JP2011076389A - Information management program, information management method and information management device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce a time period required for identifying the cause of performance trouble. <P>SOLUTION: An information management program makes a computer to execute as: a generation means for generating performance information which indicates the processing status of a processing unit, on the basis of trace information of the processing unit for executing processing to associate the performance information with trace information which is a generation source; a detection means for detecting a predetermined event, on the basis of the generated performance information; and an output means for outputting the performance information which is a detection source and the trace information corresponding to the performance information, when the predetermined event is detected. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an information management program for managing information, an information management method, and an information management apparatus.

  Regarding a processing device including a processing unit that executes predetermined processing based on a program, the processing status in the processing unit as a method for investigating the cause of performance troubles in the processing unit, for example, temporary response deterioration of some processes, etc. There is a method of analyzing performance information indicating

  The performance information is, for example, information provided by an OS (Operating System) that manages the processing device. Specifically, a counter that monitors the processing unit is generated by executing a process in the processing unit. It is generated by counting the number of write requests, the write request size, and the like.

JP 2006-227999 A JP-A-6-59944 JP 2002-288005 A

  However, the counter does not generate information that identifies the process that was executed or information that identifies who the process was executed by. I couldn't determine what it was. For this reason, depending on the type of performance trouble, it may take a long time to identify the cause.

  In view of these points, an object of the present invention is to provide an information management program, an information management method, and an information management apparatus that can reduce the time required to identify the cause of a performance problem.

In order to achieve the above object, the following information management program is provided.
The information management program generates performance information indicating the processing status of the processing unit based on the trace information of the processing unit that executes the process, and generates a generation unit that associates the performance information with the trace information of the generation source. It is executed as detection means for detecting a predetermined event based on performance information, and as output means for outputting performance information as a detection source and trace information corresponding to the performance information when a predetermined event is detected.

  According to the disclosed information management program, it is possible to reduce the time required to identify the cause of the performance trouble.

The figure which shows an example of the information management apparatus which concerns on 1st Embodiment. 5 is a flowchart illustrating an example of a processing procedure of the information management apparatus according to the first embodiment. The block diagram which shows an example of the hardware of the information management apparatus which concerns on 2nd Embodiment. The block diagram which shows an example of the function of the information management apparatus which concerns on 2nd Embodiment. The figure which shows an example of trace information. The figure which shows an example of trace information. The figure which shows an example of trace information. The figure which shows an example of a conversion table. The figure which shows an example of the performance information for the 1st period. The figure which shows an example of the performance information for the 2nd period. 9 is a flowchart illustrating an example of a processing procedure of the information management apparatus according to the second embodiment. 9 is a flowchart illustrating an example of a processing procedure of the information management apparatus according to the second embodiment. The figure explaining an example of investigation. The figure explaining an example of investigation. The figure explaining an example of investigation. The figure explaining an example of investigation.

Hereinafter, embodiments will be described with reference to the drawings.
[First Embodiment]
FIG. 1 is a diagram illustrating an example of an information management apparatus according to the first embodiment. The information management apparatus 10 includes a processing unit 11, a trace information storage unit 12, a generation unit 13, a detection unit 14, and an output unit 15.

  The processing unit 11 executes predetermined processing based on the program. The trace information storage unit 12 stores trace information indicating a history of processing in the processing unit 11. Here, the trace information includes information specifying the process and information indicating who executed the process. The trace information is provided by, for example, an OS (Operating System) that manages the information management apparatus 10.

  The generation unit 13 generates performance information based on the trace information stored in the trace information storage unit 12. The performance information is information indicating the processing status of the processing unit 11 and includes, for example, an index indicating a response speed, a processing speed, and the like. For example, the performance information includes the number of write requests, the write request size, the CPU consumption rate, the memory usage, the IO operation rate, the number of read requests, the read request size, and the like. Furthermore, the generation unit 13 associates the generated performance information with the generation source trace information.

  The detection unit 14 detects a predetermined event based on the performance information generated by the generation unit 13. The predetermined event is, for example, a specific event indicating an abnormal state that is significantly different from the normal state. In many cases, this unique event appears as a phenomenon of performance trouble.

  When the detection unit 14 detects a predetermined event, the output unit 15 displays performance information that is a detection source and trace information corresponding to the performance information, for example, a display screen of a storage unit or a display device (not illustrated). Output).

  The information management apparatus 10 does not necessarily have the processing unit 11 and the trace information storage unit 12. For example, the processing unit 11 and the trace information storage unit 12 can be set in an external processing device connected to the information management device 10 via a network or the like. In this case, the information management apparatus 10 acquires trace information from an external processing apparatus via a network or the like.

Next, the operation of the information management apparatus 10 will be described. FIG. 2 is a flowchart illustrating an example of a processing procedure of the information management apparatus according to the first embodiment.
[Step S11] When processing is started, the generation unit 13 generates performance information based on the trace information stored in the trace information storage unit 12.

[Step S12] The generation unit 13 associates the performance information generated in step S11 with the trace information of the generation source.
[Step S13] The detection unit 14 detects a predetermined event based on the performance information generated in step S11. If a predetermined event is detected, the process proceeds to step S14. If the predetermined event is not detected, the process is terminated.

  [Step S14] When the detection unit 14 detects a predetermined event in step S13, the output unit 15 outputs the performance information as the detection source and the trace information corresponding to the performance information, and ends the processing. To do.

  The cause of the performance trouble is investigated by examining the information output by the output unit 15. For example, when the output unit 15 outputs information to the display screen of the display device, the user can perform an investigation by browsing the display screen.

  In this way, the information management apparatus 10 associates the performance information with the trace information of the generation source, and when a predetermined event is detected in the performance information, the performance management information corresponding to the detection source corresponds to the performance information. Output trace information.

  As a result, when investigating the cause of a performance problem, it is possible to investigate retroactively to the trace information. The trace information includes information that identifies the process and information that indicates who is executing the process. By examining the trace information, the process that caused the performance trouble is caused by who and what process. Can be specified in a short time.

  Furthermore, in the information management apparatus 10, since the output performance information and trace information are only information in which a predetermined event is detected, it is possible to narrow down the investigation target and further reduce the investigation time. .

Next, a more specific example of the information management apparatus 10 will be described in the second embodiment.
[Second Embodiment]
An information management apparatus according to the second embodiment will be described. First, the hardware of the information management apparatus will be described. FIG. 3 is a block diagram illustrating an example of hardware of the information management apparatus according to the second embodiment.

  The information management apparatus 100 is entirely controlled by a CPU (Central Processing Unit) 101. A random access memory (RAM) 102, a hard disk drive (HDD) 103, a graphic processing unit 104, and an input interface 105 are connected to the CPU 101 via a bus 106.

  The RAM 102 temporarily stores at least a part of OS programs and application programs to be executed by the CPU 101. The RAM 102 stores various data necessary for processing by the CPU 101. The HDD 103 stores the OS, application programs, and various data. A monitor 107 is connected to the graphic processing unit 104, and an image is displayed on the screen of the monitor 107 in accordance with a command from the CPU 101. Input devices such as a keyboard 108 a and a mouse 108 b are connected to the input interface 105, and signals sent from the keyboard 108 a and the mouse 108 b are transmitted to the CPU 101 via the bus 106.

  The processing function of the information management apparatus 100 can be realized by such hardware. Next, functions of the information management apparatus 100 will be described. FIG. 4 is a block diagram illustrating an example of functions of the information management apparatus according to the second embodiment.

  The information management apparatus 100 includes a processing unit 110, a trace information storage unit 120, a performance information generation unit 130, a performance information generation unit 140, an event detection unit 150, an information output unit 160, and a storage unit 170. .

  The processing unit 110 executes processing such as a predetermined process or thread based on a program. The processing unit 110 includes, for example, an API layer 111 that executes an application program interface (API), a cache layer 112 that temporarily stores information, and an IO layer 113 that inputs and outputs information.

  The trace information storage unit 120 stores trace information indicating a history of processing in the processing unit 110. Here, the trace information storage unit 120 stores trace information corresponding to each API layer 111, cache layer 112, and IO layer 113.

  Here, the trace information includes information for identifying a process or thread and information indicating who is executing the process or thread. The trace information is provided by, for example, an OS that manages the information management apparatus 100. Note that the trace information stored in the trace information storage unit 120 is overwritten on the next trace information when, for example, a certain time (about 1 minute) has elapsed.

  The performance information generation unit 130 generates performance information based on the trace information stored in the trace information storage unit 120. The performance information indicates the processing status of the processing unit 110 and includes, for example, an index indicating a response speed, a processing speed, and the like. Specifically, the performance information includes, for example, the number of write requests, the write request size, the CPU consumption rate, the memory usage, the IO operation rate, and the like. Furthermore, the performance information generation unit 130 stores the generated performance information and the generation source trace information in association with each other.

  Specifically, the performance information generation unit 130 includes a conversion unit 131, a trace information saving unit 132, and a counter 133. Furthermore, the conversion unit 131 includes a conversion table storage unit 134 that stores a conversion table for converting trace information into performance information.

  Based on the trace information stored in the trace information storage unit 120, the conversion unit 131 refers to the conversion table stored in the conversion table storage unit 134 and performs a conversion operation for counting up the counter 133. Note that the conversion operation of the trace information by the conversion unit 131 is performed every first period (for example, 30 seconds). At this time, the conversion unit 131 sets the trace information for the immediately preceding first period (for example, 30 seconds) as a conversion operation target.

  The trace information saving unit 132 stores the trace information for the first period that is the target of the conversion operation by the conversion unit 131. Note that the trace information stored in the trace information saving unit 132 is erased from the trace information saving unit 132 when a predetermined period (for example, 10 minutes) has elapsed since the storage.

  The counter 133 stores a value indicating performance information, and performs counting based on the conversion operation of the conversion unit 131. That is, the conversion unit 131 performs a conversion operation for counting up the counter 133 based on the trace information for the first period, so that the performance information for the first period is generated and stored in the counter 133. In addition, the counter 133 is configured by, for example, a plurality of counter units provided for each type of performance information. For example, the counter 133 includes a counter unit indicating the number of write requests, a counter unit indicating the write request size, a counter unit indicating the CPU consumption rate, and the like.

  Here, the generated performance information for the first period is stored in association with the trace information that is the generation source. That is, the trace information that is the generation source can be specified from the performance information for the first period. For example, this can be realized by adding a search key for the trace information that is the generation source to the performance information for the first period. Note that the counter 133 is cleared to zero when, for example, the conversion unit 131 starts the next conversion operation after the first period has elapsed.

  Next, the performance information generation unit 140 acquires and accumulates performance information for the first period stored by the counter 133, and the accumulated performance information group for the first period reaches the second period. If so, the accumulated performance information group for the first period is totaled to generate performance information for the second period. Then, the performance information generation unit 140 stores the generated performance information for the second period and the performance information group for the first period of the aggregation source in association with each other.

  Specifically, the performance information generation unit 140 includes a counting unit 141, a performance information saving unit 142, and a counter 143. The aggregation unit 141 acquires the performance information for the first period stored by the counter 133 of the performance information generation unit 130 every time it is stored, that is, for each first period, and acquires the performance information for the first period. Accumulate information group.

  Further, when the accumulated performance information group for the first period reaches the second period (for example, 10 minutes), the counting unit 141 converts the performance information group for the first period to the performance information. For each type, for example, the number of write requests, the write request size, and the CPU consumption rate. Thereby, performance information for the second period (for example, 10 minutes) is generated.

  Note that the totaling unit 141 acquires the performance information for the first period stored in the counter 133, so that when the accumulated performance information group for the first period exceeds the second period, The old accumulated performance information for the first period is deleted. And the 1st performance information group for the 2nd period including the part acquired this time is totaled for every kind of performance information.

  The performance information saving unit 142 stores the performance information group for the first period, which is the aggregation source of the performance information for the second period generated by the aggregation unit 141. Note that the performance information group for the first period stored in the performance information saving unit 142 is deleted from the performance information saving unit 142 when a predetermined period (for example, seven days) has elapsed since the storage.

  The counter 143 stores the performance information for the second period generated by the counting unit 141. Here, the performance information for the second period is stored in association with the performance information group for the first period that is the aggregation source. That is, the performance information group for the first period that is the source of aggregation can be identified from the performance information for the second period. For example, this can be realized by assigning a search key for the performance information group for the first period, which is the source of aggregation, to the performance information for the second period. Note that the counter 143 is cleared to zero when, for example, the counting unit 141 starts counting the next time after the first period has elapsed.

  Next, the event detection unit 150 compares the performance information for the first period stored in the counter 133 with the performance information for the second period stored in the counter 143, and determines the predetermined information based on the comparison result. Detect the event. The predetermined event is, for example, a specific event in which the performance information for the first period indicates an abnormal value with respect to the performance information for the second period. As a specific example, the CPU consumption rate for 10 minutes is not so high as less than 20%, but the write request size for 30 seconds is very large such that it exceeds 10 MB.

  Here, when the performance information for the first period shows an abnormal value for the global performance information for the second period longer than the first period, the performance information for the first period It is highly probable that a performance problem has occurred during processing.

  Here, the event detection unit 150 includes a condition storage unit 151 that stores a condition identified as a unique event. Then, a predetermined event is detected from the comparison result with reference to the condition stored in the condition storage unit 151.

  In addition, for example, if an event that appears when a performance trouble occurs is known in advance, a condition for identifying the event is stored in the condition storage unit 151, so that the detection accuracy for detecting the event associated with the performance trouble is increased. It becomes possible to improve.

  When the event detection unit 150 detects a predetermined event, the information output unit 160 includes the performance information for the second period stored in the counter 143, the performance information for the first period stored in the counter 133, Trace information for the first period immediately before stored in the trace information saving unit 132 is acquired. Furthermore, the information output unit 160 outputs the acquired performance information for the second period, performance information for the first period, and trace information to the storage unit 170.

  The information output unit 160 further obtains the performance information group for the first period immediately before stored in the performance information saving unit 142 and the trace information stored in the trace information storage unit 120, and saves the storage unit. You may output to 170.

  The performance information for the second period, the performance information for the first period, and the trace information stored in the storage unit 170 are displayed on, for example, the monitor 107 of the information management apparatus 100 illustrated in FIG. . At this time, for example, performance information for the second period, performance information for the first period, and trace information are displayed in association with each other.

Next, the trace information stored in the trace information storage unit 120 will be described.
5 to 7 are diagrams illustrating examples of trace information.
The trace information 121 indicating the processing history of the API layer 111 of the processing unit 110 is illustrated in FIG. 5, for example. The trace information 121 includes a time (TIME) when the process is executed, and a process ID and a thread ID that specify a process and a thread. Furthermore, the trace information 121 includes a caller address that indicates who is executing the process, a classification that identifies whether the process is a request history or a process response history, and a function name that indicates the type of process. And a parameter indicating the processing content.

  For example, when the program A (process N1, thread M1) writes 32 MB to the file A, as shown in the uppermost column of the trace information 121, the time when the process is executed is stored in the TIME, and the process ID is “ N1 ”and“ M1 ”are stored in the thread ID. Furthermore, “xxx1” which is the caller address of this process is stored in the caller address, “call” is stored in the category, “fwrite” is stored in the function name, and “file A, 1, 32M, 1 "etc. are stored.

  The trace information 122 indicating the processing history of the cache layer 112 of the processing unit 110 is illustrated in FIG. 6, for example. The trace information 122 includes a time (TIME) when the process is executed, a request source process ID and a request source thread ID that specify the request source of the processing process and the thread. Furthermore, the trace information 122 includes a caller address indicating who is executing the process, a classification specifying whether the process is a request history or a process response history, and a function name indicating the type of process. And a parameter indicating the processing content.

  The trace information 123 indicating the processing history of the IO layer 113 of the processing unit 110 is illustrated in FIG. 7, for example. The trace information 123 includes a time (TIME) when the process is executed, a request source process ID and a request source thread ID for specifying the request source of the processing process and the thread. Further, the trace information 123 includes a caller address indicating who is executing the process, a classification specifying whether the process is a request history or a process response history, and a function name indicating the type of process. And a parameter indicating the processing content.

  Next, the conversion table stored in the conversion table storage unit 134 will be described. FIG. 8 is a diagram illustrating an example of the conversion table. The conversion table is divided for each layer in the processing unit 110. Here, the conversion table is divided into, for example, an API layer, a cache layer, and an IO layer. Further, the conversion table is provided with the function name of the trace information to be converted, the conversion destination counter section in the counter 133, and the conversion operation content for each layer.

  In the API layer column, for example, the function name is “fwrite” indicating writing, and the conversion destination counter unit has the number of write requests (whole), the number of write requests (process), and the write request size (whole). Write request size (process). Furthermore, the contents of the conversion operation are “add 1 to the number of write requests (total)”, “add 1 to the number of write requests (process ID)”, and add the third parameter to the write request size (total). And “Add third parameter to write request size (process ID)”.

  In the cache layer column, for example, the function name is “cwrite” indicating writing, and the conversion destination counter unit is the number of write requests (logical device) and the write request size (logical device). Furthermore, the contents of the conversion operation are “add 1 to the number of write requests (logical device)” and “add the third parameter to the write request size (logical device)”.

  In the IO layer column, for example, the function name is “iowrite” indicating writing, and the conversion destination counter unit is the number of write requests (physical device) and the write request size (physical device). Furthermore, the contents of the conversion operation are “add 1 to the number of write requests (physical device)” and “add the third parameter to the write request size (physical device)”.

  For example, the following conversion operation is performed on the trace information corresponding to the API layer 111 whose function name is “fwrite” based on the conversion table (API layer). That is, 1 is added to each of the counter unit indicating the number of write requests (total) in the counter 133 and the counter unit indicating the number of write requests (process ID). Furthermore, the size of the write information is added to the counter unit indicating the write request size (whole) and the counter unit indicating the write request size (process ID) in the counter 133, respectively.

Next, the performance information for the first period stored in the counter 133 will be described. FIG. 9 is a diagram illustrating an example of performance information for the first period.
In the performance information for the first period, a counter value is associated with each type of performance information, that is, for each counter unit. Here, the types of performance information include, for example, the number of write requests and the write request size of the entire process, the number of write requests and the write request size of the process ID, the number of write requests and the write request size of the logical device, It includes the number of physical device write requests and the write request size. Each of these is associated with a counter value and a counter value per unit time.

  Furthermore, the performance information for the first period includes a generation period indicating a period required to generate the performance information. In the example shown in FIG. 9, since the first period is 30 seconds, the generation period is 30 seconds. Moreover, the generation time is given to the performance information for the first period. For example, this generation time can be used as a search key when searching for the corresponding trace information.

Next, the performance information for the second period stored in the counter 143 will be described. FIG. 10 is a diagram illustrating an example of performance information for the second period.
The performance information for the second period also has the same format as the performance information for the first period shown in FIG. In the example shown in FIG. 10, since the second period is 10 minutes, that is, 600 seconds, the generation period is 600 seconds. The generation time is also given to the performance information for the second period. For example, this generation time can be used as a search key when searching for the corresponding first performance information group.

  Next, a processing procedure of the information management apparatus 100 will be described. 11 and 12 are flowcharts illustrating an example of a processing procedure of the information management apparatus according to the second embodiment. First, it demonstrates using FIG.

The process starts every first period (for example, 30 seconds).
[Step S110] The conversion unit 131 counts up the counter 133 based on the trace information for the first period stored in the trace information storage unit 120, and generates performance information for the first period. . At this time, the conversion unit 131 refers to a conversion table stored in the conversion table storage unit 134, for example.

[Step S120] The trace information saving unit 132 stores the trace information for the first period that is the generation source of the performance information for the first period generated in Step S110.
[Step S130] The counter 133 stores the performance information for the first period generated in step S110 in association with the trace information that is the generation source.

  [Step S140] When the performance information for the first period is stored in the counter 133 in step S130, the counting unit 141 acquires and accumulates the performance information for the first period from the counter 133. The following steps will be described with reference to FIG.

  [Step S150] The counting unit 141 determines whether or not the performance information group for the first period accumulated in Step S140 has reached the second period (for example, 10 minutes). If so, the process proceeds to step S160. If not, the process is terminated.

[Step S160] The totaling unit 141 totals the performance information group for the first period to generate performance information for the second period.
[Step S170] The performance information saving unit 142 stores the performance information group for the first period, which is the aggregation source of the performance information for the second period generated in step S160.

[Step S180] The counter 143 stores the performance information for the second period generated in step S160 in association with the performance information group for the first period that is the source of aggregation.
[Step S190] The event detection unit 150 compares the performance information for the first period stored in the counter 133 in step S130 with the performance information for the second period stored in the counter 143 in step S180. .

  [Step S200] The event detection unit 150 detects a predetermined event based on the comparison result in step S190. At this time, the event detection unit 150 detects a predetermined event with reference to the conditions stored in the condition storage unit 151, for example. If a predetermined event is detected, the process proceeds to step S210. If the predetermined event is not detected, the process is terminated.

  [Step S210] The information output unit 160 stores the second performance information stored in the counter 143 in Step S180, the first performance information stored in the counter 133 in Step S130, and the trace information saving unit 132 in Step S120. The trace information thus output is output to the storage unit 170. This ends the process. At this time, the information output unit 160 further includes the performance information group for the first period stored in the performance information saving unit 142 in step S170 and the trace information stored in the trace information storage unit 120. You may output to the preservation | save part 170. FIG. The investigation of the cause of the performance trouble is performed by investigating the performance information for the second period, the performance information group for the first period, and the trace information stored in the storage unit 170.

Here, an example of investigating the cause of a certain performance trouble from the information stored in the storage unit 170 will be described. 13-16 is a figure explaining an example of investigation.
FIG. 13 shows the 30-second performance information stored in the counter 133 and the 10-minute performance information stored in the counter 143. As shown in FIG. 13, the event detection unit 150 uses a 30-second magnetic disk based on 30-second performance information and 10-minute performance information, even though the CPU consumption rate for 10 minutes is not as high as 11%. It is assumed that a unique event in which the # 1 write request size is 18 MB / second is detected. Here, the magnetic disk # 1 indicates a part of the area of the magnetic disk.

  When this peculiar event is detected, the information output unit 160 acquires performance information for the first period as a detection source from the counter 133, and further traces corresponding to the performance information for the first period. Information is acquired from the trace information saving unit 132. Then, the information output unit 160 outputs the acquired performance information and trace information for the first period to the storage unit 170.

  When the event detection unit 150 detects a specific event, the information management apparatus 100 notifies the user that the specific event has been detected, for example, by displaying alarm information on the monitor 108 shown in FIG. To do. The user investigates the storage unit 170 based on notification of a specific event from the information management apparatus 100. Note that the user may periodically check the storage unit 170 without notification from the information management apparatus 100, or may detect a malfunction such as a slow operation speed during the operation of the information management apparatus 100. By doing so, you may investigate.

  When investigating the storage unit 170, the user refers to and analyzes the trace information of the same time zone associated with the 30-second performance information. FIG. 14 shows trace information of the corresponding IO layer. The trace information 123 shown in FIG. 14 stores writing to the magnetic disk # 1. Since this singular event is related to the write request size, all the cache buffers to be written are extracted from the write trace information (function name: iwrite). Here, cache buffers # 2, # 3, and # 4 are extracted. Here, each of the cache buffers # 2 to # 4 indicates a part of the area of the cache buffer.

  Next, the user investigates the trace information 122 of the cache layer 112 in the same time zone based on the extracted cache buffers # 2 to # 4. If the cache buffers # 2 to # 4 extracted in the trace information 122 are not detected, the trace information 122 for the previous 30 seconds and the trace information 122 for the previous 30 seconds are examined retrospectively. Here, the extracted cache buffers # 2 to # 4 are detected in the trace information 122 of the cache layer 112 for the previous 30 seconds. FIG. 15 shows the trace information of the cache layer.

  Next, the user analyzes the trace information 121 of the API layer 111 in the same time zone as the trace information 122 of the cache layer 112 in which the cache buffers # 2 to # 4 are detected. FIG. 16 shows the trace information of the API layer. Then, at the same time when the cache buffers # 2 to # 4 were detected, it was detected that 32 MB of “fwrite” was issued at a time from the corresponding process / thread. When the process developer was queried based on the caller address, it was found that this event occurred as a result of initial acquisition of the file with an invalid size due to a mistake in setting the program operating environment parameters.

  As described above, the information management apparatus 100 stores the performance information for the first period and the trace information of the generation source in association with each other, and when a predetermined event is detected in the performance information for the first period, The stored performance information and trace information for the first period are output to the storage unit 170.

  As a result, when investigating the cause of a performance problem, it is possible to investigate retroactively to the trace information. Trace information includes information that identifies the processing process and thread, and information that indicates who executed the processing. Therefore, by examining the trace information, what kind of processing causes the performance problem. It is possible to specify whether or not it is due to a short time.

  Furthermore, in the information management apparatus 100, the detection of the predetermined event from the performance information for the first period accumulates the performance information for the first period and the performance information for the first period for the second period. This is done by comparing the performance information for the second period totaled. This makes it possible to detect local abnormal values of the performance information for the first period, and to improve detection accuracy.

  Furthermore, in the information management apparatus 100, the performance information for the second period, the performance information for the first period, and the trace information that are stored in the storage unit 170 are only information in which a predetermined event is detected. This makes it possible to narrow down the survey time. Further, according to this configuration, the storage capacity of the storage unit 170 can be set small.

  The above processing can be realized by causing a computer to execute a predetermined program as described above. In that case, a program describing the processing contents to be realized is provided. The program describing the processing contents can be recorded on a computer-readable recording medium. Examples of the computer-readable recording medium include a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory. Examples of the magnetic recording device include a hard disk device, a flexible disk (FD), and a magnetic tape (MT). Optical discs include DVD (Digital Versatile Disc), DVD-RAM, CD-ROM (Compact Disc? Read Only Memory), CD-R (Recordable), CD-RW (ReWritable), and the like. Magneto-optical recording media include MO (Magneto-Optical disk).

  When distributing the program, for example, a portable recording medium such as a DVD or a CD-ROM in which the program is recorded is sold. It is also possible to store the program in a storage device of a server computer and transfer the program from the server computer to another computer via a network.

  The computer that executes the program stores, for example, the program recorded on the portable recording medium or the program transferred from the server computer in its own storage device. Then, the computer reads the program from its own storage device and executes processing according to the program. The computer can also read the program directly from the portable recording medium and execute processing according to the program. In addition, each time the program is transferred from the server computer, the computer can sequentially execute processing according to the received program.

DESCRIPTION OF SYMBOLS 10 Information management apparatus 11 Processing part 12 Trace information storage part 13 Generation part 14 Detection part 15 Output part

Claims (10)

Computer
Generating means for generating performance information indicating a processing status of the processing unit based on trace information of the processing unit that executes processing, and associating the performance information with the trace information of the generation source;
Detecting means for detecting a predetermined event based on the generated performance information;
When the predetermined event is detected, output means for outputting the performance information as a detection source and the trace information corresponding to the performance information;
An information management program that is executed as The generation unit generates first performance information for a first period based on the trace information for a first period, and associates the first performance information with the trace information of the generation source. ,
The detecting means compares the first performance information with second performance information for a second period longer than the first period, and detects the predetermined event based on a comparison result. ,
When the output means detects the predetermined event, the output means outputs the first performance information as a detection source and the trace information corresponding to the first performance information;
The information management program according to claim 1.   The information management program according to claim 2, wherein the second performance information is obtained by aggregating a plurality of the performance information including the first performance information.   The information according to claim 1, wherein the output unit outputs the performance information as a detection source and the trace information corresponding to the performance information to a storage unit. Management program.   The information management program according to any one of claims 1 to 4, wherein the performance information includes an index indicating a response speed and a processing speed.   The information management program according to claim 5, wherein the performance information includes a write request count and a write request size.   The information management program according to claim 1, wherein the generation unit generates the performance information with reference to a conversion table that converts the trace information into the performance information.   The information management program according to claim 1, wherein the detection unit detects the predetermined event with reference to a condition identified as specific information. Computer
Generate performance information indicating the processing status of the processing unit based on the trace information of the processing unit that executes processing, associate the performance information with the trace information of the generation source,
A predetermined event is detected based on the generated performance information,
When the predetermined event is detected, the performance information as a detection source and the trace information corresponding to the performance information are output.
An information management method characterized by that. Generating performance information indicating the processing status of the processing unit based on the trace information of the processing unit that executes processing, and a generation unit that associates the performance information with the trace information of the generation source;
A detection unit for detecting a predetermined event based on the generated performance information;
When the predetermined event is detected, an output unit that outputs the performance information as a detection source and the trace information corresponding to the performance information;
An information management apparatus comprising:

Images