JP2008234351A - Integrated operation monitoring system and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a hierarchical integrated operation monitoring system for monitoring failure information and performance information of a sub-system monitored by multiple pieces of existing operation monitoring software with a threshold of a preset fixed level. <P>SOLUTION: An output signal containing failure information and performance information of a sub-system monitoring layer 3 set for each sub-system is compared and redefined with failure linkage information between sub-systems based on past failure histories preliminarily accumulated in a knowledge database and performance information of existing operation monitoring software in an HUB layer 4, and then message-delivered as standard system management information to an integrated operation monitoring layer 2 and an operator monitoring layer 1, whereby the whole system can be monitored at a standard monitoring level. The operation monitoring function is divided between the integrated operation monitoring layer 2 and the operator monitoring layer 1, whereby efficient integrated operation monitoring can be attained. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an integrated operation monitoring system and program, and relates to an operation management server of a computer system constructed on a local area network (hereinafter referred to as a LAN), a computer system including the server, and extraction of a message for operation management. The present invention relates to a method and a program to be executed by the operation management server, and particularly relates to a method for providing an integrated operation monitoring system that manages a plurality of computer systems in an integrated, integrated and efficient manner using an off-the-shelf operation management tool. .

  Conventional techniques relating to the integrated operation monitoring system include, for example, conventional techniques disclosed in Patent Documents 1 to 3.

  The prior art described in Patent Document 1 provides a specification of an interface to an integrated operation monitoring console that realizes integrated operation management desired by an operator and means for realizing it by cutting a display portion on the integrated operation monitoring console. .

  The prior art described in Patent Document 2 has a plurality of filter functions for selecting signals to be output to the operation management terminal on the operation management server, and uses the error message of the monitored system in advance. By controlling the order in which the filters are used, a message having a high frequency of occurrence is specified by a filter having a fast usage order, thereby providing a means for increasing the monitoring speed.

In addition, the prior art described in Patent Document 3 has an error log collection agent system in which, as well as the importance of error / warning / information messages for each product provided by the vendor of each product, the importance of the entire system is also achieved. Both of them are saved (particularly, refer to paragraphs 0018 and 0019), and if the product of Company A ends abnormally, the product of Company B that cooperates should also fail, so these log information is grouped as related information (particularly, (See paragraphs 0029 and 0030).
Japanese Patent Laid-Open No. 7-253866 JP 2006-260056 A JP 2003-216457 A

  However, the conventional integrated operation monitoring system described above has the following problems.

  The first problem is that when an information system is composed of a plurality of subsystems and is operated using a plurality of off-the-shelf operation management tools, the failure of the entire system is integrated with uniform quality. This means that information and performance information cannot be managed accurately in a short time. The reason is that off-the-shelf operation management software manages messages that are output from the monitored server and storage by filtering the message performance related to faults with the threshold value unique to each off-the-shelf software. Thus, when the subsystems constituting the system are monitored independently, there arises a problem that the management level of the monitored device such as performance and failure varies depending on the off-the-shelf operation monitoring software.

  The second problem is that it is expensive to perform integrated monitoring of the entire system. The reason for this is that in recent enterprise computers, a plurality of subsystems are constructed by function and business, and a plurality of subsystems constitute one business system, and each subsystem is independently constructed. This is because it is operated by different off-the-shelf operation management software. In addition, the conventional operation monitoring system prepares a monitoring console for each subsystem, monitors and manages multiple monitoring consoles, or abolishes existing off-the-shelf operation monitoring software when a new integrated monitoring system is introduced. This is because it is necessary to newly introduce common operation monitoring software for the purpose of introducing the integrated operation monitoring system, and the monitoring software introduction cost is newly generated as an additional cost.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to monitor all monitored servers and storage monitoring levels of a plurality of subsystems managed by a plurality of off-the-shelf monitoring tools. It aims at providing the system between integrated operation which realizes uniformly and easily at the standard monitoring level set up beforehand.

  An invention according to claim 1 for solving the above object is an integrated operation monitoring system for a computer system, wherein an operation monitoring tool for collecting performance information of monitored devices in a subsystem, and the plurality of subsystems The performance information collected by the operation monitoring tool is collectively stored, a knowledge database that stores a template for standardizing the performance information, and an arithmetic processing unit that standardizes and outputs the performance information based on the template; And an integrated operation monitoring system.

  According to a second aspect of the present invention, in the integrated operation monitoring system according to the first aspect, there is provided an integrated operation monitoring unit that receives the output of the performance information standardized by the arithmetic processing unit and presents the output to a management system engineer. It is characterized by having.

  According to a third aspect of the present invention, in the integrated operation monitoring system according to the first or second aspect, the operation monitoring tool also collects failure information of monitored devices in the subsystem, and the knowledge database includes a plurality of subsystems. The failure information collected by the operation monitoring tool is accumulated, and when the failure occurs in the monitoring target device in the subsystem, the arithmetic processing means relates to the failure based on the failure information accumulated in the knowledge database. Then, it is characterized by analyzing a device that may cause a failure and outputting an analysis result.

  The invention according to claim 4 is a program for causing a computer system to function as an integrated operation monitoring system, and an operation monitoring server in a subsystem in the computer system is used as an operation monitoring tool for collecting performance information of monitored devices. Knowledge database for storing the performance information collected by the operation monitoring tool of a plurality of subsystems together and storing a template for standardizing the performance information. And an operation processing unit that standardizes and outputs the performance information based on the template.

  According to a fifth aspect of the present invention, in the integrated operation monitoring program according to the fourth aspect, the integrated operation monitoring server of the computer system receives the output of the performance information standardized by the computing means, and the output is output from the monitoring system. It is characterized by functioning as an integrated operation monitoring means presented to engineers.

  The invention according to claim 6 is the integrated operation monitoring program according to claim 4 or 5, wherein the operation monitoring tool collects failure information of monitored devices in the subsystem, and the knowledge database includes a plurality of When a failure occurs in the monitoring target device in the subsystem in the processing for storing the failure information collected by the operation monitoring tool of the subsystem and the arithmetic processing means, based on the failure information accumulated in the knowledge database, And analyzing a device in which a failure may occur in relation to the failure and outputting an analysis result.

  According to the present invention, an integrated operation that uniformly and easily realizes the monitoring levels of all monitored servers and storages of a plurality of subsystems managed by a plurality of off-the-shelf monitoring tools at a standard monitoring level set in advance. Inter-system can be provided.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

  First, the configuration of the present embodiment will be described. FIG. 1 is a diagram showing a configuration of a hierarchical integrated operation management system of a computer system having a four-layer structure according to an embodiment of the present invention configured with a plurality of subsystem groups.

  Referring to FIG. 1, the hierarchical integrated operation monitoring system of this embodiment has a four-layer structure including an operator monitoring layer 1, an integrated operation monitoring layer 2, a subsystem monitoring layer 3, and a HUB layer 4. is there.

  The operator monitoring layer 1 has a failure notification function for reporting system failure information to the operation monitoring operator (this function is hereinafter referred to as a patrol function).

  The integrated operation monitoring layer 2 is a layer where an operation management system engineer performs monitoring of the overall performance of the integrated system under the subsystem monitoring layer 3 and analysis of a failure that has occurred in the integrated system.

  The subsystem monitoring layer 3 includes subsystems 3a, 3b,... That constitute an integrated system (hereinafter referred to as subsystem 3x when referring to any one of the subsystems). ). The subsystem 3x will be described. The subsystem 3x performs failure analysis and performance analysis of the integrated system to which the subsystem 3x belongs, and monitors and manages performance information and failure information. The devices to be monitored by the subsystem 3x include servers, storages, network routers, and the like. In the example illustrated in FIG. 1, the servers 3aa, the storage 3ab, and the network 3ac of the subsystem 3a. Moreover, as the failure / performance monitoring / management / analysis software of the integrated system operating in the subsystem 3x, off-the-shelf operation management software can be used, but the performance information and failure information of the monitored device are communicated to the HUB layer 4 described later. What can output is preferable.

  The HUB layer 4 includes a knowledge database 41, an operation information collection unit 42 that receives information output from the subsystem monitoring layer 3, and an operation process that causes the operation information collection unit 42 to perform an operation process using information in the knowledge database 41. And a management information output unit 44 that outputs output information of the arithmetic processing unit 43 to the upper operator monitoring layer 1 and the integrated operation monitoring layer 2.

  The knowledge database 41 prestores information for standardizing messages of off-the-shelf operation monitoring software used for each subsystem, and fault linkage information between subsystems based on past fault histories as templates.

  The operation information collection unit 42 has a function of receiving failure information or performance information (hereinafter referred to as a message) transmitted in various formats / protocols such as SNTP and mail format.

  Note that the HUB layer 4 may be implemented by a single computer. In this case, a secondary storage device such as a hard disk of a computer functions as the knowledge database 41, and a processing device such as a CPU functions as the operation information collection unit 42, the arithmetic processing unit 43, and the management information output unit 44. However, the present invention is not limited to this, and may be virtually implemented by a computer system including a plurality of computers connected to be communicable with each other. By virtualizing with a plurality of computers, there is an effect of improving the processing capability. In this case, the HUB layer 4 is particularly referred to as a “virtual HUB layer 4”.

  The hierarchical integrated operation management system according to the present embodiment having the above configuration operates as follows.

  First, in the subsystem monitoring layer 3, each subsystem 3x is configured by a plurality of devices to be monitored (for example, a server 3aa and a storage 3ab) using a ready-made operation monitoring tool (or a ready-made operation management software) installed in each subsystem 3x. Collect performance information and failure information for. Next, each subsystem 3x outputs failure information and performance information independently detected and collected to the upper HUB layer 4.

  Here, referring to FIG. 2 regarding the operation of the HUB layer 4, the operation information collection unit 42 of the virtual HUB layer 4 receives the information transmitted in the form of SNTP, mail format, etc., as described above. A message individually transmitted from each subsystem 3x is temporarily stored (message reception, step S1). Then, after the message is temporarily stored, it is divided into failure information and performance information by the filter function and transmitted to the arithmetic processing unit 43 (steps S2 and S3).

  The filter used in the operation information collection unit 42 is prepared with a table in which failure information and performance information are recorded as filter conditions. The operation information collection unit 42 compares the input message with the filter condition table and classifies the input message into failure information and performance information, and then outputs the information to the arithmetic processing unit 43.

  When failure information is input, the arithmetic processing layer 43 refers to the knowledge database 41 (step S4) and associates it with past failure occurrence data stored in the knowledge database 41. Next, the devices and subsystems that may cause a secondary failure are automatically associated with the input failure information, performance information of the affected device, and past failure data of the device. Extraction (influence analysis on other systems, step S5). Next, a new message file is created together with the failure information (step S6). Note that this message file is data for configuring a display screen serving as a user interface of the monitoring operator or the operation manager in the operator monitoring layer 1 and the integrated operation monitoring layer 2. Next, the management information output unit 44 outputs the message file created by the arithmetic processing unit 43 to the management information output unit 44 (step S7).

  When performance information is input, the knowledge database 41 is referred to (step S8), and the operation information collection unit 42 is used by using a template having a performance comparison of a ready-made operation monitoring tool recorded in the knowledge database 41 in advance. The data collected in step 1 is converted into standard performance information (step S9). Thereafter, in the same manner as in step S6, a message file serving as data for constructing a display screen serving as a user interface for the monitoring operator and the operation manager is created in the operator monitoring layer 1 and the integrated operation monitoring layer 2 (step S10). Next, the management information output unit 44 outputs the message file created by the arithmetic processing unit 43 to the management information output unit 44 (step S11).

  Next, the knowledge database 41 of this embodiment will be described. First, the performance information stored in the knowledge database 41 will be described. FIG. 3 is a diagram showing an example of the storage performance template of the knowledge database 41.

  Referring to FIG. 3, in the operation monitoring tool (a) and the operation monitoring tool (b) used in each subsystem, performance information varies when similar storage is monitored depending on the characteristics of the ready-made operation monitoring software. .

  In the storage performance template, the standard performance value when the existing storage is used in the corresponding system is recorded in advance as information, and when the storage performance information of the operation information collection unit is input to the arithmetic processing unit 43, the storage performance template By comparing and referring to the performance template table, it can be replaced with standard performance information.

  In other words, the knowledge database 41 of the present embodiment, for example, when the performance of the same disk is measured, monitors the same monitored storage with a plurality of monitoring tools in advance in consideration of the situation where measured values differ depending on the plurality of monitoring tools. Stores monitoring results (performance information) for monitoring variations in cases. Then, by referring to this performance information stored in the knowledge database 41, the measured value is converted into a standard value in all subsystems. This standard value is different from, for example, an index indicating the importance of the entire system, and is obtained by storing the relative values of each monitored device and the operation monitoring tool in the knowledge database.

  The knowledge database 41 stores not only the performance information but also past failure information. Next, based on the failure information stored in the knowledge database 41, an operation in which the arithmetic processing unit 43 predicts that another failure may occur when a certain failure occurs will be described.

  The knowledge database 41 stores past failure information, and also stores related information between systems based on the past failure information as knowledge. For example, when the knowledge database 41 has knowledge that the A system and the B system are related based on past failure information, the arithmetic processing unit 43 temporarily causes a failure in the A system, Even if a failure has not occurred, past failure information is searched, and if a failure occurs in the A system, it is predicted that a failure may occur in the B system after a certain time. The arithmetic processing unit 43 is not limited to one device to be monitored, and there may be a plurality of devices to be monitored.

  Next, the management information output unit 44 will be described. The management information output unit 44 has a filter function for identifying whether the input signal is failure information or performance information.

  The information signal input to the management information output unit 44 outputs the input signal only to the integrated operation monitoring layer 2 when the input information signal is performance information, and the signal when the input information signal is failure information. Is output to the operation monitoring layer 2 and to the operator monitoring layer 1.

  Since the information signal transmitted to the operator monitoring layer 1 is limited by the filter function of the management information output unit 44, the operation monitoring information output to a monitoring monitor (not shown) provided in the operator monitoring layer is transmitted when the system is abnormal. It becomes possible to selectively manage only information.

  In addition, since this information is added with predictive information, system failure prediction information related to the failure location, the operator can perform predictive management of the entire system in advance before the influence of the failure expands. .

  In addition, since the integrated operation monitoring layer 2 provides the performance information that is input as standard operation monitoring performance information that does not depend on the characteristics of the off-the-shelf operation monitoring software, when a subsystem is added or removed, Even when a plurality of off-the-shelf operation monitoring software is used, it is possible to realize integrated operation monitoring capable of performing constant fault monitoring and performance monitoring with standard threshold values.

  In the above embodiment, the integrated operation monitoring layer 2 and the operator monitoring layer 1 divide the operation monitoring function, thereby realizing efficient integrated operation monitoring.

  According to the present embodiment, in the computer system composed of at least two or more subsystems and managed by a plurality of off-the-shelf operation management software, all monitored servers and storages are stored in advance. System operation that can be managed in an integrated manner with the set uniform operational quality, and that the subsystem and target device in which the failure occurred can predict in advance the possibility that other systems and other target devices will fail Management can be realized. The reason is that a four-layer integrated operation monitoring system employing a HUB layer having a knowledge database is adopted between each subsystem management layer and the operation layer.

  In addition, this invention is not limited to the said embodiment, A various deformation | transformation is possible within the range of the technical idea of this invention. The number of HUB layers and subsystem monitoring layers of the constituent elements of the above embodiment is not limited to the above embodiment, and can be set to a number and a location suitable for carrying out the present invention.

  For example, a configuration may be adopted in which a plurality of subsystems are installed in a plurality of different locations. In this case, by storing common information in the knowledge database, a HUB system is constructed for each area, standardized data is created, and then a remote system administrator remotely monitors and manages the data. It is also possible.

  Further, for example, the operator monitoring layer may be installed at different locations (see FIG. 4). In this case, it is possible to reduce communication traffic transmitted to the integrated operation monitoring layer by installing a plurality of HUB layers near the device to be monitored.

It is a block diagram which shows the structure of the hierarchy type | mold integrated operation management system of the computer system of the 4 layer structure which concerns on embodiment of this invention. It is a flowchart which shows the operation | movement procedure of embodiment of this invention. It is a figure which shows an example of the storage performance template of the knowledge database of embodiment of this invention. It is a block diagram which shows the structure of the hierarchical type integrated operation management system which concerns on other embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Operator monitoring layer 2 Integrated operation monitoring layer 3 Subsystem monitoring layer 3a, 3b, 3x Subsystem 4 HUB layer 41 Knowledge database 42 Operation information collection part 43 Arithmetic processing part 44 Management information output part

Claims (6)

An integrated operation monitoring system for a computer system,
An operation monitoring tool that collects performance information of monitored devices in the subsystem;
A knowledge database that collectively stores the performance information collected by the operation monitoring tool of a plurality of subsystems, and that stores a template for standardizing the performance information;
Arithmetic processing means for standardizing and outputting the performance information based on the template;
An integrated operation monitoring system characterized by comprising:   The integrated operation monitoring system according to claim 1, further comprising an integrated operation monitoring unit that receives the standardized output of the performance information of the arithmetic processing unit and presents the output to a management system engineer. The operation monitoring tool also collects failure information of monitored devices in the subsystem,
The knowledge database stores failure information collected by the operation monitoring tool of a plurality of subsystems,
The arithmetic processing means, when a failure occurs in a monitored device in the subsystem, analyzes a device in which a failure may occur in relation to the failure based on the failure information accumulated in the knowledge database. 3. The integrated operation monitoring system according to claim 1, wherein an analysis result is output. A program that allows a computer system to function as an integrated operation monitoring system,
An operation monitoring server in a subsystem in the computer system,
It functions as an operation monitoring tool that collects performance information of monitored devices,
An integrated operation monitoring server of the computer system,
A knowledge database that collectively stores the performance information collected by the operation monitoring tool of a plurality of subsystems, and that stores a template for standardizing the performance information;
Arithmetic processing means for standardizing and outputting the performance information based on the template;
Integrated operation monitoring program characterized by functioning as An integrated operation monitoring server of the computer system,
5. The integrated operation monitoring program according to claim 4, wherein said integrated operation monitoring program receives an output of said performance information standardized by said computing means and functions as an integrated operation monitoring means for presenting said output to a technician of a monitoring system. Processing for collecting failure information of monitored devices in the subsystem in the operation monitoring tool;
Processing for accumulating failure information collected by the operation monitoring tool of a plurality of subsystems in the knowledge database;
When a failure occurs in a monitoring target device in a subsystem, the arithmetic processing unit analyzes a device that may cause a failure in relation to the failure based on the failure information accumulated in the knowledge database. , Processing to output the analysis results,
The integrated operation monitoring program according to claim 4 or 5, wherein the integrated operation monitoring program is executed.

Images