JP2009230522A - System monitoring device and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system monitoring device and a program which can enhance the efficiency of system monitoring. <P>SOLUTION: The monitoring device 100 for monitoring a state of the monitoring target system 10 includes: a data acquiring part 102 for periodically acquiring analysis target data from the monitoring target system; an analysis processing part 108 for analyzing the analysis target data on the basis of a prescribed monitoring entry; a diagnosis processing part 114 for diagnosing a state of the monitoring target system on the basis of a result of analysis processing and prescribed diagnosis reference; and a failure information notifying part 116 for notifying failure information showing the occurrence of a failure when confirming a failure in the state of the monitoring target system on the basis of the result of the diagnosis processing. Since there is no need of setting a monitoring entry in each monitory target system in this way, setting work of a monitoring entry can be efficiently performed and failures of setting mistakes can be easily prevented even when many monitoring target systems are managed. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a system monitoring apparatus and program, and more particularly, to a system monitoring apparatus and program for monitoring the state of a computer system.

  2. Description of the Related Art Conventionally, a system monitoring device (hereinafter also referred to as a monitoring device) that monitors the state of a computer system (hereinafter also referred to as a monitoring target system) connected via a communication line, such as a server device, is known.

  For example, when a failure detection program that periodically operates on a monitoring target system detects a failure of the monitoring target system, the conventional monitoring device receives failure information indicating the occurrence of the failure from the monitoring target system. Then, the monitoring device notifies the failure information through a notification unit such as a monitor of the monitoring device or an alarm lamp by a monitoring program operating on the monitoring device.

  In addition, another conventional monitoring apparatus periodically transmits a life / death confirmation request to, for example, a monitoring target system by a monitoring program operating on the monitoring apparatus. Then, when the response status from the monitored system becomes abnormal, the monitoring device regards that the failure has occurred in the monitored system, and notifies the failure information via the notification means.

  However, the conventional monitoring device detects the occurrence of a failure only with respect to a predetermined monitoring item set in a failure detection program that operates on the monitored system. Here, the monitoring items set in the failure detection program generally differ depending on the system configuration of the monitoring target system.

  For this reason, when managing a large number of monitoring target systems, the setting work of monitoring items becomes complicated, and a setting error may occur. Also, when updating the monitoring item, since setting is required for each monitoring target system, the monitoring item updating operation may be complicated. For this reason, there was a problem that the efficiency of system monitoring could not be improved.

  Furthermore, since the occurrence of a failure is detected based on simple condition judgment for each monitoring item, there is a problem that efficient system monitoring cannot be realized by using a failure history related to a specific or unspecified monitored system. was there.

  The present invention has been made in view of the above problems, and an object thereof is to provide a new and improved system monitoring apparatus and program capable of improving the efficiency of system monitoring.

  In order to solve the above-described problem, according to a first aspect of the present invention, in a system monitoring apparatus that monitors the state of a computer system, a data acquisition unit that periodically acquires analysis target data from the computer system; An analysis processing unit for analyzing data to be analyzed based on monitoring items, a diagnosis processing unit for diagnosing the state of the computer system based on the results of the analysis processing and predetermined diagnostic criteria, and a computer system based on the results of the diagnostic processing There is provided a system monitoring apparatus including a failure information notification unit that notifies failure information indicating the occurrence of a failure when a failure is confirmed in the state.

  According to this configuration, the system monitoring device (hereinafter also referred to as a monitoring device) analyzes the analysis target data based on a predetermined monitoring item, and diagnoses the state of the computer system (hereinafter also referred to as the monitoring target system). Therefore, it is not necessary to set monitoring items for each monitored system. Thereby, even when managing a large number of monitoring target systems, the setting work of monitoring items can be performed efficiently, and the occurrence of setting errors can be easily prevented.

  Moreover, you may further provide the diagnostic reference | standard memory | storage part which memorize | stores the said predetermined diagnostic reference | standard. As a result, the monitoring device diagnoses the state of the monitored system based on the predetermined diagnostic criteria stored in the diagnostic criteria storage unit. By storing them in the system, efficient system monitoring can be realized.

  Moreover, you may further provide the monitoring item update part for updating the said predetermined monitoring item. Thereby, since the monitoring apparatus can update a predetermined monitoring item, it is not necessary to update the monitoring item for each monitoring target system, and the updating operation of the monitoring item can be performed efficiently.

  Further, a diagnostic standard update unit for updating a predetermined diagnostic standard stored in the diagnostic standard storage unit may be further provided. Thereby, since the monitoring apparatus can update a predetermined diagnostic criterion, more efficient system monitoring can be realized by diagnosing the state of the monitoring target system based on the updated diagnostic criterion.

  In order to solve the above problems, according to a second aspect of the present invention, there is provided a program for causing a computer to function as the monitoring apparatus according to the first aspect described above.

  ADVANTAGE OF THE INVENTION According to this invention, the system monitoring apparatus and program which can improve the efficiency of system monitoring can be provided.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the present specification and drawings, components having substantially the same functional configuration are denoted by the same reference numerals, and redundant description is omitted.

  FIG. 1 is an explanatory diagram showing the overall configuration of a monitoring system including a monitoring device according to an embodiment of the present invention. As shown in FIG. 1, the monitoring system includes a monitoring device 100 and at least one monitoring target system 10a, 10b, 10c connected to the monitoring device 100 through a communication line 20 (hereinafter collectively referred to as the monitoring target system 10). Including.

  The monitoring device 100 is a monitoring computer system having an analysis function, and the monitoring target system 10 is a computer system such as a server device having various system configurations.

  The monitoring apparatus 100 periodically acquires analysis target data from the monitoring target system 10, analyzes the analysis target data based on a predetermined monitoring item, and monitors the monitoring target system 10 based on a result of the analysis process and a predetermined diagnostic criterion. Is diagnosed, and failure information is notified if necessary.

  The monitoring apparatus 100 periodically acquires analysis target data from a data acquisition program that operates on the monitoring target system 10 by using a scheduling function or the like. Here, the analysis target data is information used for diagnosing the configuration and operation status of the monitoring target system 10 such as configuration information, setting information, log information, and command output information of the monitoring target system 10. The analysis target data includes information related to the operating system (OS) of the monitoring target system 10 and the data format of the analysis target data as necessary. The analysis target data is acquired as a data file at once or in units of a plurality of blocks.

(Configuration of the monitoring device 100)
Below, the structure of the monitoring apparatus 100 is demonstrated, referring FIGS. FIG. 2 is an explanatory diagram showing the configuration of the monitoring device 100. The monitoring apparatus 100 includes a data acquisition unit 102, a monitoring item storage unit 104, a monitoring item update unit 106, an analysis processing unit 108, a diagnostic reference storage unit 110, a diagnostic reference update unit 112, a diagnostic processing unit 114, a failure information notification unit 116, An input / output unit 118, a storage unit 120, and a control unit 122 are included. Below, each component of the monitoring apparatus 100 is demonstrated.

(Data acquisition unit 102)
The data acquisition unit 102 periodically acquires analysis target data from the monitoring target system 10 through the communication line 20. The acquired analysis target data is temporarily stored in the storage unit 120 and output to the analysis processing unit 108 during the analysis process.

  FIG. 3 is an explanatory diagram illustrating an example of analysis target data. The analysis target data shown in FIG. 3 is a command output result 152 for displaying the disk status and resource status of the monitoring target system 10. The command output result 152 includes “disk basic information” (manufacturer, serial number, storage capacity, operation status), “software mirror information” (mirror source disk, mirror destination disk, synchronization status), “resource usage status” (memory usage) Rate, CPU usage rate) and the like.

(Monitoring item storage unit 104)
The monitoring item storage unit 104 stores predetermined monitoring items to be analyzed, and provides them to the analysis processing unit 108 during the analysis processing. The monitoring item storage unit 104 may store monitoring items suitable for a plurality of OSs, and may provide appropriate monitoring items to the analysis processing unit 108 according to the OS of the monitoring target system 10.

  The monitoring items include, for example, information such as logical disk information, network information, cluster information, external storage information, OS configuration information, process information, memory information, time synchronization status, file system information, and backup information as major items. Including. For example, regarding the logical disk information, information such as a volume name, a usage amount, and the number / status of mirrors is included as small items.

(Monitoring item update unit 106)
The monitoring item update unit 106 acquires update information of the monitoring item, and updates the monitoring item stored in the monitoring item storage unit 104 based on the update information. The update information may be updated by an operator of the monitoring apparatus 100, or may be automatically updated by an update server connected through the communication line 20. The update information may include information related to the OS information of the OS to which the update information is applied.

(Analysis processing unit 108)
The analysis processing unit 108 analyzes the analysis target data based on a predetermined monitoring item. As shown in FIG. 3, the analysis target data includes information in a format that can be understood by the system user but cannot be directly understood by the monitoring apparatus 100 or is difficult to understand. Therefore, the analysis processing unit 108 analyzes the analysis target data, and extracts information that can be used for diagnosis processing from the analysis target data based on the monitoring items provided from the monitoring item storage unit 104. The extracted information is output to the diagnosis processing unit 114 as a result of the analysis process.

  For example, the analysis processing unit 108 refers to “mirror source disk: A”, “mirror destination disk: B”, and “synchronization state: synchronization failure” regarding the monitoring item “software mirror information” from the analysis target data illustrated in FIG. Information is extracted and output to the diagnosis processing unit 114 as a result of the analysis processing. Further, regarding the monitoring item “resource usage status”, information of “memory usage rate: 90%” and “CPU usage rate: 95%” is extracted and output to the diagnosis processing unit 114 as a result of the analysis processing.

  The analysis processing unit 108 has an analysis processing routine adapted to a plurality of OSs and / or data formats, and selects an appropriate analysis processing routine according to the OS of the analysis target system and / or the data format of the analysis target data. May be.

(Diagnostic criteria storage unit 110)
The diagnostic criteria storage unit 110 functions as a knowledge database that stores predetermined diagnostic criteria used for diagnostic processing. The diagnostic criterion is information used as a diagnostic criterion when diagnosing the configuration and operation status of the monitoring target system 10 based on the result of the analysis process. The diagnostic criteria storage unit 110 accumulates newly adopted diagnostic criteria and is updated by the diagnostic criteria update unit 112 to store the latest diagnostic criteria.

  The diagnostic criteria are, for example, qualitative information (for example, output results such as “normal” and “abnormal” in the command output result) that can be referred to in order to determine the state of the system, and quantitative information (for example, predetermined Parameter thresholds, etc.). The diagnostic criteria are created based on, for example, system specifications of various monitoring target systems 10 to which the monitoring system is applied, various command output result formats, failure histories related to specific or non-specific monitoring target systems 10, and the like. In particular, efficient system monitoring can be realized by using a failure history as a diagnostic criterion for prediction of system failure and prevention of occurrence of system failure.

(Diagnostic criteria update unit 112)
The diagnostic reference update unit 112 acquires update information of the diagnostic reference, and updates a predetermined diagnostic reference stored in the diagnostic reference storage unit 110 based on the update information. The update information may be updated by the operator of the monitoring apparatus 100 as in the monitoring item update unit 106, or may be automatically updated by an update server connected through the communication line 20. The update information may include OS information of the OS to which the update information is applied and information on the format of the analysis target data.

(Diagnosis processing unit 114)
The diagnosis processing unit 114 diagnoses the state of the monitoring target system 10 such as the configuration and operation status of the monitoring target system 10 based on the result of the analysis processing and a predetermined diagnosis criterion. Predetermined diagnostic criteria used for the diagnostic processing are stored in the diagnostic criteria storage unit 110 and are provided to the diagnostic criteria storage unit 110 during the diagnostic processing. The diagnosis processing unit 114 diagnoses the state of the monitoring target system 10 and notifies the failure information notification unit 116 of the result of the diagnosis processing.

  For example, the diagnosis processing unit 114 diagnoses that the mirror synchronization is not established between the disk A and the disk B based on the result of the analysis process regarding the monitoring item “software mirror information”, and as a result of the diagnosis process The information is output to the failure information notification unit 116. In addition, the diagnosis processing unit 114 runs out of available memory because the memory usage rate and the CPU usage rate exceed predetermined thresholds based on the result of the analysis processing related to the monitoring item “resource usage status”. And that there is a risk of system runaway, and outputs the result to the failure information notification unit 116 as a result of the diagnosis process.

  Similar to the analysis processing unit 108, the diagnostic standard storage unit 110 has diagnostic standards that are compatible with a plurality of OSs and / or data formats, and according to the OS of the analysis target system and / or the data format of the analysis target data, Appropriate diagnostic criteria may be provided to the diagnostic processor 114.

  As a result of the diagnosis processing, the diagnosis processing unit 114 creates a diagnosis report such as a failure level of the system failure, a phenomenon that may occur when left unattended, a countermeasure, and the like, and outputs the diagnosis report to the failure information notification unit 116 as part of the failure information. Also good. The failure level indicates, for example, the importance of the system failure such as “normal”, “caution (a state that requires determination of necessity of response based on the result of diagnosis processing)”, “warning (a state that requires immediate response)”, etc. Information. The phenomenon that can occur when left unattended is information indicating the effect of leaving a system failure. The coping method is information on action items that can be dealt with.

(Failure information notification unit 116)
The failure information notification unit 116 confirms the state of the monitoring target system 10 based on the result of the diagnostic process, and when failure is confirmed, notifies failure information indicating the failure state. The failure information is output to a monitor, a printer, an operation terminal connected to the monitoring device 100, a monitoring panel, or the like.

  FIG. 4 is an explanatory diagram illustrating an example of failure information. The failure information 154 shown in FIG. 4 notifies the synchronization failure of the software mirror, and includes a diagnosis report. The failure information 154 includes items of (1) a failure level, (2) a phenomenon that may occur when left unattended, and (3) a coping method included in the diagnosis processing result and the diagnosis report.

  According to FIG. 4, as a result of the diagnostic processing, it is notified that a mirror synchronization failure has occurred. Further, (1) as the failure level, it is diagnosed that the importance of the system failure is high, and the “warning” level is notified. (2) As a phenomenon that may occur when left unattended, there is a notice that there is a possibility that the OS startup may not be performed normally when a normal disk fails. (3) As a coping method, the exchange of the disk and the execution of the command for resynchronizing the mirror are notified.

(Other components)
The input / output unit 118 realizes input / output processing by an input / output device such as a keyboard, a monitor, and a printer. The storage unit 120 stores analysis target data, results of analysis processing, results of diagnosis processing, various information necessary for the operation of the monitoring apparatus 100, and the like. The control unit 122 controls the overall operation of the monitoring apparatus 100 by controlling the other components described above.

  The configuration of the monitoring device 100 has been described above. Each component of the data acquisition unit 102, the monitoring item update unit 106, the analysis processing unit 108, the diagnostic reference update unit 112, the diagnosis processing unit 114, the failure information notification unit 116, and the control unit 122 is a function of each component. May be realized by installing a software program for executing the above in the storage unit 120, or may be realized by dedicated hardware. The software program may be stored in a computer-readable storage medium, read and executed as necessary, or provided through the communication line 20. In addition, the monitoring item storage unit 104, the diagnostic reference storage unit 110, and the storage unit 120 may be configured as various storage media such as a semiconductor memory, an optical disk, and a magnetic disk, for example.

(Operation of the monitoring device 100)
Hereinafter, the operation of the monitoring apparatus 100 will be described with reference to FIG. FIG. 5 is a flowchart showing an operation method of the monitoring apparatus 100.

  The monitoring item update unit 106 determines whether or not the update information of the monitoring item has been acquired (step S102), and when the update information is acquired, the monitoring item stored in the monitoring item storage unit 104 is updated. (S104). Here, the update information of the monitoring item may include information related to OS information of the OS to which the update information is applied. Thereby, since a predetermined monitoring item can be updated on the monitoring apparatus 100 side, there is no need to update the monitoring item for each monitoring target system 10, and the updating operation of the monitoring item can be performed efficiently.

  The diagnostic reference update unit 112 determines whether or not diagnostic reference update information has been acquired (S106), and when the update information is acquired, updates the diagnostic reference stored in the diagnostic reference storage unit 110 ( S108). Here, the update information of the diagnostic criteria may include OS information of the OS to which the update information is applied, information on the format of the analysis target data, and the like. Thus, since the predetermined diagnostic criteria can be updated on the monitoring device 100 side, efficient system monitoring can be realized by diagnosing the state of the monitored system 10 based on the updated diagnostic criteria. it can.

  The control unit 122 confirms whether or not the analysis target data is received from the monitoring target system 10 (S110). The control part 122 performs the process after S112, when reception of analysis object data is confirmed, and when a confirmation is not confirmed, it continues a confirmation process.

  The data acquisition unit 102 periodically acquires analysis target data from a data acquisition program operating on the monitoring target system 10 (S112). The analysis target data may include identification information of the monitoring target system 10, OS information, information on the data format of the analysis target data, and the like.

  The data acquisition unit 102 outputs the analysis target data to the analysis processing unit 108 (S114). Here, the data acquisition unit 102 may temporarily store the analysis target data in the storage unit 120. In particular, when the analysis target data is acquired in units of blocks, the data acquisition unit 102 temporarily stores the analysis target data in the storage unit 120 until all of the analysis target data necessary for executing the analysis process is acquired. Remember.

  The analysis processing unit 108 refers to a predetermined monitoring item stored in the monitoring item storage unit 104 (S116). Here, the analysis processing unit 108 may refer to monitoring items that match the OS information of the monitoring target system 10 and / or the data format of the analysis target data.

  The analysis processing unit 108 analyzes the analysis target data based on the monitoring item (S118). Here, prior to the analysis processing, the analysis processing unit 108 may select an analysis processing routine that matches the OS information of the monitoring target system 10 and / or the data format of the analysis target data.

  The analysis processing unit 108 outputs the result of the analysis processing to the diagnosis processing unit 114 (S120). Here, the analysis processing unit 108 may temporarily store the result of the analysis processing in the storage unit 120.

  The diagnostic processing unit 114 refers to a predetermined diagnostic criterion stored in the diagnostic criterion storage unit 110 (S122). Here, the diagnosis processing unit 114 may refer to a diagnosis standard that matches the OS information of the monitoring target system 10 and / or the data format of the analysis target data. Thereby, since the state of the monitoring target system 10 is diagnosed based on the predetermined diagnostic criterion stored in the diagnostic criterion storage unit 110, the diagnosis criterion storage unit 110 can display a failure history related to the specific or unspecified monitoring target system 10. By storing them in the system, efficient system monitoring can be realized.

  The diagnosis processing unit 114 diagnoses the state of the monitoring target system 10 based on the result of the analysis process and a predetermined diagnosis criterion (S124). Here, the diagnosis processing unit 114 may create a diagnosis report as a result of the diagnosis processing.

  The diagnosis processing unit 114 outputs the result of the diagnosis processing to the failure information notification unit 116 (S126). Here, the diagnosis processing unit 114 may output the diagnosis report to the failure information notification unit 116 as a part of the result of the diagnosis processing. Further, the diagnostic processing unit 114 may temporarily store the result of the diagnostic processing in the storage unit 120.

  The failure information notification unit 116 determines whether or not a failure has been confirmed in the state of the monitored system 10 based on the result of the diagnostic processing (S128), and if confirmed, failure information indicating the occurrence of the system failure. (S130), if not confirmed, the process returns to S102.

  As described above, according to the monitoring apparatus 100 according to the present embodiment, the monitoring apparatus 100 analyzes analysis target data based on a predetermined monitoring item, diagnoses the state of the monitoring target system 10, and notifies failure information. Therefore, there is no need to set monitoring items for each monitoring target system 10. As a result, even when managing a large number of monitoring target systems 10, it is possible to efficiently perform monitoring item setting work and easily prevent setting errors. Therefore, according to the monitoring apparatus 100 according to the present embodiment, the efficiency of system monitoring can be improved.

  As mentioned above, although preferred embodiment of this invention was described referring an accompanying drawing, this invention is not limited to the example which concerns. It is obvious for those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea described in the claims. It is understood that it belongs to.

  For example, in the description of the above embodiment, the monitoring apparatus 100 includes the diagnostic reference storage unit 110 and the diagnostic processing unit 114 performs the diagnostic processing based on a predetermined diagnostic reference stored in the diagnostic reference storage unit 110. explained. However, the present embodiment can also be applied to the case where the monitoring apparatus 100 does not include the diagnostic reference storage unit 110. In this case, the monitoring apparatus 100 is based on a predetermined diagnostic reference stored in the storage unit 120. Diagnostic processing can be performed.

It is explanatory drawing which shows the whole structure of the monitoring system containing the monitoring apparatus which concerns on one Embodiment of this invention. It is explanatory drawing which shows the structure of a monitoring apparatus. It is explanatory drawing which shows an example of analysis object data. It is explanatory drawing which shows an example of failure information. It is a flowchart which shows the operating method of a monitoring apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Monitoring target system 100 System monitoring apparatus 102 Data acquisition part 108 Analysis processing part 114 Diagnosis processing part 116 Fault information notification part 110 Diagnosis reference memory | storage part 104 Monitoring item update part 112 Diagnosis reference update part

Claims (5)

In a system monitoring device for monitoring the state of a computer system,
A data acquisition unit for periodically acquiring data to be analyzed from the computer system;
An analysis processing unit that analyzes the analysis target data based on a predetermined monitoring item;
A diagnostic processing unit for diagnosing the state of the computer system based on the result of analysis processing and a predetermined diagnostic criterion;
A failure information notification unit for notifying failure information indicating the occurrence of a failure when a failure is confirmed in the state of the computer system based on a result of diagnostic processing;
System monitoring device with   The system monitoring apparatus according to claim 1, further comprising a diagnostic criterion storage unit that stores the predetermined diagnostic criterion.   The system monitoring apparatus according to claim 1, further comprising a monitoring item update unit for updating the predetermined monitoring item.   The system monitoring apparatus according to claim 2, further comprising a diagnostic standard update unit for updating the predetermined diagnostic standard stored in the diagnostic standard storage unit. In a program applied to a system monitoring apparatus for monitoring the state of a computer system,
Data acquisition means for periodically acquiring data to be analyzed from the computer system;
Analysis processing means for analyzing the analysis object data based on a predetermined monitoring item;
Diagnostic processing means for diagnosing the state of the computer system based on the result of analysis processing and a predetermined diagnostic criterion;
Failure information notifying means for notifying failure information indicating the occurrence of a failure when a failure is confirmed in the state of the computer system based on a result of diagnostic processing;
Program to function as.

Images