JP2011244164A - Server abnormality determination program, server abnormality determination device and server abnormality determination method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To identify a server that is the cause of a fault.SOLUTION: A server abnormality determination device stores information identifying a server, routing information showing a route including the server regarding message data of a transaction, and information associated with a server response average that is an average of response values, each of which represents a time from sending of a request message for the transaction to reception of an answer message in the server. When the server response average is greater than a threshold, the server abnormality determination device determines that an abnormality has occurred in the route, and records the information identifying the server and the routing information.

Description

  The present invention relates to a server abnormality determination program, a server abnormality determination device, and a server abnormality determination method for identifying a server having an abnormality.

  Services that perform peer-to-peer communication on the Internet require technology for transmitting media information such as voice, video, and text in real time using Internet Protocol (IP) packets. In addition to this, a signaling technique for controlling establishment, change, and disconnection (termination) of a peer-to-peer session (call) on the Internet is important. Peer-to-peer communication services include IP phones, videophones, and instant messengers.

In particular, IP telephones that have been remarkably popular in recent years have been realized by combining Voice Over IP (VoIP) technology for transmitting voice signals in IP packets in real time and signaling technology.
The H.323 system recommended by the International Telecommunication Union-Telecommunication sector (ITU-T) in 1997 is realized as a signaling protocol that can be used for IP telephones. Further, Session Initiation Protocol (SIP), which is standardized by the Internet Engineering Task Force (IETF) and specified as a standard track in Request for Comments (RFC) 3261 issued in 2002, is realized. In particular, in SIP, messages are written in text. SIP was designed around the Hyper Text Transfer Protocol (HTTP) for the Web and the Simple Message Transfer Protocol (SMTP) for email. For this reason, SIP is simple, scalable, and highly compatible with the Internet, and is becoming the standard for signaling protocols used in IP phones.

SIP is a signaling protocol for controlling the establishment / change / disconnection (termination) of a session (call) between terminals in an application layer.
A method (SIP request message) and a response (SIP response message) are exchanged between terminals via a relay server called a SIP server arranged on the Internet according to a predetermined procedure. Thereby, establishment / change / disconnection (termination) of the session is controlled.

  In general telephone service, response to network failures and quick service recovery are key to ensuring customer satisfaction and service reliability. In the event of a failure, it is necessary to quickly grasp the network quality and the scope of impact (affected users) in order to appropriately respond to possible customer inquiries, to prevent the expansion of the impact, and to restore the service. ing.

  In a system that exchanges data via multiple servers, it takes a lot of time and effort to investigate which intermediate server or peripheral device is the cause of a failure such as a data transmission delay or error. Cost. In particular, when there are an infinite number of server combinations through which data passes, as in the case of SIP server message exchange, it is not easy to identify the fault location.

  Conventionally, statistical values such as response time required for data transmission are calculated and held for each server. When data arrives via a plurality of servers, if there is a delay in reaching the server at a certain end point, it is necessary to identify the server or device that causes the delay. At this time, it is common to find anomalies using the aggregate value of the average response time for each server.

JP 2009-238069 A

  However, when there is a problem specific to the route, for example, the data transmission time is long in a specific route R1 passing through the server S, and the data transmission time passing through all other routes R2 to Rn passing through the server S is normal. It may be short. In this case, if the transmission time of data is totaled by the server S and the average is calculated, the long processing time of the route R1 is buried by the short processing time of the routes R2 to Rn, which occurs in the server S (the route R1). There was a problem that it was not possible to find the fault.

Similarly, when the tabulation is performed from the viewpoint of the error occurrence rate, there is a problem that a high occurrence rate error of a certain route cannot be found due to a low occurrence rate error of another route.
In such a situation, in order to find the abnormal part, it is necessary to perform the inefficient work of finding the server path of the message by following the server that the message has propagated one by one and finding the presence or absence of the delay. was there. In the past, methods for extracting route information from messages have been used, but since there are a large number of combinations of server routes, it is virtually impossible to leave statistical information for each route.

  An object of the present invention is to provide an apparatus that can easily identify a server causing a failure.

The server abnormality determination device according to the embodiment includes a storage unit and an abnormality determination unit.
The storage unit is information for specifying a server, route information indicating a route including the server for transaction message data, and a time from when the server sends a request message for the transaction to when a response message is received. Information associated with a server response average that is an average of response values is stored.

  The abnormality determination unit determines that an abnormality has occurred in the route when the server response average exceeds a threshold, and records information for specifying the server and the route information.

  According to the apparatus of the embodiment, it is possible to easily identify the server that is causing the failure.

It is a network block diagram concerning embodiment. It is a block diagram of the abnormality diagnosis apparatus which concerns on embodiment. It is an example of the server table which concerns on embodiment. It is an example of the partial path | route ID table which concerns on embodiment. It is an example of the path | route ID table which concerns on embodiment. It is an example of the learning value table which concerns on embodiment. It is an example of the preservation | save path | route table which concerns on embodiment. It is a figure which shows the flow of message data. It is a flowchart of the route information totaling process of an embodiment. It is an example of message data. It is an example of message data. It is an example of message data. It is an example of message data. It is a detailed flowchart of step S308. It is a flowchart of the shortening process of a partial path | route. It is a network block diagram in the specific example of the shortening process of a partial path | route. It is a flowchart of the expansion process of a partial path | route. It is a network block diagram in the specific example of the expansion | extension process of a partial path | route. It is a flowchart of the validation process of a partial path | route. It is a flowchart of a server abnormality determination process.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a network configuration diagram according to the present embodiment.
The network includes an abnormality diagnosis apparatus 101, a server 102-m (m = 1 to 11), and a capture apparatus 103-m.

The server 102-1 is connected to the terminal 104-1, servers 102-3 and 102-4, and the capture device 103-1.
The server 102-2 is connected to the terminal 104-2, the servers 102-3 and 102-4, and the capture device 103-2.

The server 102-3 is connected to the servers 102-1, 102-2, 102-5, 102-6, and the capture device 103-3.
The server 102-4 is connected to the servers 102-1, 102-2, 102-5, 102-6, and the capture device 103-4.

The server 102-5 is connected to the servers 102-3, 102-4, 102-7, 102-8, and the capture device 103-5.
The server 102-6 is connected to the servers 102-3, 102-4, 102-8, 102-9, and the capture device 103-6.

The server 102-7 is connected to the servers 102-5 and 102-10 and the capture device 103-7.
The server 102-8 is connected to the servers 102-5, 102-6, 102-10, 102-11, and the capture device 103-8.

The server 102-9 is connected to the servers 102-6 and 102-11 and the capture device 103-9.
The server 102-10 is connected to the terminals 104-3 and 104-4, the servers 102-3 and 102-4, and the capture device 103-10.

The server 102-11 is connected to the terminal 104-5, the servers 102-8 and 102-9, and the capture device 103-11.
The server 102 transfers the message data to the adjacent server 102 or terminal 104.
The servers 102-1 to 102-11 may be represented as servers S1 to S11, respectively.

  The capture device 103-m is connected to the server 102-m, and captures message data transmitted by the server 102-m. The capture device 103-m is connected to the abnormality diagnosis device 101 and transmits the captured message data to the abnormality diagnosis device 101.

The abnormality diagnosis apparatus 101 collects message data and performs a linking process on the message data. Then, a route of message data is generated from the association result, statistical information of route information for each server is generated, and a server abnormality for each route is discovered.
The terminal 104 is an IP phone, for example.

FIG. 2 is a configuration diagram of the abnormality diagnosis apparatus according to the embodiment.
The abnormality diagnosis apparatus 101 includes a processing unit 110, a memory 117, and a storage unit 118.
The processing unit 110 performs path generation and server abnormality diagnosis.

The memory 117 stores data used for processing in the processing unit 110.
The processing unit 110 includes a message data collection unit 111, a linking unit 112, a route information generation unit 113, a storage route selection unit 114, a statistical information management unit 115, and an abnormality diagnosis unit 116.

The message data collection unit 111 receives a plurality of message data transmitted from the capture device 103 and transmits it to the association unit 112.
The associating unit 112 associates a plurality of message data based on a common attribute (for example, Call-ID). A set of linked message data is called a transaction. Since a plurality of message data in a series of communications have common attributes, these message data are linked.

The route information generation unit 113 generates a route from the message data.
The save route selection unit 114 determines whether to save the generated route.
The statistical information management unit 115 stores various information on the storage target route and the server in the storage unit 118.

The abnormality diagnosis unit 116 determines whether there is an abnormality in the server and the route.
The storage unit 118 includes a server table 201, a partial route ID table 202, a route ID table 203, a learned value table 204, and a storage route table 205.

FIG. 3 is an example of a server table according to the embodiment.
The server table 201 has a server ID and an IP address as items.
The server ID is an ID assigned to the server, and the IP address is the IP address of the server. In the server table, a server ID and an IP address are described in association with each other.

For example, the server ID of the server 102-5 is S5, and the IP address is 192.168.1.2.
In the present embodiment, S1 to S11 are assigned as server IDs to the servers 102-1 to 102-11, respectively.

In FIG. 3, only a part of the server table (a set of three server IDs and IP addresses) is displayed.
FIG. 4 is an example of a partial path ID table according to the embodiment.

The partial route ID table 202 includes a partial route ID and a partial route as items.
The partial route ID is an ID assigned to each partial route.
The partial path indicates a part of the path. In the partial path, a predetermined number of server IDs are described side by side. In the embodiment, the length of the partial path (partial path length) is 3. That is, the number of server IDs described in each partial path is 3. For example, S3-S5-S7 indicates a route from the server S3 to the server S7 via the server S5.

FIG. 5 is an example of a route ID table according to the embodiment.
The route ID table 203 includes a route ID and a route as items.
The route ID is an ID assigned to each route.

  The route indicates a route on the network. A predetermined number of server IDs are described side by side in the route. In the embodiment, a route is obtained by adding one server before and after a partial route having a partial route length of 3. That is, the number of server IDs described in each route is 5. For example, S2-S4-S5-S8-S10 indicates a route from the server S2 to the server S10 via the servers S4, S5, and S8.

FIG. 6 is an example of a learning value table according to the embodiment.
The learning value table 204 includes, as items, a server ID, a partial path ID, a server response average, an overall response average, a frequency, TimeWin, and a valid flag.

The server ID describes the target server ID.
The partial path ID describes the target partial path ID.
In the server response average, an average response value from before TimeWin to the present in the partial path of the target server is described. The response value is the time from when the server sends a request message until it receives the response message, and the average response value is the average of the response values. As will be described later, since TimeWin is Twin3 (3 minutes) in FIG. 6, the average of response values from 3 minutes before to the present is described in the server response average.

The overall response average describes the overall response average in the partial path of the target server.
Details of the server response average and the overall response average will be described later.

The frequency describes the number of times the data appears within the time width of TimeWin.
TimeWin indicates a time window, and a predetermined time such as 3 minutes or 30 seconds is described in TimeWin. In addition, Twin3 of FIG. 6 shows that it is 3 minutes. The valid flag is a flag indicating whether or not the value of the learning value table is used, and 1 or 0 is described. 1 indicates valid (true) and 0 indicates invalid (false).

FIG. 7 is an example of a storage path table according to the embodiment.
The storage route table 205 includes, as items, server ID, route ID, server response average (current), server response average (past 1), server response average (past 2), overall response average, frequency, and TimeWin.

In the route ID, the target route ID is described.
The server response average (current) corresponds to the server response average of FIG.
The server response average (past 1) describes an average response value from 2 * TimeWin before TimeWin in the partial path of the target server. For example, in FIG. 7, an average response value from 6 minutes before to 3 minutes before is described.

  The server response average (past 2) describes the average response value from 3 * TimeWin before 2 * TimeWin in the partial path of the target server. For example, in FIG. 7, the average response value from 9 minutes before to 6 minutes before is described.

Since the server ID, server response average, overall response average, frequency, and TimeWin are the same as described above, the description thereof is omitted.
Here, the server response average and the overall response average used in the embodiment will be described.

FIG. 8 is a diagram showing the flow of message data.
In FIG. 8, the INVITE message is transferred from the server S1 to the server S10 via the servers S3, S5, and S7. Further, the RINGING message is transferred from the server S10 to the server S1 via the servers S7, S5, and S3.
Server response average The server response average in the partial path Y of the server X is an average of the response values of the server X in all paths including the partial path Y.

  The response value is the time from when the INVITE message is transmitted until the Ringing message is received. For example, the response value of the server S5 on the route shown in FIG. 8 is the time from when the INVITE message is transmitted to the server S7 until the RINGING message is received from the server S7.

The route passing through the server S5 is not only the route S1-S3-S5-S7-S10 shown in FIG. 8, but also S2-S3-S5-S8-S10 and S1-S4-S5-S7- as shown in FIG. There are several such as S10.
For example, the server response average in the partial path S3-S5-S7 of the server S5 is obtained. In FIG. 1, the paths including the partial paths S3-S5-S7 are S1-S3-S5-S7-S10 and S2-S3-S5-S7-S10. Therefore, the server response average in the partial path S3-S5-S7 of the server S5 is the average of the response values of the server S5 in the transactions of the paths S1-S3-S5-S7-S10 and S2-S3-S5-S7-S10. Become.
Overall Response Average The overall response average of the partial path Y of the server X is the average of the response values at the starting end Z in all paths including the partial path Y. The starting point is the starting server that transmits the INVITE message. For example, in FIG. 8, the starting end Z is the server S1.

  For example, the overall response average in the partial path S3-S5-S7 of the server S5 is obtained. In FIG. 1, the paths including the partial paths S3-S5-S7 are S1-S3-S5-S7-S10 and S2-S3-S5-S7-S10. The starting end Z is the servers S1 and S2. Therefore, the total response average in the partial path S3-S5-S7 of the server S5 is the response value of the servers S1 and S2 in the transactions of the paths S1-S3-S5-S7-S10 and S2-S3-S5-S7-S10. Average.

FIG. 9 is a flowchart of route information aggregation processing according to the embodiment.
In step S301, the message data collection unit collects message data.

10A to 10D are examples of message data.
The message data is, for example, a request message or a response message used in SIP.

Request-Line describes the request type, destination, and SIP version.
Status-Line describes the SIP version, Status-Code, and Reason-Phrase
From is the source and To is the destination.

In Call-ID, an ID for identifying a request and a response generated in a series of communications (calls) from a request and a response of another call is described.
In Date, the transmission date and time of the message data is described.
X-MMM is an ID representing an attribute used in a specific carrier.

Returning to FIG. 9, in step S302, the linking unit performs linking processing on the collected message data. That is, the message data is associated based on the attribute value.
Here, as an example of the linking process, the linking process for the message data 401 to 404 in FIGS. 10A to 10D will be described.

The association processing unit 112 classifies the message data based on the Call-ID of the message data.
The Call-ID of the message data 401 and the message data 404 is the same. Therefore, the message data 401 and the message data 404 are linked. Here, the associated message data 401 and message data 404 are group 1.

Further, the Call-ID of the message data 402 and the message data 403 is the same. Therefore, the message data 402 and the message data 403 are linked. Here, the associated message data 402 and message data 403 are group 2. The association processing unit 112 classifies groups based on the X-MMM of the message data.

  The X-MMM of message data 401 belonging to group 1 and the X-MMM of message data 402 belonging to group 2 are the same. Therefore, group 1 and group 2 are linked.

Through the above processing, the message data 401, message data 402, message data 403, and message data 404 are linked.
In the above example, the association is performed based on the Call-ID and the X-MMM. However, the association is not limited to this, and the association may be performed based on other attributes.

Returning to FIG. 9, in step S <b> 303, the path information generation unit 113 calculates the path of message data (the order of servers that have passed through) from the transaction.
The message data path is generated by extracting a specific request message (for example, an INVITE message) from the message data and connecting the extracted messages with a source address and a destination address. For example, if the destination address of the first message data is the same as the transmission source address of the second message data, the first and second messages are linked and the second message is sent from the destination address of the first message data. A route to the destination address of the data is generated. Further, the route information generation unit 113 calculates a server response and an overall response in the generated route.

  In step S304, the saving route selection unit 114 determines whether the generated route is a saving target route. If the saving route is a saving target route, the control proceeds to step S305, and if not, the control proceeds to step S308.

The determination as to whether the route is a storage target route is performed as follows.
(1) Select one server through the generated route in order. For example, when the generated route is S2-S4-S5-S7-S10, the servers S2, S4, S5, S7, and S10 are selected as processing targets in order.
(2) It is checked whether the combination of the server ID of the target server and the route ID of the generated route is stored in the storage route table, and if it is stored, it is determined as the storage target. Note that a path determined to be a storage target is called a storage target path.
(3) Check whether there is an unselected server. If there is an unselected server, return to (1).

In step S305, the storage route selection unit 114 checks whether the storage target route is excluded from the storage target.
For example, the storage route selection unit 114 determines that the target route is excluded from the storage target when a predetermined time has elapsed since the target route became the storage target, or when the predetermined time has passed since the abnormal value is not taken.

  In addition, for example, the storage path selection unit 114 performs an average of all server responses for the most recent predetermined time (for example, three times) time window (server response average (current), server response average (past 1) in FIG. 7), When the server response average (past 2) is smaller than the threshold value, it is determined that the route information is not stored.

If the save target route is not the save target, the control proceeds to step S306. If the save target route is not the save target, the control proceeds to step S307.
In step S306, the statistical information management unit 115 deletes the target route from the saved route table.

  In step S <b> 307, the statistical information management unit 115 stores information such as various transaction data, server response average, and overall response average as statistical values for each path in the learned value table 204 and the storage path table 205. The statistical information management unit 115 calculates the server response average and the overall response average when the server response and the overall response in the generated route are newly added.

  In step S308, the storage route selection unit 114 determines whether the generated route is a new storage target route. If it becomes a new saving target route, the control proceeds to step S309, and if it is not a new saving target route, the process is terminated. Details of the process for determining whether the generated route is a new route to be saved will be described later.

  In step S309, the statistical information management unit 115 secures an area for storing information on the storage target route in the storage unit 118, and stores information such as a route ID corresponding to the storage target route, a server response average, and an overall response average. They are stored in the learning value table 204 and the storage route table 205. The statistical information management unit 115 calculates the server response average and the overall response average when the server response and the overall response in the generated route are newly added.

FIG. 11 is a detailed flowchart of step S308.
In step S501, the storage path selection unit 114 sequentially selects one unselected server among the servers in the generated path. Here, the generated route is S2-S4-S5-S7-S10. In this case, the server S2 is selected as the processing target first, and then the servers S4, S5, S7, and S10 are sequentially selected.

  In step S502, the storage path selection unit 114 generates a partial path of the selected server. Here, a route obtained by adding a server to the target server one by one before and after is defined as a partial route. For example, when the target server is S5, the partial path is S4-S5-S7.

In step S503, the storage path selection unit 114 refers to the partial path ID table 202 and extracts a partial path ID corresponding to the generated partial path.
In step S504, the saved route selection unit 114 refers to the learned value table 204 and extracts the server response average and the overall response average corresponding to the set of the server ID of the selected server and the partial route ID of the generated partial route. The server response average and the overall response average in the learning value table 204 are referred to as learning values.

  In step S505, the storage path selection unit 114 determines whether the server response of the selected server is greater than the threshold value. If the server response of the selected server is greater than the threshold value, control proceeds to step S506, and if it is equal to or less than the threshold value, control proceeds to step S507. The threshold is N (positive real number) times the server response average extracted in step S504.

In step S506, the save route selection unit 114 sets the route generated in step S303 as a save target.
In step S507, the storage path selection unit 114 determines whether there is an unselected server. If there is an unselected server, the control returns to step S501. If there is no unselected server, the process ends.

Next, a specific example of the process for determining whether the generated route becomes a new storage target route will be described.
Here, the network configuration is the same as in FIG.
The average server response in the partial path S3-S5-S7 of the server S5 is 7 ms.
The server response average in the partial path S3-S5-S8 of the server S5 is 3 ms.
The server response average in the partial path S4-S5-S7 of the server S5 is 4 ms.
The average server response in the partial path S4-S5-S8 of the server S5 is 9 ms.

The route to be determined as a new storage target route is S2-S4-S5-S7-S10. Assume that the response value of the server S5 is 9 ms on the route S2-S4-S5-S7-S10.
N is 2.

  For example, for the server S5, the partial route of the route S2-S4-S5-S7-S10 is S4-S5-S7. The server response average in the partial path S4-S5-S7 of the server S5 is 4 ms, and 9 ms which is the response value of the server S5 in the path S2-S4-S5-S7-S10 to be determined as a new storage target path Is larger than 8 ms (twice 4 ms), the path S2-S4-S5-S7-S10 is determined to be a new storage target path.

Next, a reduction in memory usage will be described.
As described above, by classifying and summing statistical values such as response values of the server for each partial route, it is possible to improve the accuracy of determining which route is stored. On the other hand, as in the case of processing the statistics of route information, the problem of an increase in the number of partial routes handled due to the combination of servers also occurs when processing partial routes.

In order to cope with this problem, when there is not enough memory usage, the memory usage is reduced by reducing the partial path length or integrating the branched paths.
FIG. 12 is a flowchart of the partial path shortening process when the memory area is insufficient.

FIG. 13 is a network configuration diagram in a specific example of partial path shortening processing.
A specific example of the partial path shortening process will be described with reference to the network configuration diagram of FIG. 13 as appropriate.

The node 700 is connected to the nodes 701, 702, and 703.
The node 701 is connected to the nodes 711 and 712.
The node 702 is connected to the nodes 721 and 722.
The node 703 is connected to the nodes 731 and 732.

  Node 700 is n0, node 701 is n1, node 702 is n2, node 703 is n3, node 711 is n11, node 712 is n12, node 721 is n21, node 722 is n22, node 731 is n31, and node 732 is It may be expressed as n32.

The response value of n0 in the partial path n0-n1-n11 is 50 ms.
The response value of n0 in the partial path n0-n1-n12 is 40 ms.
The response value of n0 in the partial path n0-n2-n21 is 60 ms.
The response value of n0 in the partial path n0-n2-n22 is 45 ms.
The response value of n0 in the partial path n0-n3-n31 is 30 ms.
The response value of n0 in the partial path n0-n3-n32 is 50 ms.

In step S601, the statistical information management unit 115 checks the total memory capacity and the free capacity (remaining capacity).
In step S602, the statistical information management unit 115 checks whether the free space of the memory is less than a predetermined ratio. If the free space of the memory is less than the predetermined rate, the control proceeds to step S603, and if the free space of the memory is equal to or greater than the predetermined rate, the process ends.

  In step S603, the statistical information management unit 115 checks whether there is a partial path that can be reduced. If there is a partial path that can be reduced, control proceeds to step S604. If there is no partial path that can be reduced, the process ends. Whether there is a partial path that can be reduced is determined by, for example, holding a network configuration diagram and determining whether there is a node that is not an end point (for example, n1 in FIG. 13) in the network.

  In step S604, the statistical information management unit 115 checks whether there is an unprocessed partial path. If there is an unprocessed partial path, control proceeds to step S605, and if there is no unprocessed partial path, control proceeds to step S607.

  In step S605, the statistical information management unit 115 selects one unprocessed partial path. In FIG. 13, the partial paths are n0-n1-n11, n0-n1-n12, n0-n2-n21, n0-n2-n22, n0-n3-n31, and n0-n3-n32. Therefore, one unprocessed partial path is selected from these partial paths.

  In step S606, the statistical information management unit 115 records the difference in response value at the root node as the attribute value of the immediately preceding node for each path that branches from the immediately preceding node.

  Record the difference in the response value of the root node (n0) for each partial path as the attribute value of the node (n1) immediately before the end (n11, n12) in the partial paths n0-n1-n11, n0-n1-n12 To do. In the case of n1, the response value of the root node (n0) in the partial path n0-n1-n11 is 50 ms, and the response value of the root node (n0) in the partial path n0-n1-n12 is 40 ms. Therefore, the difference 50 ms-40 ms = 10 ms is recorded as the attribute value (response difference) of n1.

Similarly, the attribute value (response difference) of n2 is 15 ms, and the attribute value (response difference) of n3 is 20 ms.
In step S607, the statistical information management unit 115 checks whether there is an unprocessed node. If there is an unprocessed node, control proceeds to step S608, and if there is no unprocessed partial path, control returns to step S601.

In step S608, the statistical information management unit 115 selects one node in ascending order of the response difference recorded as the node attribute value.
In the specific example of FIG. 13, the response differences of n1, n2, and n3 are 10 ms, 15 ms, and 20 ms, respectively. Therefore, n1, n2, and n3 are selected in this order.

In step S609, the statistical information management unit 115 shortens the partial path by using the terminal node of the selected node as a reduction target.
When the selected node is n1, the end nodes are n11 and n12. Therefore, n11 and n12 are deleted from the partial path.

  In step S610, the statistical information management unit 115 checks whether the free capacity of the memory exceeds a specified value. If the free memory capacity exceeds the specified value, the process is terminated. If the free memory capacity does not exceed the specified value, the control returns to step S607.

Next, the extension of the partial path will be described.
If there is a margin in memory usage due to a decrease in the number of passing routes (because it no longer passes through the route that has been passed so far), it is possible to increase the accuracy of determining which route should be saved by expanding the partial route. Increase.

FIG. 14 is a flowchart of the partial path decompression process when there is room in the memory.
FIG. 15 is a network configuration diagram in a specific example of the partial path expansion processing.
A specific example of the partial path expansion process will be described with reference to the network configuration diagram of FIG.

The node 900 is connected to the nodes 901, 902, 903, and 904.
The node 901 is connected to the nodes 911 and 912.
The node 900 may be represented as n0, the node 901 as n1, the node 902 as n2, the node 903 as n3, the node 904 as n4, the node 911 as n11, and the node 912 as n12.

The response value of n0 in the partial path n0-n2 is 35 ms.
The response value of n0 in the partial path n0-n3 is 55 ms.
The response value of n0 in the partial path n0-n4 is 40 ms.

In step S801, the statistical information management unit 115 checks the total memory capacity and the free capacity (remaining capacity).
In step S802, the statistical information management unit 115 checks whether the free space of the memory exceeds a specified value. If the free space of the memory exceeds the specified value, the control proceeds to step S803. If the free space of the memory does not exceed the specified value, the process ends.

  In step S803, the statistical information management unit 115 checks whether there is an unprocessed partial path. If there is an unprocessed partial path, control proceeds to step S804. If there is no unprocessed partial path, the process ends.

  In step S804, the statistical information management unit 115 selects one unprocessed partial path that is shorter than the longest partial path in order of increasing response value of the root node with respect to the terminal node.

  In FIG. 13, the longest partial paths are n0-n1-n11 and n0-n1-n12, and the partial paths shorter than the longest partial path are n0-n2, n0-n3, and n0-n3. The response values of the route nodes (n0) of the partial paths n0-n2, n0-n3, n0-n4 are 35 ms, 55 ms, and 40 ms, respectively. Therefore, n0-n3, n0-n4, and n0-n2 are selected in this order.

In step S805, the statistical information management unit 115 performs a process of extending a partial path (adding a node) using the selected partial path as a path extension target.
For example, in the partial route n0-n3, nodes n31 and 32 are added to make the partial route n0-n3-n31 and n0-n3-n32.

In step S806, the statistical information management unit 115 subtracts the memory capacity used in the decompression process from the remaining memory capacity.
Next, validation of the partial path will be described.

  As described above, when the partial route is lengthened, since there are few messages passing through the extended partial route for a while after that, the reliability as the learning value is low. Therefore, it is not desirable to use the partial path immediately after decompression to determine whether or not it is a path storage target. Therefore, immediately after decompression, the decompressed partial path is invalidated by setting the valid flag of the learning value table 204 to false (0). Then, the expanded partial route is validated as a route storage target determination material by the following procedure.

FIG. 16 is a flowchart of the partial path validation process.
First, it is assumed that the validity flag of the expanded partial path in the learning value table 204 is false (0).

  In step S1001, the statistical information management unit 115 checks whether there is a partial path for which validity is determined. If it exists, the control proceeds to step S1002, and if it does not exist, the process ends. For example, in step S805, the statistical information management unit 115 records a flag indicating that the route has been expanded, and determines whether the partial route is valid or not based on the presence or absence of the flag. It is determined whether or not there is a partial path inside.

  In step S <b> 1002, the statistical information management unit 115 checks whether the number of transactions passing through the root node per prescribed time of the route to be determined exceeds the prescribed number. If the specified number has been exceeded, control proceeds to step S1004, and if not, the process ends.

  In step S <b> 1003, the statistical information management unit 115 checks whether a specified time has elapsed since the determination target route has been expanded. If the specified time has elapsed, the control proceeds to step S1004, and if not, the process ends.

  In step S1004, the statistical information management unit 115 sets the “validation flag” in the learning value table 204 to true (eg, 1). Thereby, the validated partial route is used in determining whether it is a route to be stored in step S304 in FIG.

According to the abnormality diagnosis apparatus of the embodiment, when a margin is generated in the memory, it is possible to increase the accuracy of determining which route should be saved by expanding the partial route.
Next, a process for determining whether there is a server abnormality will be described.

FIG. 17 is a flowchart of the server abnormality determination process.
In step S1101, the abnormality diagnosis unit 116 checks whether there is an unprocessed server in the storage path table 205. If there is an unprocessed server, control proceeds to step S1102, and if there is no unprocessed server, control proceeds to step S1109.

In step S1102, the abnormality diagnosis unit 116 selects one unprocessed server (server ID) from the storage path table 205.
In step S1103, the abnormality diagnosis unit 116 checks whether the server response average over a predetermined period of the selected server exceeds the threshold value. If the threshold is exceeded, control proceeds to step S1104, and if the threshold is not exceeded, control proceeds to step S1105.

  Specifically, when the server S5 is selected in the storage path table 205 of FIG. 7, the server response average of S5 is obtained from the weighted average of all paths of the server S5 recorded in the storage path table 205.

In FIG. 7, the server response average in the route ID 1 of S5 is 8 ms, and the frequency is 26. Further, the server response average in the route ID 2 of S5 is 5 ms, and the frequency is 20.
Accordingly, since the server response average of S5 is a weighted average of these, the server response average of S5 = (8 * 26 + 5 * 20) / (26 + 20) = 6.7 ms.

In step S1104, the abnormality diagnosis unit 116 records in the storage unit 118 that there is an abnormality in the selected server.
In step S1105, the abnormality diagnosis unit 116 checks whether there is an unprocessed path for all paths in the storage path table 205 including the selected server. If there is an unprocessed path, control proceeds to step S1106, and if there is no unprocessed path, control returns to step S1101.

In step S1106, the abnormality diagnosis unit 116 selects one unprocessed route.
In step S1107, the abnormality diagnosis unit 116 checks whether the server response average of the selected server and route pair exceeds the threshold value. If the threshold is exceeded, control proceeds to step S1108, and if the threshold is not exceeded, control returns to step S1105.

In step S1108, the abnormality diagnosis unit 116 records in the storage unit 118 that there is an abnormality in the selected server and route.
In step S1109, the abnormality diagnosis unit 116 notifies the user of the server recorded in step S1104, the server recorded in step S1108, and the route.

  According to the abnormality diagnosis apparatus of the present embodiment, it is possible to easily identify the server and the path that are the cause of the failure. In particular, it becomes easy to discover server abnormalities that occur on a specific route.

Regarding the above embodiment, the following additional notes are disclosed.
(Appendix 1)
Information specifying a server, route information indicating a route including the server with respect to message data of a transaction, and an average of response values that are times from when the server sends a request message of the transaction to when a response message is received And a computer having a storage unit that stores information associated with the server response average,
When the server response average exceeds a threshold, it is determined that an abnormality has occurred in the route, and processing for recording the information for specifying the server and the route information;
Server abnormality determination program that executes
(Appendix 2)
A process of associating a plurality of message data based on a predetermined attribute,
The route information indicating the route through which the associated message data passes is generated from the associated message data, and the response value of the server in the route through which the associated message data has passed is calculated. Processing to
Based on whether the generated route information is stored in the storage unit, a process of determining whether the response value of the server in the route through which the associated message data passes is a storage target;
When the response value of the server in the route through which the plurality of associated message data has passed is a storage target, the server response including the response value of the server in the route through which the associated plurality of message data has passed The process of recording the average;
The server abnormality determination program according to appendix 1, further executing
(Appendix 3)
When it is determined that the response value of the server in the route through which the associated message data has passed is not a storage target, partial route information indicating a partial route that is a part of the route is generated from the route information. And further executing a process of determining whether to save the response values of the servers in the path through which the associated message data passes based on whether the response values of the servers in the partial path are greater than a threshold value The server abnormality determination program according to supplementary note 2, characterized by:
(Appendix 4)
If it is determined that the generated route information is a storage target, the associated message data passes based on whether the server response average for a predetermined period corresponding to the generated route is smaller than a threshold value. The server abnormality determination program according to appendix 2 or 3, further comprising a process of determining whether to record a server response average including the response value of the server in the route.
(Appendix 5)
Information identifying the server to the computer, route information indicating the route including the server with respect to transaction message data, and a response value that is a time from when the server sends a request message for the transaction to when a response message is received Storing information associated with a server response average that is an average of
Determining whether the server response average exceeds a threshold, and if exceeding, recording the information identifying the server and the route information;
Server failure determination method for executing
(Appendix 6)
Associating a plurality of message data based on predetermined attributes;
The route information indicating the route through which the associated message data passes is generated from the associated message data, and the response value of the server in the route through which the associated message data has passed is calculated. And a process of
Determining whether the response value of the server in the path through which the plurality of associated message data has passed is a storage target, based on whether the generated path information is stored in the storage unit;
When the response value of the server in the route through which the plurality of associated message data has passed is a storage target, the server response including the response value of the server in the route through which the associated plurality of message data has passed Recording the average;
The server abnormality determination method according to appendix 5, further comprising:
(Appendix 7)
When it is determined that the response value of the server in the route through which the associated message data has passed is not a storage target, partial route information indicating a partial route that is a part of the route is generated from the route information. Determining whether to store the response values of the servers in the path through which the associated message data passes based on whether the response values of the servers in the partial path are greater than a threshold value. The server abnormality determination method according to appendix 6, characterized by:
(Appendix 8)
If it is determined that the response value of the server in the path through which the plurality of associated message data has passed is a storage target, is the server response average for a predetermined period corresponding to the generated path smaller than a threshold? The method further includes the step of determining whether or not to record a server response average including the response value of the server in the path through which the plurality of associated message data passes based on The server abnormality determination method described.
(Appendix 9)
Information specifying a server, route information indicating a route including the server with respect to message data of a transaction, and an average of response values that are times from when the server sends a request message of the transaction to when a response message is received A storage unit that stores information associated with the server response average,
When the server response average exceeds a threshold, it is determined that an abnormality has occurred in the route, and an abnormality determination unit that records information identifying the server and the route information;
Server abnormality determination device (Appendix 10)
An association processing unit for associating a plurality of message data based on predetermined attributes;
The route information indicating the route through which the associated message data passes is generated from the associated message data, and the response value of the server in the route through which the associated message data has passed is calculated. A route information generator to
A storage path selection unit that determines whether the response value of the server in the path through which the plurality of associated message data has passed is a storage target based on whether the generated path information is stored in the storage unit; ,
When the response value of the server in the route through which the plurality of associated message data has passed is a storage target, the server response including the response value of the server in the route through which the associated plurality of message data has passed A statistical information management unit that records the average;
The server abnormality diagnosis device according to appendix 9, further comprising:
(Appendix 11)
When the response value of the server in the route through which the plurality of associated message data passes is determined not to be stored, the storage route selection unit selects a partial route that is a part of the route from the route information. The partial route information is generated, and based on whether the response value of the server in the partial route is larger than the threshold value, the response value of the server in the route through which the associated message data passes is stored. The server abnormality determination device according to supplementary note 10, wherein:
(Appendix 12)
When it is determined that the generated route information is a storage target, the storage route selection unit is associated based on whether the server response average for a predetermined period corresponding to the generated route is smaller than a threshold value. 11. The server abnormality determination device according to appendix 10, wherein it is determined whether to record an average server response including the response value of the server in the path through which the plurality of message data passes.

DESCRIPTION OF SYMBOLS 101 Abnormality diagnosis apparatus 102 Server 103 Capture apparatus 104 Terminal 111 Message data collection part 112 Linking part 113 Path information generation part 114 Storage path selection part 115 Statistical information management part 116 Abnormality diagnosis part 117 Storage part 201 Server table 202 Partial path ID table 203 Route ID Table 204 Learning Value Table 205 Saved Route Table 401-404 Message Data

Claims (6)

Information specifying a server, route information indicating a route including the server with respect to message data of a transaction, and an average of response values that are times from when the server sends a request message of the transaction to when a response message is received And a computer having a storage unit that stores information associated with the server response average,
When the server response average exceeds a threshold, it is determined that an abnormality has occurred in the route, and processing for recording the information for specifying the server and the route information;
Server abnormality determination program that executes A process of associating a plurality of message data based on a predetermined attribute,
The route information indicating the route through which the associated message data passes is generated from the associated message data, and the response value of the server in the route through which the associated message data has passed is calculated. Processing to
Based on whether the generated route information is stored in the storage unit, a process of determining whether the response value of the server in the route through which the associated message data passes is a storage target;
When the response value of the server in the route through which the plurality of associated message data has passed is a storage target, the server response including the response value of the server in the route through which the associated plurality of message data has passed The process of recording the average;
The server abnormality determination program according to claim 1, further comprising:   When it is determined that the response value of the server in the route through which the associated message data has passed is not a storage target, partial route information indicating a partial route that is a part of the route is generated from the route information. And further executing a process of determining whether to save the response values of the servers in the path through which the associated message data passes based on whether the response values of the servers in the partial path are greater than a threshold value The server abnormality determination program according to claim 2, wherein:   If it is determined that the generated route information is a storage target, the associated message data passes based on whether the server response average for a predetermined period corresponding to the generated route is smaller than a threshold value. The server abnormality determination program according to claim 2 or 3, further comprising a process of determining whether to record a server response average including the response value of the server in the route. Information identifying the server to the computer, route information indicating the route including the server for transaction message data, and a response value that is a time from when the server sends a request message for the transaction to when a response message is received. Storing information associated with an average server response average;
Determining whether the server response average exceeds a threshold, and if exceeding, recording the information identifying the server and the route information;
Server failure determination method for executing Information specifying a server, route information indicating a route including the server with respect to message data of a transaction, and an average of response values that are times from when the server sends a request message of the transaction to when a response message is received A storage unit that stores information associated with the server response average,
When the server response average exceeds a threshold, it is determined that an abnormality has occurred in the route, and an abnormality determination unit that records information identifying the server and the route information;
A server abnormality determination device comprising:

Images