JP2011107742A - Operation management device, operation management method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an operation management device, an operation management method and a program for dynamically updating filter definitions according to an alert generated in a computer system, and for reducing a load on a manager. <P>SOLUTION: The operation management device 1 is provided with: filtering parts 21 and 22 for extracting an alert matched with definitions from an alert generated in a computer system 10; a rule adaptation determination part 42 for collating any alert which has not been extracted by the filtering part 21 or 22 with two or more preliminarily set rules, and for determining whether any rule is adapted to the alert which has not been extracted; and a filter definition management part 43 for, when it is determined that any rule is adapted to the alert, updating the definition of the filtering part 21 or 22 on the basis of the rule determined to be adapted. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an operation management apparatus, an operation management method, and a program for realizing them, for operating and managing a computer system.

  In recent years, in companies and the like, the importance of a computer system has been increasing, and its operation management has become extremely important. On the other hand, since computer systems are becoming larger and more complex year by year, the burden on managers in operation management is increasing. Under such circumstances, various operation management apparatuses (operation management servers) have been proposed in order to efficiently perform the operation management of the computer system.

  In general, the operation management apparatus monitors the occurrence of abnormalities in servers and application programs to be monitored, and when an abnormality is detected, notifies the administrator of the computer system of the occurrence of the abnormality. Also, at this time, if all abnormalities are reported to the administrator, the burden on the administrator will increase. Usually, the operation management device extracts and extracts the necessary alerts using a predefined filter. Only the alert that has been made is reported (for example, see Patent Document 1).

  Specifically, Patent Document 1 discloses an operation management apparatus that uses a plurality of filters in a predetermined order and reports an alert extracted by any of the filters to an administrator. Further, in the operation management device disclosed in Patent Document 1, the number of times that the condition is matched is counted for each filter, and the use order of the filters is rearranged in descending order of the number of times of matching. For this reason, according to the operation management apparatus disclosed in Patent Document 1, it is possible to reduce the amount of calculation necessary for filtering as much as possible, and thus it is possible to reduce the load on the operation management apparatus.

  Further, in the operation management apparatus disclosed in Patent Document 1, the filter definition is created by an administrator. Furthermore, when an alert that has not been extracted by the filter occurs, the administrator needs to analyze the occurrence frequency and occurrence tendency and update the filter definition to be appropriate. For this reason, the operation management device disclosed in Patent Document 1 is required to reduce the burden on the administrator.

  Patent Document 2 discloses an operation management apparatus for the purpose of reducing the burden on the administrator. Specifically, Patent Document 2 determines whether or not a set threshold is exceeded when an unregistered alert that is not defined in the filter is output. An operation management device that reports to the administrator is disclosed. As a specific example of the threshold value, for example, the number of cases where an alert is output within x seconds can be cited. Further, the operation management apparatus disclosed in Patent Document 2 can also use an unregistered alert extraction condition as a filter condition as it is.

  As described above, according to the operation management device disclosed in Patent Document 2, even if an unregistered alert that cannot be overlooked is notified to the administrator, it is considered that the burden on the administrator is reduced. In addition, since it is possible to detect unregistered alerts, it is possible to prevent an unexpected trouble from occurring in the managed computer system.

  In recent large-scale computer systems, alerts are frequently generated, and in addition to this, the occurrence of unregistered alerts is increasing. However, in the operation management apparatus disclosed in Patent Document 2, Unregistered alerts are reported to the administrator. Therefore, according to the operation management device disclosed in Patent Document 2, it is considered that the administrator can appropriately update the filter definition even if the number of unregistered alerts increases.

JP 2006-260056 A JP 2009-064098 A

  However, in a large-scale computer system, there is a situation in which the alert tendency changes depending on the time zone. On the other hand, in the operation management device disclosed in Patent Document 2, the determination as to whether or not to notify an unregistered alert is made uniformly, and the determination does not change according to a change in the tendency of the alert. Therefore, there is a possibility that an alert that should be reported to the administrator is not reported reliably.

  Further, the operation management device disclosed in Patent Document 2 can newly generate a filter condition in accordance with an unregistered alert, but it is also uniformly determined whether or not the filter condition is to be created. . Therefore, it is difficult to deal with a case where an unregistered alert occurs suddenly and in large quantities (alert rush).

  As described above, in the operation management apparatus disclosed in Patent Document 2, it is impossible to automatically optimize the filter definition according to the alert. Therefore, the administrator needs to perform a separate analysis in order to make the filter definition appropriate, which is a heavy burden on the administrator.

  An object of the present invention is to solve the above-described problems, dynamically update a filter definition according to an alert generated in a computer system, and reduce the burden on an administrator. And providing a program.

In order to achieve the above object, an operation management apparatus according to the present invention is an operation management apparatus for performing operation management of a computer system,
A plurality of filtering units that extract alerts that meet a definition from alerts generated in the computer system;
The alert that has not been extracted by any of the plurality of filtering units is collated with two or more preset rules, and it is determined whether any of the rules matches the alert that has not been extracted. A rule conformity determination unit;
A filter definition management unit that updates the definition of any of the plurality of filtering units based on a rule determined to match when any of the rules is determined to match the alert that has not been extracted. When,
It is characterized by having.

In order to achieve the above object, an operation management method according to the present invention is a method for managing the operation of a computer system,
(A) executing a filtering process for extracting an alert that matches a definition from alerts generated in the computer system a plurality of times; and
(B) The alert that has not been extracted by any of the filtering processes is checked against two or more preset rules, and it is determined whether any of the rules matches the alert that has not been extracted. Step,
(C) If any of the rules is determined to match the alert that has not been extracted in the step of (b), based on the rule determined to match, in any of the filtering processes Updating the definition; and
It is characterized by having.

Furthermore, in order to achieve the above object, a program according to the present invention is a program for performing operation management of a computer system by a computer,
In the computer,
(A) executing a filtering process for extracting an alert that matches a definition from alerts generated in the computer system a plurality of times; and
(B) The alert that has not been extracted by any of the filtering processes is checked against two or more preset rules, and it is determined whether any of the rules matches the alert that has not been extracted. Step,
(C) If any of the rules is determined to match the alert that has not been extracted in the step of (b), based on the rule determined to match, in any of the filtering processes Updating the definition; and
Is executed.

  With the above features, according to the operation management apparatus, operation management method, and program of the present invention, the filter definition can be dynamically updated according to the alert generated in the computer system, and the burden on the administrator is reduced. be able to.

FIG. 1 is a block diagram showing a schematic configuration of an operation management apparatus according to an embodiment of the present invention. FIG. 2 is a flowchart showing from filtering processing to rule conformance determination processing by the operation management apparatus in the embodiment of the present invention. FIG. 3 is a flowchart showing definition update processing by the operation management apparatus according to the embodiment of the present invention. FIG. 4 is a flowchart showing rule update processing by the operation management apparatus according to the embodiment of the present invention. FIG. 5 is a flowchart specifically showing analysis processing and rule creation processing included in the rule update processing shown in FIG.

(Embodiment)
Hereinafter, an operation management apparatus, an operation management method, and a program according to an embodiment of the present invention will be described with reference to FIGS. Initially, the structure of the operation management apparatus 1 in this Embodiment is demonstrated. FIG. 1 is a block diagram showing a schematic configuration of an operation management apparatus according to an embodiment of the present invention.

  As shown in FIG. 1, the operation management apparatus 1 is an apparatus for performing operation management of the computer system 10. The computer system 10 is constructed by connecting a large number of computers such as client computers and server computers via a network. The computer system 10 is a kind of alert generation device, and the alert generated in the computer system 10 is input to the operation management device 1.

  As shown in FIG. 1, the operation management apparatus 1 includes a filtering processing unit 2 that performs filtering processing on alerts generated in the computer system 10, and a processing unit 4 that performs processing of alerts extracted by the filtering processing. It has.

  Among these, the filtering processing unit 2 includes a first filtering unit 21 and a second filtering unit 22. The first filtering unit 21 and the second filtering unit 22 each extract an alert that matches the definition (filter definition) from the alert generated in the computer system 10. Note that the filter definition is different between the first filtering unit 21 and the second filtering unit 22. In the present embodiment, the filtering processing unit 2 may include three or more filtering units.

  The processing unit 4 includes a rule conformity determination unit 42 and a filter definition management unit 43. The rule conformity determination unit 42 collates the alert that has not been extracted by any of the filtering units 21 and 22 with two or more preset rules, and either rule conforms to an alert that has not been extracted. Determine whether or not.

  When it is determined that any one of the rules matches the alert that has not been extracted, the filter definition management unit 43 uses the first filtering unit 21 or the second filtering unit 22 based on the rule that is determined to match. Update filter definition for.

  In this way, in the operation management apparatus 1, when an alert that cannot be extracted by any filtering unit occurs, the filter definition is updated to cope with this. The filter definition is updated by selecting a rule that matches the alert from a plurality of rules prepared in advance and using the selected rule. In other words, the filter definition is not updated uniformly but according to the contents of the alert. Therefore, according to the operation management apparatus 1, the filter definition is dynamically updated according to the alert, and as a result, the burden on the administrator when the filter definition is updated is reduced.

  Next, the configuration of the operation management apparatus 1 in the present embodiment will be described more specifically using the following Tables 1 to 4. In the present embodiment, as shown in FIG. 1, the first filtering unit 21 and the second filtering unit 22 are connected in cascade, and an alert is first input to the first filtering unit 21. The

  In the present embodiment, only alerts that do not match the filter definition of the first filtering unit 21 are input to the second filtering unit 22. The second filtering unit 22 performs a filtering process on an alert that does not match the filter definition of the first filtering unit 21.

  Moreover, in this Embodiment, the 1st filtering part 21 and the 2nd filtering part 22 perform the operation | movement according to each filter definition, when an alert corresponds to each filter definition. For example, it is assumed that a notification is sent to the alert processing device 11 when an alert matches the filter definition. In this case, the first filtering unit 21 and the second filtering unit 22 transmit (report) alerts that match the filter definition to the external alert processing device 11. The alert processing device 11 is a device that performs failure recovery processing, software update, and the like in accordance with an alert generated in the computer system 10.

  In this embodiment, the filter definition management unit 43 adds a new filter definition and deletes a used filter definition, as will be described later. Furthermore, the filter definition management unit 43 updates only the filter definition of the first filtering unit 21.

  Further, in the present embodiment, as shown in FIG. 1, the operation management apparatus 1 includes a storage unit 3 and an analysis unit 5 in addition to the file tally processing unit 2 and the processing unit 4. Further, in the operation management apparatus 1, the processing unit 4 includes an alert processing unit 41.

  The alert processing unit 41 acquires the alert when the alert is not extracted by the first filtering unit 21 and is not extracted by the second filtering unit 22, and sends the alert to the storage unit 3. Output. Further, when the alert processing unit 41 outputs an alert to the storage unit 3, the alert processing unit 41 notifies the rule conformity determination unit 42 of that fact.

  The storage unit 3 includes a first filter definition storage unit 31, a second filter definition storage unit 32, an alert storage unit 33, and a rule storage unit 34. Among these, the first filter definition storage unit 31 stores a filter definition used by the first filtering unit 21 (hereinafter, “first filter definition”).

  Table 1 below shows an example of the filter definition used in the first filtering unit 21. As shown in Table 1, each first filter definition includes an alert type (type) to be extracted, a message of the alert, a condition for deleting the filter definition (filter definition deletion condition), and Is included. In this embodiment, as will be described later, the filter definition management unit 43 deletes, for example, an old filter definition and a special filter definition that are not expected to be used in accordance with the filter definition deletion condition. Thereby, the load in the filtering processing unit 2 is reduced.

  The second filter definition storage unit 32 stores a filter definition used by the second filtering unit 22 (hereinafter “second filter definition”). Table 2 below shows an example of the filter definition used in the second filtering unit 22. As shown in Table 2, each second filter definition also includes an alert type (classification) to be extracted and a message of the same alert as the first filter definition shown in Table 1. . However, the second filter definition includes an identifier instructing whether or not notification to the outside is executed, instead of the filter definition deletion condition (see Table 1).

Moreover, although each 1st filter definition shown by Table 1 is produced by the analysis part 5 mentioned later, this Embodiment is not limited to this aspect. In the present embodiment, some first filter definitions may be created in advance by an administrator. The second filter definition shown in Table 2 is created in advance by the administrator.

  Table 3 below shows an example (alert example 1) of an alert generated in the computer system 10 in the present embodiment. In Table 3, each alert is specified by “occurrence date / time”, “type (class)”, and “message”.

  In the storage unit 3, when an alert is output from the alert processing unit 41, the alert storage unit 33 stores the output alert. Further, the rule storage unit 34 stores rules used by the rule conformity determination unit 42. Table 4 shows an example of rules used by the rule conformity determination unit 42.

  As shown in Table 4, the rule includes a “condition statement (conformance condition)” for the alert and an “execution statement (update content)” executed when the rule is met. Specifically, in the example of Table 4, the “executed statement” includes a new filter definition that is added when the conditional statement is met, and a validity period of the new filter definition.

  When the rules shown in Table 4 are used, the rule conformity determination unit 42 receives the notification from the alert processing unit 41 and determines whether the alert matches the “conditional sentence”. If the alert matches the “conditional sentence” of the rule, the rule conformity determination unit 42 transmits the rule that the alert conforms to the filter definition management unit 43. Then, as described above, the filter definition management unit 43 updates the filter definition based on the adapted rule.

  For example, if the matched rule is the rule shown in Table 4, the filter definition management unit 43 creates a new filter definition according to the “executed statement” and stores it in the first filter definition storage unit 31. Remember. In addition, when a new filter definition is added, the filter definition management unit 43 measures the time from the addition and deletes the new definition when the effective period included in the “executed statement” has elapsed.

  The analysis unit 5 includes an accumulated alert analysis unit 51 and a rule check unit 52. Of these, the accumulated alert analysis unit 51 analyzes the alert accumulated in the alert accumulation unit 33. Specifically, the accumulated alert analysis unit 51 analyzes the occurrence frequency and tendency of alerts. Further, the accumulated alert analysis unit 51 creates a rule candidate (rule candidate) used by the rule conformity determination unit 42 based on the analysis result. A specific example of analysis processing and rule creation processing by the accumulated alert analysis unit 51 will be described later with reference to FIG.

  The rule check unit 52 is a second filtering unit in which the rule check unit 52 uses a filter definition that is updated based on the created rule candidate (that is, the filter definition of the first filtering unit 21). It is determined whether or not it matches the 22nd second filter definition. If the rule check unit 52 determines that they do not match as a result of the determination, the rule check unit 52 stores the created rule candidate in the rule storage unit 34 as a new rule. Thereby, the rule conformity determination unit 42 uses the rule created by the rule check unit 52 to collate with the alert.

  Next, operation | movement of the operation management apparatus 1 in this Embodiment is demonstrated using FIGS. In the present embodiment, the operation management method is performed by operating the operation management apparatus 1. Therefore, the description of the operation management method in the present embodiment is replaced with the following operation description of the operation management apparatus 1. In the following description, FIG. 1 is taken into consideration as appropriate.

  First, the filtering process to the rule conformity determination process in the operation management apparatus 1 will be described with reference to FIG. FIG. 2 is a flowchart showing from filtering processing to rule conformance determination processing by the operation management apparatus in the embodiment of the present invention. 2, the first filter definition storage unit 31 stores the filter definition shown in Table 1, and the second filter definition storage unit 32 stores the filter definition shown in Table 2. Suppose you remember. Further, it is assumed that the rule storage unit 34 stores the rules shown in Table 4.

  As shown in FIG. 2, first, the first filtering unit 21 receives an alert generated in the computer system 10 (step A1). Subsequently, the first filtering unit 21 accesses the first filter definition storage unit 31 and determines whether or not the received alert matches the first filter definition (step A2).

  If the received alert does not match the first filter definition as a result of step A2, the first filtering unit 21 transmits the alert to the second filtering unit 22 (step A3).

  On the other hand, if the received alert matches the first filter definition as a result of step A2, the first filtering unit 21 performs an operation according to the first filter definition (step A4). For example, in Step A4, the first filtering unit 21 can transmit (report) the alert to the external alert processing device 11. When step A4 is executed, the process in the operation management apparatus 1 ends.

  Next, the second filtering unit 22 determines whether or not the alert transmitted in step A3 matches the second filter definition (step B1). As a result of the determination in step B1, if the alert transmitted in step A3 does not match the second filter definition, the second filtering unit 22 executes a default operation (step B2). In the present embodiment, the second filtering unit 22 transmits an alert to the alert processing unit 41 as a default operation.

  On the other hand, as a result of the determination in step B1, if the alert input in step A3 matches the second filter definition, the second filtering unit 22 executes an operation according to the second filter definition (step B3). For example, in Step B3, the second filtering unit 22 transmits (reports) or does not transmit (reports) the alert to the external alert processing device 11. When step B3 is executed, the processing in the operation management apparatus 1 ends.

  Here, it is assumed that an alert (see Table 1) of the type “log monitoring” and the message “warning 1” is generated in the computer system 10 and the first filtering unit 21 receives this alert (step A1). To do. In this case, since the alert matches the first filter definition (step A2), the first filtering unit 21 reports the alert to the alert processing device 11 according to the first filter definition (step A4).

  Further, it is assumed that an alert having a type of “process monitoring” and a message of “info: testmsg” is generated in the computer system 10, and the first filtering unit 21 receives this alert (step A1). In this case, since the alert does not match the first filter definition (step A2), the alert is transmitted to the second filtering unit 22 (step A3). On the other hand, since this alert matches the second filter definition (see Table 2) (step B1), the second filtering unit 22 does not report the alert to the alert processing device 11 according to the second filter definition ( Step B3).

  Furthermore, it is assumed that an alert having a type of “process monitoring” and a message of “testmsg” is generated in the computer system 10 and is received by the first filtering unit 21 (step A1). In this case, since the alert does not match the first filter definition (step A2), the alert is transmitted to the second filtering unit 22 (step A3). Further, since this alert does not match the second filter definition (step B1), the second filtering unit 22 transmits the alert to the alert processing unit 41 as a default operation (step B2). .

  Next, when step B2 is executed, the alert processing unit 41 transmits the received alert to the alert accumulating unit 33, and stores the alert in the alert accumulating unit 33 (step C1). In Step C1, the alert processing unit 41 notifies the rule conformity determining unit 42 when an alert is output to the alert accumulating unit 33.

  Next, the rule conformity determination unit 42 accesses the rule storage unit 34 and takes out one rule from a plurality of stored rules (see Table 4) (step D1). Subsequently, the rule conformity determination unit 42 determines whether or not the extracted rule conforms to the alert stored in the alert storage unit 33 (step D2).

  As a result of the determination in step D2, if the extracted rule does not match the alert, the suit matching determination unit 42 determines whether the matching determination has been completed for all the rules (step D5). As a result of the determination in step D5, when the conformity determination has not been completed for all the rules, the rule conformity determination unit 42 executes step D1 again. Further, as a result of the determination in step D5, when the conformity determination has been completed for all the rules, the processing in the operation management apparatus ends.

  On the other hand, as a result of the determination in step D2, if the extracted rule matches the alert, the rule conformity determination unit 42 notifies the filter definition management unit 43 of the extracted rule (step D3). By executing step D3, definition update processing by the filter definition management unit 43 is executed (step D4). The definition update process will be described later with reference to FIG.

  Next, definition update processing in the operation management apparatus 1 will be described with reference to FIG. FIG. 3 is a flowchart showing definition update processing by the operation management apparatus according to the embodiment of the present invention. 3, the first filter definition storage unit 31 stores the filter definition shown in Table 1, and the second filter definition storage unit 32 stores the filter definition shown in Table 2. Is remembered. Further, it is assumed that the rule storage unit 34 stores the rules shown in Table 4.

  As shown in FIG. 3, first, the filter definition management unit 43 creates a new filter definition according to the “executed statement” of the rule determined to be suitable in the previous step D2, and stores this in the first filter definition storage. Store in the unit 31 (step E1). By step E1, a new first filter definition is added to the first filter definition storage unit 31.

  Next, the filter definition management unit 43 waits until the effective period specified in the “executed statement” of the rule elapses (step E2). While the filter definition management unit 43 is on standby, step A2 is executed using the new filter definition. Therefore, the alert determined to not match the filter definition in the previous steps A2 and B1 is determined to match the filter definition in step A2 after execution of step E1.

  Thereafter, the filter definition management unit 43 deletes the first filter definition added in step E1 from the first filter definition storage unit 31 when the effective period specified in the “executed statement” of the rule has elapsed ( Step E3). Thereafter, the processing in the operation management apparatus 1 ends.

  Here, the processing shown in FIG. 2 and FIG. 3 will be specifically described using an example of the alarms shown in Tables 5 to 7. First, it is assumed that alert rush occurs in the computer system 10 as shown in Table 5 below (alert example 2). Since the alert rush shown in Table 5 does not match either the first filter definition or the second filter definition, the second filtering unit 22 transmits this alert to the alert processing unit 41 (B2). The alert processing unit 41 stores the received alert in the alert storage unit 33 (step C1).

Then, the rule conformity determination unit 42 retrieves the rule (see Table 4) of the conditional statement “3 alerts of the same type and the same message are generated continuously” (step D1). It is determined that the rule matches the alert shown in Table 5 (step D2).
The rule conformity determination unit 42 transmits the alert shown in Table 5 to the filter definition management unit 43 (step D3).

In accordance with the “executed statement” of the rule extracted in step D1, the filter definition management unit 43 stores the type “log monitoring” and the message “error” in the first filter definition unit storage unit 31.
The filter definition that becomes “a” is added (step E1). As a result, the alert (see Table 5) hits in the first filtering unit 21 from the execution of step E1 until the validity period specified in the “executed statement” of the rule elapses. Therefore, the filtering process is not executed in the second filtering unit 22.

  Further, the filter definition management unit 43 waits for 30 seconds in accordance with the “executed statement” of the rule (step E2). Then, after the validity period (30 seconds) has elapsed, the filter definition management unit 43 deletes the filter definition (type “log monitoring”, message “error a”) added in step E1 (step E3).

  Further, it is assumed that alert rush occurs in the computer system 10 as shown in Table 6 (alert example 3) below. The alert rush shown in Table 6 is also stored in the alert accumulating unit 33 as in the case of Table 5 (Step C1).

  Then, the rule conformity determination unit 42 extracts the rule (see Table 4) of the conditional statement “5 alerts of the same type and the same message are generated per second” (step D1). It is determined that the rule matches the alert shown in Table 6 (step D2). The rule conformity determination unit 42 transmits the alert shown in Table 6 to the filter definition management unit 43 (step D3).

  Next, also in this case, the first filter definition is added according to the execution statement of the rule (step E1), and after the validity period has passed (step E2), the added first filter definition is deleted (step E2). Step E3).

  Furthermore, it is assumed that alert rush occurs in the computer system 10 as shown in Table 7 (alert example 4) below. The alert rush shown in Table 7 is also stored in the alert accumulating unit 33 as in the case of Table 5 (Step C1).

  Then, the rule conformity determination unit 42 generates three consecutive alerts of the conditional statement “type“ log monitoring ”and the message“ error number ”. ”(See Table 4) (step D1), it is determined that the extracted rule matches the alert shown in Table 7 (step D2). The rule conformity determination unit 42 transmits the alert shown in Table 7 to the filter definition management unit 43 (step D3).

  Next, also in this case, according to the execution statement of the rule, the first filter definition is added (step E1), and after the validity period has passed (step E2), the added first filter definition is deleted (step E3).

  Next, rule update processing in the operation management apparatus 1 will be described with reference to FIGS. 4 and 5. First, the entire rule update process will be described with reference to FIG. FIG. 4 is a flowchart showing rule update processing by the operation management apparatus according to the embodiment of the present invention.

  First, as shown in FIG. 4, in the analysis unit 5, the accumulated alert analysis unit 51 analyzes the occurrence frequency and tendency of alerts, and based on the analysis result, the rule candidates (rules) used by the rule conformity determination unit 42. (Candidate) is created (step F1).

  Next, the accumulated alert analysis unit 51 determines whether the rule candidate created in Step F1 is already stored in the rule storage unit 34 (Step F2). If the rule candidate is already stored in the rule storage unit 34 as a result of the determination in step F1, the processing in the analysis unit 5 ends. On the other hand, if the rule candidate is not already stored in the rule storage unit 34 as a result of the determination, step G1 is executed by the rule check unit 52.

  In step G1, the rule check unit 52 determines whether or not the first filter definition added based on the rule candidate created in step F1 matches the second filter definition used by the second filtering unit 22. judge.

  If the result of determination in step G1 is a match, the processing in the analysis unit 5 ends. On the other hand, if the result of determination in step G1 is that they do not match, the rule check unit 52 stores the created rule candidate in the rule storage unit 34 as a new rule (step G2). Thereby, the rule conformity determination part 42 performs collation with an alert using the added new rule. After step G2, the processing in the analysis unit 5 ends.

  Here, a specific example of step F1 (analysis processing and rule creation processing) shown in FIG. 4 will be described with reference to FIG. FIG. 5 is a flowchart specifically showing analysis processing and rule creation processing included in the rule update processing shown in FIG. Further, in the following description, it is assumed that the alert shown in Table 8 occurs in the computer system 10 and is stored in the alert storage unit 33.

  As shown in FIG. 5, first, the accumulated alert analysis unit 51 extracts alerts from the alert accumulation unit 33 and classifies the extracted alerts by type (step I1). Table 9 shows alerts classified by type. Next, the accumulated alert analysis unit 51 further classifies the alerts classified by type based on the number of words (step I2). Table 10 shows alerts classified based on the number of words.

  Subsequently, the accumulated alert analysis unit 51 calculates the number of the same words and the probability (hit ratio) that the same words appear for each combination of alerts having the same number of words in the message (step I3). Table 11 shows the calculation result of step I3. In Table 11, only the calculation result when the number of words is 2 is shown.

  Next, the accumulated alert analysis unit 51 identifies combinations having higher hit ratios, sets a non-identical word as “*” in each combination message, and sets the obtained message as a rule candidate (step I4). Table 12 shows the created rule candidates. In step I4, the accumulated alert analyzing unit 51 can also convert the rule candidate format into a format conforming to Table 4.

  After completion of step I4, step F2 shown in FIG. 4 is executed. Note that the algorithm of analysis processing and rule creation processing by the accumulated alert analysis unit 51 is not limited to the algorithm shown in FIG. In this embodiment, other algorithms may be used.

  In addition, the program in the present embodiment causes the computer to execute steps A1 to A4, B1 to B3, C1, D1 to D5, E1 to E3, F1 to F2, G1 to G2, I1 to I4 (see FIGS. 2 to 5). ) Can be used. By installing and executing this program on a computer, the operation management apparatus 1 and the operation management method in the present embodiment can be realized. In this case, the CPU (Central Processing Unit) of the computer functions as the filtering processing unit 2, the processing unit 4, and the analysis unit 5 to perform processing. A storage device such as a hard disk provided in the computer can function as the storage unit 3.

  Furthermore, in the present embodiment, in the operation management apparatus 1, the filtering processing unit 2, the storage unit 3, the processing unit 4, and the analysis unit 5 may be realized by separate computers. In this case, each computer is connected by a network and functions as one operation management apparatus 1.

  In this case, a program for executing a corresponding process is installed in each computer. For example, a program that executes steps A1 to A4 and steps B1 to B3 is installed in the computer that functions as the filtering processing unit 2. In addition, a program that executes Step C1, Steps D1 to D5, and Steps E1 to E3 is installed in the computer that functions as the processing unit 4. Furthermore, a program that executes steps G1 to G2 and steps I1 to I4 is installed in the computer functioning as the analysis unit 5.

  As described above, in the present embodiment, the first filtering unit 21 operates before the second filtering unit 22 operates. For this reason, when a large number of alerts that do not hit the second filtering unit 22 are generated, the large number of alerts are filtered by the first filtering unit 21, so that the load in the filtering process of the second filtering unit 22 is increased. You can avoid getting too expensive.

  Further, in the present embodiment, triggered by the occurrence of an alert, the rule conformity determination unit 42 determines which of the plurality of rules the alert conforms to, and dynamically changes the first according to the conforming rule. You can update the filter definition. For this reason, according to this Embodiment, it can respond to sudden change like alert rush, and a manager's burden is eased.

  Furthermore, in the present embodiment, when an alert that does not conform to the rules has occurred, the alert is accumulated and becomes an analysis target. That is, the analysis unit 5 analyzes the accumulated alert and creates a new rule corresponding thereto. As a result, the filter definition is added based on the new rule, so that even if an alert that does not match the rule occurs, this alert can be extracted by filtering. Further, the analysis of the alert and the creation of a new rule can be performed during the surplus processing time in the operation management apparatus 1, and an excessive load on the operation management apparatus 1 can be suppressed.

  According to the present invention, in the operation management of a computer system, a filter definition can be dynamically updated according to an alert, and the burden on the administrator can be reduced. Therefore, the present invention is useful for the operation and management of computer systems, particularly large-scale computer systems.

DESCRIPTION OF SYMBOLS 1 Operation management apparatus 2 Filtering processing part 3 Storage part 4 Processing part 5 Analysis part 10 Computer system 11 Alert processing apparatus 21 1st filtering part 22 2nd filtering part 31 1st filter definition memory | storage part 32 2nd filter definition Storage unit 33 Alert accumulation unit 34 Rule storage unit 41 Alert processing unit 42 Rule conformity determination unit 43 Filter definition management unit 51 Accumulated alert analysis unit 52 Rule check unit

Claims (15)

An operation management apparatus for performing operation management of a computer system,
A plurality of filtering units that extract alerts that meet a definition from alerts generated in the computer system;
The alert that has not been extracted by any of the plurality of filtering units is collated with two or more preset rules, and it is determined whether any of the rules matches the alert that has not been extracted. A rule conformity determination unit;
A filter definition management unit that updates the definition of any of the plurality of filtering units based on a rule determined to match when any of the rules is determined to match the alert that has not been extracted. When,
An operation management device comprising:   The operation management apparatus according to claim 1, further comprising an analysis unit that analyzes the alert that has not been extracted and creates the rule used by the rule conformity determination unit based on an analysis result. The plurality of filtering units are connected in cascade,
The operation management apparatus according to claim 1, wherein the filter definition management unit updates the definition of a filtering unit that first extracts the alert. The rule includes a matching condition, a new definition added when the matching condition is met, and a validity period of the new definition;
The operation management apparatus according to claim 1, wherein the filter definition management unit deletes the new definition when the validity period elapses. The analysis unit determines whether the definition updated based on the created rule matches the definition of the filtering unit that does not use the definition,
The operation management apparatus according to claim 2, wherein when the rule conformity determination unit determines that they do not match by the analysis unit, the operation management device performs verification using the created rule. A method for managing the operation of a computer system,
(A) executing a filtering process for extracting an alert that matches a definition from alerts generated in the computer system a plurality of times; and
(B) The alert that has not been extracted by any of the filtering processes is checked against two or more preset rules, and it is determined whether any of the rules matches the alert that has not been extracted. Step,
(C) If any of the rules is determined to match the alert that has not been extracted in the step of (b), based on the rule determined to match, in any of the filtering processes Updating the definition; and
An operation management method characterized by comprising: The method further comprises the step of: (d) analyzing an alert that has not been extracted by any of the filtering processes, and creating the rule used in the step (b) based on the analysis result. 6. The operation management method according to 6. In the step (a), the filtering process is executed a plurality of times in order,
The operation management method according to claim 6 or 7, wherein in the step (c), the definition in the filtering process executed first is updated.   When the rule includes a conforming condition, a new definition added when the conforming condition is met, and an effective period of the new definition, the elapse of the effective period in the step (c) The operation management method according to claim 6, wherein the new definition is sometimes deleted. (E) further comprising the step of determining whether the definition updated based on the rule created in step (d) matches the definition of the filtering process that does not use the definition;
The operation according to claim 7, wherein, when it is determined in step (e) that they do not match, in step (b), matching is performed using the rules created in step (d). Management method. A program for managing the operation of a computer system by a computer,
In the computer,
(A) executing a filtering process for extracting an alert that matches a definition from alerts generated in the computer system a plurality of times; and
(B) The alert that has not been extracted by any of the filtering processes is checked against two or more preset rules, and it is determined whether any of the rules matches the alert that has not been extracted. Step,
(C) If any of the rules is determined to match the alert that has not been extracted in the step of (b), based on the rule determined to match, in any of the filtering processes Updating the definition; and
A program characterized by having executed. (D) Analyzing an alert that has not been extracted by any of the filtering processes, and creating the rule used in the step (b) based on the analysis result, further causing the computer to execute a step. The program according to claim 11. In the step (a), the filtering process is executed a plurality of times in order,
The program according to claim 11 or 12, wherein in the step (c), the definition in the filtering process executed first is updated.   When the rule includes a conforming condition, a new definition added when the conforming condition is met, and an effective period of the new definition, the elapse of the effective period in the step (c) 14. A program as claimed in any of claims 11 to 13, which sometimes deletes the new definition. (E) determining whether the definition updated based on the rule created in step (d) matches the definition of the filtering process that does not use the definition; Let it run
13. The program according to claim 12, wherein, when it is determined that they do not match in the step of (e), in the step of (b), matching is performed using the rules created in the step of (d). .

Images