JP2012053680A - Monitoring processing system, monitoring processing method and monitoring processing program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a monitoring processing system, a monitoring processing method and a monitoring processing program for efficiently notifying an appropriate person in charge of failure occurred in a monitoring object system.SOLUTION: A control unit 21 of an integrated monitoring system 20 acquires a monitoring object message from a monitoring object system 10. In this case, the control unit 21 identifies a machine ID and a message ID of the monitoring object message, and acquires pattern management information. Then, the control unit 21 creates a patterned message by using the pattern management information. Next, the control unit 21 creates a notification destination determining code by using the patterned message, and registers notification destination determining information. Then, the control unit 21 specifies a notification destination code based on the notification destination determining code, and executes notification processing.

Description

  The present invention relates to a monitoring processing system, a monitoring processing method, and a monitoring processing program for efficiently notifying an appropriate person in charge of a failure that occurs in a monitoring target system such as a host computer or a server.

  Conventionally, the operating state of a system used for operation is monitored for reliable business operation. When the occurrence of a failure is detected in such monitoring, the person in charge is notified to perform recovery work. Therefore, a technique is disclosed in which when a failure occurs, notifications are sequentially made to a plurality of managers (see, for example, Patent Document 1). In the invention described in Patent Document 1, the alert notification order is determined based on the management authority of each administrator. When the alert notification system detects that an event that should notify the application of an alert has occurred, the alert notification system notifies the administrator who has a predetermined management authority among the managers of the application. If the administrator who has received the alert notification cannot respond, the alert is notified to the next administrator in the order of notification.

  In addition, a failure notification system for efficiently reporting a failure of a monitoring target device and reducing complexity has been studied (for example, see Patent Document 2). In the failure notification system described in this document, when a failure in a monitored device is detected, a notification group is specified using a failure event data storage unit. If the notification management process is in progress or has been confirmed in this notification group, only the failure is recorded. On the other hand, if the notification management process is not in progress and has not been confirmed, new notification data is recorded and a new notification is made.

Japanese Patent Laying-Open No. 2005-250760 (first page, FIG. 10) JP 2007-264907 A (first page, FIG. 1)

  Various services may be operated using a plurality of systems. Then, the operating status of the system is grasped by various messages output from each system, and the person in charge of each system is notified when an abnormality occurs. In this case, the person in charge of management may differ depending on the hardware and software constituting each system.

  However, the types of hardware and software of each monitored system may be the same, and the person to be notified should be determined based on the contents of various fault messages output from the system. It is difficult. In particular, when the person in charge of each system is determined manually and a system abnormality is notified to each person in charge, the burden of the determination work and the notification work increases.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a monitoring processing system and a monitoring processing method for efficiently notifying an appropriate person in charge of a failure that has occurred in a monitoring target system. And providing a monitoring processing program.

In order to solve the above problem, the invention described in claim 1 is characterized in that a pattern information storage means for storing pattern management information including a message section in association with a transmission source identifier and a message identifier of a monitoring target system, and a message section A classification information storage unit that stores an item for generating a notification destination determination identifier, a notification destination information storage unit that stores information for specifying a notification destination in association with the notification destination determination identifier, and a monitor. A monitoring processing system including a control unit connected to the target system, wherein the control unit acquires a monitoring target message including a message identifier from the monitoring target system, and the monitoring target that has transmitted the monitoring target message Using the transmission source identifier and message identifier of the system, the pattern information storage means Using the means for generating a patterned message based on the pattern management information and the classification information storage means, the item associated with the message classification is specified in the patterned message. And a means for generating a notification destination determination identifier using the contents of the specified item, and a means for notifying the notification destination associated with the notification destination determination identifier in the notification destination information storage means. To do.

  According to a second aspect of the present invention, in the monitoring processing system according to the first aspect, the category information storage means further stores a corresponding category for determining a method corresponding to the monitored message in association with the message category. The control means specifies a correspondence category associated with the message category acquired based on the received monitoring target message, sets the correspondence category in the pattern message, and according to the correspondence category The gist of the invention is that it further includes means for specifying a transmission method.

  According to a third aspect of the present invention, in the monitoring processing system according to the first or second aspect, when the control unit cannot extract the message identifier of the monitoring target message in the pattern information storage unit, the transmission source identifier Means for recording the output history of the monitoring target message including this message identifier, and when the output count exceeds the reference count in the output history, the pattern management information The gist of the invention is that it further comprises means for instructing registration.

  According to a fourth aspect of the present invention, in the monitoring processing system according to any one of the first to third aspects, the control unit cannot extract the message identifier of the monitoring target message in the pattern information storage unit. The method further comprises means for specifying a message category associated with another message identifier having a common source identifier and similar to the message identifier, and generating a notification destination judgment identifier using the specified message category. And

  According to a fifth aspect of the present invention, in the monitoring processing system according to any one of the first to fourth aspects, the control means records an output history for each source identifier and message identifier, and the output history The gist of the present invention is that it further includes means for outputting an alarm for encouraging the subdivision of the notification destination when the output count exceeds the reference count.

According to the sixth aspect of the present invention, pattern information storage means for storing pattern management information including a message section in association with the transmission source identifier and message identifier of the monitoring target system, and a notification destination determination identifier in association with the message section. A classification information storage unit that stores items for generation; a notification destination information storage unit that stores information for specifying a notification destination in association with a notification destination determination identifier; and a control unit that is connected to the monitoring target system. A method for executing a monitoring process using a monitoring processing system comprising: a step in which the control means acquires a monitoring target message including a message identifier from the monitoring target system; and a monitoring that transmits the monitoring target message Using the transmission source identifier and message identifier of the target system, the pattern information storage means Obtaining pattern management information including a section, generating a patterned message based on the pattern management information, and identifying the item associated with the message section using the section information storage means; The gist is to execute a step of generating a notification destination determination identifier using the contents of the item and a step of notifying the notification destination associated with the notification destination determination identifier in the notification destination information storage means.

  According to the seventh aspect of the present invention, there is provided pattern information storage means for storing pattern management information including a message section in association with a transmission source identifier and a message identifier of a monitoring target system, and a notification destination determination identifier in association with a message section. A classification information storage unit that stores items for generation; a notification destination information storage unit that stores information for specifying a notification destination in association with a notification destination determination identifier; and a control unit that is connected to the monitoring target system. A program for executing a monitoring process using a monitoring processing system comprising: the control means, means for acquiring a monitoring target message including a message identifier from the monitoring target system, and transmitting the monitoring target message Using the transmission source identifier and message identifier of the monitoring target system, from the pattern information storage means The pattern management information including the message classification is obtained, and the item associated with the message classification is identified by using the classification information storage means, the means for generating the patterned message based on the pattern management information, and the identified The gist is to function as means for generating a notification destination determination identifier using the contents of an item, and means for notifying a notification destination associated with the notification destination determination identifier in the notification destination information storage means.

(Function)
According to the first, sixth, and seventh aspects of the present invention, the control means specifies the transmission source identifier of the monitoring target system that has transmitted the monitoring target message, and uses this transmission source identifier and the message identifier to store the pattern information. The pattern management information including the message classification is acquired from the means, and the patterned message is generated based on the pattern management information. As a result, messages acquired from various monitored systems can be standardized and handled in a unified manner. Further, based on the message classification, the item for generating the notification destination determination identifier is specified in the patterned message from the classification information storage means, and the notification destination determination identifier is generated using the contents of the specified item, and the notification is performed. Notification is made to the notification destination associated with the notification destination determination identifier in the destination information storage means. Thereby, various messages provided from various monitored systems can be notified to an appropriate person in charge.

  According to the invention described in claim 2, the control means specifies the correspondence category associated with the message category acquired based on the received monitoring target message, sets the correspondence category in the patterned message, The transmission method is specified according to this correspondence category. Thereby, the notification timing can be changed according to the status of the monitoring target system.

  According to the invention described in claim 3, when the control unit cannot extract the message identifier of the monitoring target message in the pattern information storage unit, the control unit notifies the default notification destination associated with the transmission source identifier, The output history of the monitoring target message including this message identifier is recorded. If the number of outputs exceeds the reference number in the output history, registration of pattern management information is instructed. Thereby, when the number of output times of the message is large, the notification destination is automatically specified, and the load on the person in charge of the default notification destination can be reduced.

  According to the fourth aspect of the present invention, when the control unit cannot extract the message identifier of the monitoring target message, the message classification associated with the other message identifiers having the same transmission source identifier and similar message identifiers. Is identified. Thereby, even when the message identifier is not registered, it is possible to specify a likely notification destination.

According to the invention described in claim 5, the control means records an output history for each transmission source identifier and message identifier, and outputs an alarm when the number of outputs exceeds the reference number in the output history. Thereby, when the output frequency of the message is high, the burden on each person in charge can be reduced by distributing the persons in charge corresponding to each message.

  According to the present invention, it is possible to provide a monitoring processing system, a monitoring processing method, and a monitoring processing program for efficiently notifying an appropriate person in charge of a failure that has occurred in a monitoring target system.

The system schematic of embodiment of this invention. It is explanatory drawing of the data recorded on each memory | storage part of embodiment of this invention, Comprising: (a) is a reception management information storage part, (b) is a pattern management information storage part, (c) is key division management information storage. (D) is a notification destination determination information storage unit, and (e) is an explanatory diagram of data recorded in the notification destination management information storage unit. Explanatory drawing of the process sequence of embodiment of this invention. Explanatory drawing of the process sequence of embodiment of this invention. Explanatory drawing of the message of embodiment of this invention. Explanatory drawing of the message of embodiment of this invention. Explanatory drawing of the process sequence of other embodiment. Explanatory drawing of the process sequence of other embodiment. Explanatory drawing of the process sequence of other embodiment.

  Hereinafter, an embodiment of a monitoring processing system embodying the present invention will be described with reference to FIGS. In the present embodiment, as shown in FIG. 1, it is assumed that a plurality of monitoring target systems 10 are used for business operation. In order to monitor the operating state of these monitoring target systems 10, an integrated monitoring system 20 as a monitoring processing system is used.

  The monitoring target system 10 is composed of a host computer or the like for operating business, and transmits a message to the integrated monitoring system 20. In the present embodiment, each monitoring target system 10 is individually connected to each communication port of the integrated monitoring system 20. The integrated monitoring system 20 can identify the monitoring target system 10 that has transmitted the message based on the communication port that has received the monitoring target message.

  The monitoring target system 10 includes a message transmission unit 11, a job log storage unit 12, and an unfinished availability determination information storage unit 13. As will be described later, the message transmission unit 11 executes an abend job search process, an unfinished availability determination process, a message addition process, and a message registration process.

  The job log storage unit 12 records a log file that is an execution history of a completed job. In the job log storage unit 12, a history when the job ends normally and a history when the job ends abnormally are recorded as the job execution history. The log file includes a record in which control parameters are recorded. In this job control parameter, a flag is recorded for determining a response method (unsuccessful or unsuccessful) when a job ends abnormally. Here, the “unfinished impossible” flag indicates that the job should be dealt with promptly. On the other hand, the “unfinished” flag indicates that the job can be handled collectively (for example, the next business day) later.

In the incomplete / impossible determination information storage unit 13, a condition for determining whether or not incomplete is determined is recorded. Specifically, determination target characters included in a record in which job control parameters are recorded are recorded. Furthermore, a flag for determining “not ready” or “not ready” is recorded in accordance with the position (column) where the determination target character is detected.

Each monitored system 10 is connected to the integrated monitoring system 20 via a network.
The integrated monitoring system 20 monitors the operating state of each monitored system 10 and notifies the person in charge of each monitored system 10 of the situation when a failure occurs.

  The integrated monitoring system 20 includes a control unit 21, a reception management information storage unit 22, a pattern management information storage unit 23, a key category management information storage unit 24, a notification destination determination information storage unit 25, a notification destination management information storage unit 26, a notification An information storage unit 27 is provided.

  The control unit 21 includes control means including a CPU, a RAM, a ROM (not shown), and the like, and includes processes (message acquisition stage, patterning stage, notification destination specifying stage, notification stage, etc.) to be described later. ). By executing the monitoring processing program for this purpose, the control unit 21 functions as a message acquisition unit 211, a patterning unit 212, a notification destination specifying unit 213, and a notification unit 214.

  The message acquisition unit 211 executes processing for acquiring a monitoring target message from the monitoring target system 10 via the network. The message acquisition unit 211 holds a machine identification table that stores the machine ID of each monitoring target system 10 in association with the communication port connected to each monitoring target system 10.

  The patterning unit 212 performs processing for patterning information included in the monitoring target message acquired from the monitoring target system 10 and information acquired based on the monitoring target message using a predetermined format. In the present embodiment, the patterning unit 212 uses each data area for storing a message ID, message text, machine ID, product name, alert type, severity, message key classification, and message word as a format for patterning. Preserves the format provided.

The notification destination specifying unit 213 executes processing for creating a notification destination determination code based on the patterned message. Then, the notification destination specifying unit 213 specifies a notification destination code corresponding to the notification destination determination code using a notification destination management information storage unit 26 described later.
The notification unit 214 performs processing for notifying each person in charge of a message based on the notification destination code.

  In the reception management information storage unit 22, as shown in FIG. 2A, a reception management record 220 for a message received from each monitored system 10 is recorded. The reception management record 220 is recorded when a message is received from each monitoring target system 10. The reception management record 220 includes data related to reception date / time, machine ID, and reception message.

In the reception date / time data area, data related to the date / time (year / month / day, time) at which a message is received from each monitored system 10 is recorded.
In the machine ID data area, data relating to an identifier (transmission source identifier) for specifying the monitoring target system 10 that has transmitted the message is recorded. In this embodiment, the machine ID corresponding to the communication port that has received the monitoring target message is recorded.
In the received message data area, data related to the content of the monitoring target message received from the monitoring target system 10 is recorded.

The pattern management information storage unit 23 functions as a pattern information storage unit. As shown in FIG. 2B, the pattern management information storage unit 23 records a pattern management record 230 for converting a message received from each monitoring target system 10 into a predetermined pattern. This pattern management record 230 is recorded when the severity and message key classification for a message transmitted in each monitored system 10 are determined and registered. The pattern management record 230 includes data related to a machine ID, message ID, product name, alert type, severity, and message key classification.

In the machine ID data area, data relating to an identifier (transmission source identifier) for specifying the monitoring target system 10 that transmits the message is recorded.
In the message ID data area, data relating to an identifier (message identifier) for specifying the failure content or the like in a message transmitted in the monitoring target system 10 is recorded. In this embodiment, a character string composed of an essential character string and an arbitrary character string included in the message ID is recorded. Using this essential character string, message IDs similar to each other can be specified.

In the product name data area, data relating to an identifier for identifying the product in which the monitoring target message has occurred is recorded corresponding to the message ID.
In the alert type data area, data relating to an identifier for identifying the type of failure or the like is recorded corresponding to the message ID.

In the severity data area, data relating to an identifier for specifying the magnitude of the influence of the failure or the like is recorded.
In the message key classification data area, data relating to an identifier for specifying a pattern for creating a notification destination determination code is recorded. With this notification destination determination code, it is possible to specify the notification destination that notifies the message received from the monitoring target system 10.

  The key category management information storage unit 24 functions as a category information storage unit. In the key category management information storage unit 24, as shown in FIG. 2C, a key category management record 240 for specifying a pattern for creating a notification destination determination code is recorded. This key category management record 240 is recorded when a pattern for creating a notification destination determination code is registered. The key category management record 240 includes data related to a message key category, a notification destination judgment pattern, and a correspondence category.

In the message key classification data area, data relating to an identifier for specifying a pattern for creating a notification destination determination code is recorded.
In the notification destination determination pattern data area, data relating to a method of generating a notification destination determination code is recorded. In this embodiment, parameters included in a message received from the monitoring target system 10, predetermined parameters, and the like are registered as notification destination determination patterns. As the notification destination determination pattern, various combinations such as “product name”, “product name + machine ID”, “message ID + machine ID”, and the like are registered.

  Data relating to an identifier for specifying a method corresponding to each monitoring target message is recorded in the correspondence classification data area. The timing for notifying each person in charge can be determined by this correspondence category. When the severity of the failure is high, “immediate” is set, and when the severity is low, “operator response”, “reaction response”, and the like are set.

The notification destination determination information storage unit 25 functions as a notification destination information storage unit. In the notification destination determination information storage unit 25, a notification destination determination record 250 for notifying a message is recorded as shown in FIG. The notification destination determination record 250 is stored in each monitoring target system 10.
This message is recorded when a message is acquired from and a notification destination is determined. The notification destination determination record 250 includes data regarding a message number, reception date / time, message ID, message text, machine ID, product name, alert type, severity, message key classification, correspondence classification, and notification destination determination code. .

In the message number data area, data relating to an identifier for specifying each notification transmitted to each person in charge is recorded.
In the reception date / time data area, data related to the date / time (year / month / day, time) when the monitoring target message is received from each monitoring target system 10 is recorded.

In the message ID data area, data related to the message ID included in the monitoring target message received from the monitoring target system 10 is recorded.
In the message text data area, data obtained by combining the texts of the respective items included in the monitoring target message received from the monitoring target system 10 is recorded.

In the machine ID data area, data relating to an identifier for specifying the monitoring target system 10 that has transmitted the monitoring target message is recorded.
Data relating to each identifier extracted from the pattern management record 230 is recorded in each data area of product name to severity.

In the message key category data area, data related to the message key category when the notification destination is specified is recorded.
In the corresponding category data area, data relating to an identifier for identifying the corresponding category extracted from the key category management record 240 is recorded.
In the notification destination determination code data area, data relating to an identifier (notification destination determination identifier) for specifying the notification destination code of the message is recorded.

  As shown in FIG. 2E, the notification destination management information storage unit 26 stores a notification destination management record 260 for specifying the notification destination. This notification destination management record 260 is recorded when a notification destination code corresponding to each notification destination determination code is registered. The notification destination management record 260 includes data regarding a notification destination determination code and a notification destination code.

In the notification destination determination code data area, data related to the notification destination determination code created based on the message key classification is recorded.
In the notification destination code data area, data relating to an identifier for specifying a notification destination of a message is recorded. In the integrated monitoring system 20, the name and contact information (for example, e-mail address) of the person in charge of the notification (for example, the person in charge of the monitoring target system or the administrator) is recorded for this notification destination code. It is connected to a previous information storage unit (not shown). By using the notification destination code, the person-in-charge information (name and contact information) can be obtained from the contact information storage unit.

  The notification information storage unit 27 stores notification information about a message to be notified to each notification destination. This notification information is recorded when the notification destination of the message is determined. The notification information includes data related to a message number, product name, machine ID, message text, correspondence category, and notification destination code.

In the message number data area, data relating to an identifier for specifying a notification to each person in charge is recorded.
In the product name data area, data relating to the product name specified using the pattern management record 230 is recorded.

In the machine ID data area, data relating to an identifier for specifying the monitoring target system 10 that has transmitted the monitoring target message is recorded.
In the message text data area, data obtained by combining the texts of the respective items included in the received monitoring target message is recorded.

In the corresponding category data area, data relating to the corresponding category identified using the key category management record 240 is recorded.
In the notification destination code data area, data related to the notification destination code specified using the notification destination management record 260 based on the notification destination determination code is recorded.

  The integrated monitoring system 20 is connected to a plurality of person-in-charge terminals (not shown) via a network. This person-in-charge terminal is a terminal used by a person in charge who deals with a failure. In the present embodiment, a computer terminal used by a person in charge corresponding to a failure is used as the person-in-charge terminal.

Next, a processing procedure of the integrated monitoring system 20 when a failure occurs in the system configured as described above will be described with reference to FIGS.
(Notification processing in the monitored system 10)
First, the notification process in the monitoring target system 10 will be described with reference to FIG.
The monitoring target system 10 records a log file in the job log storage unit 12 when the job is completed.

  Then, the message transmission unit 11 of the monitoring target system 10 executes an abend job search process in the job log indicating the job execution history (step S1-1). Specifically, the message transmission unit 11 searches the log file recorded in the job log storage unit 12 for an abend job log file indicating abnormal termination. When an abend job log file is detected, the message transmission unit 11 generates a monitoring target message for notifying a failure. The monitoring target message includes a message ID for specifying the failure content.

  Next, the message transmission unit 11 of the monitoring target system 10 executes the process for specifying the incomplete / unavailable information in the job control parameter of the abend job (step S1-2). Specifically, the message transmission unit 11 extracts a record in which the job control parameter is recorded in the log file of the abend job, and among the records, the determination target character recorded in the incomplete / impossibility determination information storage unit 13 Search for. When the determination target character can be detected, the message transmission unit 11 identifies the position (column) where the determination target character is detected.

  Next, the message transmission unit 11 of the monitoring target system 10 determines “unsatisfied” and “unsatisfied” using the job control parameter, and executes message addition processing based on this determination (step S1-). 3). Specifically, the message transmission unit 11 acquires one of the “uncompleted / unavailable” flag and the “uncompleted / unavailable” flag recorded in the uncompleted / unavailable determination information storage unit 13 based on the position where the determination target character is detected. To do. Then, the message transmission unit 11 adds information indicating “not ready” and “not ready” to the monitoring target message based on the acquired flag.

  Next, the message transmission unit 11 of the monitoring target system 10 executes a message output process (step S1-4). Specifically, the message transmission unit 11 transmits the monitoring target message to the integrated monitoring system 20 via the network.

(Notification management processing in the integrated monitoring system 20)
Next, notification management processing in the integrated monitoring system 20 will be described with reference to FIGS.
The control unit 21 of the integrated monitoring system 20 executes monitoring target message acquisition processing (step S2-1). Specifically, the message acquisition unit 211 of the control unit 21 acquires a monitoring target message from the monitoring target system 10 via the network. The monitoring target message includes a message ID and information for determining whether or not the message has been completed. Here, for example, it is assumed that the message 500 shown in FIG. 5 is transmitted. The message body includes information for specifying “unpaid” or “unpaid”. The message acquisition unit 211 generates a reception management record 220 in which the reception time and the monitoring target message are recorded in the reception time data area and the reception message data area, respectively, and records the reception management record 220 in the reception management information storage unit 22.

  Next, the control unit 21 of the integrated monitoring system 20 executes a transmission source specifying process (step S2-2). Specifically, the message acquisition unit 211 of the control unit 21 specifies the transmission source monitoring target system 10 by extracting the machine ID corresponding to the communication port that has received the monitoring target message from the machine specification table. The message acquisition unit 211 records the machine ID in the reception management record 220. Note that a machine ID for specifying the transmission source may be included in the monitoring target message, and the monitoring target system 10 may be specified by this machine ID.

  Next, the control unit 21 of the integrated monitoring system 20 executes a search process for a record in which the transmission source identifier and the message identifier are recorded (step S2-3). Specifically, the patterning unit 212 of the control unit 21 extracts a pattern management record 230 in which the machine ID of the monitoring target system 10 that has transmitted the monitoring target message is recorded in the pattern management information storage unit 23. Then, the patterning unit 212 identifies the pattern management record 230 in which the message ID included in the monitoring target message and the message ID whose essential characters match are recorded from the extracted pattern management record 230.

  Next, the control unit 21 of the integrated monitoring system 20 acquires pattern management information (step S2-4). Specifically, the patterning unit 212 of the control unit 21 acquires the product name, alert type, severity, and message key classification recorded in the pattern management record 230 extracted from the pattern management information storage unit 23. Here, for example, the extraction information 501 shown in FIG. 5 is acquired.

  Next, the control unit 21 of the integrated monitoring system 20 executes message text generation processing (step S2-5). Specifically, the patterning unit 212 of the control unit 21 generates a message text by combining the texts of the items included in the received monitoring target message. Here, the message text 502 shown in FIG. 5 is generated.

Next, the control unit 21 of the integrated monitoring system 20 executes a patterned message creation process (step S2-6). Specifically, the patterning unit 212 of the control unit 21 acquires a parameter value to be included in the patterned message. In this embodiment, the values of parameters (here, message ID, machine ID, product name, alert type, severity, message key classification) included in the patterning format are acquired. Here, the machine ID of the monitoring target system 10 that transmitted the message is used as the machine ID. For the product name, alert type, severity, and message key classification, values recorded in the extracted pattern management record 230 are used. Then, the patterning unit 212 creates the patterned message by inserting the acquired parameter value and message text into the patterning format. Here, as shown in FIG. 5, a message 503 is generated. Further, the patterning means 212 breaks the message text into words, generates a message word combined through a space, and combines this message word with the patterned message. In this case, the message 504 shown in FIG. 5 is generated.

  Next, the control unit 21 of the integrated monitoring system 20 executes a notification destination determination code creation process (step S2-7). Specifically, the notification destination specifying unit 213 of the control unit 21 extracts the key category management record 240 in which the message key category included in the patterned message is recorded from the key category management information storage unit 24. Here, for example, as illustrated in FIG. 5, the extraction information 505 including the notification destination determination pattern and the correspondence classification is extracted. Then, the notification destination specifying unit 213 combines this correspondence category with the patterned message. In this case, the message 510 shown in FIG. 6 is generated. Then, the notification destination specifying unit 213 specifies a parameter set in the notification destination determination pattern recorded in the key classification management record 240, and acquires the parameter value from the patterned message. The notification destination specifying unit 213 combines the parameter values to create a notification destination determination code.

  Next, the control unit 21 of the integrated monitoring system 20 executes registration processing of notification destination determination information (step S2-8). Specifically, the notification destination specifying unit 213 of the control unit 21 assigns a message number. The notification destination specifying unit 213 then determines the notification destination including the message number, the reception date and time, the message ID, the message text, the machine ID, the product name, the alert type, the severity, the message key classification, the correspondence classification, and the notification destination determination code. A record 250 is created. Here, for example, a message 511 shown in FIG. 6 is created. The notification destination specifying unit 213 records the notification destination determination record 250 including the created message in the notification destination determination information storage unit 25.

  Next, the control unit 21 of the integrated monitoring system 20 executes notification destination code identification processing based on the notification destination determination code (step S2-9). Specifically, the notification destination specifying unit 213 of the control unit 21 extracts the notification destination management record 260 in which the notification destination determination code is recorded from the notification destination management information storage unit 26. Then, the notification destination specifying unit 213 uses the extracted notification destination management record 260 to specify the notification destination code. Further, the notification destination specifying unit 213 generates notification information including a message number, a product name, a machine ID, a message text, a correspondence classification, and a notification destination code, and records the notification information in the notification information storage unit 27. Here, the notification information 512 shown in FIG. 6 is recorded.

  Next, the control unit 21 of the integrated monitoring system 20 executes notification processing (step S2-10). Specifically, the notification unit 214 of the control unit 21 periodically accesses the notification information storage unit 27 and extracts the notification information from the notification information storage unit 27. Then, the notification unit 214 determines the timing for notification based on the correspondence classification stored in the notification information. Specifically, notification information that is “immediately” is promptly transmitted. On the other hand, notification information that is not “immediate” is transmitted at a predetermined time. In this case, the notification unit 214 acquires a notification destination corresponding to the notification destination code from the contact information storage unit, and transmits the notification information to each notification destination.

According to the monitoring processing system of the present embodiment, the following effects can be obtained.
(1) In the above-described embodiment, the message transmission unit 11 of the monitoring target system 10 executes the process for specifying the unsuccessful / impossible information in the job control parameter of the abend job (step S1-2). Then, the message transmission unit 11 of the monitoring target system 10 determines “unsatisfied” and “unsatisfied” according to the end status and type of the job, and executes message addition processing based on this determination (step S1). S1-3). As a result, the person in charge who has acquired the message can determine whether or not the job has been completed.

(2) In the above embodiment, the control unit 21 of the integrated monitoring system 20 executes a message text generation process (step S2-5) and a patterned message creation process (step S2-6). As a result, even when various messages are acquired from the various monitoring target systems 10, they can be standardized in the same format.

  And the control part 21 of the integrated monitoring system 20 performs the preparation process of a notification destination judgment code (step S2-7). Thereby, even when a message having the same message ID is acquired from a plurality of monitoring target systems 10, it is possible to notify an appropriate person in charge according to the usage status of each monitoring target system 10. Furthermore, since the timing of notification is specified by the correspondence classification, notification can be performed at an appropriate timing according to the severity of the failure or the like according to the operating status of each monitored system 10.

<Second Embodiment>
In the first embodiment, the control unit 21 of the integrated monitoring system 20 executes a search process for a record in which a transmission source identifier and a message identifier are recorded (step S2-3). In the notification management process of the first embodiment, the second embodiment responds to the operator who manages the monitoring target system 10 when the pattern management record 230 in which the transmission source identifier and the message identifier are recorded cannot be detected. The detailed configuration of the same part is omitted.

  Here, registration of the pattern management information is prompted according to the message generation status. For this purpose, the control unit 21 includes a notification destination management unit and an unregistered pattern storage unit for urging registration of pattern management information. The notification destination management means holds data relating to the reference number for determining whether pattern management information needs to be registered.

In the unregistered pattern storage unit, an unregistered pattern record in which the message output count is recorded is registered in association with the machine ID and the message ID.
Further, in the pattern management information storage unit 23, a default notification destination (for example, a contact address of the operator of the monitoring target system) is registered in association with the machine ID. The processing of this embodiment will be described with reference to FIG.

  First, similarly to steps S2-1 to S2-3, the control unit 21 of the integrated monitoring system 20 retrieves a monitoring target message (step S3-1) to search for a record in which a transmission source identifier and a message identifier are recorded. The process (step S3-3) is executed.

  Next, the control part 21 of the integrated monitoring system 20 performs the determination process about whether the applicable record is registered (step S3-4). Specifically, the determination is made based on the extraction of the pattern management record in which the machine ID and the message ID included in the monitoring target message are recorded.

  When the corresponding record can be extracted (in the case of “YES” in step S3-4), the control unit 21 of the integrated monitoring system 20 acquires pattern management information (steps S2-4 to S2-10). Steps S3-5) to notification processing (step S3-11) are executed.

On the other hand, when the corresponding record cannot be extracted (in the case of “NO” in step S3-4), the control unit 21 of the integrated monitoring system 20 executes a determination process as to whether or not the output count is greater than or equal to the reference count ( Step S3-12). Specifically, the notification destination management unit of the control unit 21 searches the unregistered pattern storage unit for an unregistered pattern record in which the machine ID and the message ID are recorded for a message for which the notification destination could not be specified. If an unregistered pattern record has already been detected, the notification destination management means adds “1” to the output count of this unregistered pattern record. On the other hand, when the unregistered pattern record cannot be detected, the notification destination management unit generates an unregistered pattern record in which the machine ID and the message ID are recorded, and records the unregistered pattern record in the unregistered pattern storage unit. In this case, “1” is set as the number of outputs. Then, the notification destination management means compares the number of outputs recorded in the unregistered pattern record with the reference number.

  When the output count is equal to or greater than the reference count (“YES” in step S3-12), the control unit 21 of the integrated monitoring system 20 executes pattern management information registration request processing (step S3-13). Specifically, the notification destination management means of the control unit 21 outputs an alarm prompting the operator terminal to register the pattern management record 230 for the machine ID and message ID. In this case, the operator determines the product name, alert type, severity, and message key classification for the machine ID and message ID. Then, a new pattern management record 230 in which the product name, alert type, severity, and message key classification are recorded for the machine ID and message ID is registered in the pattern management information storage unit 23.

  On the other hand, when the output count is less than the reference count (in the case of “NO” in step S3-12), the control unit 21 of the integrated monitoring system 20 skips the pattern management information registration request process (step S3-13). .

  Next, the control part 21 of the integrated monitoring system 20 performs an operator notification process (step S3-14). Specifically, the notification destination specifying unit 213 of the control unit 21 notifies the operator terminal that is the default notification destination that the notification destination could not be specified. In this case, the operator confirms the monitoring target message and notifies a predetermined person in charge.

According to the monitoring processing system of this embodiment, in addition to the effects (1) and (2), the following effects can be obtained.
(3) In the above embodiment, the control unit 21 of the integrated monitoring system 20 executes a determination process as to whether or not the output count is equal to or greater than the reference count (step S3-12). If the number of outputs is equal to or greater than the reference number (if “YES” in step S3-12), the control unit 21 of the integrated monitoring system 20 executes a pattern management information registration request process (step S3-13). . Thereby, even if the pattern management records 230 for all the messages are not registered in advance, the pattern management records 230 can be newly accumulated according to the frequency of the received message.

<Third Embodiment>
In the second embodiment, when the pattern management record 230 in which the transmission source identifier and the message identifier are recorded cannot be detected, the operator who manages the monitoring target system 10 is prompted to respond. In the third embodiment, a message similar to the message identifier included in the monitoring target message when the pattern management record 230 in which the transmission source identifier and the message identifier are recorded cannot be detected in the notification management processing in the second embodiment. The configuration is such that the notification destination is specified based on the identifier, and detailed description of similar parts is omitted. The processing of this embodiment will be described with reference to FIG.

  Similar to steps S3-1 to S3-4, the control unit 21 of the integrated monitoring system 20 executes a monitoring target message acquisition process (step S4-1) to a determination process on whether or not the corresponding record is registered (steps). S4-4).

  When the corresponding record can be extracted (in the case of “YES” in step S4-4), the control unit 21 of the integrated monitoring system 20 acquires pattern management information (steps S3-5 to S3-11). Steps S4-5) to notification processing (step S4-11) are executed.

  On the other hand, if the corresponding record could not be extracted (in the case of “NO” in step S4-4), the control unit 21 of the integrated monitoring system 20 next executes a search process for similar pattern management records ( Step S4-12). Specifically, the notification destination specifying unit 213 of the control unit 21 specifies the pattern management record 230 that is common to the machine ID of the monitoring target system 10 that has transmitted the monitoring target message. Next, the notification destination specifying unit 213 searches the pattern management record 230 in which the message ID included in the monitoring target message has a common character string equal to or larger than the reference number and the message ID having the largest number of common characters is recorded. To do.

  Next, the control part 21 of the integrated monitoring system 20 performs the determination process about whether there exists similar registration (step S4-13). Specifically, the notification destination specifying unit 213 has a pattern management record 230 in which the message IDs included in the monitoring target message have a common character string equal to or larger than the reference number and a message ID having the largest number of common characters. Can be extracted, it is determined that there is similar registration.

  When there is similar registration (in the case of “YES” in step S4-13), the control unit 21 of the integrated monitoring system 20 executes pattern management information registration request processing in the same manner as in step S3-13 (step S4-). 14). And the control part 21 of the integrated monitoring system 20 performs acquisition (step S4-5)-notification process (step S4-11) of pattern management information.

  On the other hand, when there is no similar registration (in the case of “NO” in step S4-13), the control unit 21 of the integrated monitoring system 20 executes an operator notification process in the same manner as in step S3-14 (step S4-15). .

According to the monitoring processing system of this embodiment, in addition to the effects (1), (2), and (3), the following effects can be obtained.
(4) In the above embodiment, when the corresponding record cannot be extracted (in the case of “NO” in step S4-4), the control unit 21 of the integrated monitoring system 20 performs a similar pattern management record search process. Execute (Step S4-12). When there is similar registration (in the case of “YES” in step S4-13), the control unit 21 of the integrated monitoring system 20 acquires pattern management information (step S4-14) following the pattern management information registration request processing (step S4-14). Steps S4-5) to notification processing (step S4-11) are executed. Thereby, even when the pattern management record 230 for the machine ID and the message ID is not registered, the notification destination can be specified using a similar message ID.

<Fourth Embodiment>
In the first embodiment, the control unit 21 of the integrated monitoring system 20 executes a search process for a record in which a transmission source identifier and a message identifier are recorded (step S2-3). In the notification management process of the first embodiment, the fourth embodiment is configured to prompt the review of the notification destination when the frequency of occurrence of a specific monitoring target message is high. Description is omitted. Here, the control unit 21 is provided with notification destination management means for prompting the review of the notification destination. This notification destination management means holds data relating to the evaluation target period for calculating the frequency of occurrence of messages and data relating to the reference count for determining whether or not the pattern management information needs to be subdivided. The processing of this embodiment will be described with reference to FIG.

  First, similarly to steps S2-1 to S2-3, the control unit 21 of the integrated monitoring system 20 retrieves a monitoring target message (step S5-1) to search for a record in which a transmission source identifier and a message identifier are recorded. The process (step S5-3) is executed.

  Next, the control part 21 of the integrated monitoring system 20 performs the acquisition process of the frequency of the same pattern (step S5-4). Specifically, the notification destination management means of the control unit 21 receives from the reception management information storage unit 22 a reception management record 220 in which the same pattern (here, machine ID, message ID) is recorded in the latest evaluation target period. To extract. Then, the notification destination management means calculates the frequency of occurrence of messages with the same pattern by counting the number of extracted reception management records 220.

  Next, the control part 21 of the integrated monitoring system 20 performs the determination process about whether it is more than reference | standard frequency (step S5-5). Specifically, the notification destination management unit of the control unit 21 compares the occurrence frequency of the same pattern message with the reference number.

  Here, when the occurrence frequency is equal to or greater than the reference number (in the case of “YES” in step S5-5), the control unit 21 of the integrated monitoring system 20 executes a request process for subdividing confirmation of the notification destination code (step S5). -6). Specifically, the notification destination management means of the control unit 21 notifies the operator terminal of a request for confirming that the frequency of occurrence of this pattern is high and the necessity for subdivision of the notification destination code. In this case, the operator reviews the notification destination in consideration of the burden on the person in charge of the notification destination according to the content of the message. When the burden on the person in charge is large, the pattern management record 230 recorded in the pattern management information storage unit 23 and the notification destination management record 260 recorded in the notification destination management information storage unit 26 so as to distribute the notification destinations. To change.

  Then, the control unit 21 of the integrated monitoring system 20 acquires the pattern management information (step S5-7) to the notification process (steps), similarly to steps S2-4 to S2-10. S5-13) is executed.

According to the monitoring processing system of this embodiment, in addition to the effects (1) to (4), the following effects can be obtained.
(5) In the above-described embodiment, the control unit 21 of the integrated monitoring system 20 performs a determination process as to whether or not the reference number is exceeded (step S5-5). Here, when the number is equal to or greater than the reference number (in the case of “YES” in step S5-5), the control unit 21 of the integrated monitoring system 20 executes a request processing for subdividing confirmation of the notification destination code (step S5-6). . Thereby, it is possible to decentralize notification destinations where notifications are concentrated.

Moreover, you may change the said embodiment as follows.
In each of the above embodiments, in the notification process in the monitoring target system 10, the message transmission unit 11 of the monitoring target system 10 determines “unfinished” and “unfinished” according to the job completion status and type ( In step S1-2), a message addition process (step S1-3) is executed based on this determination. Here, the failure information may be notified to the integrated monitoring system 20 without adding a message.

In each of the above embodiments, the control unit 21 of the integrated monitoring system 20 executes notification destination determination code creation processing (steps S2-7, S3-8, S4-8, S5-10). Specifically, the notification destination specifying unit 213 of the control unit 21 extracts the key category management record 240 in which the message key category included in the patterned message is recorded from the key category management information storage unit 24. Then, the corresponding category recorded in the key category management record 240 is acquired. The method for identifying the correspondence category is not limited to this. For example, the correspondence category may be set according to the time when the monitoring target message is received. In this case, the corresponding category corresponding to the reception time zone is stored in the key category management record 240 of the key category management information storage unit 24. Then, the notification destination specifying unit 213 acquires, from the key category management information storage unit 24, the corresponding category of the time zone corresponding to the time when the monitoring target message is received from the monitoring target system 10. Thereby, the transmission method of the notification with respect to the person in charge can be changed according to the reception time of the monitoring target message.

  In each of the above embodiments, the transmission method is specified according to the correspondence category. Specifically, the notification destination specifying unit 213 sets a different transmission method based on the correspondence classification. In the present embodiment, the notification timing is determined based on the correspondence category. The change of the transmission method is not limited to the change of the notification timing according to the correspondence category. For example, the communication channel may be changed according to the correspondence category. Specifically, in the case of the correspondence category having a high severity, a highly immediate communication means (for example, a telephone call) is used.

  In each of the above embodiments, the monitoring target system 10 includes the job log storage unit 12. The present invention can also be applied to a configuration in which the monitoring target system 10 transmits a message to the integrated monitoring system 20 when an abnormality occurs.

  DESCRIPTION OF SYMBOLS 10 ... Monitoring object system, 11 ... Message transmission part, 12 ... Job log memory | storage part, 13 ... Unfinished availability determination information memory part, 20 ... Integrated monitoring system, 21 ... Control part, 211 ... Message acquisition means, 212 ... Patterning means 213 ... Notification destination specifying means, 214 ... Notification means, 22 ... Reception management information storage section, 23 ... Pattern management information storage section, 24 ... Key category management information storage section, 25 ... Notification destination judgment information storage section, 26 ... Notification Previous management information storage unit, 27... Notification information storage unit.

Claims (7)

Pattern information storage means for storing pattern management information including message classification in association with the transmission source identifier and message identifier of the monitoring target system;
A category information storage means for storing an item for generating a notification destination determination identifier in association with a message category;
A notification destination information storage unit that stores information for specifying the notification destination in association with the notification destination determination identifier;
A monitoring processing system comprising control means connected to the monitoring target system,
The control means is
Means for obtaining a monitored message including a message identifier from the monitored system;
The transmission source identifier of the monitoring target system that has transmitted the monitoring target message is specified, and using this transmission source identifier and the message identifier, pattern management information including the message classification is acquired from the pattern information storage unit, and this pattern management information Means for generating a patterned message based on
Means for identifying an item associated with the message category in the patterned message using the category information storage means, and generating a notification destination determination identifier using the content of the identified item;
A monitoring processing system comprising: means for notifying a notification destination associated with a notification destination determination identifier in the notification destination information storage means. The category information storage means further stores a correspondence category for determining a method corresponding to the monitoring target message in association with the message category,
The control means specifies the correspondence category associated with the message category acquired based on the received monitoring target message, sets this correspondence category in the pattern message, and specifies the transmission method according to this correspondence category The monitoring processing system according to claim 1, further comprising: The control means is
When the message identifier of the monitoring target message cannot be extracted in the pattern information storage means, the default notification destination associated with the transmission source identifier is notified and the output history of the monitoring target message including this message identifier is recorded. Means,
3. The monitoring processing system according to claim 1, further comprising means for instructing registration of pattern management information when the number of outputs exceeds a reference number in the output history. When the control unit cannot extract the message identifier of the monitoring target message in the pattern information storage unit, the message identifier associated with another message identifier having a common source identifier and similar to the message identifier is specified. Further comprising means for
The monitoring processing system according to claim 1, wherein a notification destination determination identifier is generated using the identified message classification.   Means for recording an output history for each source identifier and message identifier, and outputting an alarm for encouraging segmentation of a notification destination when the number of outputs exceeds a reference number in the output history. The monitoring processing system according to claim 1, further comprising: Pattern information storage means for storing pattern management information including message classification in association with the transmission source identifier and message identifier of the monitoring target system;
A category information storage means for storing an item for generating a notification destination determination identifier in association with a message category;
A notification destination information storage unit that stores information for specifying the notification destination in association with the notification destination determination identifier;
A method for executing a monitoring process using a monitoring processing system including a control unit connected to a monitoring target system,
The control means is
Obtaining a monitored message including a message identifier from the monitored system;
The transmission source identifier of the monitoring target system that has transmitted the monitoring target message is specified, and using this transmission source identifier and the message identifier, pattern management information including the message classification is acquired from the pattern information storage unit, and this pattern management information Generating a patterned message based on
Identifying the item associated with the message category in the patterned message using the category information storage means, and generating a notification destination determination identifier using the content of the identified item;
And a step of notifying the notification destination associated with the notification destination determination identifier in the notification destination information storage means. Pattern information storage means for storing pattern management information including message classification in association with the transmission source identifier and message identifier of the monitoring target system;
A category information storage means for storing an item for generating a notification destination determination identifier in association with a message category;
A notification destination information storage unit that stores information for specifying the notification destination in association with the notification destination determination identifier;
A program for executing a monitoring process using a monitoring processing system including a control unit connected to the monitoring target system,
The control means;
Means for obtaining a monitored message including a message identifier from the monitored system;
The transmission source identifier of the monitoring target system that has transmitted the monitoring target message is specified, and using this transmission source identifier and the message identifier, pattern management information including the message classification is acquired from the pattern information storage unit, and this pattern management information Means for generating a patterned message based on
Means for identifying an item associated with the message category in the patterned message using the category information storage means, and generating a notification destination determination identifier using the content of the identified item;
A monitoring processing program that functions as means for notifying a notification destination associated with a notification destination determination identifier in the notification destination information storage means.

Images