JP2013164668A - Fault monitoring system, incident tabulation method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To materialize case classification and configuration information of non-handling hours and incident reports by handling category and handling department, and utilize a policy file for tabulation in order to efficiently provide service quality assurance.SOLUTION: A tabulation system 30 retrieves incident information 21 and calculates respectively a number of incident cases and an average handling time corresponding to the retrieval item, on the basis of a condition item to be outputted to a tabulation report 32 inputted to a policy file 31 and configuration information 23 stored in a system management database 22. Subsequently, there is added to the report an item which is calculated from a condition inputted to the policy file 31 of one item for calculating a proportion of the incident cases (incident case number ratio) and from the configuration information 23 stored in the system management database 22. These processes are repeatedly executed a condition number of times defined in the policy file 31 and output as a tabulation report.

Description

  The present invention relates to a technology for monitoring incidents such as faults, and more particularly to a technology effective for creating reports according to incident response categories and response departments.

  Computer systems that provide information processing services in recent years provide various services through the Internet. Among them, in incident management work, a failure monitoring device receives a failure message, registers the received failure message as incident information in an incident management system, and the registered incident is handled by a service desk according to a predetermined workflow. Correspond.

  The service desk response status is defined as SLA (Service Level Agreement), which is a report time after an incident occurs and a primary response execution time, and this SLA is used as a quantitative index to guarantee the quality of service to customers.

  In addition, as this kind of incident management technology, for example, the storage device stores the processing target time for each business step, the time management unit determines the time excess for each business step, and the notification unit outputs the time excess By doing this, there is known one that manages work time for each business step (see, for example, Patent Document 1).

JP 2007-34353 A

  However, the present inventor has found that the incident management technology as described above has the following problems.

  In other words, in the above technology, it is considered that collection and aggregation of notification time and countermeasure time can be realized by the workflow determined for each monitoring target, but depending on the response contents of the incident that occurred, it is not the department that performs the incident management work Therefore, it is difficult to accurately grasp the service quality, and it is difficult to guarantee the service to the customer.

  The purpose of the present invention is to realize case classification and configuration information outside the response time, and report by incident response classification and response department, and accurately grasp the service quality by using a policy file for aggregation. It is to provide technology that can.

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in the present application, the outline of typical ones will be briefly described as follows.

  In other words, in order to achieve the above-described object, the present invention can accurately grasp the quality of service by using an incident management system having incident information, configuration information including a department name and source information, and a policy file. Realize the mechanism.

  The policy file defines whether incidents are to be counted according to the input conditions. The number of incidents for each condition input to the policy file is output as incident total information according to the configuration information according to the configuration information.

  The present invention comprises a failure monitoring system that collects and aggregates incidents in devices to be monitored.

  This fault monitoring system searches for incident information in which a corresponding case number is added to a fault message that occurred in a monitored device, based on the policy file that defines the incidents to be counted and the configuration information that indicates the counting unit And an aggregation section that calculates and outputs incident aggregation information for each condition defined in the policy file.

  Further, the present invention can be applied to a method by a system that realizes calculation of incident total information for each condition defined in a policy file, and a program that causes a computer system to function as the system.

  Among the inventions disclosed in the present application, effects obtained by typical ones will be briefly described as follows.

  The service quality at the service desk can be accurately grasped.

It is explanatory drawing which shows an example of a structure of the failure monitoring system by one embodiment of this invention. It is explanatory drawing which showed an example of the item in the incident information stored in the incident database of FIG. It is explanatory drawing which showed an example of the item in the structure information stored in the system management database of FIG. It is explanatory drawing which showed the example of the item in the correspondence case database which the case addition system of FIG. 1 refers. It is explanatory drawing which showed the example of the item of the policy file which the aggregation system of FIG. 1 inputs. It is a flowchart which shows an example of operation | movement of the total system of FIG. It is explanatory drawing which showed the implementation example of the report preparation by the process of step S109 of FIG. It is explanatory drawing which showed an example of the total report which the total system of FIG. 1 produces | generates.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

<Summary of invention>
The first outline of the present invention is a failure monitoring system (failure monitoring system 1) that collects and aggregates incidents in devices to be monitored (monitored devices 2).

  This fault monitoring system responds to fault messages generated in devices to be monitored based on a policy file (policy file 31) that defines incidents to be counted and configuration information (configuration information 23) that indicates the counting unit. The incident information (incident information 21) to which the case number (corresponding case number) is added is searched, the incident aggregation information (aggregation report 32) for each condition defined in the policy file is calculated, and the aggregation section (aggregation) System 30).

  The second outline of the present invention is an incident counting method for collecting and counting incidents in a device to be monitored (monitored device 2) by a computer system (fault monitoring system 1).

  The incident counting method includes a step of collecting a failure message from a device via a communication line (inter-center network 4), a failure message to which a response case number is added to the failure message, and a response case number is added. Is stored as incident information (incident information 21), a policy file (policy file 31) that defines whether incidents are to be counted, and configuration information (configuration information 23) that indicates a counting unit. And outputting incident total information (total report 32) for each condition defined in the policy file.

  Furthermore, a third outline of the present invention is a program that causes a computer system to execute the following steps.

  This program collects a failure message from a device to be monitored (monitored device 2) via a communication line (inter-center network 4), adds a corresponding case number to the failure message, Is stored as incident information (incident information 21), a policy file (policy file 31) that defines the incidents to be counted, and configuration information (configuration information 23) that indicates a counting unit. And searching for incident information and outputting incident total information (total report 32) for each condition defined in the policy file.

  Hereinafter, the embodiment will be described in detail based on the above-described outline.

<Configuration of fault monitoring system>
FIG. 1 is an explanatory diagram showing an example of a configuration of a failure monitoring system according to an embodiment of the present invention. As shown in FIG. 1, the failure monitoring system 1 includes a plurality of monitored devices 2, a failure monitoring device 3, a case addition system 6, a response case database 7, an operation terminal 8, an incident management system 10, an incident database 20, and system management. A database 22 and a totaling system 30 are included.

  The monitoring target device 2 and the failure monitoring device 3 are provided in the data center DC. The case addition system 6, the response case database 7, the operation terminal 8, the incident management system 10, the incident database 20, and the counting system 30 are It is provided in the monitoring center KC.

  The failure monitoring apparatus 3 and the case addition system 6 are connected to each other via an inter-center network 4 that is a communication line. The monitoring target device 2 is a device that is a target for fault monitoring, and includes, for example, an electronic system such as an information processing system.

  These devices to be monitored 2 are connected to the failure monitoring device 3, respectively. Although FIG. 1 shows an example in which there are three monitored devices 2, the number of monitored devices 2 is not limited to this.

  The failure monitoring device 3 transmits a message of a failure that has occurred in the monitored device 2 to the case addition system 6 via the inter-center network 4. The case addition system 6 is connected to a corresponding case database 7 and an incident management system 10.

  The case addition system 6 extracts a correspondence case to be associated with the failure message from the correspondence case database 7 based on the content of the failure message transmitted and the origin information, and the correspondence case that is the number of the correspondence case extracted with the failure message. No. Is transmitted to the incident management system 10.

  The incident management system 10 includes a failure information input unit 11 and a workflow control unit 12. An incident database 20 and a system management database 22 are connected to the failure information input unit 11 and the workflow control unit 12, respectively.

  The failure message transmitted from the case addition system 6 and the corresponding case No. The (number) is input to the failure information input unit 11. The failure information input unit 11 registers the input failure message as incident information 21 in the incident database 20.

  In the monitoring center KC, the service desk personnel use the operation terminal 8 to perform the work step processing of the workflow of the incident information registered by the failure information input unit 11 by the workflow control unit 12 of the incident management system 10.

  The totaling system 30 searches the incident information 21 in the incident database 20 from the conditions defined in the policy file 31 and the configuration information 23 stored in the system management database 22, and generates a totaling report 32.

<Example configuration of incident information>
FIG. 2 is an explanatory diagram showing an example of items in the incident information 21 stored in the incident database 20 of FIG.

  The incident information 21 includes an “incident ID”, “occurrence date / time”, “customer name”, “corresponding case No.”, and the like as illustrated.

  The “incident ID” is an identification code that uniquely identifies a registered incident. “Occurrence date and time” indicates the occurrence date and time of the failure detected by the failure monitoring device 3. The “customer name” is a customer name associated with the monitoring target device 2 that is the generation source. “Correspondence case No.” is a number for searching for a response procedure (section) for each incident added by the case addition system 6 of FIG.

<Configuration example of configuration information>
FIG. 3 is an explanatory diagram showing an example of items in the configuration information 23 stored in the system management database 22 of FIG.

  As shown in the figure, the items of the configuration information 23 are composed of “center name”, “customer name”, “system name”, “subsystem name”, and “contact”, and these are classified according to incident case classifications. It is used when creating reports for each department and corresponding department.

<Example of correspondence cases stored in the correspondence case database>
FIG. 4 is an explanatory diagram showing an example of a corresponding case item in the corresponding case database 7 referred to by the case addition system 6 of FIG.

  Corresponding case items in the corresponding case database 7 include “corresponding case No.” and “corresponding procedure”. Corresponding case No. Is a number for uniquely identifying a response case, and the response procedure is a response procedure to be referred to when an incident occurs.

<Configuration example of policy file>
FIG. 5 is an explanatory diagram showing an example of items of the policy file 31 input by the counting system 30 of FIG. 1, which defines the extraction conditions for incidents to be counted.

<Operation example of aggregation system>
Next, the operation of the counting system 30 will be described.

  The various functions of the processing performed by the totaling system 30 include, for example, program format software stored in a program storage memory (not shown) or the like provided in the totaling system 30 and a CPU (Central Processing) (not shown) of the totaling system 30. This is realized by executing (Unit).

  FIG. 6 is a flowchart showing an example of the operation of the counting system 30 of FIG.

  First, a condition to be output to the total report 32 is input to the policy file 31 by the total system 30 (step S101). Thereafter, the processes in steps S103 to S109 are repeated for the number of conditions defined in the policy file 31 (steps S102 and S110).

  The incident information 21 in the incident database 20 is searched from the condition items input to the policy file 31 and the configuration information 23 stored in the system management database 22 (steps S103 and S104), the number of incidents corresponding to the search items, and the average response Each time is calculated (step S106).

  After calculating the number of incidents and the average response time, the ratio of the number of incidents (incident number ratio) is calculated (step S107). The processes in steps S106 and S107 are repeatedly executed for the number of incidents (steps S105 and S108).

  After the processes in steps S106 and S107 are repeatedly executed for the number of incidents, the condition input in the policy file 31 of one item and the item calculated from the configuration information 23 stored in the system management database 22 are added to the report (step S109). ). As described above, the processes in steps S103 to S109 are repeatedly executed for the number of conditions defined in the policy file 31.

<Example of item addition in step S109>
FIG. 7 is an explanatory diagram showing an implementation example of report creation by the process of step S109 of FIG.

  The upper part of FIG. 7 shows the conditions input to the policy file 31, and the lower part of FIG. 7 shows an example of the created report. The conditions input to the policy file 31 in the upper part of FIG. 7 are “items” shown in the lower part of FIG. 7, and the “aggregation unit” in the lower part of FIG. Then, a report is created by extracting the number of incidents and the average response time for each item in each tabulation unit.

<Example of aggregate report>
FIG. 8 is an explanatory diagram showing an example of a summary report 32 generated by the summary system 30.

  The total report 32 is automatically generated from the policy file 31 and the configuration information 23. The X axis of the total report 32 in FIG. 8 indicates the definition content in the total template, and the Y axis indicates the ratio for each incident response classification according to the conditions input to the policy file 31 and the conditions defined in the configuration information 23. Is extracted.

  Thereby, according to the present embodiment, in order to calculate the ratio for each incident, the policy file 31 and the configuration information 23 are associated with each other, and the incident information 21 is also combined, so Or, the ratio of corresponding cases can be found in each source unit, and the service quality inherent in the service desk can be accurately grasped.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  The present invention is suitable for a quality improvement technique for a failure monitoring operation service in an outsourcing service.

DESCRIPTION OF SYMBOLS 1 Fault monitoring system 2 Monitoring object apparatus 3 Fault monitoring apparatus 4 Center network 6 Case addition system 7 Correspondence case database 8 Operation terminal 10 Incident management system 11 Fault information input part 12 Workflow control part 20 Incident database 21 Incident information 22 System management database 23 Configuration Information 30 Total System 31 Policy File 32 Total Report DC Data Center KC Monitoring Center

Claims (9)

  Based on the policy file that defines the incidents to be counted, and the configuration information indicating the counting unit, the policy file is searched by searching for incident information in which the number of the corresponding case is added to the failure message that occurred in the monitored device. A fault monitoring system comprising: a totaling unit that calculates and outputs incident totaling information for each condition defined in 1). The failure monitoring system according to claim 1,
Furthermore, a response case database storing response cases consisting of response procedures for each incident associated with the failure message;
A case addition system that searches the correspondence case database, extracts a correspondence case associated with the failure message, and outputs the extracted number of the correspondence case and the failure message;
An incident management unit that registers the failure message output from the case addition system and the number of the corresponding case;
An incident information database for storing the information registered by the incident management unit as the incident information;
The counting unit is
A failure monitoring system that searches the incident information database and acquires the incident information. The failure monitoring system according to claim 1 or 2,
The incident total information output by the totaling unit is
Fault monitoring, which is the ratio of the number of incidents, average response time, and the number of incidents corresponding to the items to be counted for incidents defined in the policy file, for each counting unit indicated in the configuration information system. An incident counting method for collecting and tabulating incidents on devices to be monitored by a computer system,
Collecting fault messages from the device via a communication line;
Adding a response case number to the failure message, and storing the failure message with the response case number added as incident information;
A policy file that defines incidents to be counted, and a step of searching the incident information based on configuration information indicating a counting unit and outputting incident count information for each condition defined in the policy file Incident aggregation method characterized by In the incident totaling method according to claim 4,
The step of storing the failure message as incident information includes:
Searching a response case database in which a response case consisting of a response procedure for each incident associated with a failure message is stored, and extracting a response case associated with the failure message transmitted via the communication line;
And a step of storing the extracted number of the corresponding case and the failure message in the incident information database as the incident information. In the incident totaling method according to claim 4 or 5,
The step of outputting the incident total information includes
For each counting unit indicated in the configuration information, the number of incidents corresponding to the items to be counted for incidents defined in the policy file, an average response time, and a ratio of the number of incidents are calculated and output. Incident aggregation method. Collecting fault messages from monitored devices via a communication line;
Adding a response case number to the failure message, and storing the failure message with the response case number added as incident information;
A computer system defining a policy file defining incidents to be aggregated, and outputting the incident aggregation information for each condition defined in the policy file by searching for the incident information based on configuration information indicating an aggregation unit A program characterized by being executed by. The program according to claim 7, wherein
The step of storing the failure message as incident information includes:
Searching a response case database in which a response case consisting of a response procedure for each incident associated with a failure message is stored, and extracting a response case associated with the failure message transmitted via the communication line;
A program comprising the step of storing the extracted number of the corresponding case and the failure message in the incident information database as the incident information. The program according to claim 7 or 8,
The step of outputting the incident total information includes
For each counting unit indicated in the configuration information, the number of incidents corresponding to the items to be counted for incidents defined in the policy file, an average response time, and a ratio of the number of incidents are calculated and output. Program.

Images