JP2011034319A - Terminal operation state monitoring system, terminal operation state monitoring method, and terminal operation state monitoring program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To highly accurately detect an operational abnormality in a processing operation in a computer terminal. <P>SOLUTION: A terminal operation monitoring system includes: a sensor group 21 for acquiring information indicating the operation state of a preset monitoring target unit in a server 10; a monitoring software unit 11 for acquiring information indicating the operation state of the monitoring target unit by program processing; a determination and communication unit 30 for determining whether a correlation between the information acquired by the sensor group 21 and the monitoring software unit 11 is different from determination criterion information representing a preset correlation; and a monitoring terminal 50 having a display unit for displaying a content of the operational abnormality in the monitoring target unit when the correlation between the acquired information is determined to be different from the determination criterion information. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a system for monitoring an operation state in a computer terminal and detecting an operation abnormality thereof.

Monitors the operating status of hardware monitoring elements (hereinafter referred to as “hardware monitoring elements”) such as sound, smell, and weight within the server, which is a computer terminal, using sensor devices installed in the server in advance. A monitoring system is disclosed (Patent Documents 1 and 2).
Also, information indicating the operating status is obtained by executing preset programs such as CPU (Central Processing Unit) usage rate, memory usage rate, disk access rate, disk usage rate, and fan speed in the server. A system is disclosed that acquires the operating state of possible monitoring elements (hereinafter referred to as “software monitoring elements”) and monitors the operating state of a computer terminal based on this information.

  However, in the system that monitors each of the hardware monitoring element and the software monitoring element as a single monitoring element, there is a disadvantage that an unexpected operation abnormality cannot be detected, which is different from an operation abnormality state caused by a correlation operation between the monitoring elements. there were. Moreover, although the operation state in the computer terminal (server) is a normal state, there may be a problem that an operation abnormality is erroneously detected.

  As a related technology, for example, a computer terminal monitors the access sound of an HDD (hard disk drive) and the access rate (disk access rate) for data stored on the disk, and detects the detected access sound and access. A system for detecting an abnormal operation based on a rate is disclosed (Patent Document 3).

  In addition, when a software module in which various hardware states in the computer terminal are set in advance is executed, a hardware failure or a malfunction of the software and an execution violation are detected, and an operation in the computer terminal is hindered. A system is disclosed that automatically restarts a computer terminal to perform error processing, and further notifies the destination set in advance by SMTP or SNMP (Patent Document 4).

JP 2003-029818 A JP 2002-328749 A Japanese Patent Application Laid-Open No. 11-065653 JP 2002-283683 A

  However, in the related techniques disclosed in Patent Documents 1 and 2, a monitoring element (hardware monitoring element: for example, sound, smell, weight, etc.) related to the hardware of the computer terminal, or software in the computer terminal Each monitoring element (software monitoring element) that can detect its operation state by execution is set as a single monitoring target, and its operation abnormality is detected.

For this reason, for example, when the processing load of the CPU of the server becomes temporarily high, for example, the access sound as the hardware monitoring element is preliminarily obtained in spite of the normal state that the processing load of the server is small. If the setting is such that a state larger than the set value is detected as an abnormal operation, there is a disadvantage that the normal state is detected as an abnormal state.
Even when only the access rate is monitored, the processing operation status of the entire server is normal because the detected access rate is set to detect a state where the detected access rate is larger (or smaller) as an abnormal operation state. In spite of the state, there may be a disadvantage that the operation state is detected as an operation abnormality.

Further, in the related art disclosed in the above-mentioned patent document 3, in order to detect a hardware failure or a software malfunction, etc., there is an operation abnormality other than the operation abnormality assumed in advance from the correlation of the operation states of the monitoring elements. If it occurs, there is an inconvenience that the operation abnormality cannot be detected and erroneous detection occurs.
Further, in the related art disclosed in Patent Document 4, for example, when the processing load of some hardware such as a CPU in a computer terminal temporarily increases, for example, the access sound is higher than a preset value. A large condition is detected. In this case, although the processing operation state of the entire computer terminal is in a normal state, an inconvenience that an operation abnormality is detected may occur.

[Object of invention]
An object of the present invention is to provide a terminal operation state monitoring system that improves the disadvantages of the related art and can detect an operation abnormality in a processing operation at a computer terminal with high accuracy.

  In order to achieve the above object, a terminal operation state monitoring system according to the present invention acquires hardware operation state information indicating an operation state of a preset monitoring target part included in a computer terminal by a preset sensor unit. A hardware operation state monitoring unit, a software operation state monitoring unit that indicates an operation state of the monitoring target unit and acquires software operation state information that can be detected by executing a preset program, and the hardware and software A terminal operation monitoring system comprising: an operation abnormality notification unit that notifies an operation state display unit that is set in advance of an operation abnormality of the monitoring target unit detected based on operation state information, the hardware and software operation state Correlation indicating changes in operating state between pieces of information is previously stored as operating state relationship information. A correlation state information extraction unit that extracts the hardware and software operation state information correlated with the manner of change of the operation state from the acquired hardware and software operation state information; Correlated operation abnormality determining means for detecting an operation abnormality in the monitoring target unit by comparing whether or not the correlation between the extracted hardware and software operation state information is different from the operation state relationship information is provided. It has a configuration.

  The terminal operation state monitoring method according to the present invention is a hardware operation state monitor that acquires hardware operation state information indicating an operation state of a preset monitoring target unit included in a computer terminal by a preset sensor unit. An operation state between the hardware and the software operation state information, and a software operation state monitoring unit that obtains software operation state information that can be detected by execution processing of a preset program and that indicates an operation state of the monitoring target unit A terminal operation monitoring system comprising a relation information database for storing operation relation information set in advance as a state change relation, the terminal operation monitoring method for detecting an operation abnormality of the monitoring target unit, the hardware Software monitoring element information, and the hardware and software A) hardware and software operation state information correlated with the operation state change method from each operation state information, and the correlation between the extracted hardware and software operation state information and the preset operation state It is determined whether or not the relationship information is different, and when the correlation is different from the operation state relationship information, the operation state of the monitoring target unit is notified to the preset operation state display unit as an operation abnormality. It is characterized by.

  The terminal operation state monitoring program according to the present invention is a hardware operation state monitor that obtains hardware operation state information indicating an operation state of a preset monitoring target unit included in a computer terminal by a preset sensor unit. An operation state between the hardware and the software operation state information, and a software operation state monitoring unit that obtains software operation state information that can be detected by execution processing of a preset program and that indicates an operation state of the monitoring target unit A terminal operation monitoring system comprising a relation information database for storing operation relation information set in advance as a state change relation, the terminal operation monitoring program for detecting an operation abnormality of the monitoring target unit, Obtain hardware and software monitoring element information and And a correlation state information extraction function for extracting hardware and software operation state information correlated with the manner of change of the operation state from each of the software operation state information, and a correlation between the extracted hardware and software operation state information Correlation operation abnormality determination function for determining whether or not the operation state relationship information set in advance is different from the operation state display unit set in advance when the correlation is different from the operation state relationship information An operation abnormality notification function for performing a process of notifying the operation state of the monitoring target unit as an operation abnormality is executed by a computer set in advance.

  Since the present invention is configured and functions as described above, according to this, the hardware monitoring target unit and the software monitoring target unit that are provided in the computer terminal and have a correlation with the change in the operation state, It is equipped with a means for detecting an uncorrelated operating state change in the monitored part extracted based on the operating state relationship information indicating the correlation of the operating state correlation change, thereby accurately detecting an abnormal operation in the computer terminal. Therefore, it is possible to provide a terminal operation state monitoring system that can be detected in a short time.

It is a schematic block diagram which shows one Embodiment in the terminal operation state monitoring system by this invention. It is a schematic block diagram which shows an example of the internal structure of the monitoring apparatus and server in the terminal operation state monitoring system disclosed in FIG. It is a schematic block diagram which shows an example of the internal structure of the judgment communication apparatus in the terminal operation state monitoring system disclosed in FIG. It is a flowchart which shows the whole operation | movement process step in the terminal operation state monitoring system disclosed in FIG.

[Embodiment]
Next, the basic configuration content of the embodiment of the present invention will be described.

  As shown in FIG. 1, the terminal operation state monitoring system according to the present embodiment is notified by the server 10 as a computer terminal, the monitoring device 20 that monitors the operation state in the server 10, and the server 10 and the monitoring device 20. Information indicating the operating state of the server 10 is acquired, and a determination communication device 30 that determines whether the monitoring element in the server 10 is abnormal in operation and information for determining abnormal operation (determination reference information) are stored in advance. A database 40 that stores and provides this information to the determination communication device 30 and a monitoring terminal 50 that is connected to the determination communication device 30 and that acquires and displays information related to abnormal operation of the server 10 are provided.

  The terminal operation state monitoring system includes a server 15 that is a computer terminal having an internal configuration equivalent to that of the server 10, and a monitoring device 25 that has an internal configuration equivalent to that of the monitoring device 20 and that monitors the operating state of the server 15. Is connected to the determination communication device 30, and the determination communication device 30 is configured to determine whether there is an abnormal operation in the server 10 based on the information indicating the operation state of the server 15 notified from the server 15 and the monitoring device 25. ing.

  In this embodiment, the monitoring devices (20 and 25) for monitoring the operating state of each server (10 and 15) are installed corresponding to each server, but one monitoring device is provided. The operation status of a plurality of different servers may be monitored. Alternatively, a configuration in which three or more servers or monitoring devices are connected to the determination communication device 30 may be used.

This will be described in detail below.
Each of the servers 10 and 15 includes a CPU (Central Processing Unit), a memory, an HDD (Hard Disk Drive: hereinafter referred to as “Disk”), a cooling fan, and the like, and the CPU executes processing based on a preset program. It is a general computer terminal (terminal computer).

Hereinafter, the server 10 will be described as a configuration of the servers 10 and 15, but the server 15 is also configured to have the same functional contents.
The server 10 is provided with a sensing unit as one component of the sensor group 21 provided in the monitoring device 20.
Specifically, the sensing unit is configured such that the sound inside the server 10 (such as an access sound in the disk), smell, color of the network access lamp, the weight of the disk drive, and the size (height, length) of the server 10 casing. It is assumed that the sensor device is for detecting information relating to the temperature in the housing.

The server 10 also includes a monitoring software unit 11 that monitors the operating state of software monitoring elements set in advance in the server 10 such as a CPU, a memory, a disk, and a cooling fan.
The monitoring software unit 11 uses a specific command or API (Application Program Interface) executed by the CPU based on an OS (operating system) preset in the server 10 or a program provided as a partial function of the application. Shall be realized.
Also, the monitoring software unit 11 acquires a software monitoring element information acquisition function that acquires information such as CPU usage rate, memory usage rate, disk access rate, disk usage rate, and fan rotation speed in the server 10 as software monitoring element information. Have

  Further, the monitoring software unit 11 has a software monitoring element transmission function for transmitting the software monitoring element information acquired by executing this software monitoring element information acquisition function to the determination communication device 30.

  As shown in FIG. 2, the monitoring device 20 acquires a sensor group 21 that acquires a preset operating state of the monitoring element in the server 10, and sensor information that transmits information acquired by the sensor group 21 to the determination communication device 30. A transmission unit is provided.

  As described above, the sensor group 21 is installed in the server 10 in advance, and the sound inside the server 10 (such as an access sound in Disk), smell, lighting color of the network access lamp (lighting number), weight of the disk drive, A sensing unit as a sensor device for detecting the size (height, length, width) in the housing of the server 10 and information on the temperature in the housing, and sensor detection detected via the sensing unit A detection information acquisition unit (hardware monitoring element information acquisition unit) that acquires information as hardware monitoring element information is provided.

The sensing unit includes, for example, a sound sensor (access sound detection sensor) that detects an access sound in the disk, an odor sensor that detects an odor of the server 10 casing and the CPU, a warning lamp and a data access lamp that are set in advance in the server 10. A color detection sensor that detects a lighting color (number of lighting times) is included.
The network access lamp is lit when there is communication access or data communication from the server 10 to the Internet or a LAN (Local Area Network). Moreover, the setting which acquires the lighting frequency | count per fixed time may be sufficient.

In addition, the sensing unit is a weight measurement sensor that detects the weight of a disk drive such as a DVD drive set in advance in the server 10, and a size that detects the size (height, length, width) in the server 10 housing. The sensor includes a temperature sensor that detects the temperature in the housing of the server 10 and the temperature of the CPU.
The weight measurement sensor can detect whether or not a medium such as a DVD is set in the DVD drive.

  A detection information acquisition unit (hardware monitoring element information acquisition unit) of the monitoring device 20 is a monitoring element set in advance in the server 10 (hereinafter referred to as “hardware monitoring element”) that is detected by the sensing unit and acquired via the communication line. ) Includes sensor detection information holding means for storing and holding information (hereinafter referred to as “hardware monitoring element information”).

Here, the hardware monitoring element information includes the disk access sound in the server 10, the smell of the CPU, the lighting color of the access lamp, the number of times the access lamp blinks, the weight of the disk drive, the size inside the server, Indicates the temperature of the CPU.
The communication unit of the monitoring device 20 has an information transmission function for transmitting the hardware monitoring element information held in the sensor detection information holding unit to the determination communication device 30.
In the present embodiment, the monitoring device 20 is described. However, the monitoring device 25 is assumed to have the same configuration as the monitoring device 20.

As shown in FIG. 3, the determination communication device 30 temporarily acquires the sensor detection information of the hardware monitoring elements sent from the monitoring device 20 and the software monitoring element information sent from the monitoring software 11 of the server 10. Monitoring element information holding means 302 is provided.
In addition, the determination communication device 30 includes a numerical value conversion unit 303 that performs processing for digitizing the acquired hardware monitoring element information and software monitoring element information based on a preset algorithm.
In addition, the numerical value conversion means 303 obtains information (monitoring element) that correlates with how the value changes, that is, how the operating state changes, from each of the hardware monitoring element information and the software monitoring element information based on the digitized value. Information) is selected and extracted (correlation state information extraction unit).
It is assumed that the hardware monitoring element information and the software monitoring element information are acquired for a predetermined number of times within a certain period. As a result, the determination communication device 30 determines whether there is a correlation based on how the values of the hardware monitoring element information and the software monitoring element information change.

Further, the determination communication device 30 refers to the determination criterion information (condition information) stored in the database 40 based on the monitoring element information held in the monitoring element information holding means, and each hardware monitoring element in the server 10 and each And an operation state determination unit 301 that determines whether the operation state of the software monitoring element is abnormal.
Here, the operation state determination unit 301 determines whether the operation state of each hardware monitoring element and each software monitoring element of the server 10 is normal, normal operation abnormality, or abnormal operation abnormality. .

In addition, the determination communication device 30 includes numerical value conversion means 303 for converting the hardware monitoring element information sent from the monitoring device 20 and the software monitoring element information sent from the server 10 into values in a preset numerical value range. Yes.
Furthermore, the determination communication device 30 determines whether or not there is an operation abnormality in the hardware monitoring element and the software monitoring element in the server 10 by a combination of the digitized hardware and software monitoring element information. It has.

In addition, the determination communication device 30 includes a state notification unit 304 that transmits information indicating the operation states of hardware and software monitoring elements determined to have an operation abnormality to the monitoring terminal 50.
Further, the determination communication device 30 operates in the case where operation abnormality countermeasure information indicating a procedure and an operation instruction for avoiding an operation abnormality in the server 10 and returning to a normal state is set in the database 40 in advance. A configuration having a handling information transmitting means for transmitting (hereinafter referred to as “handling information”) to the server 10 may be used. At this time, the server 10 can perform the processing for the operation abnormality by executing the processing based on the countermeasure information, and return the operation abnormality state to the normal operation state.

  Here, the operation state determination in which the operation state determination unit 301 of the determination communication device 30 determines whether or not the operation states of the hardware and software monitoring elements in the server 10 cause an operation abnormality will be described.

  Specifically, the hardware monitoring element information indicating the state of access sound in the HDD of the server 10 detected by the sound sensor by the monitoring device 20 and the disk access rate in the HDD of the server 10 detected by the monitoring software unit 11 are displayed. The operation state determination combined with the software monitoring element information shown will be described.

  As described above, the operation state determination unit 301 is configured so that the operation state of each monitoring element in the server 10 is normal based on the criterion information preset in the database 40 from the acquired hardware monitoring element information and software monitoring element information. Then, it is determined whether the operation is abnormal (normal operation abnormality or abnormal operation abnormality).

[Normal operation abnormality judgment]
It is assumed that a numerical range indicating an abnormal operation state is stored in advance in the database 40 as determination criterion information.
For this reason, the operation state determination unit 301, for example, when the monitoring element information obtained by quantifying the access sound (A) and the disk access rate (B) is a numerical value within a certain numerical range set by the determination criterion information. When the numerical value range is reached (for example, 0 <A50 and 0 <B <50), the HDD operating state in the server 10 is determined as “normal operation abnormality”.

  In addition, as described above, the operation state determination unit 301 may be set to perform operation state determination combining three or more pieces of monitoring element information. For example, by adding the lighting state of the disk access lamp and the number of lighting times (C) as a monitoring element to be combined, the accuracy of the determination of the abnormal state can be increased.

For example, when the monitoring element information is A, B, and C, the operation state determination unit 301 determines a certain numerical range set in the determination reference information (for example, 100 <A and 100 <B and 70 <C <100). Are included as “normal operation abnormality”.
As a result, the access sound in the HDD of the server 10 increases until reaching a certain value (numerical range), the Disk access rate also rises to a certain value, and the number of times the disk access lamp is turned on per certain time. Is equal to or greater than a preset value, the operation state determination unit 301 maintains the correlation between the monitoring elements, but the detected numerical value is greater than or equal to the set numerical range. The monitoring terminal 50 is notified of the occurrence of an operation abnormality as a normal operation abnormality.

Further, the determination communication device 30 extracts the monitoring elements having the correlation from the hardware monitoring elements and the software monitoring elements, and also performs the correlation monitoring for determining the operation state by combining the monitoring element information regarding the extracted monitoring elements. An element extraction judgment function is provided.
In the present embodiment, the operation state determination performed by combining two monitoring elements (access sound and disk access rate) is described. However, the setting for determining the operation state combining three or more monitoring elements is described. It may be.

[Abnormal operation abnormality judgment]
By the way, when one detected value rises among the access sound and the disk access rate, the other detected value also rises. That is, when the detection value of the access sound detected by the sound sensor increases, the value of the disk access rate also increases, and when the detected access sound decreases, the disk access rate also decreases.

Here, the database 40 sets a plurality of monitoring elements having different correlations as correlation monitoring elements such as access sound and Disk access rate (correlation monitoring element setting means).
Further, the database 40 includes the contents of the correlation between different pieces of monitoring element information (for example, two) (in this case, the access sound and the disk access rate) (for example, “if one detected value increases, the other It is assumed that the detected value of “also rises”) is stored as the criterion information.

The operation state determination unit 301 indicates the relationship between the mutual operation state changes (contents) indicated in the plurality of pieces of acquired different monitoring element information (access sound (A) and disk access rate (B)) in the determination criterion information. It is determined whether or not it matches the relationship (correlation) made.
Here, the operation state determination means 301 is a monitoring element which is an operation change such as an increase in access sound but a low disk access rate, or an operation change content such as a low access sound but a high disk access rate. When the information is acquired, the operation state change indicated in the monitoring element information is an operation state change different from the correlation indicated in the determination criterion information. Is determined as “abnormal operation abnormality” indicating an operation abnormality different from the normal operation abnormality.

  At this time, the operation state determination unit 301 determines that an abnormal operation abnormality has occurred in the HDD or memory affected by the disk access rate and access sound, and notifies the monitoring terminal 50 of it.

As described above, different monitoring elements (for example, the access sound and the disk access rate) have undergone mutually correlated operation changes, and the operating states of both monitoring elements (or all three or more monitoring elements) are changed. When the indicated value reaches a predetermined constant value, the operation state determination unit 301 determines that a “normal operation abnormality” indicating an operation abnormality that can be normally assumed has occurred in the monitoring element in the server 10. .
At this time, the operation state determination unit 301 may be configured to specify which monitoring element in the server 10 has the operation abnormality based on the monitoring element combined with the detected value.

  On the other hand, when the operation change method of different monitoring elements (for example, access sound and disk access rate) is an operation change different from the preset correlation, the operation state determination unit 301 includes It is determined that an abnormal operation abnormality that is an operation abnormality that is usually difficult to assume has occurred.

  It should be noted that the status notification means 304 of the determination communication device 30 transmits the content of the operation abnormality to the monitoring terminal 50 only when it is determined that the operation state of the hardware and software monitoring elements in the server 10 is “abnormal operation abnormality”. It is good also as a setting which transmits.

  Thereby, when there is a correlation in the way of changing the operation of each of the different monitoring elements, the abnormal operation (normal operation abnormality) is not notified to the monitoring terminal 50. Therefore, for example, it is possible to effectively reduce the occurrence of a situation in which the occurrence of an abnormal operation is notified even though the processing operation in the server 10 is in a normal state.

  As described above, the database 40 includes a determination criterion information storage unit that stores determination criterion information that is reference information for the determination communication device 30 to determine an abnormal operation state of the server 10. It is assumed that a combination of monitoring element information and a numerical range of digitized monitoring element information are shown.

Further, as described above, the database 40 includes correlation monitoring element setting means for setting a plurality of different monitoring element information having correlation as correlation monitoring elements.
Furthermore, the database 40 is used to avoid the contents of the operation event in the server 10 in an abnormal state, event information indicating the content of the operation abnormality, abnormality cause information indicating the cause of the abnormal state, and the abnormal state that has occurred. It may be a setting in which handling information indicating an operation procedure or the like is stored in advance.

  Here, the criteria information stored in the database 40 will be specifically described. Here, a combination of A (access sound), B (disk access rate), and C (number of times the disk access lamp is turned on) having a correlation with how the detected value changes is shown as the judgment reference information. Here, A, B, and C are assumed to be correlation monitoring elements.

  In addition, regarding the detected values of the above A, B, and C, when a numerical change having no correlation is detected, the determination communication device 30 determines that an abnormal operation abnormality has occurred in the monitoring element of the server 10. The monitoring terminal 50 is notified.

  In addition, in the criterion information, the contents of the correlation between a plurality of different (for example, two) pieces of monitoring element information (for example, “when one detected value falls, the other detected value also falls”). May be included.

The above criteria information includes “0 <A <50 and 0 <B <50”, “0 <A <50 and 0 <C <30”, “0 <A <50 and 30 ≦ C <50”, “ A numerical range indicating an abnormal state (normal operation abnormality) such as “100 <A and (100 <B or 70 <C <100)” is registered.
The determination communication device 30 determines whether or not the numerical values of the monitored element information A, B, and C are included in this numerical range.

  Here, the determination communication device 30 determines whether or not the digitized monitoring element information A and B or A and C are included in the numerical range. When the numerical values of the monitoring element information A and B or A and C are included in the range, it is determined that the monitoring element of the server 10 is in an abnormal state, and the monitoring element combination contents (for example, Based on A and C), the monitoring element in the operation abnormal state in the server 10 is specified, and the monitoring terminal 50 is notified as a normal operation abnormality.

Note that the database 40 has a configuration in which an operation abnormality monitoring element list in which monitoring elements in an abnormal operation state in the server 10 are specified based on the combination contents (for example, A and C) of the monitoring elements and a list thereof is set. May be.
Thereby, the judgment communication device 30 can quickly notify the monitoring terminal 50 of the monitoring element in the abnormal operation state.

  The monitoring terminal 50 is, for example, a terminal computer operated by an operator (administrator), and an operation state display means (display) that displays the operation state of the servers (10, 15) sent from the determination communication device 30. It has.

In addition, the monitoring terminal 50 transmits operation abnormality countermeasure information (handling information) indicating a preset procedure and operation instruction for avoiding the operation abnormality in the server 10 and returning to the normal state to the determination communication device 30. Coping information notification means is provided.
Note that the handling information may be set according to each of the operation state information sent from the determination communication device 30. Further, the handling information may be set by the operator of the monitoring terminal 50 in accordance with each of the operation state information sent from the determination communication device 30.

  At this time, the determination communication device 30 notifies the server 10 of the handling information sent from the monitoring terminal 50, so that the server 10 can perform an execution process based on the handling information. As a result, the server 10 can perform processing for the operation abnormality that has occurred in the server 10, and can return the operation abnormality state that has occurred to a normal operation state.

  In the present embodiment, as described below, the determination communication device 30 may be configured to perform an operation abnormality determination by combining hardware monitoring element information and software monitoring element information.

For example, the CPU temperature (hardware monitoring element information) detected by the temperature sensor set in the server 10, the CPU usage rate (software monitoring element information) detected by the monitoring software 11, and the fan rotation speed Since (software monitoring element information) has a correlation, it is possible to perform an operation abnormality determination by combining these.
Here, the determination communication device 30 extracts the CPU temperature, the CPU usage rate, and the fan rotation speed as the monitoring elements having a correlation from the hardware monitoring element and the software monitoring element, and the access sound and the disk access rate are Similarly to the case, the operation state is determined by combining the digitized monitoring element information (CPU temperature, CPU usage rate, and fan rotation speed) (correlation monitoring element extraction determination function).

The CPU usage rate of the server 10 is acquired when the monitoring software 11 executes a “sar command” provided by the OS of the server 10.
Further, the fan rotation speed of the server 10 is acquired using an API provided by the monitoring software 11 from the OS of the server 10.

  Further, since the CPU usage rate and the fan rotation speed have a correlation that the fan rotation speed increases when the CPU usage rate increases, the database 40 stores the CPU usage rate and the fan rotation speed (both software Monitoring element information) may be set as the correlation monitoring element.

  Here, the operation state determination unit 301 of the determination communication device 30 has a state (state change) in which the server temperature is higher than a predetermined value, even though the CPU usage rate is lower than a predetermined value. Stored in the database 40 when it is detected or when a state (state change) in which the fan speed is higher than a predetermined value is detected even though the CPU usage rate is lower than a predetermined value. It is determined that the operating state changes different from the correlation shown in the determined criterion information, that is, the abnormal operating abnormality state.

  At this time, the state notification means of the determination communication device 30 determines that an abnormal operation abnormality has occurred in the CPU, fan, etc. of the server 10 and notifies the monitoring terminal 50 of this.

  Further, for example, the weight of the DVD drive of the server 10 (hardware monitoring element information) detected by the weight sensor set in the server 10 and the disk access rate (software monitoring element information) detected by the monitoring software 11 Have a correlation, it is possible to perform an operation abnormality determination combining them.

Here, the judgment communication device 30 extracts the weight of the DVD drive and the disk access rate as the monitoring elements having a correlation from the hardware monitoring element and the software monitoring element, respectively, and the case of the access sound and the disk access rate. Similarly, the operation state is determined by combining the monitoring element information (correlation monitoring element extraction determination function).
For example, the operation state determination unit 301 detects a state in which the disk access rate to the DVD device of the server 10 is high in a state where a medium such as a DVD or a CD is not set in the DVD drive (detected by the weight sensor). The status notification means notifies the monitoring terminal 50 of the detected content.

Further, for example, the number of lighting of the network access lamp of the network card of the server 10 detected by the color sensor set in the server 10 (number of times of changing the lighting color: hardware monitoring element information) and the monitoring software 11 Since there is a correlation with the network load factor (software monitoring element information), it is possible to perform an operation abnormality determination combining these.
Here, the determination communication device 30 extracts the network access lamp and the network load factor as the monitoring elements having a correlation from the hardware monitoring element and the software monitoring element, and performs the same as in the case of the access sound and the disk access rate. Then, the operation state is determined by combining the monitoring element information (correlation monitoring element extraction determination function).

  The network load factor in the server 10 is acquired when the monitoring software 11 executes a “netstat command” provided by the OS of the server 10.

  Here, the operation state determination unit 301 of the determination communication device 30 is, for example, a state (state where the number of lighting of the network access lamp is higher than a predetermined value, even though the network load factor is lower than a predetermined value set in advance. Change) is detected, or when the network load factor is lower than a preset fixed value, but the network access lamp lighting count is higher than the preset value (status change). In addition, it is determined that the operating state changes different from the correlation indicated in the criterion information stored in the database 40, that is, the abnormal operating abnormality state.

  At this time, the state notification means of the determination communication device 30 determines that an abnormal operation abnormality has occurred in the network access lamp or the network communication device in the server 10 and notifies the monitoring terminal 50 of this.

  In the present embodiment, as described above, as the hardware monitoring element, the operating sound of the server 10, the odor in the server 10, the color of the lamp, the weight of the DVD drive, the size of the casing of the server 10 (high (Sheet, Length, Width), the temperature of the CPU in the server 10, and the like are described by measuring and acquiring with a preset sensor device. A configuration in which a monitoring element capable of acquiring information related to the operation is set by the device may be used.

  In this embodiment, the case where the monitoring software 11 acquires the CPU usage rate, the memory usage rate, the disk access rate, the disk usage rate, the fan rotation speed, and the like as the software monitoring elements by the program execution process is described. The monitoring element other than the above in the server 10 may be configured such that a monitoring element capable of acquiring information related to the operation by the program execution process is set.

Furthermore, a configuration in which monitoring elements other than those described above may be set as the hardware monitoring elements and software monitoring elements, and a combination thereof can be set.
Further, in accordance with the set hardware monitoring element and software monitoring element, the value range in which the values of the hardware monitoring element and software monitoring element information indicating the abnormal operation state in the criterion information registered in the database 40 are combined. Shall be set.

[Description of Operation of Embodiment]
Next, an outline of the operation of this embodiment will be described.
First, the determination communication device 30 acquires the hardware and software monitoring element information detected from the monitoring device 20, and the hardware and software operation state information correlated with how the operation state changes from the monitoring element information. Is extracted (correlation state information extraction step).
Next, the determination communication device 30 determines whether or not the correlation between the extracted hardware and software operation state information is different from the operation state relationship information set in the database 40 in advance (correlation operation abnormality determination step). ,
When the correlation is different from the operation state relationship information, a process of notifying the operation state display unit set in advance as the operation state of the monitoring target unit as an operation abnormality is performed (operation abnormality notification step).

  Here, regarding the correlation state information extraction step, the correlation operation abnormality determination step, and the operation abnormality notification step, the execution contents may be programmed and executed by a computer.

  Next, the operation of the terminal operation monitoring system according to the present embodiment will be described based on the flowchart of FIG.

First, the access sound in the HDD (Disk) of the server 10 is acquired as hardware monitoring element information of the server 10 via the sensing unit 211 set in the server 10 in the sensor group 21, and the detection information acquisition unit of the monitoring device 20 212 (hardware monitoring element information acquisition unit) holds the hardware monitoring element information.
The access sound indicates the arm operation sound volume and the number of operation sounds for data access.

  In addition, the detection information acquisition unit 212 includes an odor in the server 10 casing, a lighting color of the network access lamp (number of lighting), a weight of the disk drive, a size (height, length, width) in the server 10 casing, It is assumed that information related to the temperature in the housing is detected as hardware monitoring element information.

In addition, the monitoring software unit 11 of the server 10 acquires the disk access rate in the server 10 as software monitoring element information. At this time, the monitoring software unit 11 includes the CPU usage rate, the memory usage rate, the disk usage rate, and the fan rotation speed. Etc. (software monitoring element information) is also acquired.

Next, the communication unit 213 of the monitoring device 20 transmits the hardware monitoring element information held in the sensor detection information holding unit to the determination communication device 30 (hardware information transmission function), and the monitoring software unit 11 acquires The determined software monitoring element information is transmitted to the determination communication device 30 (software monitoring element transmission function).
Thereby, the determination communication apparatus 30 acquires the hardware and software monitoring element information in the server 10, and memorize | stores it temporarily (step S101).

Next, the determination communication device 30 performs a process of digitizing the acquired hardware monitoring element information and software monitoring element information based on a preset algorithm.
Here, the numerical value conversion means 303 of the determination communication device 30 correlates with each of the hardware monitoring element information and the software monitoring element information based on the digitized value to change the value, that is, the operation state. Information (monitoring element information) is extracted (step S102: correlation state information extraction unit).

  Here, a case where an access sound and a disk access rate are extracted as correlated operation state information will be described.

Next, the operation abnormality determination unit of the determination communication device 30 determines the determination criterion information (conditions) stored in advance in the database 40 based on the digitized hardware monitoring element information and software monitoring element information (access sound and disk access rate). Information) and reference (step S103).
The access sound and the disk access rate are acquired for a predetermined number of times within a predetermined period, and the judgment communication device 30 compares the values based on the change and transition of the values of the access sound and the disk access rate. Reference shall be made.

  Here, the operation state determination unit 301 of the determination communication device 30 determines whether or not the operation state of the hardware and software monitoring elements in the server 10 has an operation abnormality (step S104: operation state determination step).

In this operation state determination step, the operation state change of the access sound (hardware monitoring element information) and the disk access rate (software monitoring element information) in the HDD of the server 10 is compared with the determination criterion information of the database 40. Determine the state.
Here, the operation state determination unit 301 refers to the access criteria set in advance in the database 40 and the criteria information related to the disk access rate, and the hardware monitoring element information (access sound) and the software monitoring element information (disk access rate) ) To determine whether the operation state of the monitoring element (here, HDD) in the server 10 is normal or abnormal (normal operation abnormality or abnormal operation abnormality).

  Specifically, the operation state determination unit 301 differs from the correlation indicated in the determination criterion information in the relationship between the mutual operation state changes indicated by the acquired monitoring element information (access sound and disk access rate) (YES) ) Or not (NO) is determined (step S104).

  At this time, if the operation state change of the acquired access sound and the operation state change of the disk access rate are different from the correlation shown in the determination criterion information, the operation state determination unit 301 acquires the monitored element The information (access sound, disk access rate) is determined to be an abnormal operation abnormality that is different from the normal operation abnormality (YES: Step S104).

  Next, it is determined that an abnormal operation abnormality has occurred, and the state notification means of the determination communication device 30 notifies the monitoring terminal 50 of the occurrence of an operation abnormality in the HDD of the server 10 and its contents (step S106). ).

On the other hand, when the operation state change of the acquired access sound and the operation state change of the disk access rate match the correlation shown in the above-described determination criterion information (NO: Step S104), It is determined whether the operation state of the HDD is normal or abnormal (step S105).
Here, when the digitized access sound (A) and the disk access rate (B), which are the monitoring element information, are values within a certain numerical range set in the criterion information, or reach this numerical range. In the case (for example, 0 <A50 and 0 <B <50), the HDD operation state in the server 10 is determined as a normal operation abnormality (YES: Step S105).

Here, the monitoring terminal 50 is notified of the content of the HDD operation abnormality (normal operation abnormality) detected by the determination communication device 30 (step S106).
The determination communication device 30 may be configured not to notify the monitoring terminal 50 of the content of the operation abnormality (normal operation abnormality) when the operation state of the HDD in the server 10 is determined as the normal operation abnormality.

  Thereby, although the processing operation of the server 10 is normal, the monitoring terminal 50 side can be prevented from being erroneously detected as a state in which the operation abnormality has occurred. The abnormal operation abnormality) can be accurately grasped by the monitoring terminal 50.

  In addition, when the digitized access sound (A) and the disk access rate (B) that are the monitoring element information are different from the certain numerical range set in the criterion information (that is, outside the numerical range) The operation state of the HDD in the server 10 is determined as a normal operation state (to step S101).

  The monitoring terminal 50 outputs and displays the notified operation abnormality on a preset display means, and indicates a preset procedure and operation instruction for avoiding this operation abnormality (HDD operation abnormality) and returning to a normal state. Operation abnormality handling information (handling information) may be transmitted to the determination communication device 30 to restore the HDD operation abnormality (step S107).

  Note that the handling information may be set according to each of the operation state information sent from the determination communication device 30. Further, the handling information may be set by the operator of the monitoring terminal 50 in accordance with each of the operation state information sent from the determination communication device 30.

  At this time, the determination communication device 30 notifies the server 10 of the handling information sent from the monitoring terminal 50, so that the server 10 can perform an execution process based on the handling information. As a result, the server 10 can perform processing for the operation abnormality that has occurred in the server 10, and can return the operation abnormality state that has occurred to a normal operation state.

As described above, in this embodiment, for example, by monitoring the monitoring element information related to the hardware of the server 10 and the monitoring element information acquired using the software in an integrated manner, Can detect different operation abnormal states (abnormal operation abnormalities) with high accuracy, and can notify the operation terminals 50 to a monitoring terminal (administrator) 50 connected to a remote place via a communication line.
As a result, the administrator becomes aware of the server abnormality or the abnormality before the server abnormality and can take appropriate measures.

  The present invention can be usefully applied to a system that centrally manages a large number of servers such as a database center.

10, 15 Server 11, 16 Monitoring software 20, 25 Sensor group 30 Judgment communication device 40 Database 50 Monitoring terminal

Claims (5)

A hardware operation state monitoring unit that acquires hardware operation state information indicating an operation state of a preset monitoring target unit included in the computer terminal by a preset sensor unit, and an operation state of the monitoring target unit A software operation state monitoring unit that acquires software operation state information that can be detected by execution processing of a preset program, and an operation abnormality of the monitoring target unit that is detected based on the hardware and software operation state information is set in advance. A terminal operation monitoring system comprising an operation abnormality notification unit for notifying the operation state display unit,
A relationship information database that stores in advance a correlation indicating an operation state change between the hardware and software operation state information as operation state relationship information;
A correlation state information extraction unit that extracts the hardware and software operation state information correlated with the manner of change of the operation state from the acquired hardware and software operation state information;
Correlation operation abnormality determining means for detecting an operation abnormality in the monitoring target unit by comparing and determining whether or not the correlation between the extracted hardware and software operation state information differs from the operation state relationship information. A terminal operation monitoring system characterized by that. The terminal operation monitoring system according to claim 1,
The monitoring target unit can acquire the software operation state information by a hardware monitoring target unit capable of acquiring hardware operation state information indicating an operation state by the sensor unit and execution processing of the preset program. A terminal operation monitoring system comprising: a software monitoring target unit. The terminal operation monitoring system according to claim 1,
The operation state display unit, when an operation abnormality is detected in the monitoring target unit, transmits operation abnormality solution procedure information set in advance for avoiding the operation abnormality to the operation terminal. It has a procedure notification function,
The terminal operation monitoring system characterized in that the computer terminal comprises operation abnormality solution executing means for executing an operation error solution procedure in the monitoring target unit based on the operation error solution procedure information. A hardware operation state monitoring unit that acquires hardware operation state information indicating an operation state of a preset monitoring target unit included in the computer terminal by a preset sensor unit, and an operation state of the monitoring target unit A software operation state monitoring unit that acquires software operation state information that can be detected by execution processing of a preset program, and stores operation relationship information that is set in advance as an operation state change relationship between the hardware and software operation state information A terminal operation monitoring system comprising a relational information database to detect an operation abnormality of the monitoring target unit,
Obtaining the hardware and software monitoring element information, extracting hardware and software operating state information correlated with how the operating state changes from the hardware and software operating state information,
It is determined whether the correlation between the extracted hardware and software operation state information is different from the preset operation state relationship information,
A terminal operation monitoring method comprising: notifying an operation state of the monitoring target unit as an operation abnormality to a preset operation state display unit when the correlation is different from the operation state relationship information. A hardware operation state monitoring unit that acquires hardware operation state information indicating an operation state of a preset monitoring target unit included in the computer terminal by a preset sensor unit, and an operation state of the monitoring target unit A software operation state monitoring unit that acquires software operation state information that can be detected by execution processing of a preset program, and stores operation relationship information that is set in advance as an operation state change relationship between the hardware and software operation state information A terminal operation monitoring system comprising a relational information database to detect an operation abnormality of the monitoring target unit,
A correlation state information extraction function for acquiring the hardware and software monitoring element information, and extracting hardware and software operation state information correlated with how to change the operation state from each of the hardware and software operation state information;
A correlation operation abnormality determination function for determining whether or not the correlation between the extracted hardware and software operation state information differs from the preset operation state relationship information;
A computer in which an operation abnormality notification function for performing a process of notifying the operation state of the monitoring target unit as an operation abnormality to a preset operation state display unit when the correlation is different from the operation state relation information is set in advance A terminal operation monitoring program that is executed by a computer.

Images