JP2008293157A - Rule activation device and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a rule activation device for activating and executing rules when driven by events. <P>SOLUTION: The rule activation device 100 includes a correspondence table storage part 140 for storing a data/rule activation table 141; a working memory 120 for storing data; a rule storage part 130 for storing rules described in the data/rule activation table 141; a data change detecting part 111 for detecting the data changes of data if the data is stored in the working memory 120 or if the data stored in the working memory 120 is updated, then searching for rules corresponding to the data whose data changes have been detected, by referring to the data/rule activation table 141, and, if the rules are found by the search, obtaining the rules found from the rule storage part 130; and a rule engine 110 for activating the rules obtained by the data change detecting part 111. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a rule activation device and a rule activation program for activating rules.

  In the conventional monitoring system, the monitoring rule is written in a program, and it is difficult to flexibly cope with the case where the rule needs to be changed due to a change in operation rule or the like. In contrast, the application of rule-based technology to monitoring systems is increasing. By using rule-based technology, it becomes easier to respond to changes in monitoring rules.

  A rule is expressed in a format such as if <LHS> then <RHS> or when <LHS> then <RHS> (LHS: Left Hand Side, RHS: Right Hand Side).

  If <LHS> is a “condition part” and the condition part of <LHS> is satisfied as a result of collation with the data of the rule base system, the “execution part” <RHS> is executed. The rule engine searches the data in the working memory for a rule having <LHS> that matches the data, and executes the rule by executing <RHS> of the matched rule (FIG. 12). ).

The following points have been issues in the rule-based monitoring system. When the monitoring action is executed every time an event occurs in the monitoring target, when the data to be sent is input to the working memory (FIG. 13), it is necessary to collate the data in the working memory with the rules (FIG. 14). ). When a rule is executed, all rules and all data in the working memory are collated. When new data is added, all rules including existing data are checked against all data in the working memory. Although the rule engine is omitted in FIGS. 13 and 14, the rule engine collates the data in the working memory with the rule. On the other hand, in Japanese Patent Laid-Open No. 2000-305783 (Patent Document 1), the working memory and rules are hierarchized to narrow the range in which data and rules are collated. There is no change in the collation of.
Japanese Patent Laid-Open No. 2000-305783, “Rule-Based System Division / Reuse Device and Method”

  The conventional rule execution method has a problem that it takes time to execute a rule because data and a rule are collated. In addition, when applying a rule-based system to a monitoring system, event data and log data obtained from the monitoring target are applied to the rule, but the data generated by the event may be passed to a specific rule that processes it, and periodically When the situation is audited, the data generated during the audit period is used from the data in the working memory, so that the data and memory verification processing is wasteful. In the monitoring system, since data generated in the monitoring target needs to be processed by a rule in real time, the rule needs to be activated by a data generation event.

  An object of the present invention is to provide a rule starting device and a rule starting program for starting and executing a rule by event driving.

The rule starting device of the present invention is:
A correspondence table storage unit that stores a correspondence table in which at least one correspondence relation including at least data and a rule is described;
A data storage unit for storing data;
A rule storage for storing the rules described in the correspondence table;
Detecting when data is stored in the data storage unit as a data change in stored data and detecting when data stored in the data storage unit is updated as a data change in updated data; The rule corresponding to the data in which the data change is detected is searched by referring to the correspondence table stored in the correspondence table storage unit, and when the rule is hit by the search, the rule that has been hit is acquired from the rule storage unit A data change detecting unit,
The data change detection unit includes a rule activation unit that activates the acquired rule.

  According to the present invention, it is possible to provide a rule activation device that activates and executes a rule by event driving.

Embodiment 1 FIG.
The first embodiment will be described with reference to FIGS.

  FIG. 1 is a diagram illustrating an example of an appearance of a rule activation device 100 that is a computer. In FIG. 1, a rule activation device 100 includes a system unit 830, a display device 813 having a CRT (Cathode / Ray / Tube) or LCD (liquid crystal) display screen, a keyboard 814 (Key / Board: K / B), and a mouse 815. , FDD817 (Flexible Disk Drive), compact disk device 818 (CDD: Compact Disk Drive), printer device 819, and other hardware resources, which are connected by cables and signal lines.

  The system unit 830 is a computer and is connected to a network. A monitoring target system 200 and a log file 300 are connected to the network, and the rule activation device 100 can communicate with them.

  FIG. 2 is a diagram illustrating an example of hardware resources of the rule activation device 100 according to the first embodiment. In FIG. 2, the rule activation device 100 includes a CPU 810 (also referred to as a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, or a processor) that executes a program. The CPU 810 includes a ROM (Read Only Memory) 811, a RAM (Random Access Memory) 812, a display device 813, a keyboard 814, a mouse 815, a communication board 816, an FDD 817, a CDD 818, a printer device 819, and a magnetic disk device 820 via a bus 825. And control these hardware devices. Instead of the magnetic disk device 820, a storage device such as an optical disk device or a flash memory may be used. The magnetic disk device 820 is an example of the working memory 120, the rule storage unit 130, or the correspondence table storage unit 140.

  The RAM 812 is an example of a volatile memory. The RAM 812 is an example of a working memory 120 described later. Storage media such as the ROM 811, the FDD 817, the CDD 818, and the magnetic disk device 820 are examples of nonvolatile memories. These are examples of a storage device or a storage unit, a storage unit, and a memory. The communication board 816, the keyboard 814, the FDD 817, and the like are examples of an input unit and an input device. The communication board 816, the display device 813, the printer device 819, and the like are examples of an output unit and an output device.

  The communication board 816 is connected to a network (such as a LAN). The communication board 816 may be connected not only to the LAN but also to a WAN (wide area network) such as the Internet or ISDN.

  The magnetic disk device 820 stores an operating system 821 (OS), a window system 822, a program group 823, and a file group 824. The programs in the program group 823 are executed by the CPU 810, the operating system 821, and the window system 822.

  The program group 823 stores a program that executes a function described as “˜unit” in the description of the embodiment described below. The program is read and executed by the CPU 810.

  The file group 824 includes “determination result”, “calculation result”, “extraction result”, “generation result”, and “processing result” in the description of the embodiment described below. , Data / data / rule activation table 141 and rules described later, signal values, variable values, parameters, and the like are stored as items of “˜file” and “˜database”. The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 810 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, output, printing, and display. Information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory during the CPU operations of extraction, search, reference, comparison, operation, calculation, processing, output, printing, and display. Is remembered.

  In the description of the embodiments described below, data and signal values are stored in the memory of RAM 812, the flexible disk of FDD 817, the compact disk of CDD 818, the magnetic disk of magnetic disk device 820, other optical disks, mini disks, DVDs (Digital). -It records on recording media, such as Versatile and Disk. Data and signals are transmitted on-line via the bus 825, signal lines, cables, and other transmission media.

  In addition, what is described as “to part” in the description of the embodiment described below may be “to circuit”, “to device”, “to device”, “means”, and “to step”. ”,“ ˜procedure ”, or“ ˜processing ”. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 811. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 810 and executed by the CPU 810. That is, the program causes the computer to function as “to part” described below. Alternatively, the procedure or method of “to part” described below is executed by a computer.

  FIG. 3 is a block diagram of the rule activation device 100 according to the first embodiment. The rule activation device 100 includes a rule engine 110, a working memory 120, a rule storage unit 130, and a correspondence table storage unit 140. The rule engine 110 includes a data change detection unit 111.

  In FIG. 3, the data / rule activation table 141 has a list of rules that are activated when data changes for each data type. In the example of FIG. 3, when data having the name “name1” changes, Rule1 is activated, and when data having the name “name2” changes, Rule2 is activated. The data / rule activation table 141 is prepared in advance by the system administrator.

  The rule engine 110 activates and executes a predetermined rule.

  The data change detection unit 111 detects when new data is added to the working memory 120 or when data in the working memory 120 is rewritten, as data change of the data.

  The data stored in the working memory 120 has the “name” and “attribute” of the data. The “name” of data indicates the definition of data, and the number of “attributes” of data and the name of “attributes” are set for each “name”. There may be a plurality of data having the same “name”. In the example of FIG. 3, the “name” data “name1” has two attributes, attribute 1 and attribute 2, and there are two data with “name1” “name1” in the working memory 120. One has the value of attribute 1 “aaa” and the value of attribute 2 is “bbb”, and the other has the value of attribute 1 “xxx” and the value of attribute 2 “yyy”.

  Next, the operation of the rule activation device 100 will be described with reference to FIGS. FIG. 4 shows a configuration diagram including the system to be monitored. In FIG. 4, an input unit 101 from the monitoring target system 200 and an input unit 102 from the log file 300 are further added to the rule activation device 100. FIG. 5 is a flowchart showing the operation of the rule activation device 100.

  When an event occurs in the monitoring target system 200 or the log file 300 is generated, the monitoring event data or log data is stored in the working memory by the input unit 101 from the monitoring target system 200 or the input unit 102 from the log file 300. 120 is taken in (S11).

  At this time, the data change detection unit 111 marks the fetched data as having changed as shown in FIG. 3 (S12).

  When the mark is added, the data change detection unit 111 searches the corresponding rule with reference to the data / rule activation table 141 shown in FIG. 3 (S13), and when the corresponding rule is hit, the hit rule is stored in the rule. Obtained from the unit 130 (S14). In the case of FIG. 3, the data change detection unit 111 acquires “rule 1” from the rule storage unit 130.

  “Rule 1” acquired by the data change detection unit 111 from the rule storage unit 130 is executed by the rule engine 110 (S15).

  In addition, when new data is generated in the working memory 120 or the data in the working memory 120 is changed by executing “Rule 1”, the data change is the same as when event data is generated in the monitoring target. The detection unit 111 marks that there has been a change, and the data change detection unit 111 refers to the data / rule activation table 141 to obtain a rule to be executed.

  As described above, the rule activation device 100 according to the first embodiment includes the data change detection unit 111. Therefore, the rules to be executed are referred to by using only the data that has changed and using the data / rule activation table 141. Can be selected. In addition, a rule to be activated is triggered by a data change (new registration or rewriting) and executed by the rule engine 110, and the rule can be activated by event driving of data change.

  In the first embodiment described above, the rule activation device 100 as an apparatus has been described. However, it is also possible to grasp as a program for causing a computer to execute the operation of the rule activation device 100.

Embodiment 2. FIG.
The second embodiment will be described with reference to FIGS. In the first embodiment described above, the rule is executed by referring to the data / rule activation table 141 when the data changes. However, in the second embodiment, the rule is activated according to the data attribute. Is an embodiment for setting

  FIG. 6 shows the data / rule activation table 141 in the second embodiment. An attribute column is added to the data / rule activation table 141 shown in FIG. FIG. 7 is a block diagram of the rule activation device 100 of the second embodiment having the data / rule activation table 141 of FIG. FIG. 8 is a flowchart for explaining the rule activation device 100 according to the second embodiment.

  Next, the operation will be described with reference to FIGS.

  The rule activation device 100 executes the corresponding rule when the value of the attribute in the data indicated by the data name is changed by executing the predetermined rule.

  For example, in FIG. 7, it is assumed that the attribute 1 “xxx” of the data “name1” whose attribute 1 is “xxx” is changed by the execution of a predetermined rule by the rule engine 110 (S21).

  In this case, the data change detection unit 111 detects that the attribute value “xxx” of attribute 1 has been changed (S22).

  When detecting the change of the attribute 1 of the data “name1”, the data change detection unit 111 refers to the data / rule activation table 141 and searches for a corresponding rule (S23). In this case, as a result of the search by the data change detection unit 111, “rule 1” written in a column whose data is “name1” and whose attribute is attribute 1 is hit. The data change detecting unit 111 acquires the hit “rule 1” from the rule storing unit 130 and passes it to the rule engine 110 as an activation target (S24). The rule engine 110 activates and executes “rule 1” passed from the data change detection unit 111 (S25).

  If no attribute is specified in the data / rule activation table 141 as “name3” shown in FIG. 6, the rule in the rule column is executed regardless of which attribute is changed. . That is, when the data change detection unit 111 detects a change in any attribute of “name3”, the search of the data / rule activation table 141 by the data change detection unit 111 results in a hit of “rule 3”. . Then, the data change detection unit 111 acquires “Rule 3” from the rule storage unit 130 and passes it to the rule engine 110.

  The rule activation device 100 according to the second embodiment can determine which rule is activated depending on whether or not an attribute value whose unit is smaller than that of data is changed. Depending on the monitored system, there are cases where only specific attribute values in the monitored event data are monitored, which is effective in such a case.

Embodiment 3 FIG.
The third embodiment will be described with reference to FIGS. FIG. 9 shows data stored in the working memory 120 in the third embodiment. FIG. 10 is a block diagram of the rule activation device 100 according to the third embodiment. FIG. 11 is a flowchart showing the operation of the rule activation device 100 according to the third embodiment.

  In the second embodiment described above, the data in the working memory 120 has a name and an attribute as shown in FIG. On the other hand, in the third embodiment, as shown in FIG. 9, it is assumed that the data in the working memory 120 further has a data generation time.

  As shown in FIG. 10, the rule activation device 100 according to the third embodiment further includes a “history information management unit 150”. The history information management unit 150 manages the history of data stored in the working memory 120.

  As the data generation time, the time in the event data sent from the monitoring target system 200 or the time written in the log when data is obtained from the log file 300 is used. When such time cannot be obtained, the history information management unit 150 sets the time when the input unit 101 or the input unit 102 acquires the event log or the log file as the generation time.

  In addition, the history information management unit 150 manages the history of data in the working memory 120, and when accessing the data, refers to the latest value for each data name and the previous value by specifying the previous time, etc. To be able to Access to the working memory 120 is performed via the history information management unit 150 that performs history management. In other words, when the data stored in the working memory 120 is updated, the history information management unit 150 saves the data before update and the data after update in the working memory 120 and uses the data update history as history information. to manage.

  Next, the operation of the rule activation device 100 will be described with reference to FIG.

  In the monitoring system, when an event for executing a rule occurs, the cause of the occurred event may be analyzed by referring to past event data. When data is added or changed by input from event data or log data, a rule to be activated by the data change detection unit 111 is selected as in the first embodiment (S31).

  The history information management unit 150 stores both the updated data and the pre-update data in the working memory 120. Here, when there is a reference to past data (or the current value of any data) in the “condition section” of the rule, the rule engine 110 requests the history information management section 150 for the data. When this request is made, the history information management unit 150 obtains the past value of the designated data indicated by time designation or the like one time ago from the working memory 120 and passes the data to the rule engine 110 (S32). The rule engine 110 evaluates the “condition part” (S33), and executes the “execution part” of the rule if it is satisfied (S34).

  Similarly, when referring to the data in the working memory 120 in the “execution part” of the rule, the rule engine 110 can acquire the current value or past value of the data via the history information management part 150. .

  For all the data referenced in the “condition part” of the rule, when the rule is activated at the time of data change, when the data is generated and updated in the working memory 120 by reading the event or log file, the past data has the generation Since one is older, it is considered updated. Therefore, even when rule activation is not necessary, the condition part of the rule is evaluated, and the condition part is evaluated uselessly.

  As described above, when there is a condition part of a rule that refers to past data, a rule to be executed can be selected by referring to only the data that has changed and using the data / rule activation table 141.

  In the above embodiment, a data / rule activation table having a list of rules to be activated when data changes for each data type, and when new data is added to the working memory or data is rewritten. A rule activation device has been described that has a data change detection unit that detects a data change and activates a rule according to an event in which data is added to the working memory or data is updated.

  In the above embodiment, there is a data / rule activation table having a list of rules to be activated for each data attribute, and rule activation that activates a rule by an event in which data is added to the working memory or data is updated The apparatus has been described.

  In the above embodiment, the data in the working memory has an occurrence time, has a history information management unit for performing history management and access to the data in the working memory, and whether the data is added to the working memory, A rule activation device that activates a rule according to an event whose data has been updated has been described.

FIG. 3 is a diagram illustrating an appearance of the rule activation device 100 according to the first embodiment. 2 is a hardware configuration of the rule activation device 100 according to the first embodiment. FIG. 2 is a block diagram of rule activation device 100 in the first embodiment. 1 is a system configuration according to a first embodiment. 5 is a flowchart of the operation of the rule activation device 100 according to the first embodiment. Data / rule activation table 141 in the second embodiment. FIG. 4 is a block diagram of a rule activation device 100 according to Embodiment 2. 10 is a flowchart of the operation of the rule activation device 100 according to the second embodiment. Data stored in working memory 120 in the third embodiment. FIG. 5 is a block diagram of a rule activation device 100 according to Embodiment 3. 10 is a flowchart of the operation of the rule activation device 100 according to Embodiment 3. The figure which shows a prior art. Another figure which shows a prior art. Another figure which shows a prior art.

Explanation of symbols

  1, 2 rule, 100 rule activation device, 101, 102 input means, 110 rule engine, 111 data change detection unit, 120 working memory, 130 rule storage unit, 140 table storage unit, 141 data / rule activation table, 150 history information Management unit, 200 monitored system, 300 log file.

Claims (4)

A correspondence table storage unit that stores a correspondence table in which at least one correspondence relation including at least data and a rule is described;
A data storage unit for storing data;
A rule storage for storing the rules described in the correspondence table;
Detecting when data is stored in the data storage unit as a data change in stored data and detecting when data stored in the data storage unit is updated as a data change in updated data; The rule corresponding to the data in which the data change is detected is searched by referring to the correspondence table stored in the correspondence table storage unit, and when the rule is hit by the search, the rule that has been hit is acquired from the rule storage unit A data change detecting unit,
A rule activation device comprising: a rule activation unit that activates a rule acquired by the data change detection unit. The correspondence table stored in the correspondence table storage unit is:
There is at least one correspondence between data, a predetermined attribute of this data, and a rule,
The data change detector is
A rule that detects when an attribute update has occurred with respect to data stored in the data storage unit as a data change in the data with the updated attribute, and corresponds to the data that has detected the data change and the updated attribute 2. The search is performed by referring to the correspondence table stored in the correspondence table storage unit, and when a rule is hit by the search, the hit rule is acquired from the rule storage unit. Rule activation device. The rule activation device further includes:
When the data stored in the data storage unit is updated, the history information management unit stores the data before update and the data after update in the data storage unit, and manages the update history of the data as history information With
The rule activation unit
If the predetermined rule is being executed, the history information management unit is requested for any value from the present to the past of the predetermined data according to the rule being executed,
The history information management unit
Upon receiving a request from the rule activation unit, referring to history information, the value of data that matches the request is acquired from the data storage unit and sent to the rule activation unit,
The rule activation unit
3. The rule activation device according to claim 1, wherein a value of data sent from the history information management unit is received, and the predetermined rule is executed using the value of the received data. 4. A rule activation program that causes a computer including a correspondence table storage unit, a rule storage unit, and a data storage unit to store data to execute the following processing: (1) a set of at least data and rules (2) Processing to store a correspondence table in which one or more correspondences are described in the correspondence table storage unit (2) Processing to store rules described in the correspondence table in the rule storage unit (3) Data in the data storage unit Is detected as a data change of the stored data, and the data stored in the data storage unit is detected as a data change of the updated data. Is retrieved by referring to the correspondence table stored in the correspondence table storage unit. If the rule is hit, the process of obtaining a hit rules from said rule storage portion (4) a process of starting the acquisition rule.

Images