JP2014096056A - Incident data movement processing system, incident data movement processing method, and storage medium storing incident data movement processing program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an incident data movement processing system capable of performing the movement of incidents with making little impact on performance of an incident system during actual operation.SOLUTION: An incident data movement processing system comprises: an incident management system (for update) 6; an incident management system (for reference) 9; and an incident archive system 12 having an archive policy file 13; and a processing history file 14. When performing movement processing of incidents 15, the incident archive system 12 calculates assumed processing time on the basis of the incident number of the incidents 15 to be moved next time, movement capacity, and processing achievement in the past which is recorded in the processing history file 14. Also, the incident archive system 12 calculates movement start time of the incidents 15 on the basis of the assumed processing time and a movement condition recorded in the archive policy file 13 so as to start the movement processing of the incidents 15 on the basis of the movement start time.

Description

  The present invention uses a system comprising a fault monitoring apparatus and an incident management system to identify incidents that have been processed by the service desk for incidents detected by the fault monitoring apparatus and registered in the incident management system. In relation to the incident data movement processing system and incident data movement processing method to be moved to the incident management system database for reference, in particular, during the movement, the time required for movement is calculated from the past processing results, and the movement is performed based on this. The present invention relates to a technique for moving an incident by a designated time by correcting a processing start time.

  In the fault monitoring operation business, the service desk contacts and performs primary responses to incidents that occur daily from monitored devices in order to minimize the impact on the business.

  Incidents generated from monitored devices are accumulated in the database of the incident management system, so that the data capacity of the database increases every day.

  For this reason, there is a concern that the response performance of the incident management system deteriorates as the number of incidents increases.

  As a countermeasure, install an incident management system (referred to as a reference) that is different from the incident management system used by the service desk (referred to as an update), and manage incidents that have been handled as a reference. By moving to the system database, the response performance of the incident management system for updating is prevented from deteriorating.

  This movement of incident data requires processing such as extracting the incident from the update database, copying the incident to the reference database, and then deleting the completed incident. In order not to degrade the response performance of the management system, it is necessary to move data little by little over a certain period of time every day.

  For this data movement, for example, a technique has been proposed in which a divided file is created using a means found in Japanese Patent Application Laid-Open No. 2007-128273 (Patent Document 1) and is efficiently arranged on a distributed storage. Yes.

JP 2007-128273 A

  However, although the technique described in Patent Document 1 can be used for archiving data that is delimited in a distributed manner, such as a storage target file or DB, it is applied to data movement in units of records as described above. It is difficult.

  For this reason, generally, a command for moving a target incident between DBs at regular time intervals is created, and this is periodically executed.

  With these technologies, it is possible to move specific incidents on a regular basis. However, in order to complete the movement of incident data by a predetermined time every day, the daily operation results and the data capacity of the movement target are reduced. Originally, it is necessary to manually adjust the start time of data movement.

  For this reason, when an incident management system is constructed with two systems for update and reference, there are variations in the number of incidents that occur every day, and the processing is delayed due to the presence or absence of specific operations. For example, an administrator of the incident management system manually monitors the data movement processing status and appropriately adjusts the processing start time.

  Therefore, an object of the present invention is to form an incident that does not affect the performance of the incident system in production operation as much as possible by moving the incident data up to a specified time with an optimal amount of movement from the amount of incidents generated and the past processing amount. An incident data movement processing system capable of moving an incident, an incident data movement processing method, and a storage medium storing an incident data movement processing program are provided.

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in the present application, the outline of typical ones will be briefly described as follows.

  In other words, the outline of typical ones is that the incident management system for updating incidents registered from the fault monitoring device that monitors the monitored device and the incidents registered in the incident management system for updating are periodically moved It has a reference incident management system, an archive policy file in which incident movement conditions are recorded, and a processing history file in which past incident movement processing results are recorded. From the incident management system for updating, the incident management system for reference The incident archive system records the number of incidents to be moved next, the moving capacity, and the processing history file when the incident is moved. Based on the past processing results, calculate the estimated processing time of the incident movement process, calculate the incident movement start time based on the calculated estimated processing time and the movement condition recorded in the archive policy file, The incident movement process is started based on the calculated movement start time.

  Also, an update incident management system for registering incidents transmitted from fault monitoring devices that monitor monitored devices, a reference incident management system for regularly moving incidents registered in the update incident management system, It has an archive policy file that records incident movement conditions and a process history file that records past incident movement processing results, and handles incident movement processing from the incident management system for updating to the incident management system for reference. An incident data movement processing method in an incident data movement processing system having an incident archive system to be executed, and when an incident movement process is performed by the incident archive system, the incident data to be moved next The estimated processing time of the incident moving process is calculated based on the number of incidents, moving capacity, and past processing records recorded in the processing history file, and the calculated estimated processing time and the movement recorded in the archive policy file are calculated. The incident movement start time is calculated based on the condition, and the incident movement process is started based on the calculated movement start time.

  The incident data migration processing program is a storage medium storing an incident data migration processing program. The incident data migration processing program is a reference incident management from an incident management system for updating that registers incidents transmitted from fault monitoring devices that monitor monitored devices. The information processing apparatus has an archive policy file that records incident movement conditions and a processing history file that records the past incident movement processing results. When performing the move process, the expected process time of the incident move process is calculated based on the number of incidents to be moved next, the move capacity, and the past process record recorded in the process history file. Time and archive points Based on the movement condition recorded in a file, and calculates a movement start time of the incident, based on the calculated movement starting time, it is intended to function as an incident data movement processing system that initiates the process of moving the incident.

  The effects obtained by typical ones of the inventions disclosed in the present application will be briefly described as follows.

  In other words, the effect obtained by a typical one is that the amount of incident data that occurs every day and the presence or absence of a specific business process are determined by automatically setting the next data movement time in the system based on the processing results of daily incident data movement. Thus, even when the processing time related to the data movement varies, it is possible to complete the data movement by a designated time as much as possible, and it is possible to reduce the number of man-hours compared with the manual response.

It is a block diagram which shows the structure of the incident data movement processing system which concerns on one embodiment of this invention. It is a figure which shows an example of the incident table used with the incident data movement processing system which concerns on one embodiment of this invention. It is a figure which shows an example of the archive policy file used with the incident data movement processing system which concerns on one embodiment of this invention. It is a figure which shows an example of the process history file used with the incident data movement processing system which concerns on one embodiment of this invention. It is a figure which shows an example of the registration by the incident data movement of the incident data movement processing system which concerns on one embodiment of this invention. It is explanatory drawing for demonstrating correction | amendment of the assumption processing time of the incident data movement processing system which concerns on one embodiment of this invention. It is a flowchart which shows the process of the incident archive system of the incident data movement processing system which concerns on one embodiment of this invention.

<Configuration of incident data movement processing system>
With reference to FIG. 1, the configuration of an incident data migration processing system according to an embodiment of the present invention will be described. FIG. 1 is a configuration diagram showing a configuration of an incident data migration processing system according to an embodiment of the present invention.

  In FIG. 1, the incident data movement processing system includes an incident management system (for update) 6, an incident management system (for reference) 9, and an incident archive system 12 in the monitoring center 5.

  The incident management system (for update) 6, the incident management system (for reference) 9, and the incident archive system 12 are each configured by an information processing device such as a server.

  An incident database (hereinafter referred to as an incident DB) 7 and an incident DB 10 are connected to the incident management system (for updating) 6 and the incident management system (for reference) 9, respectively.

  Each incident DB 7 and incident DB 10 stores an incident table 16 that records incidents 15.

  An archive policy file 13 and a process history file 14 are input to and output from the incident archive system 12.

  A data center 1 is connected to the monitoring center 5 via a network, and the monitoring target device 2 is monitored by the failure monitoring device 3 in the data center 1.

  The failure monitoring device 3 of the data center 1 transmits a failure message generated in the monitored device 2 to the incident management system 6 of the monitoring center 5 via the network 4.

  The incident management system (for updating) 6 automatically registers the received failure message as the incident 15 in the incident DB 7.

  The service desk 8 refers to the registered incident 15 and performs the primary response work.

  The incident management system (for reference) 9 is a system installed for reference, and is a system that is used for the purpose of viewing by the related parties 11 and the like using the past incident 15 as a past case.

  The incident management system (for reference) 9 refers to the incident table 16 of the incident DB 10. The incident 15 stored in the incident DB 10 is periodically moved from the incident DB 7 to the incident DB 10 by the incident archive system 12.

  The incident archive system 12 is a system that inputs the archive policy file 13 and the processing history file 14 and moves the incident by the period defined in the archive policy file 13 until the completion time similarly defined in the archive policy file 13. .

  For example, an incident data movement processing program is stored in the incident archive system 12, and the incident data movement processing is performed by executing the incident data movement processing program.

  The incident data movement processing program is stored in a storage medium or the like, and operates as the incident archive system 12 by installing the incident data movement processing program from the storage medium to an information processing apparatus or the like.

<Example of incident table, archive policy file, and processing history file>
Next, examples of an incident table, an archive policy file, and a processing history file used in the incident data migration processing system according to the embodiment of the present invention will be described with reference to FIGS.

  FIG. 2 is a diagram showing an example of an incident table used in the incident data movement processing system according to the embodiment of the present invention, and FIG. 3 is used in the incident data movement processing system according to the embodiment of the present invention. FIG. 4 is a diagram showing an example of an archive policy file, and FIG. 4 is a diagram showing an example of a processing history file used in the incident data migration processing system according to an embodiment of the present invention.

  In the incident DB 7, there is an incident table 16 that records the incident 15 that is output from the monitoring target device 2 shown in FIG. 1 and received via the failure monitoring device 3 and the network 4.

  As shown in FIG. 2, the incident table 16 includes “incident ID”, “occurrence date / time”, “host name”, “occurrence system”, “customer name”, which are actually generated, which are automatically assigned at the time of registration. “Message” and “status” information storing the service desk processing status for the incident are recorded.

  A status of “in process” indicates that the service desk is currently responding, and a status of “closed” indicates that the response at the service desk has been completed.

  As an example of data in the incident table 16, for example, for incident 15 with an “incident ID” of 1000, “occurrence date / time” is 2012-07-10 10:00:00, “host name” is AHost1, and “occurrence system” Is the A system, “customer name” is company A, “message” is the error application A error, and “status” is data being processed.

  When the response of the incident 15 having the “incident ID” of 1000 is completed, the “status” is closed.

  Further, the archive policy file 13 is a file that defines moving conditions such as frequency and completion time when the incident archive system 12 shown in FIG. 1 moves the incident 15 from the incident DB 7 shown in FIG. 1 to the incident DB 10.

  As shown in FIG. 3, the archive policy file 13 includes “execution frequency” such as daily or weekly, “completion time” for completing the movement of the incident, “number of processes” in minutes, “customer name”, “Target period” and “Target condition” are recorded.

  “Customer name”, “target period”, and “target condition” are definitions necessary for narrowing down incidents to be moved from the incident DB 7 shown in FIG.

  As an example of data of the archive policy file 13, for example, “execution frequency” is daily, “completion time” is 05:00, “number of processes” is 100 cases / minute or less, “customer name” is A company, B company , “Target period” is recorded in the past three months or more, and “Target condition” is closed.

  As shown in FIG. 4, the processing history file 14 includes “date” and “day of the week” indicating past execution dates, and “incident” actually moved from the incident DB 7 to the incident DB 10 shown in FIG. Number ”, physical“ capacity ”of the moved incident, and“ processing time ”taken for the movement are recorded.

  The processing history is stored in the processing history file 14 by the incident archive system 12 shown in FIG.

  As an example of data in the processing history file 14, for example, data in which “date” is July 1, “day of the week” is day, “incident number” is 1000, “capacity” is 100, and “processing time” is 20 is stored. Has been.

<Example of registration by moving incident data>
Next, an example of registration by incident data movement of the incident data movement processing system according to the embodiment of the present invention will be described with reference to FIG.

  FIG. 5 is a diagram showing an example of registration by incident data movement of the incident data movement processing system according to the embodiment of the present invention, and shows an example of data registration when the incident 15 is moved from the incident DB 7 to the incident DB 10. It is a thing.

  In the example shown in FIG. 5, the incident 15 whose “customer name” is company A, company B and “target condition” is moved to the incident DB 10 from the information in the archive policy file 13, and the “incident ID” is 1000, 1001, 1003, 1006 incident 15 has been moved.

<Correction of assumed processing time>
Next, correction of the assumed processing time of the incident data movement processing system according to the embodiment of the present invention will be described with reference to FIG. FIG. 6 is an explanatory diagram for explaining the correction of the assumed processing time of the incident data movement processing system according to the embodiment of the present invention.

  6 is processed when the incident archive system 12 sets an execution time when the incident 15 is moved from the incident DB 7 to the incident DB 10.

  First, as shown in FIG. 6, the number of incidents / minute and the amount of transfer (MB) / minute are calculated from the processing history file 14 for one week from July 1 to July 7, Information on the existence of work on each date is obtained.

  For obtaining information on the presence / absence of business, information recorded in the monitoring center 5 may be input as information associated with the processing history file 14, or information may be collected in the processing history file 14 during execution of movement processing. It may be recorded.

  As information on the presence / absence of work, information on the existence of work and the contents of the work carried out are recorded on the day when work such as reboot, nightly batch, weekly batch, etc. is carried out.

  Then, as the calculation of the assumed processing time for moving the incident 15 on July 8 from the incident DB 7 to the incident DB 10, the calculation is performed in the following four cases (a) to (d).

  First, in the example shown in FIG. 6A, the estimated processing time is calculated using only the “number of processes” defined in the archive policy file 13, 2500/100 = 25 is calculated, and 25 minutes is calculated. This is the estimated processing time.

  In the example shown in FIG. 6B, the assumed processing time is calculated from the average processing amount of incidents in the past week. In the example shown in FIG. 6, the average processing amount is 74.52 cases / In minutes, 2500 cases / 74.52 = 33.55 are calculated, and 34 minutes is assumed processing time.

  In the example shown in FIG. 6C, the estimated processing time is calculated from the past physical transfer amount. In the example shown in FIG. 6, the average transfer amount is 7.74 MB / min and 375 MB. /7.74=48.45 is calculated, and 49 minutes is assumed processing time.

  Also, in the example shown in FIG. 6D, based on the operation schedule of each customer (Company A, Company B), etc., it is confirmed whether there is any other business during the time period, In this case, the estimated processing time is calculated from the execution history. For example, the execution on July 8 is Sunday, and it is understood that the reboot process occurs from the past performance (July 1). The estimated processing time is calculated from the average of the transfer amount with business.

  In the example shown in FIG. 6D, the average transfer amount with business is 5.61 MB / min, 375 MB / 5.61 = 66.84 is calculated, and 67 minutes is the assumed processing time.

  In the example shown in FIG. 6, the assumed processing time is calculated by moving up the decimal part.

<Incident Archive System Processing>
Next, processing of the incident archive system of the incident data movement processing system according to an embodiment of the present invention will be described with reference to FIG. FIG. 7 is a flowchart showing the process of the incident archive system of the incident data movement processing system according to the embodiment of the present invention.

  First, when the incident archive system 12 is activated, the archive policy file 13 is input (step S101).

  Then, based on (4) customer name, (5) target period, and (6) target condition of the archive policy file 13, the number of relevant incidents and capacity are calculated from the incident DB 7 (step S102).

  In step S102, for example, 2500 cases and 375 MB are calculated as the number of incidents and the capacity.

  Next, a processing time required for the movement is calculated from (3) the number of processes of the archive policy file 13 (step S103). In step S103, for example, 2500/100 = 25 minutes is calculated in the case of 2500 cases.

  Next, an execution time which is a movement start time for starting the movement of incident data is calculated from (1) the execution frequency of the archive policy file 13, (2) the completion time and the processing time calculated in step S103 (step S104). .

  Next, the date, the number of incidents, and the processing time are input from the processing history file 14 (step S105).

  Next, the processing amount (incidents / minute, transfer amount / minute) is calculated from the one-week results of the processing history file 14 input in step S105, and as the correction processing 1, the estimated processing time is calculated from the number of incidents. Is calculated (step S106). In step S106, 34 minutes is calculated in the example shown in FIG.

  Next, as the correction process 2, an estimated processing time is calculated from the processing result of the transfer amount (step S107). In step S107, 49 minutes is calculated in the example shown in FIG.

  Next, as the correction process 3, an estimated processing time is calculated from the average transfer amount with work depending on the presence or absence of work in the operation schedule (step S108). In step S108, for example, 67 minutes is calculated in the example shown in FIG.

  Next, based on the estimated processing time calculated in steps S106 to S108, the execution time calculated in step S104 is changed based on the time that takes the longest processing time. In this case, the incident 15 is moved (step S109).

  In this example, since 67 minutes calculated in step S108 is the longest, the start time is changed from 04:35 to 03:53.

  In step S109, if all of the estimated processing times calculated in steps S106 to S108 are shorter than the processing time calculated in step S104, the execution time calculated in step S104 is not changed. The incident is moved at the execution time set in step S104.

  With the above processing, in the present embodiment, not only the number of incidents defined by (3) the number of processes in the archive policy file 13 but also the execution result in the past (the last one week), the capacity of the target incident, etc. Can be changed dynamically.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  DESCRIPTION OF SYMBOLS 1 ... Data center, 2 ... Monitoring object apparatus, 3 ... Fault monitoring apparatus, 4 ... Network, 5 ... Monitoring center, 6 ... Incident management system (for update), 7 ... Incident DB, 8 ... Service desk, 9 ... Incident management System (for reference), 10 ... incident DB, 11 ... related person, 12 ... incident archive system, 13 ... archive policy file, 14 ... processing history file, 15 ... incident, 16 ... incident table.

Claims (7)

Update incident management system for registering incidents sent from fault monitoring devices that monitor monitored devices,
A reference incident management system in which the incident registered in the update incident management system is periodically moved;
An archive policy file in which the movement conditions of the incident are recorded and a processing history file in which processing results of the past movement processing of the incident are recorded; the incident management system for update to the incident management system for reference An incident archiving system for handling incident movement,
The incident archive system moves the incident based on the number of incidents of the incident to be moved, the moving capacity, and the past processing record recorded in the processing history file when the incident is moved. Calculate the estimated processing time of the process, calculate the incident movement start time based on the calculated estimated processing time and the movement condition recorded in the archive policy file, and based on the calculated movement start time An incident data movement processing system characterized by starting the incident movement process. In the incident data movement processing system according to claim 1,
The processing history file includes information on the number of incidents and movement capacity when the incident movement process is executed,
The incident archiving system includes a first assumed processing time based on the number of incidents when the incident moving process is executed, a second assumed processing time based on a moving capacity when the incident moving process is executed, and the incident moving process. A third assumed processing time is calculated in consideration of the presence or absence of business at the time of execution, and the assumption is made that the processing time is long among the first assumed processing time, the second assumed processing time, and the third assumed processing time. Incident data transfer processing system characterized by processing time. In the incident data movement processing system according to claim 2,
The archive policy file includes information on the frequency of execution of the incident movement, completion time, and the standard number of incidents processed,
The incident archiving system compares a processing time based on the standard number of incidents processed and the assumed processing time, and calculates the movement start time of the incident based on the longer processing time Incident data movement processing system characterized by the above. An incident management system for updating that registers an incident transmitted from a failure monitoring device that monitors a monitored device, an incident management system for reference in which the incident registered in the incident management system for updating is periodically moved, and An archive policy file in which the movement conditions of the incident are recorded and a processing history file in which processing results of the past movement processing of the incident are recorded; the incident management system for update to the incident management system for reference An incident data movement processing method in an incident data movement processing system comprising an incident archive system for performing incident movement processing,
When performing the incident movement process by the incident archive system, the incident movement is performed based on the number of incidents of the incident to be moved, the movement capacity, and the past processing record recorded in the processing history file. Calculate the estimated processing time of the process, calculate the incident movement start time based on the calculated estimated processing time and the movement condition recorded in the archive policy file, and based on the calculated movement start time An incident data movement processing method characterized by starting the incident movement process. In the incident data movement processing method according to claim 4,
The processing history file includes information on the number of incidents and movement capacity when the incident movement process is executed,
By the incident archive system, a first assumed processing time based on the number of incidents when the incident moving process is executed, a second assumed processing time based on the moving capacity when the incident moving process is executed, and the incident moving process A third assumed processing time is calculated in consideration of the presence or absence of business at the time of execution, and the assumption is made that the processing time is long among the first assumed processing time, the second assumed processing time, and the third assumed processing time. An incident data movement processing method characterized by a processing time. In the incident data movement processing method according to claim 5,
The archive policy file includes information on the frequency of execution of the incident movement, completion time, and the standard number of incidents processed,
The incident archiving system compares the processing time based on the standard number of incidents processed with the assumed processing time, and calculates the movement start time of the incident based on the longer processing time. Incident data transfer processing method. An information processing apparatus for performing the process of moving the incident from the incident management system for update to the incident management system for reference, which registers the incident transmitted from the fault monitoring apparatus that monitors the monitoring target device,
An archive policy file in which the incident movement conditions are recorded, and a processing history file in which the processing results of the past incident movement process are recorded; Based on the number of incidents, the movement capacity, and the past processing results recorded in the processing history file, the estimated processing time of the incident movement processing is calculated, and is recorded in the calculated estimated processing time and the archive policy file. The movement start time of the incident is calculated based on the moved movement condition, and the incident data movement processing system starts the incident movement process based on the calculated movement start time. Incident data movement processing program Storing a storage medium.

Images