JP2009181537A

JP2009181537A - System, method and program for managing incident

Info

Publication number: JP2009181537A
Application number: JP2008022626A
Authority: JP
Inventors: Yurika Itako; 有里佳板子; Hiroaki Kyobayashi; 弘晃京林
Original assignee: Hitachi Information Systems Ltd
Current assignee: Hitachi Information Systems Ltd
Priority date: 2008-02-01
Filing date: 2008-02-01
Publication date: 2009-08-13
Anticipated expiration: 2028-02-01
Also published as: JP4651126B2

Abstract

<P>PROBLEM TO BE SOLVED: To update incident information according to a contract with a customer. <P>SOLUTION: An incident management system includes a static monitoring definition information storing part 22 for storing priority change conditions corresponding to combinations of a customer name, urgency, importance or the like included in incident information received from a failure monitoring apparatus 3; and a dynamic monitoring definition information storing part 23 for storing priority change conditions satisfying the combination conditions. When the residence time of an incident satisfying the change conditions of the incident information received from the monitoring apparatus 3 exceeds a preset residence time, or when the residence time zone of the incident satisfying the change condition of the incident information received is included in a preset residence time zone, the priority of the incident information is changed to a priority included in the dynamic or static monitoring definition information, and the incident information with the updated priority is transmitted to an address of a maintenance worker set in accordance with customer information. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

本発明は、各種情報処理サービスを行うコンピュータシステムにおける障害等のインシデントの時間を監視するインシデント管理システム及び同管理方法並びに同管理プログラムに係り、特に利用者にサービスの品質を保証することができるインシデント管理システム及び同管理方法並びに同管理プログラムに関する。 The present invention relates to an incident management system, a management method, and a management program for monitoring the time of an incident such as a failure in a computer system that performs various information processing services, and in particular, an incident that can guarantee service quality to a user. The present invention relates to a management system, the management method, and the management program.

近年のコンピュータシステムは、インターネット等の通信回線網を介して各種情報処理サービスを顧客に提供することが行われており、このサービス提供業者は顧客に対してＳＬＡ（エスエルエー：ＳｅｒｖｉｃｅＬｅｖｅｌＡｇｒｅｅｍｅｎｔ）と呼ばれるサービスの品質を保証する制度が採用されている。このＳＬＡは、例えば、回線の最低通信速度やネットワーク内の平均遅延時間、利用不能時間の上限など、サービス品質の保証項目や、時刻帯による障害対応時間や、それらを実現できなかった場合の利用料金の減額に関する規定などをサービス契約に含めることを指すものである。 In recent years, computer systems provide various information processing services to customers via a communication network such as the Internet. This service provider is called SLA (Service Level Agreement) for customers. A system that guarantees the quality of service is adopted. This SLA is, for example, service quality guarantee items such as the minimum communication speed of the line, the average delay time in the network, the upper limit of the unavailable time, the failure response time according to the time zone, and use when these cannot be realized This refers to the inclusion of provisions regarding fee reductions in service contracts.

このＳＬＡを確保するためコンピュータシステムの管理者は、ある情報処理サービスに対する応答速度の低下等の質的低下又は中断等の障害が発生した場合、サーバやルータ等の監視対象装置から障害メッセージが発せられ、この障害メッセージを基に障害の復旧予定時刻等を顧客に通知するインシデント管理業務が行われている。 In order to secure this SLA, the administrator of a computer system can issue a failure message from a monitored device such as a server or a router when a failure such as a reduction in the response speed to a certain information processing service or a failure such as interruption occurs. Incident management work is performed to notify the customer of the scheduled recovery time of failure based on the failure message.

このインシデント管理業務は、前記障害メッセージを障害監視装置が受信し、この障害監視装置からの報告を基にインシデント管理システムがインシデント情報（重要度、緊急度、発生時刻等）を登録し、この登録されたインシデントは、予め定義された業務フローに従ってワークフローシステム等を用いてサービスデスク要員が対応するものである。 In this incident management service, the failure monitoring device receives the failure message, and the incident management system registers incident information (severity, urgency, time of occurrence, etc.) based on the report from the failure monitoring device. The incidents are handled by service desk personnel using a workflow system or the like according to a predefined business flow.

このインシデント発生後は、一般的に、関係者への連絡／一次対応／原因究明／対策等の業務ステップが存在し、通常のデータセンタのインシデント管理業務においては、インシデント発生後の通報や一次対応までの時間をＳＬＡとして定め、この対応時間を運用品質の定量的な指標として利用している。 After this incident occurs, there are generally business steps such as contact with related parties / primary response / cause investigation / countermeasures. In normal data center incident management, post-incident reporting and primary response The time until is determined as SLA, and this response time is used as a quantitative indicator of operational quality.

このような状況において、サービスデスク要員が対応するインシデントが、何らかの原因で同時多発したり１インシデントの対応に長時間を要する場合に、対応遅延や対応漏れによる運用品質の低下が懸念され、ＳＬＡを維持できないという可能性があった。 In such a situation, when incidents handled by service desk personnel occur frequently for some reason or a long time is required to respond to one incident, there is a concern that operational quality may be degraded due to response delays or omissions. There was a possibility that it could not be maintained.

尚、インシデント（incident）とは、一般に事件、出来事、ハプニングなどの意味を持つ英単語であって、本出願では、情報管理やシステム運用に関して保安上の脅威となる現象や事案(セキュリティインシデント)である障害のことを指し、例えばこうした事案としては、ウイルス感染や不正アクセス、情報漏洩、迷惑メール送信、サービス拒否攻撃(DoSアタック)などが含まれ、セキュリティ関連以外では、ソフトウェア製品などのユーザサポートや問い合わせ窓口などでの対応回数の単位のことを指すものである。 Incidents are English words that generally mean incidents, events, and happenings. In this application, incidents are phenomena and incidents (security incidents) that pose a security threat to information management and system operation. For example, these incidents include virus infection, unauthorized access, information leakage, spam mail transmission, denial of service attack (DoS attack), etc. This refers to the unit of the number of responses at the inquiry desk.

また、前記障害発生時のインシデント業務処理に関する技術が記載された文献としては、下記特許文献が挙げられ、この特許文献には、ルータやサーバ等の機器毎に定義された業務フローおよび業務ステップに対し、復旧（および対応）目標時間を定義し、これを経過した場合に、障害復旧時間の超過を通知することが記載されている。
特開２００７−３４３５３号公報 In addition, as a document describing the technology related to incident business processing at the time of the failure occurrence, the following patent document can be cited. This patent document includes a business flow and a business step defined for each device such as a router and a server. On the other hand, it is described that a recovery (and response) target time is defined, and when the time has elapsed, a notification of exceeding the failure recovery time is given.
JP 2007-34353 A

前述の特許文献記載の技術は、顧客の監視対象装置毎に個別に定義された業務フローにより、共通のサービスレベルに基づいた対応時間監視が実現できると考えられるが、インシデント対応業務においては、同一機器から発生したインシデントであっても、障害内容や発生時間・曜日や顧客毎のＳＬＡ情報（顧客毎の契約内容：例えば時刻帯による対応時間）により対応の優先度が異なるため、共通のサービスレベルを用いた対応時間監視では、顧客とのＳＬＡ契約条件を維持することが困難となると言う不具合があった。このため、サービスデスク要員は、インシデント発生元顧客／内容／時間帯により、個別に対応時間をチェックする必要があり、運用品質維持のためには、属人的な運用が排除できないという不具合もあった。 The technology described in the above-mentioned patent document is thought to be able to realize response time monitoring based on a common service level by a business flow defined individually for each device to be monitored by the customer. Even if an incident occurs from a device, the priority of response varies depending on the failure content, time of occurrence, day of the week, and SLA information for each customer (contract content for each customer: response time according to time of day, for example), so a common service level In the response time monitoring using, there is a problem that it becomes difficult to maintain the SLA contract conditions with the customer. For this reason, service desk personnel need to check the response time individually according to the customer / content / time zone of the incident, and there is a problem that personal operation cannot be excluded in order to maintain operational quality. It was.

本発明の目的は、発生したインシデント情報及び顧客毎のＳＬＡ情報から、各インシデントの優先度を動的に変更させ、この優先度からサービス品質を低下させるインシデントを抽出・警告することによって、顧客毎に異なるＳＬＡを定めた場合でも、インシデント管理業務の運用品質の維持を実現することができるインシデント管理システム及び同管理方法並びに同管理プログラムを提供することである。 The object of the present invention is to dynamically change the priority of each incident from the incident information generated and the SLA information for each customer, and extract / warn incidents that degrade the service quality from this priority. It is to provide an incident management system, the same management method, and the same management program that can realize the maintenance of the operational quality of incident management work even when different SLA is defined.

前記目的を達成するために本発明は、監視対象装置の障害に関する顧客名情報と緊急度情報と重要度情報と優先度情報と障害発生時刻情報を含むインシデント情報を入力とするインシデント情報管理部と、顧客との契約に基づいて予め設定された滞留時間定義情報及び滞留時刻帯定義情報並びに前記滞留時間定義情報及び滞留時刻帯定義情報に対応した更新後の優先度情報を記憶するインシデント情報データベースとを備えるインシデント管理システムであって、
前記インシデント情報データベースが、
前記インシデント情報管理部に入力したインシデント情報を格納するインシデント情報格納部と、該インシデント情報格納部に格納したインシデント情報の顧客名情報と緊急度情報と重要度情報との組合せに対応した滞留時間定義情報を含む静的監視定義情報を格納する静的監視定義情報格納部と、前記インシデント情報の顧客名情報と緊急度情報と重要度情報との組合せに対応した滞留時刻帯定義情報を含む動的監視定義情報を格納する動的監視定義情報格納部とを備え、
前記インシデント情報管理部が、
前記インシデント情報格納部にインシデント情報を格納する第１工程と、
該第１工程により格納したインシデント情報の顧客名情報と緊急度情報と重要度情報とが合致する動的監視定義情報を抽出する第２工程と、
前記第１工程で格納したインシデント情報のインシデントの滞留時間が、該第２工程により抽出した動的監視定義情報の滞留時刻帯定義情報に定義した滞留時刻帯か否かを障害発生時刻情報を基に判定する第３工程と、
該第３工程において滞留時刻帯であると判定したとき、前記インシデント情報の優先度情報の優先度を前記動的監視定義情報に含まれる更新後優先度に更新する第４工程と、
前記第３工程において滞留時刻帯でないと判定したとき、前記第１工程により格納したインシデント情報の顧客名情報と緊急度情報と重要度情報とが合致する静的監視定義情報を抽出する第５工程と、
前記第１工程により格納したインシデント情報の滞留時間が、該第５工程で抽出した静的監視定義情報の滞留時間定義情報に定義した滞留時間を超えるか否かを判定する第６工程と、
該第６工程において滞留時間を超えると判定したとき、前記インシデント情報の優先度情報の優先度を前記静的監視定義情報に含まれる更新後優先度に更新する第７工程と、
を実行することを第１の特徴とする。 In order to achieve the above object, the present invention provides an incident information management unit that receives incident information including customer name information, urgency information, importance information, priority information, and failure occurrence time information relating to a failure of a monitoring target device. An incident information database for storing the residence time definition information and residence time zone definition information set in advance based on the contract with the customer, and the updated priority information corresponding to the residence time definition information and the residence time zone definition information; An incident management system comprising:
The incident information database is
Incident information storage unit for storing incident information input to the incident information management unit, and a dwell time definition corresponding to a combination of customer name information, urgency information, and importance information of incident information stored in the incident information storage unit A static monitoring definition information storage unit for storing static monitoring definition information including information, and dynamic information including residence time zone definition information corresponding to a combination of customer name information, urgency information, and importance information of the incident information A dynamic monitoring definition information storage unit for storing monitoring definition information;
The incident information management unit
A first step of storing incident information in the incident information storage unit;
A second step of extracting dynamic monitoring definition information in which the customer name information, the urgency level information, and the importance level information of the incident information stored in the first step match;
Based on the failure occurrence time information, whether the incident residence time of the incident information stored in the first step is the residence time zone defined in the residence time zone definition information of the dynamic monitoring definition information extracted in the second step. A third step of determining
A fourth step of updating the priority of the priority information of the incident information to the post-update priority included in the dynamic monitoring definition information when it is determined that it is a staying time zone in the third step;
Fifth step of extracting static monitoring definition information in which customer name information, urgency level information, and importance level information of the incident information stored in the first step match when it is determined that the time is not a staying time zone in the third step When,
A sixth step of determining whether the residence time of the incident information stored in the first step exceeds the residence time defined in the residence time definition information of the static monitoring definition information extracted in the fifth step;
A seventh step of updating the priority of the priority information of the incident information to the post-update priority included in the static monitoring definition information when it is determined that the residence time is exceeded in the sixth step;
The first feature is to execute the above.

また本発明は、前記特徴のインシデント管理システムにおいて、前記インシデント情報管理部が、インシデント情報に含まれる障害発生時刻情報の時刻からの経過時間を監視する経過時間監視部を備え、前記第６工程におけるインシデントの滞留時間が第５工程により抽出した静的監視定義情報に定義した滞留時間を超えるか否かを、前記経過時間監視部からの経過時間を基に判定することを第２の特徴とする。 In the incident management system according to the present invention, the incident information management unit includes an elapsed time monitoring unit that monitors an elapsed time from the time of the failure occurrence time information included in the incident information. The second feature is to determine whether or not the residence time of the incident exceeds the residence time defined in the static monitoring definition information extracted in the fifth step based on the elapsed time from the elapsed time monitoring unit. .

また本発明は、前記何れかの特徴のインシデント管理システムにおいて、前記インシデント情報管理部が、電子メールの宛先情報を格納し、インシデント情報の顧客情報に対応して設定された宛先に電子メールを発信するメール送信部を備え、前記第４工程及び第７工程により優先度情報を更新したインシデント情報を前記メール送信部が前記設定された宛先に電子メール送信することを第３の特徴とする。 According to the present invention, in the incident management system according to any one of the above features, the incident information management unit stores e-mail destination information and transmits the e-mail to a destination set corresponding to the customer information of the incident information. A third feature is that a mail transmission unit is provided, and incident information whose priority information is updated in the fourth step and the seventh step is transmitted by the mail transmission unit to the set destination.

また本発明は、前記何れかの特徴のインシデント管理システムにおいて、前記インシデント情報管理部が、複数のインシデント情報のリストを表示する表示部を備え、前記第４工程及び第７工程により優先度情報が更新されたインシデント情報の表示色を更新されないインシデント情報の表示色と異なる色により表示することを第４の特徴とする。 According to the present invention, in the incident management system according to any one of the above features, the incident information management unit includes a display unit that displays a list of a plurality of incident information, and the priority information is obtained by the fourth step and the seventh step. A fourth feature is that the display color of the updated incident information is displayed in a color different from the display color of the incident information that is not updated.

更に本発明は、監視対象装置の障害に関する顧客名情報と緊急度情報と重要度情報と優先度情報と障害発生時刻情報を含むインシデント情報を入力とするインシデント情報管理部と、顧客との契約に基づいて予め設定された滞留時間定義情報及び滞留時刻帯定義情報並びに前記滞留時間定義情報及び滞留時刻帯定義情報に対応した更新後の優先度情報を記憶するインシデント情報データベースとを備え、該インシデント情報データベースが、前記インシデント情報管理部に入力したインシデント情報を格納するインシデント情報格納部と、該インシデント情報格納部に格納したインシデント情報の顧客名情報と緊急度情報と重要度情報との組合せに対応した滞留時間定義情報を含む静的監視定義情報を格納する静的監視定義情報格納部と、前記インシデント情報の顧客名情報と緊急度情報と重要度情報との組合せに対応した滞留時刻帯定義情報を含む動的監視定義情報を格納する動的監視定義情報格納部とを有するインシデント管理システムのインシデント管理方法であって、
前記インシデント情報管理部が、
前記インシデント情報格納部にインシデント情報を格納する第１工程と、
該第１工程により格納したインシデント情報の顧客名情報と緊急度情報と重要度情報とが合致する動的監視定義情報を抽出する第２工程と、
前記第１工程で格納したインシデント情報のインシデントの滞留時間が、該第２工程により抽出した動的監視定義情報の滞留時刻帯定義情報に定義した滞留時刻帯か否かを障害発生時刻情報を基に判定する第３工程と、
該第３工程において滞留時刻帯であると判定したとき、前記インシデント情報の優先度情報の優先度を前記動的監視定義情報に含まれる更新後優先度に更新する第４工程と、
前記第３工程において滞留時刻帯でないと判定したとき、前記第１工程により格納したインシデント情報の顧客名情報と緊急度情報と重要度情報とが合致する静的監視定義情報を抽出する第５工程と、
前記第１工程により格納したインシデント情報の滞留時間が、該第５工程で抽出した静的監視定義情報の滞留時間定義情報に定義した滞留時間を超えるか否かを判定する第６工程と、
該第６工程において滞留時間を超えると判定したとき、前記インシデント情報の優先度情報の優先度を前記静的監視定義情報に含まれる更新後優先度に更新する第７工程と、
を実行することを第５の特徴とする。 Further, the present invention provides a contract between an incident information management unit that receives incident information including customer name information, urgency information, importance information, priority information, and failure occurrence time information related to a failure of a monitoring target device, and a customer. An incident information database that stores pre-set residence time definition information and residence time zone definition information, and updated priority information corresponding to the residence time definition information and residence time zone definition information. The database corresponds to an incident information storage unit that stores incident information input to the incident information management unit, and a combination of customer name information, urgency information, and importance information of incident information stored in the incident information storage unit Static monitoring definition information storage unit for storing static monitoring definition information including residence time definition information Incidents in an incident management system having a dynamic monitoring definition information storage unit that stores dynamic monitoring definition information including residence time zone definition information corresponding to a combination of customer name information, urgency information, and importance information of incident information A management method,
The incident information management unit
A first step of storing incident information in the incident information storage unit;
A second step of extracting dynamic monitoring definition information in which the customer name information, the urgency level information, and the importance level information of the incident information stored in the first step match;
Based on the failure occurrence time information, whether the incident residence time of the incident information stored in the first step is the residence time zone defined in the residence time zone definition information of the dynamic monitoring definition information extracted in the second step. A third step of determining
A fourth step of updating the priority of the priority information of the incident information to the post-update priority included in the dynamic monitoring definition information when it is determined that it is a staying time zone in the third step;
Fifth step of extracting static monitoring definition information in which customer name information, urgency level information, and importance level information of the incident information stored in the first step match when it is determined that the time is not a staying time zone in the third step When,
A sixth step of determining whether the residence time of the incident information stored in the first step exceeds the residence time defined in the residence time definition information of the static monitoring definition information extracted in the fifth step;
A seventh step of updating the priority of the priority information of the incident information to the post-update priority included in the static monitoring definition information when it is determined that the residence time is exceeded in the sixth step;
The fifth feature is to execute the above.

また本発明は、前記特徴のインシデント管理方法において、前記インシデント情報管理部に、インシデント情報に含まれる障害発生時刻情報の時刻からの経過時間を監視する経過時間監視部を設け、前記第６工程におけるインシデントの滞留時間が第５工程により抽出した静的監視定義情報に定義した滞留時間を超えるか否かを、前記経過時間監視部からの経過時間を基に判定することを第６の特徴とする。 According to the present invention, in the incident management method of the above feature, the incident information management unit is provided with an elapsed time monitoring unit that monitors an elapsed time from the time of the failure occurrence time information included in the incident information. A sixth feature is to determine whether or not the stay time of an incident exceeds the stay time defined in the static monitoring definition information extracted in the fifth step based on the elapsed time from the elapsed time monitoring unit. .

また本発明は、前記特徴のインシデント管理方法において、前記インシデント情報管理部に、電子メールの宛先情報を格納し、インシデント情報の顧客情報に対応して設定された宛先に電子メールを発信するメール送信部を設け、前記第４工程及び第７工程により優先度情報を更新したインシデント情報を前記メール送信部が前記設定された宛先に電子メール送信することを第７の特徴とする。 Further, the present invention provides the incident management method according to the above feature, wherein the incident information management unit stores e-mail destination information, and sends the e-mail to a destination set corresponding to the customer information of the incident information. A seventh feature is that an email is transmitted to the set destination by the mail transmission unit, incident information whose priority information has been updated in the fourth and seventh steps.

また本発明は、前記何れかの特徴のインシデント管理方法において、前記インシデント情報管理部に、複数のインシデント情報のリストを表示する表示部を設け、前記第４工程及び第７工程により優先度情報が更新されたインシデント情報の表示色を更新されないインシデント情報の表示色と異なる色により表示することを第８の特徴とする。 In the incident management method according to any one of the above features, the incident information management unit includes a display unit that displays a list of a plurality of incident information, and the priority information is obtained by the fourth step and the seventh step. An eighth feature is that the display color of the updated incident information is displayed in a color different from the display color of the incident information that is not updated.

更に本発明は、監視対象装置の障害に関する顧客名情報と緊急度情報と重要度情報と優先度情報と障害発生時刻情報を含むインシデント情報を入力とするインシデント情報管理部と、顧客との契約に基づいて予め設定された滞留時間定義情報及び滞留時刻帯定義情報並びに前記滞留時間定義情報及び滞留時刻帯定義情報に対応した更新後の優先度情報を記憶するインシデント情報データベースとを備え、該インシデント情報データベースが、前記インシデント情報管理部に入力したインシデント情報を格納するインシデント情報格納部と、該インシデント情報格納部に格納したインシデント情報の顧客名情報と緊急度情報と重要度情報との組合せに対応した滞留時間定義情報を含む静的監視定義情報を格納する静的監視定義情報格納部と、前記インシデント情報の顧客名情報と緊急度情報と重要度情報との組合せに対応した滞留時刻帯定義情報を含む動的監視定義情報を格納する動的監視定義情報格納部とを有するインシデント管理システムのインシデント管理プログラムであって、
前記インシデント情報管理部に、
前記インシデント情報格納部にインシデント情報を格納する第１機能と、
該第１機能により格納したインシデント情報の顧客名情報と緊急度情報と重要度情報とが合致する動的監視定義情報を抽出する第２機能と、
前記第１機能で格納したインシデント情報のインシデントの滞留時間が、該第２機能により抽出した動的監視定義情報の滞留時刻帯定義情報に定義した滞留時刻帯か否かを障害発生時刻情報を基に判定する第３機能と、
該第３機能において滞留時刻帯であると判定したとき、前記インシデント情報の優先度情報の優先度を前記動的監視定義情報に含まれる更新後優先度に更新する第４機能と、
前記第３機能において滞留時刻帯でないと判定したとき、前記第１機能により格納したインシデント情報の顧客名情報と緊急度情報と重要度情報とが合致する静的監視定義情報を抽出する第５機能と、
前記第１工程により格納したインシデント情報の滞留時間が、該第５機能で抽出した静的監視定義情報の滞留時間定義情報に定義した滞留時間を超えるか否かを判定する第６機能と、
該第６機能において滞留時間を超えると判定したとき、前記インシデント情報の優先度情報の優先度を前記静的監視定義情報に含まれる更新後優先度に更新する第７機能と、
を実現させることを第９の特徴とする。 Further, the present invention provides a contract between an incident information management unit that receives incident information including customer name information, urgency information, importance information, priority information, and failure occurrence time information related to a failure of a monitoring target device, and a customer. An incident information database that stores pre-set residence time definition information and residence time zone definition information, and updated priority information corresponding to the residence time definition information and residence time zone definition information. The database corresponds to an incident information storage unit that stores incident information input to the incident information management unit, and a combination of customer name information, urgency information, and importance information of incident information stored in the incident information storage unit Static monitoring definition information storage unit for storing static monitoring definition information including residence time definition information Incidents in an incident management system having a dynamic monitoring definition information storage unit that stores dynamic monitoring definition information including residence time zone definition information corresponding to a combination of customer name information, urgency information, and importance information of incident information A management program,
In the incident information management department,
A first function for storing incident information in the incident information storage unit;
A second function for extracting dynamic monitoring definition information in which customer name information, urgency information, and importance information of incident information stored by the first function match;
Based on the failure occurrence time information, whether the incident residence time of the incident information stored by the first function is the residence time zone defined in the residence time zone definition information of the dynamic monitoring definition information extracted by the second function. A third function for determining
A fourth function for updating the priority of the priority information of the incident information to the post-update priority included in the dynamic monitoring definition information when the third function determines that it is a staying time zone;
A fifth function for extracting static monitoring definition information in which customer name information, urgency information, and importance information of incident information stored by the first function match when it is determined that the time is not a staying time zone in the third function When,
A sixth function for determining whether or not the residence time of the incident information stored in the first step exceeds the residence time defined in the residence time definition information of the static monitoring definition information extracted by the fifth function;
A seventh function that updates the priority of the priority information of the incident information to the post-update priority included in the static monitoring definition information when it is determined that the residence time is exceeded in the sixth function;
The ninth feature is to realize the above.

また本発明は、前記特徴のインシデント管理プログラムにおいて、前記インシデント情報管理部が、インシデント情報に含まれる障害発生時刻情報の時刻からの経過時間を監視する経過時間監視部を備え、
該インシデント情報管理部に、
前記第６機能におけるインシデントの滞留時間が第５機能により抽出した静的監視定義情報に定義した滞留時間を超えるか否かを、前記経過時間監視部からの経過時間を基に判定することを第１０の特徴とする。 In the incident management program according to the present invention, the incident information management unit includes an elapsed time monitoring unit that monitors an elapsed time from the time of failure occurrence time information included in the incident information,
In the incident information management department,
Determining whether the residence time of the incident in the sixth function exceeds the residence time defined in the static monitoring definition information extracted by the fifth function based on the elapsed time from the elapsed time monitoring unit; Ten features.

また本発明は、前記何れかの特徴のインシデント管理プログラムにおいて、前記インシデント情報管理部が、電子メールの宛先情報を格納し、インシデント情報の顧客情報に対応して設定された宛先に電子メールを発信するメール送信部を備え、
前記インシデント情報管理部に、
前記第４機能及び第７機能により優先度情報を更新したインシデント情報を前記メール送信部が前記設定された宛先に電子メール送信する機能を実現させることを第１１の特徴とする。 According to the present invention, in the incident management program according to any one of the above features, the incident information management unit stores e-mail destination information and sends the e-mail to a destination set corresponding to the customer information of the incident information. With an email sender
In the incident information management department,
An eleventh feature is that the mail transmitting unit realizes a function of transmitting the e-mail to the set destination by incident information whose priority information is updated by the fourth function and the seventh function.

また本発明は、前記何れかの特徴のインシデント管理プログラムにおいて、前記インシデント情報管理部が、複数のインシデント情報のリストを表示する表示部を備え、
前記インシデント情報管理部に、
前記第４機能及び第７機能により優先度情報が更新されたインシデント情報の表示部への表示色を更新されないインシデント情報の表示色と異なる色により表示する機能を実現させることを第１２の特徴とする。 In the incident management program according to any one of the above features, the incident information management unit includes a display unit that displays a list of a plurality of incident information.
In the incident information management department,
A twelfth feature is to realize a function of displaying the display color of the incident information whose priority information is updated by the fourth function and the seventh function in a color different from the display color of the incident information which is not updated. To do.

本発明によるインシデント管理システム及び同管理方法並びに同管理プログラムは、監視装置から受信したインシデント情報の顧客名情報と緊急度情報と重要度情報とが合致する動的監視定義情報を抽出し、該インシデント情報のインシデントの滞留時刻帯が、前記抽出した動的監視定義情報の滞留時刻帯に含まれるとき、前記インシデント情報の優先度情報の優先度を前記動的監視定義情報に含まれる更新優先度に更新し、前記抽出した動的監視定義情報の滞留帯に含まれないとき、前記インシデント情報の顧客名情報と緊急度情報と重要度情報とが合致する静的監視定義情報を抽出し、インシデント情報の滞留時間が、抽出した静的定義情報の滞留定義時間を超えるとき、前記インシデント情報の優先度情報の優先度を前記静的監視定義情報に含まれる更新優先度に更新し、前記優先度を更新したインシデント情報を顧客情報に対応して設定された保守員等の宛先に電子メールを発信する様に動作する。 The incident management system, the management method, and the management program according to the present invention extract dynamic monitoring definition information in which customer name information, urgency information, and importance information of incident information received from a monitoring device match, and the incident When the stay time zone of the incident of information is included in the stay time zone of the extracted dynamic monitoring definition information, the priority of the priority information of the incident information is set to the update priority included in the dynamic monitoring definition information. When the updated dynamic monitoring definition information is not included in the retention zone of the extracted dynamic monitoring definition information, the static monitoring definition information that matches the customer name information, the urgency information, and the importance information of the incident information is extracted, and the incident information If the retention time exceeds the retention definition time of the extracted static definition information, the priority information priority of the incident information is set to the static monitoring definition. Update to update the priority that is included in the broadcast, to operate so as to outgoing e-mail to a destination such as the incident information that updates the priority has been set corresponding to the customer information maintenance personnel.

以下、本発明によるインシデント管理システム及び同管理方法並びに同管理プログラムの一実施形態を図面を参照して詳細に説明する。図１は、本発明によるインシデント経過時間監視方法及び同プログラムを実現するコンピュータシステムの概略構成を示す図、図２は本実施形態による動的監視定義情報及び静的監視定義情報の定義例を説明するための図、図３は、本実施形態によるインシデント経過時間監視方法の動作を説明するための図、図４は、本実施形態によるインシデント情報の一覧画面表示例を示す図、図５は、本実施形態によるインシデント経過時間監視動作のフローチャート図である。
［構成の説明］
本実施形態によるインシデント経過時間監視方法及び同プログラムを実現するコンピュータシステムは、図１に示す如く、各種業務処理を行うコンピュータである複数の監視対象装置２及び該複数の監視対象装置２の障害等を監視する障害監視装置３とから成るデータセンタ１と、該データセンタ１とインターネット通信回線網４を介して接続され、前記障害監視装置３からのインシデント情報を基に発生した障害に対応するための監視センタ５と、前記監視対象装置２とインターネット通信回線網４を介して接続され、各種業務等を操作するユーザ側の端末装置（図示せず）とから構成される。 Hereinafter, an embodiment of an incident management system, the management method, and the management program according to the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing a schematic configuration of an incident elapsed time monitoring method and a computer system that implements the program according to the present invention, and FIG. 2 illustrates definition examples of dynamic monitoring definition information and static monitoring definition information according to the present embodiment. FIG. 3 is a diagram for explaining the operation of the incident elapsed time monitoring method according to the present embodiment, FIG. 4 is a diagram showing an incident information list screen display example according to the present embodiment, and FIG. It is a flowchart figure of the incident elapsed time monitoring operation | movement by this embodiment.
[Description of configuration]
As shown in FIG. 1, a computer system that implements the incident elapsed time monitoring method and the program according to the present embodiment includes a plurality of monitoring target devices 2 that are computers for performing various business processes, failures of the plurality of monitoring target devices 2, and the like. In order to respond to a failure that occurs based on incident information from the failure monitoring device 3 connected to the data center 1 via the Internet communication line network 4. And a terminal device (not shown) on the user side that is connected to the monitoring target device 2 via the Internet communication network 4 and operates various operations.

前記監視センタ５は、前記障害監視装置３から送られるインシデント情報を入力としてインシデント（障害）の経過時間を監視し、ワークフローに従った障害対策業務を制御するインシデント情報管理部１０と、前記前記障害監視装置３から送られるインシデント情報を格納するインシデント情報格納部２１並びに本実施形態の特徴である静的監視定義情報格納部２２及び動的監視定義情報記憶部２３とを備えるインシデント情報データベース２０と、前記インシデント情報管理部１０にアクセスしてインシデントの監視並びに対応を行うための複数の運用端末６とから構成される。尚、前記運用端末６を用いた対策とは、例えば、障害の受け付け業務と、障害内容に応じて該運用端末６により対処可能なものは当該運用端末６を用いて対処し、保守員を派遣する必要がある場合は、予め設定された保守員のメールアドレス宛に当該インシデントの連絡並びに派遣依頼のメールを発する業務、前記対処結果を記録させる業務、顧客に障害に応じた報告を行う業務等が挙げられ、これら機能を行う機能部を含むものとする。 The monitoring center 5 receives incident information sent from the failure monitoring device 3 as an input, monitors the elapsed time of incidents (failures), and controls an incident information management unit 10 that controls failure countermeasure work according to a workflow; and the failure An incident information database 20 comprising an incident information storage unit 21 for storing incident information sent from the monitoring device 3, and a static monitoring definition information storage unit 22 and a dynamic monitoring definition information storage unit 23 which are features of the present embodiment; It comprises a plurality of operation terminals 6 for accessing the incident information management unit 10 and monitoring and responding to incidents. The countermeasures using the operation terminal 6 are, for example, a fault acceptance operation and those that can be dealt with by the operation terminal 6 according to the contents of the failure, deal with the operation terminal 6 and dispatch maintenance personnel. If there is a need to do so, work to send a notification email and dispatch request email to the email address of a maintenance staff set in advance, work to record the response results, work to report to the customer according to the trouble, etc. And includes a functional unit that performs these functions.

前記インシデント情報管理部１０は、前記インシデント情報を前記障害監視装置３から入力するための障害情報入力部１１と、現在時刻を計数するタイマーを含み、該障害情報入力部１１により入力したインシデント情報の経過時間を監視する経過時間監視部１２と、前記運用端末６を操作するオペレータの指示によってインシデント（障害）に対応する処理のワークフローを制御するワークフロー制御部１３とを備える。 The incident information management unit 10 includes a failure information input unit 11 for inputting the incident information from the failure monitoring device 3 and a timer for counting the current time. An elapsed time monitoring unit 12 that monitors the elapsed time and a workflow control unit 13 that controls a workflow of processing corresponding to an incident (failure) according to an instruction from an operator who operates the operation terminal 6 are provided.

前記障害監視装置３から入力されるインシデント情報は、図３に示す、インシデント毎に一意に付与されたインシデントＩＤと、該インシデントの発生時刻と、顧客名と、当該インシデントに対応する業務の経過である業務ステップ名（例えば、受付−対策−報告の各ステップ）と、当該インシデントの緊急度／重要度／優先度と、その他インシデント内容等の各項目とから成り、前記障害監視装置３が各監視対象装置２からの各種情報を基に所定の規則（例えば、障害内容及び顧客対応並びに滞留時間毎に予め設定した「緊急度」や「重要度」を付与する規則）に従って作成し、監視センタ５に送信するものである。尚、図３に示したインシデント情報中には、「業務ステップ開始日時」及び「業務ステップ終了日時」の各欄を図示しているが、この各欄の情報は前記インシデント情報管理部１０がインシデント情報を受け付けた後に付与されるものである。 The incident information input from the failure monitoring device 3 includes the incident ID uniquely assigned to each incident, the occurrence time of the incident, the customer name, and the progress of work corresponding to the incident shown in FIG. It consists of a certain business step name (for example, each step of reception-countermeasure-report), urgency / importance / priority of the incident, and other items such as incident contents. Based on various information from the target device 2, it is created according to predetermined rules (for example, rules for assigning “emergency” and “importance” preset for each failure time, customer response, and residence time), and the monitoring center 5 To send to. In the incident information shown in FIG. 3, “business step start date and time” and “business step end date and time” fields are shown. The information in each field is stored by the incident information management unit 10. It is given after receiving information.

前記インシデント情報データベース２０は、インシデント情報管理部１０の障害情報入力部１１が入力した図３に示した形式のインシデント情報を格納するためのインシデント情報格納部２１と、図２に示した顧客１００毎の滞留時間１０１に対応した時間帯に係わらない変更後の優先度（「最高」「高」「中」「低」）１０２を格納する静的監視定義情報格納部２２と、顧客１０３毎／対象業務ステップレベル１０４／緊急度１０５／重要度１０６／発生時刻帯１０７／滞留時間１０８に対応した変更後の優先度１０９を格納する動的監視定義情報記憶部２３とを有する。例えば、図２に示す静的監視定義情報格納部２２の顧客Ａの滞留時間１０１が、業務ステップや緊急度や時間帯に係わらず、１５分を経過したときには優先度１０２を「高」に変更する等の静的な変更条件が設定され、動的監視定義情報記憶部２３の顧客Ａの対象業務ステップ名１０４が「受付」、且つ緊急度１０５が「高」、且つ重要度１０６が「最高」のインシデント（障害）が、発生時間帯「平日の８：３０から９：００」１０７内に発生したときには、優先度１０９を「最高」に変更する等の動的な変更条件が設定されている。 The incident information database 20 includes an incident information storage unit 21 for storing incident information in the format shown in FIG. 3 input by the failure information input unit 11 of the incident information management unit 10, and each customer 100 shown in FIG. Static monitoring definition information storage unit 22 for storing priorities ("highest", "high", "medium", and "low") 102 that are not related to the time zone corresponding to the residence time 101 of each customer, and for each customer 103 / target And a dynamic monitoring definition information storage unit 23 for storing the changed priority 109 corresponding to the business step level 104 / the degree of urgency 105 / the degree of importance 106 / the occurrence time zone 107 / the residence time 108. For example, the priority 102 is changed to “high” when the stay time 101 of the customer A in the static monitoring definition information storage unit 22 shown in FIG. 2 passes 15 minutes regardless of the business step, the urgency level, and the time zone. Static change condition such as “Yes” is set, the target job step name 104 of the customer A in the dynamic monitoring definition information storage unit 23 is “reception”, the urgency 105 is “high”, and the importance 106 is “highest” When the incident “failure” occurs within the time period “weekdays 8:30 to 9:00” 107, a dynamic change condition such as changing the priority 109 to “highest” is set. Yes.

また前記静的監視定義情報格納部２２及び動的監視定義情報記憶部２３に設定した優先度の変更条件は、顧客毎に交わされたＳＬＡの契約条件情報（例えば、顧客Ａに対しては、時刻帯に係わらず１５分以上、インシデントが滞留した場合は、優先度を「高」とし、図２に示した動的条件１０３〜１０６に合致したインシテントが平日の指定時刻帯１０７に発生した場合は、優先度１０９を「最高」とする契約内容の情報）に応じて予め設定されている。
［動作の説明］
次に本実施形態によるインシデント経過時間監視方法及びインシデント経過時間監視プログラムを採用したコンピュータシステムにおいて、図３（ｄ）に示す如く、図１のコンピュータシステムの監視対象装置２に以下（ａ）〜（ｄ）に挙げるインシデントが発生し、このインシデントにより障害監視装置３がインシデント情報を監視センタ５に送信したものとして説明する。 The priority change conditions set in the static monitoring definition information storage unit 22 and the dynamic monitoring definition information storage unit 23 are the contract condition information of the SLA exchanged for each customer (for example, for customer A, When the incident stays for 15 minutes or more regardless of the time zone, the priority is set to “high”, and the intent corresponding to the dynamic conditions 103 to 106 shown in FIG. Is set in advance in accordance with the contract content information that sets the priority 109 to “highest”.
[Description of operation]
Next, in the computer system employing the incident elapsed time monitoring method and the incident elapsed time monitoring program according to the present embodiment, as shown in FIG. 3D, the monitoring target device 2 of the computer system of FIG. It is assumed that the incident listed in d) occurs and the failure monitoring apparatus 3 has transmitted incident information to the monitoring center 5 due to this incident.

（ａ）インシデントＩＤ１１０：顧客Ａの業務処理にインシデント（障害）が発生したことを時刻８：２０に受け付け、８：２５から対策を講じたインシデントであって、業務ステップが「対策」、緊急度が「低」、重要度が「低」。
（ｂ）インシデントＩＤ１１１：顧客Ａの業務処理にインシデント（障害）が発生したことを時刻８：３５に受け付けたインシデントであって、業務ステップが「受付」、緊急度が「高」、重要度が「最高」。 (A) Incident ID 110: Incident that an incident (failure) occurred in the business process of customer A at time 8:20, an incident for which countermeasures were taken from 8:25, the business step was “Countermeasure”, and the urgency level Is low and importance is low.
(B) Incident ID 111: Incident received at time 8:35 that an incident (failure) occurred in the business process of customer A, the business step is “reception”, the urgency is “high”, and the importance is "Best".

（ｃ）インシデントＩＤ１１２：顧客Ｂの業務処理にインシデント（障害）が発生したことを時刻８：４５に受け付け、９：００から対策を講じたインシデントであって、業務ステップが「対策」、緊急度が「低」、重要度が「低」。
（ｄ）インシデントＩＤ１１３：顧客Ｂの業務処理にインシデント（障害）が発生したことを時刻９：０５に受け付け、９：１０から対策を講じたインシデントであって、業務ステップが「対策」、緊急度が「中」、重要度が「中」。 (C) Incident ID 112: An incident (failure) occurred in the business process of customer B at time 8:45, an incident for which a countermeasure was taken from 9:00, and the business step was “Countermeasure”. Is low and importance is low.
(D) Incident ID 113: Incident that an incident (failure) occurred in the business process of customer B at time 9:05, an incident for which measures were taken from 9:10, the business step was “measure”, and the urgency level Is “medium” and importance is “medium”.

上述のような複数のインシデント（ａ）〜（ｄ）が発生した場合、本実施形態によるコンピュータシステムは、図５に示す如く、インシデント情報管理部１０が、業務ステップ処理が完了していないインシデント情報（業務ステップの完了日時が定義されていない情報）を読み込むステップ４０１と、インシデント情報データベース２０の動的監視定義情報記憶部２３から図３（ｂ）に示す動的監視定義情報を読み込むステップ４０２と、前記ステップ４０１により読み込んだインシデント情報の監視定義情報（「顧客名」「対象業務ステップ名」「緊急度」「重要度」）と前記ステップ４０２により読み込んだ動的監視定義情報の監視定義情報とが合致するか否かを判定するステップ４０３とを実行することによって、入力したインデント情報の監視条件が動的監視条件に合致するか否か、即ち、「顧客名」「対象業務ステップ名」「緊急度」「重要度」の組合せによる監視条件が予め定めた監視条件に合致するか否かを判定する。 When a plurality of incidents (a) to (d) as described above occur, the computer system according to the present embodiment, as shown in FIG. 5, the incident information management unit 10 does not complete the business step process. Step 401 for reading (information in which the completion date and time of the business step is not defined), Step 402 for reading the dynamic monitoring definition information shown in FIG. 3B from the dynamic monitoring definition information storage unit 23 of the incident information database 20 Monitoring definition information of incident information read in step 401 (“customer name”, “target business step name”, “urgency”, “importance”) and monitoring definition information of dynamic monitoring definition information read in step 402 The indent entered by performing step 403 to determine whether or not Whether the monitoring condition of the information matches the dynamic monitoring condition, that is, the monitoring condition based on the combination of “customer name”, “target job step name”, “urgent level”, and “importance” matches the predetermined monitoring condition It is determined whether or not.

次いで本システムは、前記ステップ４０３により動的な監視条件が合致すると判定したとき、インシデント情報の「業務ステップ開始時刻」とタイマーから得た現在時刻とから滞留時間を計算し、該滞留時間が動的監視定義情報の「滞留時間」を超えているか否かを判定し、超えていないと判定したときに処理を終了するステップ４０４と、該ステップ４０４により滞留時間が設定した滞留時間を超えていると判定したとき、インシデント情報の「優先度」を動的監視定義情報に設定された「優先度」に更新するステップ４０５を実行する。この「優先度」の更新とは、例えば図３（ａ）のインシデントＩＤ１１１のインシデント情報の監視定義情報（「顧客名」「対象業務ステップ名」「緊急度」「重要度」）が、図３（ｃ）に示す動的監視定義情報の最上段の監視条件と一致し、且つ滞留時間が１０分を超えているため、インシデントＩＤ１１１のインシデント情報の優先度「低」を動的監視定義情報に設定した優先度「最高」に変更することである。 Next, when it is determined in step 403 that the dynamic monitoring condition is met, the system calculates the residence time from the “business step start time” of the incident information and the current time obtained from the timer, and the residence time is changed. Step 404 that terminates the process when it is determined whether or not the “stay time” of the general monitoring definition information has been exceeded, and when it has not been exceeded, and the stay time set by the step 404 exceeds the stay time When it is determined, step 405 is executed to update the “priority” of the incident information to the “priority” set in the dynamic monitoring definition information. This “priority” update refers to, for example, monitoring definition information (“customer name”, “target business step name”, “emergency”, “importance”) of incident information of incident ID 111 in FIG. Since it matches the uppermost monitoring condition of the dynamic monitoring definition information shown in (c) and the residence time exceeds 10 minutes, the priority “low” of the incident information of incident ID 111 is set as the dynamic monitoring definition information. The priority is to change to the highest priority set.

他方、前述のステップ４０３において動的な監視条件が一致しないと判定したとき、本システムは、静的監視定義情報格納部２２から図３（ｂ）に示す静的監視定義情報を読み込むステップ４０７と、前記ステップ４０１により読み込んだインシデント情報の監視定義情報（「顧客名」「対象業務ステップ名」「緊急度」「重要度」）と前記ステップ４０７により読み込んだ静的監視定義情報の監視定義情報とが合致するか否かを判定し、合致しないと判定したときに処理を終了するステップ４０８と、該ステップ４０８において滞留時間が設定した滞留時間を超えていると判定したとき、インシデント情報の「優先度」を静的監視定義情報に設定された「優先度」に更新するステップ４０９を実行する。この「優先度」の更新とは、例えば図３（ａ）のインシデントＩＤ１１０のインシデント情報の監視定義情報（「顧客名」「対象業務ステップ名」「緊急度」「重要度」の組合せ）が、図３（ｂ）に示す静的監視定義情報の最上段の監視条件と一致し、滞留時間が１５分を超えているため、インシデントＩＤ１１０のインシデント情報の優先度「低」を静的監視定義情報に設定した優先度「高」に変更することである。 On the other hand, when it is determined in step 403 that the dynamic monitoring conditions do not match, the system reads the static monitoring definition information shown in FIG. , The incident information monitoring definition information (“customer name”, “target business step name”, “emergency”, “importance”) read in step 401, and the static monitoring definition information monitoring definition information read in step 407, Is determined to match, and when it is determined that they do not match, step 408 is terminated, and when it is determined that the dwell time set in step 408 exceeds the dwell time set in the incident information, Step 409 is executed to update “degree” to “priority” set in the static monitoring definition information. This “priority” update refers to, for example, monitoring definition information (combination of “customer name”, “target business step name”, “urgent level”, “importance”) of incident information of incident ID 110 in FIG. It matches the top monitoring condition of the static monitoring definition information shown in FIG. 3B, and the residence time exceeds 15 minutes. Therefore, the priority “low” of the incident information of incident ID 110 is set to the static monitoring definition information. The priority is set to “high”.

ここで、本コンピュータシステムの運用端末６の操作画面は、図４に示したインシデント一覧画面の如く、インシデント管理システムにログインしたユーザ名が表示されるユーザ名欄３００と、ログインしたユーザに処理が割り当てられ、ログインしたユーザに処理が割り当てられたインシデント情報が一覧表示される一覧欄３０２と、択一選択された一覧欄３０２のインシデント情報の業務ステップ処理を開始する業務ステップ処理開始ボタン欄３０１と、一覧欄３０２に表示されるインシデント情報の並び替えを設定するための並び替えドロップダウンボタン３０３とが表示され、前述のステップ４０５又は４０９により「優先度」が更新された場合、図のインシデントＩＤ１１０及び１１０に示す如く優先度が更新表示されると共に、優先度が更新されたインシデントは、経過時間監視により滞留しているインシデントとして優先度毎に表示色が変化し、処理が滞留していることを運用端末６の操作者に対して強調表示する様に動作する。 Here, the operation screen of the operation terminal 6 of this computer system includes a user name column 300 in which the user name logged in to the incident management system is displayed, as in the incident list screen shown in FIG. A list field 302 that displays a list of incident information assigned to the logged-in user and a business step process start button field 301 that starts a business step process for incident information in the selected and selected list field 302; When the sort drop-down button 303 for setting the sort of incident information displayed in the list field 302 is displayed and the “priority” is updated in the above-described step 405 or 409, the incident ID 110 in the figure is displayed. And 110, the priority is updated and displayed, Incidents that have been updated in advance are displayed as incidents that remain due to elapsed time monitoring, and the display color changes for each priority, and the fact that the processing is retained is highlighted to the operator of the operation terminal 6 To work.

次いで本実施形態によるコンピュータシステムは、インシデント情報管理部１０が、図５に示した前述のステップ４０５又は４０８によりインシデント情報の「優先度」を更新したインシデント情報を当該インシデントに予め登録した保守担当者等に当該インシデント状況をメール送信を行うステップ４０６又は４１０を実行して処理を終了することにより、障害監視装置３から報告されたインシデント情報を基に、顧客毎の契約条件に応じて予め変更後の「優先度」が設定された動的及び静的監視定義情報を基に、「優先度」を更新し、この更新した「優先度」のインシデント情報を保守担当者にメール等によって連絡することができる。 Next, in the computer system according to the present embodiment, the incident information management unit 10 has previously registered the incident information in which the “priority” of the incident information is updated in step 405 or 408 shown in FIG. By executing step 406 or 410 for sending the incident status by e-mail, etc. and ending the processing, the incident status is changed in advance according to the contract conditions for each customer based on the incident information reported from the failure monitoring device 3 Update the "priority" based on the dynamic and static monitoring definition information for which the "priority" is set, and notify the maintenance staff of the updated "priority" incident information by e-mail etc. Can do.

このように本実施形態によるインシデント管理システム及び同管理方法並びに同管理プログラムは、監視センタ５のインシデント情報管理部１０がデータセンタ１の障害監視装置３から報告されたインシデント情報を入力し、インシデント情報データベース２０の静的監視定義情報格納部２２及び動的監視定義情報記憶部２３に格納された静的及び動的監視定義情報の監視条件（「顧客名」「対象業務ステップ名」「緊急度」「重要度」の組合せ）と合致するインシデント情報の「優先度」を、前記静的及び動的監視定義情報に予め設定したＳＬＡ契約条件に応じて優先度を更新し、運用端末６の操作者及び保守担当者に知らしめることができる。 As described above, the incident management system, the management method, and the management program according to the present embodiment input the incident information reported from the failure monitoring device 3 of the data center 1 by the incident information management unit 10 of the monitoring center 5, and the incident information Monitoring conditions (“customer name”, “target business step name”, “urgency”) of static and dynamic monitoring definition information stored in the static monitoring definition information storage unit 22 and the dynamic monitoring definition information storage unit 23 of the database 20 The operator of the operation terminal 6 updates the priority according to the SLA contract conditions set in advance in the static and dynamic monitoring definition information for the “priority” of the incident information that matches the “importance” combination) And the maintenance staff.

本発明の一実施形態によるインシデント管理システム及び同管理方法並びに同管理プログラムを実現するコンピュータシステムの概略構成を示す図。The figure which shows schematic structure of the computer system which implement | achieves the incident management system by the one embodiment of this invention, the management method, and the management program. 本実施形態による動的監視定義情報及び静的監視定義情報の定義例を説明するための図。The figure for demonstrating the example of a definition of the dynamic monitoring definition information by this embodiment, and static monitoring definition information. 本実施形態によるインシデント管理方法の動作を説明するための図。The figure for demonstrating operation | movement of the incident management method by this embodiment. 本実施形態によるインシデント情報の一覧画面表示例を示す図。The figure which shows the list screen display example of incident information by this embodiment. 本実施形態によるインシデント管理方法動作のフローチャート図。The flowchart figure of the incident management method operation | movement by this embodiment.

Explanation of symbols

１：データセンタ、２：監視対象機器、３：障害監視装置、４：インターネット通信回線網、５：監視センタ、６：運用端末、１０：インシデント情報管理部、１１：障害情報入力部、１２：経過時間監視部、１３：ワークフロー制御部、２０：インシデント情報データベース、２１：インシデント情報格納部、２２：静的監視定義情報格納部、２３：動的監視定義情報格納部。 1: data center, 2: monitored device, 3: fault monitoring device, 4: internet communication network, 5: monitoring center, 6: operation terminal, 10: incident information management unit, 11: fault information input unit, 12: Elapsed time monitoring unit, 13: workflow control unit, 20: incident information database, 21: incident information storage unit, 22: static monitoring definition information storage unit, and 23: dynamic monitoring definition information storage unit.

Claims

An incident information management unit that inputs incident information including customer name information, urgency information, importance information, priority information, and failure occurrence time information regarding the failure of the monitored device, and preset based on a contract with the customer An incident management system comprising an incident information database for storing residence time definition information and residence time zone definition information, and updated priority information corresponding to the residence time definition information and residence time zone definition information,
The incident information database is
An incident information storage unit that stores incident information input to the incident information management unit, residence time definition information corresponding to a combination of the customer name information, urgency information, and importance information, and the residence time definition information Static monitoring definition information storage unit for storing dynamic monitoring definition information including priority information after update, residence time zone definition information corresponding to a combination of the customer name information, urgency information and importance information, and A dynamic monitoring definition information storage unit for storing dynamic monitoring definition information including updated priority information corresponding to the stay time definition information,
The incident information management unit
A first step of storing incident information in the incident information storage unit;
A second step of extracting, from the dynamic monitoring definition information storage unit, dynamic monitoring definition information in which customer name information, urgency information, and importance level information of incident information stored in the first step match;
Whether or not the stay time of the incident information stored in the first step is the stay time zone defined in the stay time zone definition information of the dynamic monitoring definition information extracted in the second step is determined as the failure occurrence time of the incident information. A third step of determining based on the information;
A fourth step of updating the priority of the priority information of the incident information to the post-update priority included in the dynamic monitoring definition information when it is determined that it is a staying time zone in the third step;
When it is determined in the third step that the time is not a staying time zone, the static monitoring definition information in which the customer name information, the urgency level information, and the importance level information of the incident information stored in the first step match is set as the static monitoring definition information. A fifth step of extracting from the storage unit;
A sixth step of determining whether the residence time of the incident information stored in the first step exceeds the residence time defined in the residence time definition information of the static monitoring definition information extracted in the fifth step;
A seventh step of updating the priority of the priority information of the incident information to the post-update priority included in the static monitoring definition information when it is determined that the residence time is exceeded in the sixth step;
Incident management system that executes.

The incident information management unit includes an elapsed time monitoring unit that monitors an elapsed time from the time of failure occurrence time information included in the incident information with a timer, and the incident residence time in the sixth step is extracted in the fifth step The incident management system according to claim 1, wherein whether or not the residence time defined in the static monitoring definition information is exceeded is determined based on the elapsed time from the elapsed time monitoring unit.

The incident information management unit includes a mail transmission unit that stores e-mail destination information and transmits an e-mail to a destination set corresponding to the customer information of the incident information, and includes the fourth step and the seventh step. The incident management system according to claim 1, wherein the mail transmission unit transmits the incident information whose priority information has been updated to the set destination.

The incident information management unit includes a display unit that displays a list of a plurality of incident information, and the display unit does not update the display color of the incident information whose priority information has been updated in the fourth and seventh steps. The incident management system according to any one of claims 1 to 3, wherein the incident information is displayed in a color different from a display color of the incident information.

The incident information management unit that receives incident information including the customer name information, urgency information, importance level information, priority level information, and failure occurrence time information related to the failure of the monitored device is preset based on the contract with the customer. And an incident information database that stores updated priority information corresponding to the residence time definition information and the residence time zone definition information, and the incident information database includes the incident information database. An incident information storage unit for storing incident information input to the information management unit, and residence time definition information corresponding to a combination of customer name information, urgency information, and importance information of incident information stored in the incident information storage unit. A static monitoring definition information storage unit for storing static monitoring definition information including the incident Management of an incident management system having a dynamic monitoring definition information storage unit for storing dynamic monitoring definition information including residence time zone definition information corresponding to a combination of customer name information, urgency level information, and importance level information A method,
The incident information management unit
A first step of storing incident information in the incident information storage unit;
A second step of extracting, from the dynamic monitoring definition information storage unit, dynamic monitoring definition information in which customer name information, urgency information, and importance level information of incident information stored in the first step match;
Whether or not the stay time of the incident information stored in the first step is the stay time zone defined in the stay time zone definition information of the dynamic monitoring definition information extracted in the second step is determined as the failure occurrence time of the incident information. A third step of determining based on the information;
A fourth step of updating the priority of the priority information of the incident information to the post-update priority included in the dynamic monitoring definition information when it is determined that it is a staying time zone in the third step;
When it is determined in the third step that the time is not a staying time zone, the static monitoring definition information in which the customer name information, the urgency level information, and the importance level information of the incident information stored in the first step match is set as the static monitoring definition information. A fifth step of extracting from the storage unit;
A sixth step of determining whether the residence time of the incident information stored in the first step exceeds the residence time defined in the residence time definition information of the static monitoring definition information extracted in the fifth step;
A seventh step of updating the priority of the priority information of the incident information to the post-update priority included in the static monitoring definition information when it is determined that the residence time is exceeded in the sixth step;
Incident management method to execute.

The incident information management unit is provided with an elapsed time monitoring unit that monitors the elapsed time from the time of failure occurrence time information included in the incident information, and the incident residence time in the sixth step is extracted by the fifth step 6. The incident management method according to claim 5, wherein whether or not the residence time defined in the monitoring definition information is exceeded is determined based on the elapsed time from the elapsed time monitoring unit.

The incident information management unit is provided with a mail transmission unit that stores e-mail destination information and transmits an e-mail to a destination set corresponding to the customer information of the incident information. According to the fourth step and the seventh step, The incident management method according to claim 5 or 6, wherein the mail transmitting unit transmits the incident information whose priority information is updated to the set destination.

The incident information management unit is provided with a display unit for displaying a list of a plurality of incident information, and the display unit is not updated with the display color of the incident information whose priority information has been updated in the fourth and seventh steps. The incident management method according to claim 5, wherein the incident information is displayed in a color different from the display color of the incident information.

The incident information management unit that receives incident information including the customer name information, urgency information, importance level information, priority level information, and failure occurrence time information related to the failure of the monitored device is preset based on the contract with the customer. And an incident information database that stores updated priority information corresponding to the residence time definition information and the residence time zone definition information, and the incident information database includes the incident information database. An incident information storage unit for storing incident information input to the information management unit, and residence time definition information corresponding to a combination of customer name information, urgency information, and importance information of incident information stored in the incident information storage unit. A static monitoring definition information storage unit for storing static monitoring definition information including the incident Management of an incident management system having a dynamic monitoring definition information storage unit for storing dynamic monitoring definition information including residence time zone definition information corresponding to a combination of customer name information, urgency level information, and importance level information A program,
In the incident information management department,
A first function for storing incident information in the incident information storage unit;
A second function for extracting, from the dynamic monitoring definition information storage unit, dynamic monitoring definition information in which customer name information, urgency information, and importance level information of incident information stored by the first function match;
Whether or not the stay time of the incident information stored by the first function is the stay time zone defined in the stay time zone definition information of the dynamic monitoring definition information extracted by the second function is determined as the failure occurrence time of the incident information. A third function for determining based on information;
A fourth function for updating the priority of the priority information of the incident information to the post-update priority included in the dynamic monitoring definition information when the third function determines that it is a staying time zone;
When the third function determines that it is not a staying time zone, the static monitoring definition information in which the customer name information, the urgency information, and the importance information of the incident information stored by the first function match is set as the static monitoring definition information. A fifth function to extract from the storage unit;
A sixth function for determining whether or not the residence time of the incident information stored in the first step exceeds the residence time defined in the residence time definition information of the static monitoring definition information extracted by the fifth function;
A seventh function that updates the priority of the priority information of the incident information to the post-update priority included in the static monitoring definition information when it is determined that the residence time is exceeded in the sixth function;
Incident management program to realize

The incident information management unit includes an elapsed time monitoring unit that monitors an elapsed time from the time of failure occurrence time information included in the incident information,
In the incident information management department,
10. It is determined based on the elapsed time from the elapsed time monitoring unit whether or not the residence time of the incident in the sixth function exceeds the residence time defined in the static monitoring definition information extracted by the fifth function. The incident management program described.

The incident information management unit includes a mail transmission unit that stores e-mail destination information and sends an e-mail to a destination set in correspondence with customer information of the incident information.
In the incident information management department,
The incident management program according to claim 9 or 10, for realizing a function in which the mail transmission unit transmits an e-mail to the set destination, incident information whose priority information is updated by the fourth function and the seventh function.

The incident information management unit includes a display unit that displays a list of a plurality of incident information,
In the incident information management department,
The function for displaying the display color of the incident information whose priority information is updated by the fourth function and the seventh function on the display unit in a color different from the display color of the incident information which is not updated. 11. Incident management program according to any one of 11.