitoring target device 2 of the present invention is not limited to one, but may be one or more plural devices. Further, the monitoring device 1 of the present invention does not need to be a physically separate computer from the monitoring target device 2, and a computer constituting any one of the monitoring target devices 2 can be used as the monitoring device 1. is there.

  Moreover, although the function of the monitoring device 1 of the present invention can be realized by hardware, it can also be realized by a computer and a program. The program is provided by being recorded on a computer-readable storage medium such as a magnetic disk or a semiconductor memory, and is read by the computer at the time of starting up the computer and the computer is controlled by controlling the operation of the computer. Function as the monitoring device 1 in the above-described form, and execute the above processing.

  INDUSTRIAL APPLICABILITY The present invention is useful as an apparatus and method for monitoring an information processing system capable of exchanging and sharing data via the Internet, and in particular, a monitoring target whose business service and system performance are monitoring targets. The present invention is suitably applied to operation and maintenance consulting that supports an operation and maintenance service for operating and maintaining an apparatus.

It is a block diagram which shows the structural example of 1st Embodiment of the monitoring apparatus by this invention. It is explanatory drawing which shows the example of the metric definition information memorize | stored in the metric definition information storage part in 1st Embodiment. It is explanatory drawing which shows the example of the metric value information memorize | stored in the metric value memory | storage part in 1st Embodiment. It is explanatory drawing which shows the example of the threshold value information memorize | stored in the threshold value memory | storage part in 1st Embodiment. It is explanatory drawing which shows the example of the metric map memorize | stored in the metric map memory | storage part in 1st Embodiment. It is explanatory drawing which shows an example of the display screen of the management terminal in 1st Embodiment. It is a flowchart which shows the process example of the monitoring apparatus of 1st Embodiment. It is explanatory drawing which shows the utilization form of the operation maintenance consulting using 2nd Embodiment. It is a block diagram which shows the structural example of 2nd Embodiment of the monitoring apparatus by this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1, 1a, 1b Monitoring apparatus 101 Metric value acquisition means 102 Alert determination means 103 Definition information storage part 104 Threshold change determination means 105 Threshold value derivation means 2 Monitoring object apparatus 3, 3a, 3b Storage apparatus 301 Metric definition information storage Unit 302 Metric value storage unit 303 Threshold value storage unit 304 Metric map storage unit 4, 4a, 4b, 4c Management terminal 10 Customer system 20 Operation maintenance system 30 Operation maintenance consulting system 40 Communication network

Claims (9)

A system performance value or business service metric transmitted from a metric value acquisition means for acquiring one or more system performance values and one or more business service metric values of the monitoring target device according to the metric definition information stored in the metric definition information storage unit The value is stored in the metric value storage unit, and the system performance and business service problems are detected in the monitored device according to the business service metric threshold value and the system performance item threshold value stored in the threshold value storage unit. In a monitoring device provided with alert determination means for determining whether or not it has occurred,
A metric map storage unit for storing a metric map indicating a relationship between one business service metric and one or more system performance items;
Based on the alert determination result by the business service metric determined to be normal by the alert determination means, the system performance item associated with the business service metric in the metric map, and the system performance value of the system performance item, And a threshold deriving means for calculating the system performance value when the alert judgment result of the business service metric is normal by regression analysis and storing the calculation result in a threshold storage unit. apparatus. A system with a positive predictive ratio indicating how often the alert judgment result of the business service metric is normal and the alert judgment result of the system performance is normal, and the alert judgment result of the business service metric is abnormal A definition information storage unit that stores a negative prediction ratio indicating how much the case where the performance alert determination result is also abnormal, and
Threshold value change determination means for determining whether to change the threshold value of the system performance item stored in the threshold value storage unit according to the positive prediction ratio and negative prediction ratio stored in the definition information storage unit The monitoring device according to claim 1, further comprising: Connected to the management terminal including the display means,
The threshold value derivation means displays the calculated threshold value on the screen of the management terminal, and when the threshold value setting is instructed on the screen, the threshold value derivation unit sets the threshold value as a new threshold value. The monitoring device according to claim 2, which is stored in a storage unit. A plurality of monitoring target devices, a monitoring device connected to be able to communicate with the plurality of monitoring target devices, a management terminal connected to be able to communicate with the monitoring device, and a connection to be able to communicate with the monitoring device and the management terminal A monitoring system comprising a storage device,
The storage device includes a metric definition information storage unit that stores metric definition information, a metric value storage unit that stores one or more system performance values and one or more business service metric values of the monitoring target device, and a system performance item. A threshold value storage unit for storing a threshold value and a threshold value for a business service metric; and a metric map storage unit for storing a metric map indicating a relationship between one business service metric and one or more system performance items;
The monitoring device includes a metric value acquisition unit that acquires one or more system performance values and one or more business service metric values of the monitoring target device according to the metric definition information stored in the metric definition information storage unit, and the metric value acquisition Alert determination means for storing a system performance value or a business service metric value transmitted from the means in the metric value storage unit, and determining whether a problem of system performance and business service has occurred in the monitored device; A positive prediction ratio indicating how often the service metric alert judgment result is normal and the system performance alert judgment result is normal, and the business service metric alert judgment result is abnormal and the system performance The percentage of cases where the alert judgment result is abnormal A definition information storage unit that stores a negative prediction ratio indicating whether to perform, a threshold value change determination unit that determines whether to change a threshold value of a system performance item stored in the threshold value storage unit, , Based on the alert determination result by the business service metric determined to be normal by the alert determination means, the system performance item associated with the business service metric in the metric map, and the system performance value of the system performance item And a threshold value deriving unit that calculates the system performance value when the alert determination result of the business service metric is normal by regression analysis and stores the calculation result in a threshold value storage unit. system. The threshold value derivation means transmits the calculated threshold value to the management terminal and displays it on the screen of the management terminal. When the threshold setting is instructed on the screen, the threshold value deriving means The monitoring system according to claim 4, wherein the threshold value storage unit stores the threshold value as a threshold value. In a method of monitoring a monitoring target device by a computer that is communicably connected to a plurality of monitoring target devices,
The computer is
According to the threshold value of the business service metric and the threshold value of the system performance item, it is determined whether there is a problem with the system performance and the business service in the monitored device, and the alert determination result is stored in the storage unit.
Based on the alert determination result based on the business service metric determined to be normal stored in the storage unit, the system performance item associated with the business service metric, and the system performance value of the system performance item, the business The system performance value when the service metric alert judgment result is normal is calculated by regression analysis, and the calculation result is stored.
Outputting the calculation result to the management terminal;
In accordance with an instruction from the management terminal, a new threshold value output to the management terminal is set as a threshold value of the system performance item stored in the storage unit,
A monitoring method comprising receiving and storing a system performance value and a business service metric value transmitted from a monitoring target device. When calculating system performance values by regression analysis,
Business service metric alert judgment and business service metric alert judgment indicating how often the business service metric alert judgment result stored in the storage unit is normal and the system performance alert judgment result is normal A determination is made as to whether or not to change the threshold value of the system performance item according to a negative predictive ratio indicating a rate at which the result is abnormal and the system performance alert determination result is also abnormal. 6. The monitoring method according to 6. To a computer that is communicably connected to multiple monitored devices,
Processing for determining whether system performance and business service problems have occurred in the monitored device according to the business service metric threshold value and the system performance item threshold value, and storing the alert determination result in the storage unit; ,
Based on the alert determination result based on the business service metric determined to be normal stored in the storage unit, the system performance item associated with the business service metric, and the system performance value of the system performance item, the business service Processing for calculating the system performance value when the alert determination result of the metric is normal by regression analysis and storing the calculation result;
Processing to output the calculation result to a management terminal;
In accordance with an instruction from the management terminal, a process of setting a new threshold value output to the management terminal as a threshold value of the system performance item stored in the storage unit;
A monitoring program for executing a process of receiving a system performance value and a business service metric value transmitted from a monitoring target device and storing them in a storage unit. When calculating system performance values by regression analysis,
Business service metric alert judgment and business service metric alert judgment indicating the percentage of cases where the business service metric alert judgment result stored in the storage unit is normal and the system performance alert judgment result is also normal To determine whether or not to change the threshold value of the system performance item according to the negative prediction ratio that indicates the rate at which the result is abnormal and the system performance alert determination result is also abnormal The monitoring program according to claim 8.

Images