JP2013200899A - Operation management apparatus, and operation management method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an operation management apparatus, a method and a program for accurately detecting performance deterioration of a system.SOLUTION: An operation management apparatus comprises: normal model distribution accumulation means for holding a range of distribution of collapse of correlation of a normal model when a system is normally operated; fault model distribution accumulation means for holding a fault model when any abnormality occurs in the system; correlation variant distribution determination means for determining whether or not the distribution of the collapse of each correlation model of performance information falls within the range of the distribution of the collapse of the normal model; correlation variant history accumulation means for holding the distribution of the collapse of each collation model determined to not fall within the range; and correlation collapse increase determination means for determining whether or not the distribution of the collapse of each correlation model held by the correlation variant history accumulation means tends to approximate the distribution of the collapse of the fault model accumulated by the fault model distribution accumulation means.

Description

  The present invention relates to an information processing apparatus that provides an information communication service such as a WEB service or a business service, and more particularly to an operation management apparatus and an operation management method having a function of accurately detecting and localizing system performance degradation. .

  As a first conventional technique, there is an operation management apparatus that sets a threshold value for each piece of performance information and detects a fault by detecting that the threshold value is exceeded for each piece of performance information. In this conventional operation management apparatus, a value that clearly indicates an abnormality is set in advance as a threshold value, and an abnormality in the performance of each element is detected.

  As a second conventional technique, there is an operation management device that generates a correlation model by deriving a conversion function when one is an input and the other is an output with respect to a time series of two arbitrary performance information values. Have been conceived. In this conventional operation management device, when new performance information is detected, it is determined whether or not the performance value conforms to the conversion function of the correlation model, and a failure is detected based on the number and amount of correlations To do.

JP 2007-293393 A JP 2008-293441 A

  However, in the operation management apparatus according to the first prior art, if the threshold value is set low, there is a problem that the administrator is confused due to frequent misreports when the performance information varies greatly. Further, if the threshold is set high, there is a problem that it becomes difficult to detect other than a serious failure, and it becomes difficult to detect a performance abnormality such as a system operating but a response speed deteriorated. Furthermore, although an abnormal value for each element can be detected, there is a problem that an abnormality caused by a relationship with a performance value of another element having an input / output relationship such as a bottleneck cannot be detected.

  Further, in the operation management apparatus according to the second prior art, a failure is detected based on the number and amount of correlation collapse. For this reason, in the second prior art, in the case of a system in which the number of components is biased, the number of collapses of the entire system can be reduced even if many correlation failures occur in a small number of elements. There was a problem that if there were not many, it was not detected as a failure.

  In other words, the operation management apparatus according to the second prior art generates a normal correlation model in order to detect a system performance deterioration failure, and detects the failure from the situation in which the correlation has broken during operation. Identify abnormalities. However, in this conventional method, as a first problem, since a failure is detected based on the number and amount of correlation collapse, in the case of a system in which the number of components is biased, the number of There has been a problem that even if many correlation failures occur in a small number of elements, it is not detected as a failure unless the number of collapses in the entire system is large. For example, in a general three-tier system composed of Web, AP, DB, etc., a large number of Webs and APs are installed in consideration of load distribution, but there are generally few DBs. In such a system, even if many correlation failures occur in the DB, since the number is smaller than the correlation between the Web and the AP, the entire system may be considered to have few failures and no abnormality. In addition, as a second problem, for example, the amount of network traffic between two points does not cause a correlation failure in a normal state, and if a failure occurs, it is almost a fault. There was a problem that even if it was a model with no error, it was not detected as a failure.

  Accordingly, an object of the present invention is to provide an operation management apparatus and an operation management method having a function of accurately detecting system performance deterioration or a function of localizing system performance deterioration.

  The present invention has been made to solve the above-described problems, monitors performance information of a system that executes a service, extracts a correlation among a plurality of performance values established in the system at normal time, Operation having a function of detecting and localizing performance degradation of the system by detecting a plurality of performance values during operation of the system, extracting the change of the correlation from the detection result, and presenting it to an administrator In the distribution of the correlation collapse between the performance values of the management device, the range of the distribution of the correlation of the normal correlation model, which is the range of the distribution of the correlation breakdown when the system is operating normally Each of the performance information, the normal model distribution storage means for holding the fault model, the fault model distribution storage means for holding the fault model indicating the distribution of the collapse of the correlation when an abnormality occurs in the system, and the performance information The correlation distribution of the correlation model and the range of the distribution of the normal correlation model collapse in the normal model distribution storage means are compared, and the distribution of the collapse of each correlation model in the performance information is stored in the normal model distribution storage means. Correlation change distribution determining means for determining whether or not the normal correlation model falls within the range of the collapse distribution, and each correlation of the performance information determined not to be within the range by the correlation change distribution determining means Correlation change history accumulating means for holding a model disruption distribution and when a history of a predetermined number of correlation model disruption distributions is accumulated in the correlation change history accumulation means, the history is stored in the failure model distribution accumulation means. An operation management apparatus comprising: correlation loss increase determination means for determining whether or not there is a tendency to approximate the distribution of failure of accumulated failure models.

  Further, the present invention monitors performance information of a system that executes a service, extracts a correlation between a plurality of performance values established in the system at normal time, and obtains a plurality of performance values during operation of the system. An operation management method for detecting and extracting a change in the correlation from the detection result and presenting the change to the administrator, wherein the system is operating normally in the distribution of the collapse of the correlation between the performance values. A normal model distribution accumulation step that retains a distribution range of the normal correlation model that is a distribution range of the correlation breakdown in a case, and a distribution of the correlation breakdown when an abnormality occurs in the system. A failure model distribution accumulation step that holds the indicated failure model, a breakdown distribution of each correlation model of the performance information, and a failure of the normal correlation model held in the normal model distribution accumulation step Correlation comparing the range of the cloth and determining whether or not the distribution of the collapse of each correlation model of the performance information is within the range of the breakdown distribution of the normal correlation model held in the normal model distribution accumulation step A change distribution determining step, a correlation change history accumulating step for holding a distribution of collapse of each correlation model of the performance information determined not to fall within a range in the correlation change distribution determining step, and the correlation change history accumulating step When the history as the distribution of the collapse of the predetermined number of correlation models is accumulated, whether or not the history tends to approximate the failure model collapse distribution accumulated by the failure model distribution accumulation step. An operation management method comprising: determining a correlation failure increase determination step.

  Further, the present invention monitors performance information of a system that executes a service, extracts a correlation between a plurality of performance values established in the system at normal time, and obtains a plurality of performance values during operation of the system. A program for causing a computer to execute a process of detecting and extracting a change in the correlation from the detection result and presenting the change to the administrator. The normal model distribution accumulation process that holds the range of the normal correlation model collapse distribution, which is the range of the correlation collapse distribution when operating, and the correlation when the system is malfunctioning Failure model distribution storage process that holds a failure model indicating the distribution of collapse, the distribution of the collapse of each correlation model of the performance information and the normal phase retained in the normal model distribution storage process Compare with the range of distribution of model collapse, and whether the distribution of collapse of each correlation model of the performance information is within the range of collapse distribution of the normal correlation model held in the normal model distribution accumulation process Correlation change distribution discriminating process for determining the correlation change history accumulating process for holding the distribution of collapse of each correlation model of the performance information determined to be not within the range in the correlation change distribution discriminating process, and the correlation When a history that is the distribution of the collapse of a predetermined number of correlation models is accumulated by the change history accumulation process, the history tends to approximate the failure model collapse distribution accumulated by the failure model distribution accumulation process. This is a program that causes a computer to execute a correlation failure increase determination process for determining whether or not.

  According to the present invention, the correlation of each performance information in normal times is modeled, and the distribution tendency for each element of the collapse of the correlation is monitored at the time of operation, so that a sign of failure is detected and the occurrence location is specified. It is possible to provide an operation management apparatus, an operation management method, and a program thereof having a function of accurately detecting system performance degradation or a function of localizing system performance degradation.

  Further, according to the present invention, with regard to the collapse of the correlation model, paying attention to the distribution of each system component, the distribution of the collapse of the correlation model at the time of abnormality is registered in advance, and If there is a tendency that the distribution of the collapse of the correlation model of the correlation of the collapse of the model of the correlation approximates the distribution of the collapse at the time of abnormality over a certain period of time, the abnormality can be notified to the administrator as a sign of a failure. Thereby, according to this invention, even if it is a case where the number of the failure models which collapsed is small, abnormality can be detected and said 1st and 2nd subject can be solved. Further, according to the present invention, it is also determined whether the distribution of the collapse of the correlation model during operation is within the normal range. Thus, if there is no notification of abnormality, the administrator can consider that the system is operating normally.

It is a block diagram which shows the operation management apparatus used as the premise of this invention. It is a figure which shows an example of performance information. It is a flowchart figure which shows the step which analyzes the correlation change of performance information. It is a figure which shows an example of a correlation model. It is a figure which shows an example of the screen shown by the operation management apparatus of FIG. It is a block diagram which shows the operation management apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart figure which shows operation | movement of the operation management apparatus shown in FIG. It is a figure which shows the information registered as distribution of collapse of the correlation model at the time of abnormality. It is a figure which shows the outline | summary of the comparison of the range of the distribution of collapse of each correlation model of the performance information which concerns on embodiment of this invention, and the distribution of collapse of a normal model. It is a figure which shows an example of the screen shown by the operation management apparatus of FIG. It is a figure which shows an example of the screen shown by the operation management apparatus which concerns on the 2nd Embodiment of this invention. It is a flowchart figure which shows operation | movement of the operation management apparatus which concerns on the 3rd Embodiment of this invention.

(Prerequisite configuration)
First, with reference to FIG. 1 to FIG. 5, the configuration and operation of an operation management apparatus as a premise of the present invention will be described.

  Referring to FIG. 1, an operation management apparatus as a premise of the present invention includes a service execution unit 1, a performance information storage unit 2, an information collection unit 3, a failure analysis unit 4, an administrator dialogue unit 5, and a countermeasure. The execution unit 6, the correlation model generation unit 7, the correlation model storage unit 8, and the correlation change analysis unit 9 are configured.

  The service execution means 1 is an information processing apparatus that provides an information communication service such as a WEB service or a business service.

  The performance information storage unit 2 stores the performance information of each element of the service execution unit 1.

  The information collecting means 3 detects and outputs the performance information of the service execution means 1 or an operational state such as an error message, and causes the performance information storage means 2 to accumulate the performance information included in the operational state.

  The failure analysis unit 4 receives outputs from the information collection unit 3 and the correlation change analysis unit 9 and performs failure analysis.

  The administrator interaction means 5 receives the result of the failure analysis from the failure analysis means 4 and presents it to the administrator, and receives the input from the administrator and outputs it to the countermeasure execution means 6.

  The coping execution means 6 causes the service execution means 1 to execute processing for coping with a failure in accordance with the output of the administrator dialogue means 5.

  The correlation model generation unit 7 extracts the performance information for a certain period from the performance information storage unit 2 and derives a time-series conversion function of the values of any two pieces of performance information, so that the overall service execution unit 1 A correlation model of the operating state is generated.

  The correlation model accumulation unit 8 accumulates the correlation model generated by the correlation model generation unit 7.

  The correlation change analyzing means 9 receives newly detected performance information from the information collecting means 3, and the performance value included in this performance information is converted between each piece of performance information of the correlation model accumulated in the correlation model accumulating means 8. It analyzes whether or not the relationship indicated by the function is satisfied within a certain error range, and outputs the result.

  With reference to FIG. 1 to FIG. 5, the operation of the operation management apparatus which is the premise of the present invention will be described below.

  First, the information collecting means 3 shown in FIG. 1 detects the operating state of the service executing means 1 and accumulates performance information in the performance information accumulating means 2. For example, when the service execution unit 1 is executing the WEB service, the information collection unit 3 detects the CPU usage rate or the remaining memory capacity of each server that provides the WEB service at regular time intervals. The performance information 101 shown in FIG. 2 is an example of performance information detected in this way. In FIG. 2, for example, “A.CPU” indicates the value of the CPU usage rate of one server, and the value of 17:25 on October 5, 2007 is 12. Further, values such as 15, 34, 63 are detected from 17:26 at intervals of 1 minute. Similarly, “A.MEM” detects the value of the remaining memory capacity of the same server, and “B.CPU” detects the value of the CPU utilization rate of another server at the same time.

  Next, the failure analysis means 4 performs failure analysis by a predetermined method. For example, the failure analysis unit 4 determines whether the load on a specific server is based on the value of the performance information detected by the information collection unit 3 according to a specification that a warning message is presented to the administrator if the CPU usage rate is a certain value or more. A threshold is used to determine whether or not the value is high.

  The manager dialogue means 5 presents the result of the fault analysis by the fault analysis means 4 as described above to the manager. Then, the administrator interaction means 5 causes the service execution means 1 to execute the countermeasure command via the countermeasure execution means 6 when the administrator inputs to instruct some kind of countermeasure. For example, the administrator can know that the CPU load is high by presenting the administrator interaction means 5, and can reduce the workload or change the configuration for load distribution. By repeating such information collection, analysis, and handling processes, the service execution means 1 continues to handle failures.

  Furthermore, the operation management apparatus shown in FIG. 1 can detect the performance abnormality in the failure analysis as described above more accurately by the correlation model generation means 7, the correlation model storage means 8, and the correlation change analysis means 9.

  FIG. 3 shows a process for more accurately detecting such a performance abnormality, and shows a step of analyzing a correlation change in performance information.

  First, in the state where the information shown in the performance information 101 of FIG. 2 is stored in the performance information storage unit 2, the correlation model generation unit 7 creates a correlation model by deriving a conversion function between the pieces of performance information. The correlation model is stored in the correlation model storage unit 8 (step S501 in FIG. 3).

  A correlation model 201 shown in FIG. 4 shows an example of the correlation model generated in this way. Referring to the correlation model 201, for example, the conversion function “Y = αX + β” when “A.CPU” is an input X and “A.MEM” is an output Y is a value indicated by the performance information 101 in FIG. With reference to the time series, “−0.6” and “100” are determined as the values of α and β, respectively, and the time series of values generated by the conversion function and the actual performance information that is output The time series of values are compared, and the weight “0.88” of this conversion function is calculated from the conversion error that is the difference. Similarly, a conversion function between any two pieces of performance information is derived, and one having a certain weight is extracted as an effective correlation, and a correlation model 201 is generated. Although the case of the conversion function “Y = αX + β” has been described here, the present invention is not limited to this example, and any function that converts time series of two arbitrary values of performance information may be used.

  Next, the correlation change analysis unit 9 analyzes whether or not the performance information newly acquired from the information collection unit 3 matches the correlation shown in the correlation model (step S502).

  For example, when the correlation change analysis unit 9 obtains performance information at the time “2007/11/07 8:30” in the bottom row in the performance information 101 shown in FIG. 2, the correlation change analysis unit 9 writes the performance information in the correlation model 201 shown in FIG. 4. When the conversion value calculated using the conversion function from the input performance information and the newly acquired value of the output performance information are within a certain range of conversion error It is determined that the correlation is maintained, and if the conversion error range is exceeded, it is determined that the correlation is broken. The correlation change analysis means 9 repeats such processing for all the conversion functions, determines whether or not there is a correlation change in all newly acquired performance information, and then includes abnormality level information indicating the degree of this correlation change and Correlation change information including abnormal element information indicating elements related to the correlation change is created and output to the failure analysis means 4.

  The failure analysis means 4 receives this correlation change information, and when the changed abnormality degree exceeds a predetermined value (step S503), the failure analysis means 4 indicates that there is a possibility of a failure with respect to the changed abnormality degree. The manager dialogue means 5 is made to present it (step S504).

  FIG. 5 shows an example of a screen presented by the manager interaction means 5 to the manager in this way. The display screen 401 includes the number of broken correlations (a) indicating the degree of abnormality, a correlation diagram (b) indicating the abnormal location, a list (c) of elements having a high degree of abnormality, and the like. In this way, for example, it is possible to present to the administrator that there is a possibility of failure in the element “C.CPU” having a high degree of abnormality.

  As described above, in the operation management apparatus that is the premise of the present invention, a correlation model is generated from normal performance information that does not cause a failure, and the detected performance information has changed from this normal correlation model. By calculating the ratio, it is possible to detect the occurrence of a performance abnormality such as response deterioration and specify the location where the performance abnormality has occurred.

  However, in the operation management apparatus that is the premise of the present invention, the possibility of failure is presented to the administrator only when the number of correlation disruptions indicating the degree of abnormality is large to some extent. For this reason, in the operation management apparatus which is the premise of the present invention, if there is a bias in the number of each application constituting the system, there is a problem that even if a large number of abnormalities occur in a server with a small number of applications, the performance abnormality is not presented. is there.

  For example, let us consider a case where the operation management apparatus which is the premise of the present invention manages a WEB server and a DB server as applications constituting a WEB service. In this case, since the number of servers is generally larger for the WEB server than for the DB server, even if many abnormalities occur in the DB server, the total number of correlation failures does not increase so much and a failure is presented. There was a possibility not to be.

(First embodiment)
Next, the operation management apparatus according to the first embodiment of the present invention will be described with reference to FIGS.

[Configuration of First Embodiment]
FIG. 6 is a block diagram showing an operation management apparatus according to the first embodiment of the present invention. In addition to the configuration of the operation management apparatus shown in FIG. 1, the operation management apparatus of the present embodiment includes a normal model distribution storage means 10, a failure model distribution storage means 11, a correlation change distribution determination means 12, and a correlation change history storage. Means 13 and correlation loss increase determination means 14 are provided.

  The normal model distribution accumulating unit 10 accumulates a distribution range (see a distribution range 802 in FIG. 9) of the correlation model collapse when the performance information input by the administrator is normal.

  The failure model distribution accumulating unit 11 accumulates the distribution of the collapse of the correlation model when the performance information input by the administrator is abnormal.

  The correlation change distribution discriminating means 12 receives the performance information from the correlation change analyzing means 9 and compares the correlation model collapse distribution of the performance information with the range of the correlation model collapse distribution in the normal model distribution storage means 10. Based on the comparison result, it is analyzed whether or not the performance information is within a normal range.

  The correlation change history accumulating unit 13 accumulates the number of collapses for each correlation model of performance information.

  Correlation failure increase determination means 14 is based on the history of the number of failures for each correlation model stored in correlation change history storage means 13, and the abnormality of distribution of correlation model failure stored in failure model distribution storage means 11. It is analyzed for each failure model whether or not the distribution of the correlation model of the time is approximate (that is, the distribution of the failure model). As a result, when it is determined that there is a distribution of the approximate fault model, the correlation loss increase determination unit 14 determines the fault model approximated to the performance information and the approximate ratio calculated in comparison with the fault model. Is notified to the failure analysis means 4.

  Further, the failure analysis unit 4 receives the failure model approximated to the performance information and the approximate ratio calculated by comparing with the failure model from the correlation failure increase determination unit 14, and these are received via the administrator dialogue unit 5. A new function for presenting the information to the administrator is provided.

[Operation of First Embodiment]
Next, the operation of the operation management apparatus of this embodiment will be described with reference to FIGS.

  First, as a premise, the administrator registers the range of collapse of the normal correlation model in the normal model distribution accumulating means 10 (step S711 in FIG. 7). This may be performed before the operation management apparatus is operated, or may be appropriately added during the operation. For example, there is a correlation model A that indicates the correlation between the CPU usage rate of server A and the CPU usage rate of server B. If the collapse is within 5 to 10% of the total, the correlation model A The range of A is registered as 5-10. Other correlation models are registered in the same manner.

  Similarly, as a premise, the administrator registers the distribution of the collapse of the correlation model at the time of abnormality in the abnormality model distribution accumulating unit 11. This may also be performed before operating the operation management apparatus, or may be added as appropriate during operation (step S712).

  FIG. 8 shows information to be registered as the distribution of the collapse of the correlation model at the time of abnormality. For example, the administrator registers a set of correlation model name, importance, and correlation model collapse distribution as the distribution of the collapse of the correlation model at the time of abnormality.

  As in the case described with reference to FIG. 1 to FIG. 5 for the operation management apparatus that is the premise of the present embodiment, the correlation model generation unit 7 is based on the performance information collected from the service execution unit 1 by the information collection unit 3. Generates a correlation model (step S713). Further, when the information collecting means 3 collects performance information during operation, the correlation change analyzing means 9 analyzes whether or not this performance information matches the correlation shown in the correlation model, and from the change in correlation. The degree of abnormality is calculated (step S714).

  Next, the correlation change distribution discriminating means 12 compares the distribution of the collapse of each correlation model of the received performance information with the range of the distribution of the collapse of the correlation model in the normal model distribution accumulating means 10, and the performance information is normal. It is analyzed whether the correlation distribution of the correlation model in the model distribution storage means 10 is within the range of distribution (step S715). If it is within the range, the correlation change distribution determination means 12 clears the number of collapses for all correlation models stored in the correlation change history storage means 13 (step S716).

  FIG. 9 is a diagram showing an outline of a comparison between the collapse distribution of each correlation model of performance information and the range of the collapse distribution of the normal model in the present embodiment. Referring to FIG. 9, among the correlation models A, B, C, and D shown in the graph 801, the correlation model D is the distribution of the collapse of the normal model in the normal model distribution storage means 10 shown as the distribution range 802. It can be seen that the range is exceeded. That is, the value “20.4” of the correlation model D in the graph 801 exceeds the distribution range “10-15%” of the correlation model D in the distribution range 802. In such a case, the correlation change history accumulating unit 13 accumulates the number of collapses for each correlation model of performance information (step S717).

  Steps S713 to S717 are repeated, and the correlation loss increase determination unit 14 determines whether or not a predetermined number of performance information has been stored in the correlation change history storage unit 13 (step S718). Here, if it is determined that a predetermined number of performance information has been stored in the correlation change history storage means 13, the correlation failure increase determination means 14 inquires of the failure model distribution storage means 11 and the distribution of the correlation model failure at the time of abnormality. Is acquired (step S719). Then, based on the history of the number of collapses for each correlation model accumulated in the correlation change history accumulating unit 13, the correlation collapse increase determination unit 14 calculates the correlation model collapse distribution obtained in step S 719. It is analyzed whether there is a tendency to approximate the distribution (step S720).

  As a result of step S720, when it is determined that there is a failure model to be approximated, the failure analysis means 4 determines the failure model, the latest distribution of the history of the number of collapses for each correlation model, and the approximate The degree is received from the correlation loss increase determination means 14, and the result is presented to the administrator via the administrator dialogue means 5 (step S721).

  FIG. 10 shows an example of the display screen presented to the administrator in this way. Referring to FIG. 10, a graph 901 shows the distribution state of the collapse of the correlation model of the current service and the distribution of the collapse of the approximate failure model. Further, the information 902 shows the fault model being approximated and the degree of approximation. Further, the graph 903 shows the time series change of the degree of abnormality.

In this case, in the time series change of the abnormality level graph, the threshold value that is determined to be abnormal at the current time has not been reached, and thus no abnormality is notified. Therefore, there is a high possibility that the administrator will not notice that an abnormality has occurred. However, referring to the distribution of collapse, it can be understood that there is a bias in the collapse of a certain correlation model, which approximates the “DB connection delay failure model” registered in advance by the administrator (information 902). reference). For this reason, the administrator can determine that there is a sign of a delay failure related to the DB connection, and can take appropriate measures.
For example, for pursuing the cause, it is possible to refer to the DB log to check whether there is a problem or to investigate the influence on the AP server side connected to the DB.

[Effect of the first embodiment]
In the operation management apparatus according to the present embodiment, the correlation failure increase determination unit 14 determines whether or not the distribution of the failure of the correlation model of the performance information approximates a correlation model at the time of abnormality registered in advance. Whether or not to notify the person. Thereby, the operation management apparatus of this embodiment can detect an abnormality even when the collapse of the correlation model is concentrated on a small number of elements among all elements constituting the service. This is not possible with the conventional operation management apparatus. Therefore, the operation management apparatus according to the present embodiment cannot detect an abnormality even if the collapse of the correlation model concentrates on a small number of elements among all elements constituting the service, which is the first problem of the present invention. Challenges can be overcome.

  Further, according to the operation management apparatus of the present embodiment, an abnormality is detected in a model in which a correlation does not break in a normal state, and when a break occurs, there is almost no fault. can do. Therefore, the operation management apparatus according to the present embodiment is a second problem of the present invention, in which the correlation is not broken in a normal state, and when the break occurs, it is almost certainly a failure. Even such a model can overcome the problem that an abnormality cannot be detected.

  Further, according to the operation management apparatus of the present embodiment, in order to determine whether or not it is approximate to the correlation model at the time of abnormality based on the past results, the action to be taken for the generated abnormality is clear from past experience. This has the effect of reducing the burden on the manager for handling. Furthermore, since only the performance information that does not fall within the distribution range of the normal correlation model stored in the normal model distribution storage means 10 is subject to analysis, the system operates normally during a period in which no abnormality is detected. Can be identified. Therefore, according to the operation management apparatus of the present embodiment, when the administrator conducts a cause investigation while referring to the log when an abnormality occurs, the log of the normal operation period can be excluded from the investigation target, and the burden is reduced. There is also an effect.

(Second Embodiment)
As in the first embodiment, the configuration and operation of this embodiment will be described with reference to FIG.

  In the operation management apparatus of this embodiment, the operation of accumulating a predetermined number of performance information that does not fall within the normal distribution model collapse distribution is the same as that described in the first embodiment. Further, the correlation failure increase determination unit 14 of the present embodiment includes a plurality of correlations at the time of abnormality acquired from the failure model distribution storage unit 11 as the history of the number of failures for each correlation model stored in the correlation change history storage unit 13. Compare with the model collapse distribution and analyze whether there is a tendency to approximate each failure model.

  Next, the effect of this embodiment will be described. FIG. 11 shows an example of a display screen presented to the administrator when an approximate value is obtained for each failure model by the correlation loss increase determination means 14 of the present embodiment. Referring to FIG. 11, information 906 shows how close the current performance information is to each of a plurality of failure models. As a result, the administrator can infer the possibility of various failures from the combination of the plurality of presented failure models. For example, in FIG. 11, the DB-related failure is displayed as having the highest degree of approximation, but it is also displayed that all three subsequent failures are Web-related. The administrator sees the display screen of FIG. 11 and can consider the possibility that an abnormality has occurred in the Web as well as the possibility that an abnormality has occurred in the DB.

(Third embodiment)
With reference to FIG. 12, the configuration and operation of the operation management apparatus of this embodiment will be described.

  The operation management apparatus of this embodiment shown in FIG. 12 is characterized by having a normal model distribution automatic generation means 15 in addition to the configuration of the operation management apparatus according to the first embodiment. .

  When the normal model distribution automatic generation means 15 analyzes that all the performance information acquired by the correlation change analysis means 9 matches the correlation shown in the correlation model within a certain error range, the normal model distribution automatic generation means 15 receives the correlation change information, Calculate the ratio of collapse of the correlation model in the whole. The normal model distribution automatic generation means 15 repeats such a process a certain number of times, finds the minimum and maximum values of the collapse rate for each correlation model, and regards the result as the collapse distribution of the correlation model in the normal state. Register in the normal model distribution storage means 10.

  Next, the effect of this embodiment will be described. As described above, the collapse distribution of the correlation model in the normal state is automatically accumulated in the normal model distribution accumulating unit 10, so that the administrator can correlate the normal state as shown in step S <b> 711 in FIG. 7. Even without performing the act of calculating and registering the model collapse distribution by itself, it is possible to detect a failure based on the correlation model collapse distribution.

  Note that the process of the operation management apparatus according to each embodiment of the present invention described above may be stored in a computer-readable recording medium in the form of a program. The above processing may be performed by the computer reading and executing this program. Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

DESCRIPTION OF SYMBOLS 1 Service execution means 2 Performance information storage means 3 Information collection means 4 Failure analysis means 5 Manager interaction means 6 Countermeasure execution means 7 Correlation model generation means 8 Correlation model storage means 9 Correlation change analysis means 10 Normal model distribution storage means 11 Failure model Distribution accumulation means 12 Correlation change distribution discrimination means 13 Correlation change history accumulation means 14 Correlation failure increase discrimination means 15 Normal model distribution automatic generation means

Claims (6)

System performance information is monitored, extracted as a model indicating a relationship between a plurality of performance values established in the system, a plurality of performance values during operation of the system are detected, and a change in the relationship is detected from the detection result. An operation management device to detect,
Storage means for holding a distribution of the disruption of the relationship for each model as a first distribution;
Whether or not the second distribution is approximate to the first distribution by comparing the first distribution and the second distribution with the current collapse distribution for each model as the second distribution. An operation management apparatus comprising: a first determination unit that determines whether or not. History storage means for holding the determination result by the first determination means as history;
The operation management apparatus according to claim 1, further comprising: a second determination unit configured to determine whether the second distribution tends to approximate the first distribution from the history. The operation management apparatus according to claim 1, wherein the first distribution and the second distribution are ratios of numbers indicating a collapse of a relationship for each model. System performance information is monitored, extracted as a model indicating a relationship between a plurality of performance values established in the system, a plurality of performance values during operation of the system are detected, and a change in the relationship is detected from the detection result. An operation management method to detect,
An accumulation stage for retaining a distribution of the disruption of the relationship for each model as a first distribution;
Whether or not the second distribution is approximate to the first distribution by comparing the first distribution and the second distribution with the current collapse distribution for each model as the second distribution. An operation management method comprising: a first determination stage for determining whether or not. A history accumulating stage for holding the discrimination result in the first discrimination stage as a history;
The operation management method according to claim 4, further comprising: a second determination step of determining whether or not the second distribution tends to approximate the first distribution from the history. The operation management method according to claim 4, wherein the first distribution and the second distribution are ratios of numbers indicating the collapse of the relationship for each model.

Images