JP2009211658A - Failure detection device, failure detection method and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve a problem that a failure caused by a complex combination of monitoring items cannot be detected. <P>SOLUTION: A failure detection device 10 for detecting occurrence of a failure of an object to be monitored based on monitoring information about predetermined monitoring items acquired from the object to be monitored includes: a monitoring information recording processing section 12 for giving a scoring point to each piece of information about the monitoring item according to a predetermined rule condition; a scoring point accumulation processing section 13 for accumulating the scoring points for every group of a plurality of monitoring items; and a failure determination processing section 14 for determining the presence of a failure of the object to be monitored by comparing the accumulated scoring points and a threshold set for every group. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a failure detection device, a failure detection method, and a program for detecting and reporting a failure of a monitored device based on monitoring information from the monitored device.

  In system operation management, a method of detecting a failure of a monitored device based on monitoring information collected from the monitored device such as a computer constituting the system is adopted.

  In such failure detection, generally, monitoring information about individual monitoring items related to software or hardware of the monitored device is collected, and whether or not a failure (problem) has occurred for each monitoring item. A method is used to determine the above.

For example, Patent Document 1 discloses a related technology of this type of failure monitoring apparatus. In this Patent Document 1, a failure state of a monitoring target (item) is weighted in advance, and even when a failure has occurred in the monitoring target, a notification is given when a failure having a higher weight than that failure has been previously notified. The technology that suppresses unnecessary trouble reports is described.
JP 2002-171304 A

  In system operation management, even if a failure detected from the monitoring information for each monitoring item alone does not cause a major problem, a serious problem with a high degree of urgency occurs when a combination of failures for multiple monitoring items is combined. May occur.

  In the related art failure detection method described in Patent Document 1 and the like described above, since a failure is detected for each monitoring item based on the monitoring information about each management item, there are a plurality of monitoring items as described above. When a serious problem occurs in combination, there is a problem that it is difficult to identify the cause. In particular, there is a problem that as the number of system monitoring targets (monitoring items) increases, it takes time to investigate the cause.

(Object of invention)
An object of the present invention is to detect a failure caused by a combination of monitoring items based on not only monitoring information about individual monitoring items but also composite information about a combination of a plurality of monitoring items. It is an object of the present invention to provide a failure detection device, a failure detection method, and a program thereof.

  The failure detection device according to the present invention is a failure detection device that detects the occurrence of a failure of a monitored target based on monitoring information for a predetermined monitoring item acquired from the monitored target, and for each monitoring information for the monitored item, By comparing the means for assigning points according to a predetermined rule condition, the point accumulating means for accumulating points for each group of a plurality of monitoring items, and the threshold value set for each group to be monitored Determination means for determining the presence or absence of a target failure.

  The failure detection method according to the present invention is a failure detection method for detecting the occurrence of a failure of a monitored target based on monitoring information for a predetermined monitoring item acquired from the monitored target, and for each monitoring information for the monitored item, A step of assigning points according to a predetermined rule condition, a step of accumulating points for each group of a plurality of monitoring items, and comparing the accumulated points with a threshold set for each group, A determination step of determining the presence or absence of a failure.

  A program according to the present invention is a program that is executed on a computer and detects occurrence of a failure of a monitored object based on monitoring information for a predetermined monitoring item acquired from the monitored object. By comparing the process of assigning points according to a predetermined rule condition for each monitoring information, the process of accumulating points for each group of a plurality of monitoring items, and the threshold value set for each group A determination process for determining the presence or absence of a failure to be monitored is executed.

According to the present invention, it is possible to detect a failure that occurs due to a combination of monitoring items.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

(First embodiment)
Referring to FIG. 1, the failure detection notification system according to the first exemplary embodiment of the present invention is a monitored device 100 that is a target for failure monitoring, and a failure detection notification that detects and reports a failure of the monitored device 100. The apparatus 10 is provided.

  The monitored device 100 is a device such as a computer, a router, a hub, or a firewall device, and the failure detection notification device 10 is a device that performs processing up to failure detection and notification based on the monitoring information collected from the monitored device 100. It is. The monitored device 100 and the failure detection notification device 10 are connected to each other via a local area network (LAN) or the Internet.

  The monitored device 100 includes a monitoring information collection unit 101 that collects monitoring information related to hardware and software on the monitored device 100. The monitoring information collection unit 101 is realized by a program and has a function of collecting monitoring information related to, for example, hardware and software by using a function of an OS (operation system).

  Monitoring information collected by the monitoring information collection unit 101 includes temperature, voltage, fan, CPU, memory, disk (DB table), network, process, message log (application log, event log, system log), life and death of the monitored device 100. Information about monitoring etc. is included.

  The failure detection notification device 10 includes a monitoring information acquisition unit 11, a monitoring information recording processing unit 12, a score accumulation processing unit 13, a failure determination processing unit 14, a report execution unit 15, a score assignment rule table 21, data The storage unit 22, the problem determination table 23, the score update information table 24, and the cumulative score storage unit 25 are configured.

  The monitoring information acquisition unit 11 has a function of acquiring monitoring information of the monitored apparatus 100 collected by the monitoring information collection unit 101 via a LAN, the Internet, or the like.

  The monitoring information recording processing unit 12 receives the monitoring information acquired by the monitoring information acquisition unit 11, adds a cumulative target flag and a score to the monitoring information with reference to the score addition rule table 21, and stores the data in the data storage unit 22. Has the function of storing.

  The score accumulation processing unit 13 has a function of adding the score added to the monitoring information by the monitoring information recording processing unit 12 to the accumulated score storage unit 25 functioning as a temporary storage area for a set predetermined time.

  The failure determination processing unit 14 detects the presence or absence of a failure by comparing the accumulated score sent from the monitoring information recording processing unit 12 or the score accumulation processing unit 13 with the threshold score of the problem determination table 23, and there is a failure. This function has a function to determine the reporting method when the determination is made. The failure determination processing unit 14 also has a function of correcting the threshold score in the problem determination table 23 when an incorrect determination is made by referring to the score update information table 24.

  The notification execution unit 15 has a function of executing notification according to the notification method determined by the failure determination processing unit 14.

  The score assignment rule table 21 has fields of “server (system name)”, “monitoring type”, “rule condition”, “cumulative target flag”, “cumulative group name”, and “granted score”.

  In the server (system name), the server name or system name of the monitored apparatus 100 is registered.

  Types of monitoring include types of monitoring items such as temperature, voltage, fan (rotation speed), CPU, memory, disk (DB table), network, process, message log (application log, event log, syslog), and life / death monitoring. It is registered.

  In the rule condition, a threshold condition and a character string condition for the state of the monitoring item specified by the monitoring type are registered.

  As the threshold condition, it is possible to point out either the upper limit or the lower limit, or both the upper limit and the lower limit. For example, in the case of the load factor of the CPU, it can be specified as “upper limit: 80% or more”, “lower limit: 20% or less”, or “upper limit: 80% or more, lower limit: 20% or less”. . As the character string condition, a predetermined character string included in a message log or the like is designated.

  In the accumulation target flag, YES or NO is registered as a flag indicating whether or not the monitoring item specified by the monitoring type is a target for accumulating points.

  In the cumulative group name, a name indicating a group that is a unit for accumulating points is registered. For example, if a certain monitoring item alone does not cause a serious situation, but it can be assumed that a serious situation will occur when combined with other monitoring items, a plurality of monitoring items included in the combination are grouped together, The group is distinguished by the cumulative group name.

  For example, among the monitoring items, “temperature”, “voltage”, and “fan” are registered as a group, and the cumulative group name is registered as “AA1”.

  When the monitoring item is not the accumulation target (when it does not belong to the accumulation group), the character string “default” is registered in the accumulation group name.

  The number of points (1, 2, 3,...) To be assigned for each monitoring item or cumulative group is designated as the number of points to be assigned.

  The recorded information in the data storage unit 22 includes fields of “ID”, “server (system name)”, “monitoring type”, “occurrence time”, “monitoring information details”, “cumulative target flag”, and “score”. .

  In the ID, an identification number (for example, ID1, ID2, ID3,...) That uniquely identifies the monitoring information assigned by the monitoring information recording processing unit 12 is registered.

  The time at which the monitoring information is generated is specified as the occurrence time, and the detailed contents of the monitoring information are registered in the monitoring information details.

  In the score, the score given based on the score granting rule table 21 is registered.

  The server (system name), the monitoring type, and the accumulation target flag are the same as the corresponding fields in the score assignment rule table 21.

  The problem determination table 23 includes fields of “cumulative group name”, “threshold score”, “problem rank”, and “report method”. The cumulative group name is as described above.

In the threshold score, a threshold of the score (cumulative score) for each monitoring item or cumulative group is described. In this threshold score, a threshold divided into several stages can be set according to the difference in importance.
The failure determination processing unit 14 determines that a failure has occurred in the monitored device 100 (the report needs to be reported) when the score or the cumulative score of the monitoring item or cumulative group exceeds the value registered in the threshold score. To do.

  The problem rank describes the importance of the problem according to the score threshold (for example, A, B, C... In descending order of importance).

  The reporting method includes a reporting method for problems such as lighting of a patrol lamp, notification by e-mail, notification to another application, notification by telephone, or a combination thereof.

  The score update information table 24 has fields of “cumulative group name”, “standby time”, “server (system name)”, “monitoring type”, “rule condition”, and “correction coefficient”. For the cumulative group, server (system name), monitoring type, and rule condition fields of the score update information table 24, the same data as each field of the score assignment rule table 21 is described. A correction factor field has been added.

  The waiting time for the update information is designated as the waiting time.

  In the correction coefficient, a coefficient for correcting the score in the “threshold score” field of the problem determination table 23 is described.

  The cumulative score storage unit 25 has fields of “cumulative group name”, “cumulative score”, and “ID”. The cumulative group name is as described above.

  In the cumulative score, the score added during a certain set time is described.

  In the ID, the ID of the monitoring information to be added is described.

  Next, a hardware configuration example of the failure detection notification apparatus 10 will be described with reference to FIG.

  Referring to FIG. 10, the failure detection notification device 10 can be realized by a hardware configuration similar to a general computer device, and is a main memory such as a CPU (Central Processing Unit) 401 and a RAM (Random Access Memory). A main storage unit 402 used for a data work area and a temporary data save area; a communication unit 403 that transmits / receives data via the network 600; and an input / output interface unit 404 that transmits / receives data by connecting to an external device. Auxiliary storage unit 405 (for example, a score assignment rule table 21, a data storage unit 22, a problem determination table 23) which is a hard disk device including a nonvolatile memory such as a ROM (Read Only Memory), a magnetic disk, and a semiconductor memory The score update information table 24 and the cumulative score storage unit 25 are built on the auxiliary storage unit 405), a system bus 406 for interconnecting the above-described components of the information processing apparatus, and an output device such as a display device 407 and an input device 408 such as a keyboard.

  The failure detection notification device 10 according to the present embodiment implements a hardware operation by mounting a circuit component which is a hardware component such as an LSI (Large Scale Integration) in which a program for detecting and reporting a failure is incorporated. As a matter of course, the program that provides each function of the monitoring information acquisition unit 11, the monitoring information recording processing unit 12, the score accumulation processing unit 13, the failure determination processing unit 14, and the notification execution unit 15 is auxiliary storage. The program can be realized by software by storing the program in the unit 405, loading the program into the main storage unit 402, and executing the program by the CPU 401.

(Operation according to the embodiment)
Next, the operation of the failure detection notification device 10 according to the present embodiment configured as described above will be described with reference to FIGS. 1, 2 to 6 and 7. 7 and 8 are flowcharts for explaining the operation contents of the failure detection notification device 10.

  Referring to FIG. 7, after the monitoring information acquisition unit 11 acquires the collected monitoring information of the monitored device 100 from the monitoring information collection unit 101 via the LAN and the Internet, and confirms whether the acquired information is fraudulent, The information is transferred to the monitoring information recording processing unit 12 (step S101).

  The monitoring information recording processing unit 12 refers to the score assignment rule table 21 and is passed from the monitoring information acquisition unit 11 as to whether the “server (system) name”, “monitoring type”, and “rule condition” are met. One piece of monitoring information is collated (step S102).

  When the condition is met, the monitoring information recording processing unit 12 includes “accumulation target flag” (YES or NO), “accumulation group name”, and “granting score” set in the score assignment rule table 21 in the monitoring information. Add information.

  If there is no item that matches the condition, information of “accumulation target flag” (= NO), “accumulation group” (= default), and “granting number” is added to the monitoring information.

  When the collation with the score assignment rule table 21 is completed, the monitoring information recording processing unit 12 relates to the monitoring information, ID, server (system) name, monitoring type, occurrence time, monitoring information details, accumulation target flag, score information Is registered in the data recording unit 22 as recording information as shown in FIG. 3 (step S103).

  The monitoring information recording processing unit 12 refers to the added “accumulation target flag” (step S104), and if the accumulation target flag = YES, the information recorded in the data recording unit 22 is sent to the score accumulation processing unit 13. If the accumulation target flag = NO, the information is sent to the failure determination processing unit 14 (step S106).

  Upon receiving the sent recording information, the score accumulation processing unit 13 adds the score given to the recording information to the cumulative score corresponding to the same cumulative group name as the recording information in the cumulative score storage unit 25 in cumulative group names. (Steps S107 to S109).

  The addition of the points by the point accumulation processing unit 13 is performed at a preset fixed time interval. As for the set time, an arbitrary time is set in advance in accordance with the type of the monitored device 100 to be monitored, the operation status, and the like.

  The score accumulation processing unit 13 starts counting the set time for each accumulated group name from the time when the information is first received (step S107), waits for the set time, and until the count ends (step S109). The score added to the recorded information is accumulated in the “accumulated score” of the accumulated score storage unit 25 (step S108).

  When the counting is completed, the cumulative score in the cumulative score storage unit 25 and the record information that has arrived from the start to the end of the count are sent to the failure determination processing unit 14 (step S110).

  When new information is received after the set time has been counted, the accumulated score storage unit 25 starts counting the set time again upon receipt, and accumulates the points.

  When receiving the cumulative score, the failure determination processing unit 14 determines the necessity of notification, the importance of the problem, and the notification method based on the problem determination table 23 (step S111).

Details of the determination processing by the failure determination processing unit 14 will be described below.
(1) When the recording information is the accumulation target flag = NO (in the case of the recording information sent from the monitoring information recording processing unit 12)
Referring to the field of “cumulative group name” = default in the problem determination table 23, the “threshold score” is compared with the “score” recorded in the sent record information, and the “score” is set to “threshold value”. If it exceeds the “score”, it is determined that a failure has occurred in the monitored apparatus 100, and it is determined that a notification is necessary.
(2) When the information is the accumulation target flag = YES (in the case of recording information sent from the point accumulation processing unit 13)
With reference to the corresponding “cumulative group name” in the problem determination table 23, the corresponding “threshold score” is compared with the “cumulative score” sent from the score accumulation processing unit 13, and the “cumulative score” is “ If the threshold value is exceeded, it is determined that a failure has occurred in the monitored apparatus 100, and it is determined that a notification is necessary.

  When it is determined that the report is necessary, the failure determination processing unit 14 refers to the problem determination table 23, designates the importance level described in the “problem rank”, and the notification method described in the “report method”. The report execution unit 15 is instructed to report.

  For example, when the importance level is low, it is possible to designate the lighting of the patrol lamp as the reporting method, and when the importance level is high, it is possible to designate the reporting by e-mail in addition to the lighting of the patrol lamp as the reporting method.

  In any of the above cases, if the score or the cumulative score is below the “threshold score” in the problem determination table 23, it is determined that no failure has occurred, and it is determined that there is no need for notification. Do not do.

  When receiving a notification instruction from the failure determination processing unit 14, the notification execution unit 15 performs a notification by the specified notification method (step S112).

  At that time, with respect to e-mail, notification to other applications, and telephone notification, the contents of the recorded information recorded in the data recording unit 22 are attached to the monitoring information. Furthermore, regarding the monitoring information that is the accumulation target of the score, the contents of all the monitoring items included in the accumulation group are attached and notified.

  Moreover, you may make it report a failure by lighting of a patrol lamp. Furthermore, the patrol lamp may be turned on in conjunction with e-mail or notification to other applications.

  Next, correction processing of the “threshold score” of the problem determination table 23 by the failure determination processing unit 14 will be described with reference to FIGS. 8 and 9.

  First, a correction process in the case where the determination that there is a failure (need to report) is an erroneous determination will be described with reference to the flowchart of FIG.

  The failure determination processing unit 14 determines that there is a failure (need to report) and executes the notification. Then, the failure determination processing unit 14 refers to the point update information table 24 and refers to the assumed failure for the time designated as “waiting time”. That is, it is determined whether or not the recording information having the same cumulative group name as the notified cumulative group name has arrived from the point accumulation processing unit 13 during the standby time (steps S201 to S203).

  If the recorded information of the same cumulative group name as the reported cumulative group name arrives during the waiting time, it can be determined that the determination of fault (need to report) is appropriate, so the threshold score correction process Do not do.

  If the recorded information of the same cumulative group name as the reported cumulative group name does not arrive during the waiting time, it can be determined that the determination of fault (need to be reported) was an erroneous determination, so the information for updating the score The score of the “threshold score” is corrected by adding the correction score α calculated using the “correction coefficient” corresponding to the same cumulative group name in the table 24 to the “threshold score” field of the problem determination table 23 ( Step S204).

The correction score α is calculated based on the following formula, for example.
Number of correction points α = (X−Y) * F
Here, X is the value of “cumulative score” in the cumulative score storage unit 25, Y is the value of “threshold score” in the problem determination table 23, and F is the value of “correction coefficient” in the score update information table 24.

  Next, correction processing when the determination of no failure (no need for notification) is an erroneous determination will be described with reference to the flowchart of FIG.

  After determining that there is no failure (no need for notification), the failure determination processing unit 14 determines whether a failure registered in the score update information table 24 has occurred. That is, when the monitoring information arrives from the score accumulation processing unit 13, the failure determination processing unit 14 determines whether the received monitoring information matches the rule condition of the same accumulation group name in the score update information table 24 ( Step S301).

  If the arrived monitoring information does not match the rule conditions of the score update information table 24, the failure registered in the score update information table 24 has not occurred (no failure (no report required) determination) And the process is terminated.

  When the arrived monitoring information matches the rule condition of the same cumulative group name in the score update information table 24, it is determined whether or not the score is accumulated in the score accumulation processing unit 13 (steps S107 to S109 in FIG. 7). Determination is made (step S302).

  If the points have been accumulated, the process waits until the set time has been counted.

  If the points are not accumulated, it is further determined whether or not the “waiting time” in the point update information table 24 is being waited for (step S303). If the waiting time is waiting, it is determined that there is a failure (need to report), so the processing is terminated.

  If it is not waiting for the waiting time, it can be determined that a failure registered in the score update information table 24 has occurred despite the determination of no failure (no need for notification). That is, since it can be determined that the determination of no failure is an erroneous determination, the correction score β calculated with reference to the “correction coefficient” in the score update information table 24 is subtracted from the “threshold score” field of the problem determination table 23. As a result, the score of “threshold score” is corrected (step S304).

This correction score β is calculated based on the following equation, for example.
Number of correction points β = Y * F

(Effects of the first embodiment)
According to this embodiment, for each piece of monitoring information for a monitoring item, points are assigned according to the rule conditions of the point assignment rule table 21, and the points are accumulated for each group of a plurality of monitoring items combined. Therefore, it is possible to detect and report a failure that occurs when monitoring items are combined in combination.

  In addition, by setting a notification method according to the importance of the failure for each monitoring item group, an appropriate notification method according to the importance of the failure can be selected.

  Although the present invention has been described with reference to the preferred embodiments and examples, the present invention is not necessarily limited to the above-described embodiments and examples, and various modifications can be made within the scope of the technical idea. Can be implemented.

  In the above embodiment, the failure detection notification device that detects and reports a failure is described. However, only the failure detection is performed by the above-described method, and the notification is sent to an external device that functions as the notification execution unit 15. It is also possible to adopt a configuration for instructing.

It is a block diagram which shows the structure of the failure detection notification apparatus by embodiment of this invention. It is a figure which shows the structural example of the score provision rule table in embodiment of this invention. It is a figure which shows the structural example of the recording information of the data storage part in embodiment of this invention. It is a figure which shows the structural example of the problem determination table in embodiment of this invention. It is a figure which shows the structural example of the registration content of the accumulation score memory | storage part in embodiment of this invention. It is a figure which shows the structural example of the information table for score update in embodiment of this invention. It is a flowchart explaining operation | movement of the failure detection notification apparatus by embodiment of this invention. It is a flowchart explaining the operation | movement of the correction process of the threshold value in the failure detection notification apparatus by embodiment of this invention. It is a flowchart explaining the operation | movement of the correction process of the threshold value in the failure detection notification apparatus by embodiment of this invention. It is a block diagram which shows the hardware structural example of the failure detection notification apparatus by embodiment of this invention.

Explanation of symbols

10: Failure detection notification device 11: Monitoring information acquisition unit 12: Monitoring information recording processing unit 13: Score accumulation processing unit 14: Failure determination processing unit 15: Notification execution unit 21: Score assignment rule table 22: Data storage unit 22
23: Problem determination table 24: Score update information table 25: Cumulative score storage unit 100: Monitored device 101: Monitoring information collection unit

Claims (30)

A failure detection device that detects the occurrence of a failure in the monitored target based on monitoring information for a predetermined monitoring item acquired from the monitored target,
Means for assigning points according to a predetermined rule condition for each monitoring information for the monitoring item;
Point accumulation means for accumulating the points for each group of a plurality of the monitoring items;
A failure detection apparatus comprising: a determination unit that determines whether there is a failure of the monitored target by comparing the accumulated score with a threshold set for each group. Provided with a report execution means for executing a report when the failure is determined;
The failure detection apparatus according to claim 1, wherein when the determination unit determines that the failure is present, the determination unit selects a notification method set for each type of the group and instructs the notification execution unit. . Different notification methods are set for each threshold set in stages.
3. The failure detection apparatus according to claim 2, wherein the determination unit selects a notification method according to a threshold value where the accumulated score exceeds, and instructs the notification execution unit.   The failure according to any one of claims 1 to 3, wherein the determination unit increases or decreases the threshold based on a predetermined correction coefficient when the determination of the presence or absence of a failure is an erroneous determination. Detection device.   The said determination means correct | amends the said threshold value by adding the value calculated using the predetermined | prescribed correction coefficient to the said threshold value when determination with a failure is a misjudgment. The failure detection device described in 1.   The said determination means correct | amends the said threshold value by subtracting the value calculated using the predetermined | prescribed correction coefficient from the said threshold value, when determination with no failure is a misjudgment. 4. The fault detection apparatus according to 4. For each monitoring item, a rule condition indicating whether or not points are assigned, an accumulation target flag indicating whether or not points are accumulated, a group name, and a rule table in which points to be assigned are registered,
When the monitoring information is acquired, the means for assigning the score refers to the rule table, the value of the monitoring item indicated in the monitoring information satisfies the rule condition, and the accumulation target flag is the accumulation target. The failure detection apparatus according to any one of claims 1 to 6, wherein, in the case where the information is indicated, the score registered in the rule table is added to the monitoring information. Cumulative score storage means for recording the cumulative score for each group, the threshold value, the problem rank indicating the importance of the failure, and at least one notification method according to the problem rank for each group Provide a problem determination table,
The score accumulating means accumulates the score given to the monitoring information to the accumulated score of the accumulated score storage means,
The determination means determines the presence or absence of a failure by comparing the cumulative score of the cumulative score storage means with the threshold value of the problem determination table. The failure detection device according to claim 2, wherein the notification method is selected according to the method.   The said determination means determines the presence or absence of the said fault by comparing the score accumulate | stored during the predetermined setting time with the said threshold value, The said any one of Claims 1-8 characterized by the above-mentioned. Failure detection device. An update table in which a correction coefficient for correcting the threshold is registered for each group,
The determination means includes
When it is determined that there is a failure, the determination that there is a failure is determined to be an erroneous determination when the monitoring information for the monitoring item included in the group that has been determined to have a failure is not acquired during a predetermined waiting time. And adding the value calculated using the correction coefficient of the update table to the threshold value,
When it is determined that there is no failure, when the monitoring information for the monitoring item included in the group that is determined as having no failure is acquired, the determination that there is no failure is determined as an erroneous determination, and the update table is corrected. 6. The failure detection apparatus according to claim 4, wherein a value calculated using a coefficient is subtracted from the threshold value. A failure detection method for detecting the occurrence of a failure of the monitored object based on monitoring information for a predetermined monitoring item acquired from the monitored object,
For each piece of monitoring information for the monitoring item, assigning a score according to a predetermined rule condition;
Accumulating the score for each group of a plurality of the monitoring items;
A failure detection method comprising: a determination step of determining the presence or absence of a failure of the monitored target by comparing the accumulated score and a threshold set for each group.   The failure detection method according to claim 11, further comprising a notification step of executing a notification by a notification method set for each type of the group when it is determined that the failure is present in the determination step. Different notification methods are set for each threshold set in stages.
13. The fault detection according to claim 12, wherein in the determination step, a notification method is selected according to a threshold value where the accumulated score exceeds, and the notification is executed in the notification step by the selected notification method. Method.   14. The method according to claim 11, wherein the determination step includes a step of increasing or decreasing the threshold value based on a predetermined correction coefficient when the determination of the presence or absence of a failure is an erroneous determination. The failure detection method described.   The determination step includes a step of correcting the threshold value by adding a value calculated using a predetermined correction coefficient to the threshold value when the determination of failure is an erroneous determination. The fault detection method according to claim 14.   The determination step includes a step of correcting the threshold value by subtracting a value calculated using a predetermined correction coefficient from the threshold value when the determination of no failure is an erroneous determination. The failure detection method according to claim 14. For each monitoring item, a rule condition indicating whether or not points are assigned, an accumulation target flag indicating whether or not points are accumulated, a group name, and a rule table in which points to be assigned are registered,
In the step of assigning points, when the monitoring information is acquired, the value of the monitoring item indicated in the monitoring information satisfies the rule condition with reference to the rule table, and the accumulation target flag is an accumulation target The failure detection method according to any one of claims 11 to 16, wherein a point registered in the rule table is assigned to the monitoring information. Cumulative score storage means for recording the cumulative score for each group, the threshold value, the problem rank indicating the importance of the failure, and at least one notification method according to the problem rank for each group Provide a problem determination table,
In the step of accumulating the score, the score given to the monitoring information is accumulated in the accumulated score of the accumulated score storage means,
In the determination step, the cumulative score of the cumulative score storage means is compared with the threshold value of the problem determination table to determine whether there is a failure. The failure detection method according to any one of claims 12 to 17, wherein the notification method is selected in accordance with the method.   19. The presence or absence of the failure is determined by comparing the score accumulated during a predetermined set time with the threshold value in the determination step. Failure detection method. An update table in which a correction coefficient for correcting the threshold is registered for each group,
In the determination step,
When it is determined that there is a failure, the determination that there is a failure is determined to be an erroneous determination when the monitoring information for the monitoring item included in the group that has been determined to have a failure is not acquired during a predetermined waiting time. And adding the value calculated using the correction coefficient of the update table to the threshold value,
When it is determined that there is no failure, when the monitoring information for the monitoring item included in the group that is determined as having no failure is acquired, the determination that there is no failure is determined as an erroneous determination, and the update table is corrected. The failure detection method according to claim 14 or 15, wherein a value calculated using a coefficient is subtracted from the threshold. A program that is executed on a computer and detects occurrence of a failure of the monitored object based on monitoring information for a predetermined monitoring item acquired from the monitored object,
In the computer,
A process of assigning points according to a predetermined rule condition for each monitoring information for the monitoring item;
A process of accumulating the score for each group of a plurality of the monitoring items;
A program for executing a determination process for determining the presence or absence of a failure of the monitored object by comparing the accumulated score and a threshold set for each group.   The program according to claim 21, wherein when the determination process determines that the failure is present, a notification process for executing a notification by a notification method set for each type of the group is executed. Different notification methods are set for each threshold set in stages.
The program according to claim 22, wherein a notification method is selected in accordance with a threshold value in which the accumulated score exceeds in the determination process, and a notification is performed by the selected notification method in the notification process.   24. The method according to claim 21, wherein the determination process includes a process of increasing or decreasing the threshold value based on a predetermined correction coefficient when the determination of the presence or absence of a failure is an erroneous determination. The listed program.   The determination process includes a process of correcting the threshold value by adding a value calculated using a predetermined correction coefficient to the threshold value when the determination of failure is an erroneous determination. The program according to claim 24.   The determination process includes a process of correcting the threshold value by subtracting a value calculated using a predetermined correction coefficient from the threshold value when the determination of no failure is an erroneous determination. The program according to claim 24. For each monitoring item, a rule condition indicating whether or not points are assigned, an accumulation target flag indicating whether or not points are accumulated, a group name, and a rule table in which points to be assigned are registered,
In the process of assigning points, when the monitoring information is acquired, the rule table is referred to, the value of the monitoring item indicated in the monitoring information satisfies the rule condition, and the accumulation target flag is an accumulation target 27. The program according to any one of claims 21 to 26, wherein a point registered in the rule table is added to the monitoring information when the information is indicated. Cumulative score storage means for recording the cumulative score for each group, the threshold value, the problem rank indicating the importance of the failure, and at least one notification method according to the problem rank for each group Provide a problem determination table,
In the process of accumulating the score, the score given to the monitoring information is accumulated in the accumulated score of the accumulated score storage means,
In the determination process, the cumulative score of the cumulative score storage means is compared with the threshold value of the problem determination table to determine whether or not there is a failure. The program according to any one of claims 22 to 27, wherein the notification method is selected according to the method.   29. The presence or absence of the failure is determined by comparing the score accumulated during a predetermined set time with the threshold value in the determination process. Program. An update table in which a correction coefficient for correcting the threshold is registered for each group,
In the determination process,
When it is determined that there is a failure, the determination that there is a failure is determined to be an erroneous determination when the monitoring information for the monitoring item included in the group that has been determined to have a failure is not acquired during a predetermined waiting time. And adding the value calculated using the correction coefficient of the update table to the threshold value,
When it is determined that there is no failure, when the monitoring information for the monitoring item included in the group that is determined as having no failure is acquired, the determination that there is no failure is determined as an erroneous determination, and the update table is corrected. The program according to claim 24 or 25, wherein a value calculated using a coefficient is subtracted from the threshold value.

Images