JP2015005077A - Failure information management method, failure information management device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve examination efficiency by detecting a failure having the same causing spot by a method other than retrieval by a key word.SOLUTION: In a failure information management device, a route of trouble propagation (referred to as the route) along a call relation between a phenomenon module and a cause module, the number of passing times through each module of the route ([module call frequency]), and the number of passing times through each call relation ([call frequency between modules]) are managed relative to each failure generated in the past, and a cause module is retrieved from a phenomenon module of a trouble phenomenon generated newly, based on the information.

Description

  The present invention relates to a failure information management method and a failure information management apparatus and program for implementing the failure information management method.

  When a large number of failures occur during system operation, the failures may be caused by the same cause as other failures. However, if each failure is not investigated, the cause will not be known, and it will take time.

  Investigate similar faults by describing fault phenomena, causes, countermeasures, and log information as fault slips, and automatically detecting faults that may have similar causes based on similarities in description. Methods for increasing efficiency are known (see, for example, Patent Document 1 and Patent Document 2).

JP 2002-251295 A JP 2006-99249 A

  With the technology disclosed in Patent Document 1, failure information with similar keywords can be presented by paying attention to the phenomenon, cause, and countermeasure content. However, even in the same phenomenon, there are cases where the sentence expression is different depending on the person, and similar fault information may not be detected by keyword search. On the other hand, in the technique disclosed in Patent Document 2, attention is paid to log information, failure information with similar log information is presented, and search accuracy is improved. However, even when the cause is the same, the apparent phenomenon and log information may look different. In such a case, failure information of the same cause cannot be detected by keyword search or log information similarity determination.

  An object of the present invention is to improve the investigation efficiency by making it possible to detect a fault having the same cause by a method other than a search using a keyword or a similarity determination of log information.

  A typical example for solving the above problems is as follows. That is, the present invention is a failure information management method in a failure information management apparatus.

The fault information management device includes a module call hierarchy table that stores module-related information in program analysis, a fault management table that stores fault management information, an inter-module call count table that records fault propagation routes and the number of occurrences, and module call A number table is provided. Then, the failure information management device extracts a related module from the module call hierarchy table using the phenomenon module acquired from the input unit as a key, creates a call relationship from the phenomenon module to each module, and in each module, Obtain the call count information from the module call count table as a key,
In the call relationship, the call count information is obtained from the inter-module call count table using the call destination and the caller as keys, and the cause estimation value is calculated based on the probability of propagation from the module to the module where the probability that the module will fail Then, the cause module is identified from the cause estimated value, and the cause location is identified.

  According to the present invention, when a failure occurs, by estimating the cause module from the phenomenon module, a known failure having the same cause location can be extracted, and the efficiency of failure investigation can be improved.

2 is a diagram illustrating a hardware configuration example of a failure information management apparatus 1. FIG. It is a figure which shows the concept of module relation and the number of times of calling of a module. It is a figure which shows the example of a data structure of the failure information management table 114 with which the failure information management apparatus 1 is provided. It is a figure which shows the example of a data structure of the module call hierarchy table 115 with which the failure information management apparatus 1 is provided. It is a figure which shows the example of a data structure of the frequency | count number-of-calls module 116 which the failure information management apparatus 1 has. It is a figure which shows the data structural example of the module call frequency table 117 which the failure information management apparatus 1 comprises. It is a flowchart which shows the process of the module call hierarchy analysis function 111 which the failure information management apparatus 1 comprises. It is a flowchart which shows the process of the cause module estimation function 112 which the failure information management apparatus 1 comprises. It is a figure which shows the process of cause module estimation which the failure information management apparatus 1 comprises. It is a flowchart which shows the process of the failure information management function 113 which the failure information management apparatus 1 comprises. It is a figure which shows the example of a menu screen displayed on the display part 102 of the failure information management apparatus 1. FIG. It is a figure which shows the example of a module call hierarchy analysis function screen displayed on the display part 102 of the failure information management apparatus 1. FIG. It is a figure which shows the example of a cause module estimation function screen displayed on the display part 102 of the failure information management apparatus 1. FIG. It is a figure which shows the example of a failure information management function screen displayed on the display part 102 of the failure information management apparatus 1. FIG.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram illustrating a hardware configuration example of a failure information management apparatus 1 according to the present embodiment. The failure information management apparatus 1 includes a storage unit 101, a display unit 102, an input unit 103, and a control unit 104. Each unit is connected by a bus (BUS). The storage unit 101 includes a program 110 including a module call hierarchy analysis function 111, a cause module estimation function 112, and a failure information management function 113, a module call hierarchy table 114, a failure information management table 115, an inter-module call count table 116, and a module. A call count table 117 is stored. The program 110 is loaded into a memory (not shown) from the program storage area 118 of the storage unit 101 and executed by the control unit 104.

  FIG. 2 is a diagram illustrating the concept of module association and the number of module calls.

  The module 201 is a program that realizes a certain function (P0001 in this example), and has a function of calling another module (F0001 in this example). This calling relationship is represented by a solid arrow 203. This association is generated by source analysis. The module call count 202 is a counter provided for every module. When a failure occurs, 1 is added to the number of calls of all modules on the route determined from the phenomenon module to the cause module. The inter-module call count 204 is a counter provided between two modules having a call relationship. When a failure occurs, 1 is added to the number of inter-module calls between all two modules on the route determined from the phenomenon module to the cause module. In the example shown in the figure, when a failure occurs in the phenomenon module P0001 and the cause module is D0001, 1 is added to the module call count 202 of the modules (P0001, F0001, D0001) for the route (P0001-F0001-D0001). 1 is added to the number of inter-module calls 204 between two modules (P0001-F0001, F0001-D0001).

  FIG. 3 is a diagram showing the module call hierarchy table 114 provided in the failure information management apparatus 1.

  The module call hierarchy table 114 stores the result of analyzing the module call relationship by source analysis. The caller of the call relationship between the two modules is stored in the caller 302, and the callee is stored in the callee 303. The serial number 301 is numbered and stored every time a record is added to the module call hierarchy table 114.

  FIG. 4 is a diagram illustrating a failure information management table provided in the failure information management apparatus 1.

  The failure information management table 115 is a table that stores a phenomenon module, a phenomenon content, a cause content, a cause module, and a countermeasure content input by the user using the input unit 103 at the time of failure information management. Updated when executed. As shown in FIG. 5, the failure information management table 115 stores a serial number 401, a failure ID 402, a phenomenon module 403, a cause content 404, a cause module 405, and a countermeasure content 406 in association with each other. Here, the serial number 401 stores a value assigned each time a record is added to the failure information management table 115. The failure ID 402 stores an ID generated from the failure identifier and the number assigned each time a record is added to the failure information management table 115. The phenomenon module 403 stores a phenomenon module input by the user using the input unit 103 when executing the failure information management function 113. The cause content 404 stores the cause input by the user using the input unit 103 when executing the failure information management function 113. The cause module 405 stores the cause module input by the user using the input unit 103 when the failure information management function 112 is executed. The countermeasure content 406 stores countermeasure information input by the user using the input unit 103 when the failure information management function 113 is executed.

  FIG. 5 is a diagram illustrating a data configuration example of the inter-module call count table 116 included in the failure information management apparatus 1.

  The inter-module call count table 116 is a table that stores the inter-module call count 504. Since the inter-module call count 504 is uniquely specified by the caller and the callee, the caller is stored in the caller 502 and the callee is stored in the callee 503. The number of calls is stored in the number of calls 504. The serial number 501 is numbered and stored every time a record is added to the inter-module call count table 116.

  FIG. 6 is a diagram illustrating a data configuration example of the module call count table 117 included in the failure information management apparatus 1.

  The module call count table 117 is a table that stores the module call count 603. Since the module call count 603 is a count managed for each module, the module is stored in the module 602. The number of calls is stored in the number of calls 603. The serial number 601 is assigned a value each time a record is added to the module call count table 117 and stored.

  FIG. 7 is a flowchart showing processing of the module call hierarchy analysis function 111 provided in the failure information management apparatus 1.

  The module call hierarchy analysis function 111 is activated by the user selecting the module call hierarchy analysis function on the menu screen shown in FIG. 11 using the input unit 103 (S701), and the module call hierarchy analysis function shown in FIG. A screen is displayed (S702). The user specifies the source path (in this example, C: \ source \) using the input unit 103, or the user presses the reference button on the module analysis function screen using the input unit 103. Thus, the source path is designated, and the module analysis is executed when the user presses the execution button on the module analysis function screen using the input unit 103 (S703). After analyzing all modules, the caller and callee of the call relationship between modules (for example, after analyzing FIG. 2, the module call relationship is P0001-F0001, F0001-D0001, P0002-F0001, P0003-F0002, F0002- D0001, F0002-D0002, and F0002-D0003) are stored in the module call hierarchy table 114 (S704).

  FIG. 8 is a flowchart showing the processing of the cause module estimation function 112 provided in the failure information management apparatus 1.

  The cause module estimation function 112 is activated by the user selecting the cause module estimation function on the menu screen shown in FIG. 11 using the input unit 103 (S801), and displays the cause module estimation function screen shown in FIG. (S802). By pressing the guess button 1302, the cause module guess function is executed. First, a phenomenon module 1301 (referred to as P0001 (901) in this example) input on the cause module estimation function screen by the user using the input unit 103 is acquired (S803). The caller 302 of the module call hierarchy table 114 is searched using the phenomenon module as a key, and the callee 303 of the corresponding record is extracted. Next, the next call destination is extracted by repeating the above process using all the extracted call destinations 303 as keys. All modules that can be reached from the phenomenon module by the above processing (in this example, P0001 (901), F0001 (903), F0002 (907), and D0001 (905)) are acquired (S804) and stored in the memory. Next, the module 602 of the module call count table 117 is searched for each module, and the call count 603 of the corresponding record is searched for the call count (in this example, the call count of P0001 (901) is 4, F0001 ( The obtained numerical values are stored in the memory, assuming that the number of calls in 903) is 3, the number of calls in F0002 (907) is 2, and the number of calls in D0001 (905) is 2. For each module, the caller 502 in the inter-module call count table 116 is searched for the key, the call count 504 of the corresponding record is extracted, and the inter-module call count (P0001-F0001 (902) in this example is 2). , F0001-D0001 (904) is 1, P0001-F0002 (906) is 1, and F0002-D0001 (908) is 1.) is stored in the memory. Next, with respect to all the modules extracted in the above processing, the formula 906 “(number of module calls−number of calls between modules whose Σ module is the call source) / (number of module calls)” is referred to, and the route stop probability is calculated. (S805) and stored in the memory (in this example, the failure probability of P0001 (901) is (4-2-1) / 4 = 1/4 and the failure probability of F0001 (903) is (3-1) / 3 = 2/3, failure probability of F0002 (907) is (2-1) / 2 = 1/2, and failure establishment of D0001 (905) is (2-0) / 2 = 1). Similarly, with respect to all modules having the extracted module as a caller, the formula 907 “number of calls between modules / number of callers of the caller” is referred to, and the route propagation probability is calculated (S806) and stored in the memory (S806). In this example, the route propagation probability of P0001-F0001 (902) is 2/4 = 1/2, the route propagation probability of F0001-D0001 (904) is 1/3, and the route propagation probability of P0001-F0002 (906) is ( 2-1) / 2 = 1/2, and the route propagation probability of F0002-D0001 (908) is 1/2). The following processing is performed on each module extracted by the processing (S807 to S811). One is extracted from the extracted modules (S807) (for example, this is D0001 (905)). All routes that can be reached from the phenomenon module are created (S808) and stored in the memory (if all routes that reach D0001 are created for the current phenomenon module P0001 (901), P0001-F0001-D0001, P0001- F0002−D0001). Next, the following processing is performed on each route extracted in the above processing (S809 to S810). One is extracted from the extracted routes (S809) (for example, P0001-F0001-D0001). Referring to Formula 908 “(product of route propagation probabilities of all modules from each phenomenon module to each module) × (module route stop probability)”, the cause estimated value of the module along the route is calculated (S810) (In this example, the failure probability of P0001-F0001-D0001 is (1/2) × (1/3) × (2-0) / 2 = 1/6). The estimated cause values of the modules calculated in all the routes are added (S811) and stored in the memory (for example, the estimated cause value along the route P0001-F0001-D0001 is 1/6, for D0001 (905), The cause estimated value along the route P0001-F0002-D0001 is 1/8, and finally the cause estimated value of D0001 is 1/6 + 1/8 = 7/24). Other modules are similarly calculated (S807 to S811) (P0001 is 1/4, F0001 is 1/3, and F0002 is 1/8). For all the modules, the result of sorting the estimated cause values of modules larger than 0 in descending order (this time, the order is F0001, D0001, P0001, F0002) is stored in the memory. The following processing is performed on all the stored modules. The failure information management table 115 is searched using the stored cause module as a key, and information on the corresponding record failure ID 1304, phenomenon module 1305, phenomenon content 1306, cause content 1307, and cause module 1308 is extracted and stored in the memory. . The implemented result is acquired from the memory, and the cause module estimation result list is displayed on the module estimation function screen shown in FIG. 13 (S812).

  FIG. 10 is a flowchart showing the processing of the failure information management function 113 provided in the failure information management apparatus 1.

  The failure information management function 112 is activated when the user selects the failure information management function on the menu screen shown in FIG. 11 using the input unit 103 (S1001), and displays the failure information management function screen shown in FIG. (S1002). The user obtains the phenomenon module 1402, the phenomenon content 1404, the cause content 1404, the cause module 1405, and the countermeasure content 1406 that are input to the failure information management function screen by the user using the input unit 103 (S1004), and presses the registration button 1409. Thus, the acquired phenomenon module 1402, phenomenon content 1403, cause content 1404, cause module 1405, and countermeasure content 1406 are associated with each other and stored in the failure information management table 115 (S1005).

  Next, the phenomenon module 403 of the record stored in the failure information management table 115 is set as the caller 302, the cause module 406 is set as the callee 303, the module call hierarchy table 114 is referred to, route information is created, and the pull-down is performed. indicate. For the route selected from the pull-down, 1 is added to the inter-module call count 504 and the module call count 603 of each module, and the count is performed (S1006). The inter-module call count is stored in the inter-module call count 504 of the inter-module call count table 116. The module call count is stored in the module call count 603 of the module call count table 117 (S1007).

  The embodiment of the present invention has been described above. As described above, in the above embodiment, paying attention to the structure of the program, a failure having the same cause of failure is determined and extracted as the same case. The target system that performs failure management according to the above embodiment is a system configured by combining modules that realize a single function. In an actual program, modules are units called classes or functions. The modules have a calling relationship with each other in order to realize complex functions of the system. When a failure occurs in such a system, there are a module (called a cause module) that includes a direct failure that causes the failure, and a screen that shows an event that is recognized as a failure due to the failure (called a phenomenon module). May be different.

  The failure information management device according to the present invention is configured by a failure information management device alone.

  The failure information management device, for failures that have occurred in the past, has a failure propagation path (called a route) along the call relationship between the phenomenon module and the cause module, and the number of times the route has passed through each module ("number of module calls ") Is a device that manages the number of times that each call relationship has been passed (" number of calls between modules ") and estimates the cause module from the phenomenon module of the newly occurring failure phenomenon based on this information.

  The failure information management apparatus has a module call hierarchy table that stores module call hierarchy information obtained by analyzing a program source, analyzes program source information acquired from an input unit of the failure information management apparatus from a phenomenon module, and relates to module call Are extracted and stored in the module call hierarchy table.

  The failure information management device includes a failure information management table storing failure phenomenon modules (such as screens), phenomenon contents, cause contents, cause modules, countermeasure contents, and from failure phenomenon modules to failure cause modules. It has a module call count table that stores “module call count” of each module that has passed through, and an inter-module call count table that stores “inter-module call count” between two modules.

Then, the failure information management apparatus acquires a newly generated failure phenomenon module from the input unit, searches the module call hierarchy table using the failure phenomenon module as a key, and acquires all reachable modules from the failure phenomenon module. Then, all routes from the phenomenon module are created for each of the modules. Obtain the number of calls in the module call count table and the call count in the inter-module call count table for each module of each created route, and using these values, for each module, the route extending from the phenomenon module to that module is , The probability of ending with the module, that is, the conditional probability that the module is the causal module (route stop probability) under the condition that the route passes through the module, and each module call relationship from the phenomenon module to the module Calculates the probability that an extended route will follow the call relationship and pass through the module, that is, the conditional probability that the route will follow the call relationship (route propagation probability) under the condition that the route passes the module .
For an arbitrary module, consider all routes that reach the module from the phenomenon module, calculate the product of the route propagation probability and the route stop probability of the arbitrary module for each call relationship of each route, and add these The probability that the module is the cause (cause estimation value) is calculated, and the cause module is estimated.

  Although the embodiment of the present invention has been described above, the present invention is not limited to this, and various modifications can be made without departing from the scope of the invention.

DESCRIPTION OF SYMBOLS 1 ... Fault information management apparatus, 101 ... Memory | storage part, 102 ... Display part, 103 ... Input part, 104 ... Control part.

Claims (3)

In the failure information management method in the failure information management device,
The failure information management device includes:
A module call hierarchy table that stores module-related information in program analysis, a failure management table that stores failure management information, an inter-module call count table that records the failure propagation route and the number of occurrences, and a module call count table
Using the phenomenon module acquired from the input unit as a key, extract the related module from the module call hierarchy table,
Create a call relationship from the symptom module to each module,
In each module, the call count information is obtained from the module call count table using the module as a key,
In the call relationship, the call count information is obtained from the inter-module call count table using the call destination and the caller as keys,
Probability of module failure Phenomenon by calculating the cause estimated value from the probability of propagation from the module to the module, identify the cause module from the cause estimated value, identify the cause location,
Fault information management method characterized by the above. In the device that manages fault information,
A control unit, an input unit, a module call hierarchy table that stores module-related information in program analysis, a failure management table that stores failure management information, an inter-module call count table that records the failure propagation route and the number of occurrences, and modules It has a call count table,
The controller is
Using the phenomenon module acquired from the input unit as a key, extract a related module from the module call hierarchy table,
Create a call relationship from the symptom module to each module,
In each module, the call count information is obtained from the module call count table using the module as a key,
In the call relationship, the call count information is obtained from the inter-module call count table using the call destination and the caller as keys,
Probability of module failure Phenomenon of cause is determined from the estimated cause value by calculating the estimated cause value based on the probability of propagation from the module to the module.
A failure information management apparatus characterized by the above.   The program which controls a computer and performs the failure information management method of Claim 1.

Images