JP2016197450A - Operation management device, operation management system, information processing method, and operation management program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an operation management device capable of detecting a sign of failure and identifying an occurrence place.SOLUTION: An operation management device manages the operation of a system including a plurality of devices to be managed. The operation management device includes a generation unit, an analysis unit, and a display instruction unit. The generation unit generates a correlation function representing a correlation between time series of performance information obtained from the devices to be managed. The analysis unit applies newly obtained performance information to the correlation function and analyzes whether or not the correlation is maintained. The display instruction unit provides an instruction to display a second abnormality degree indicating the abnormality degree of the system together with a first abnormality degree indicating the abnormality degree of each of the devices to be managed which is calculated on the basis of an analysis result.SELECTED DRAWING: Figure 4

Description

  The present invention relates to an operation management apparatus, an operation management system, an information processing method, and an operation management program, and more particularly to an operation management apparatus that accurately detects and localizes performance degradation of a system that provides an information communication service.

  In relatively large-scale systems such as corporate information systems and IDCs (Internet Data Centers), as the importance of information communication services such as web services and business services as social infrastructure increases, devices such as servers that provide such services Stable operation is important. The operation management of such an apparatus has been performed manually by an administrator. As the devices become larger and more complicated, the burden on the manager is drastically increased in terms of knowledge and operation, and a situation such as service interruption due to a determination error or an operation error has also occurred.

  In order to cope with such a situation, an integrated operation management system that centrally monitors and controls the hardware or software constituting the system is provided.

  In this integrated management system, information regarding the operating status of a plurality of hardware or software to be managed is acquired online and output to an operation management apparatus connected to the integrated management system. To determine the failure of the system to be managed, there are a method of setting a threshold value in the operation information in advance and a method of evaluating a deviation from the average value. Is done.

  For example, in the operation management apparatus of such an integrated operation management system, a threshold is set for each piece of performance information, and a failure is detected by detecting that each piece of performance information exceeds the threshold. A value that is clearly abnormal in advance is set as a threshold value, and an abnormality in the performance of each element is detected.

  When abnormality detection is reported, it is necessary to narrow down the cause for resolution, such as whether it is caused by insufficient memory capacity, CPU load, or network load. In general, investigation of computer system logs and parameters that are likely to be related to the elucidation of the cause, as well as relying on the experience and intuition of system engineers, require time and effort to solve.

  For this reason, the integrated operation management system automatically analyzes combinations of abnormal conditions based on event data (status notifications) collected from multiple devices, estimates global problems and causes, and It is important to notify and provide support.

  In particular, in order to ensure reliability in long-term continuous service operation, not only abnormalities that have occurred but also conditions such as performance deterioration that is not clearly abnormal and signs of failure that are expected to occur in the future are detected and planned. There is a demand for equipment enhancement.

  As technologies related to such an integrated operation management system, for example, Patent Documents 1 to 7 shown below can be cited.

  In Patent Document 1, a load amount resulting from a specific process is specified by comparing a history of processing of system elements and a history of changes in performance information, and a load at a future processing amount is analyzed. In this operation management apparatus, the behavior of the system can be specified when the relationship between the processing and the load can be grasped in advance.

  In Patent Document 2, the size of the relationship between the system components is quantified based on the operation information to identify the component causing the failure. In this operation management apparatus, the cause candidates are listed by weighting the elements that have a correlation with the performance values at that point in time and displaying them in a list.

  That is, Patent Document 2 includes a management target system, a network, and an operation management server, and the operation information of each component collected from the management target system via the operation information collection adapter is stored in the operation information storage unit. . The analysis calculation unit selects one piece of operation information that exceeds an arbitrary or preset value range, and quantifies the magnitude of the relationship with other pieces of operation information. During the quantification calculation, necessary operation information is sequentially extracted from the operation information collection unit. Of the operation information that is subject to calculation, if the quantified related value exceeds the preset value range, it is highly likely that it will cause a performance bottleneck or failure. Report to output section.

  In Patent Literature 3, an operation information collection unit uses a plurality of devices in a monitoring target system using ICMP, SNMP, rsh, etc., and hardware operation information such as CPU, Network IO (network input / output), Web Application operation information such as the server access amount and DB server processing query amount is acquired at regular time intervals and stored in the operation information DB.

  The preprocessing unit performs a statistical process for obtaining a statistical analysis value between the pieces of operation information of each component stored in the operation information DB. For example, the preprocessing unit obtains a statistical analysis value by obtaining a correlation coefficient between pieces of operation information or performing principal component analysis between pieces of operation information. This statistical analysis value is a value indicating the degree of association between the operation information of each device at a predetermined time. For example, in FIG. 2 of Patent Document 5, the correlation coefficient between “CPU usage rate of server 1” and “CPU usage rate of server 2” is “0.93” or the like. The correlation coefficient is a numerical value indicating the degree of correlation between two variables.

  In such an operation management apparatus, first, hardware operation information such as a CPU usage rate from a monitoring target server or network device, or application level information such as an access status for a Web server is periodically transmitted. Based on the operation information in each situation such as normal access or failure occurrence, the “relation between acquired values” that characterizes each situation is calculated using statistical methods such as correlation analysis and principal component analysis. The model of each situation is defined and stored in the model information DB.

  At the time of operation, a statistical method similar to the model defined for the current operation information is performed periodically or triggered by a failure alert or a decrease in response of the provided service, and defined in the model information DB. Compare the model to identify the situation of the matched model as the current situation.

  In Patent Document 4, the monitor unit acquires state information regarding the states of the AC environment and the non-AC environment, and the analysis unit or the model diagnosis unit determines the state of the device in the AC environment based on the acquired state information. To do. The simulation unit refers to the countermeasure list corresponding to the determination result, executes a simulation process by each of at least one countermeasure included in the countermeasure list, and evaluates the effect of each countermeasure.

  The model extraction unit plots the monitoring data from time 1 to time 3 in a coordinate system representing the relationship of the CPU usage rate with respect to time, and obtains a linear approximate expression (fa (x) = αx + β) for each plotted monitoring data. As a result, a model representing a temporal change in the CPU usage rate is extracted. The model extraction unit stores the extracted model in the knowledge information storage unit.

  Similarly, a model is also obtained in a coordinate system representing the relationship of throughput with respect to time.

  Then, the model extraction unit performs a correlation analysis and a multivariate analysis on these two models, so that a linear approximate expression (corresponding to the CPU usage rate and the throughput for each of the processing A and the processing B) ( fTA (x) = ρ1x + θ1, fTB (x) = ρ2x + θ2) is obtained, and a model indicating the correlation between the CPU usage rate and the throughput is extracted. The model diagnosis unit performs diagnosis by referring to the policy corresponding to each model (paragraph numbers 0060 to 0062 of Patent Document 6).

  In Patent Document 5, it is determined what kind of workload is running on the computer, a collector is started based on the type of workload, and a threshold for metrics is set based on the workload mix. , Determine when a metric exceeds a threshold (both current and predicted workload) and correlate the metric to determine if hardware capacity is the cause of the problem.

JP 2006-024017 A JP 2002-342182 A JP 2006-146668 A JP 2007-207117 A JP 2005-524886 A

  However, the related technology operation management apparatus has the following problems.

  That is, in the related art operation management apparatus, if the threshold value is set low, there is a problem that the manager is confused because many false alarms occur when the performance information fluctuates greatly. Further, if the threshold value is set high, there is a problem that it becomes difficult to detect other than a serious failure, and it becomes difficult to detect a performance abnormality such as a system operating but a response speed deteriorated.

  Furthermore, although an abnormal value for each element can be detected, there is a problem that an abnormality caused by a relationship with a performance value of another element having an input / output relationship such as a bottleneck cannot be detected.

  As described above, in the threshold information monitoring of the performance information of the related technology, there is a problem in that it is impossible to accurately detect a performance abnormality such as response deterioration and specify a location.

  Furthermore, the method of calculating the correlation of performance information at the time of abnormality has a problem that it is difficult to determine whether the correlation is generated only at the time of abnormality or is present at normal times.

  Further, in Patent Document 1, in order to predict an accurate load, it is necessary to collect and analyze the history of all processes that can be related, and the system becomes large-scale or cooperates with other systems. In some cases, the relationship between the processing and the load is extremely complicated, the load of data collection and analysis is large, and a high level of knowledge for analyzing it is also required.

  Furthermore, since Patent Document 2 presents a relationship between performance information at the time when a failure occurs, the administrator can determine which is actually the cause from performance information that may have a causal relationship with a certain abnormality. However, there was a defect that had to be verified.

  In addition, there is a problem that it is difficult to determine whether these correlations occur only during an abnormality or exist during normal times.

  In Patent Document 3, since the correlation coefficient is a value, a related abnormality cause can be presented from the correlation of the value at a certain point in time (at the time of abnormality), but the correlation of a future value that does not exist cannot be calculated. There was a problem that the administrator had to verify which is actually the cause from the performance information that could have a causal relationship with the abnormality. In addition, there was a problem that a sign of failure could not be detected.

  In Patent Document 4, a function of individual performance information is estimated (similar to the third related technique). In the equation y = f (x), x is time and represents one time change of y. Two expressions are prepared, and the two relations are determined by the correlation rule given separately. Since the rules are not automatically generated, unless there is a separate rule between all pieces of performance information for each element that makes up the system, which of the pieces of performance information may have a causal relationship with a certain abnormality There was a problem that the cause could not be accurately predicted.

  In other words, the correlation between the CPU usage rate and the throughput is only the correlation between one element and the other elements, so the correlation for all the elements that make up the system is unknown. There is a problem that the administrator must verify from the system elements which is actually the cause from the possible performance information.

  In Patent Document 5, although the workload and metrics are converted, since both values are calculated, since no model is used, performance information that may have a causal relationship with a certain abnormality is actually used. In the verification, all of these conversion methods have to be input manually.

  The present invention has been made to solve the problems of the above-described technology, and its purpose is to detect an indication of a failure and identify an occurrence location, an operation management device, and an operation management A system, an information processing method, and an operation management program are provided.

  An operation management apparatus according to the present invention is an operation management apparatus that operates and manages a system including a plurality of managed devices, and generates a correlation function representing a correlation between time series of performance information acquired from the managed device. A generating unit that performs analysis of whether or not the correlation is maintained by applying the newly acquired performance information to the correlation function, and a managed object calculated based on the result of the analysis A display instructing unit for giving an instruction to display a second abnormality degree indicating the abnormality degree of the system together with a first abnormality degree indicating the abnormality degree of each device.

  An operation management system according to the present invention includes a system including a plurality of managed devices and an operation management device, and the operation management device indicates a correlation between time series of performance information acquired from the managed device. A generating unit that generates a correlation function to represent, an analysis unit that analyzes whether or not the correlation is maintained by applying the newly acquired performance information to the correlation function, and based on the result of the analysis A display instruction unit for giving an instruction to display a second abnormality degree indicating the abnormality degree of the system together with the first abnormality degree indicating the calculated abnormality degree of each managed device.

  The information processing method of the present invention generates a correlation function representing a correlation between time series of performance information acquired from a plurality of managed devices included in the system, and the newly acquired performance information is used as the correlation function. And whether or not the correlation is maintained, and indicates the degree of abnormality of the system together with the degree of abnormality of each managed device calculated based on the result of the analysis. An instruction to display the second abnormality degree is given.

  The operation management program of the present invention generates a correlation function representing a correlation between time series of performance information acquired from a plurality of managed devices included in the system, and newly acquires the performance information. Analyzing whether or not the correlation is maintained by applying to the correlation function, along with the first abnormality degree indicating the degree of abnormality of each managed device calculated based on the result of the analysis, the abnormality of the system An instruction to display the second degree of abnormality indicating the degree is executed.

  According to the present invention, the correlation model generation unit generates a correlation model by deriving a correlation function for each time series (performance series information) of each piece of performance information of any two elements, and performs a correlation change analysis. When the unit detects new performance information, it analyzes whether the performance information conforms to the correlation function of this correlation model and changes the correlation of the correlation model (maintenance or collapse of the correlation). analyse.

  As a result, it is possible to identify the location of the abnormality (the element with the abnormality) depending on whether the correlation generated during normal operation is broken, model the correlation of the detected performance information, and monitor the changes in the model. Providing an excellent operation management device, operation management system, information processing method, and operation management program that are not available in related technologies, which can accurately detect performance anomalies such as response degradation and failure signs and identify the location of failure. it can.

It is a block diagram which shows an example of the whole structure of the operation management system containing the operation management apparatus by the 1st Embodiment of this invention. It is a block diagram which shows an example of the structure used as the premise of the operation management apparatus by the 1st Embodiment of this invention. It is explanatory drawing which shows an example of the performance information utilized with the operation management apparatus by the 1st Embodiment of this invention. It is a block diagram which shows an example of the whole structure of the operation management apparatus by the 1st Embodiment of this invention. It is a block diagram which shows an example of the whole structure of the operation management apparatus by the 1st Embodiment of this invention. It is explanatory drawing which shows an example for demonstrating conversion function identification in the operation management apparatus by the 1st Embodiment of this invention. It is explanatory drawing which shows an example of the data structure of a correlation model in the operation management apparatus by the 1st Embodiment of this invention. It is explanatory drawing which shows an example of the other data structure of a correlation model in the operation management apparatus by the 1st Embodiment of this invention. It is explanatory drawing which shows an example of correlation model selection in the operation management apparatus by the 1st Embodiment of this invention. It is explanatory drawing which shows an example of a correlation change detection in the operation management apparatus by the 1st Embodiment of this invention. It is a flowchart which shows an example of the whole process sequence processed in the operation management apparatus by the 1st Embodiment of this invention. It is a flowchart which shows an example of the detailed process sequence of a correlation model production | generation in the operation management apparatus by the 1st Embodiment of this invention. It is a flowchart which shows an example of the detailed process sequence of a correlation change analysis in the operation management apparatus by the 1st Embodiment of this invention. It is explanatory drawing for demonstrating an example of the display screen displayed in the operation management apparatus by the 1st Embodiment of this invention. It is a block diagram which shows an example of the whole structure of the operation management apparatus by the 2nd Embodiment of this invention. It is a block diagram which shows an example of the whole structure of the operation management apparatus by the 2nd Embodiment of this invention. It is explanatory drawing which shows an example of correlation model invalidation in the operation management apparatus by the 2nd Embodiment of this invention. It is explanatory drawing which shows an example of the data structure of a correlation model in the operation management apparatus by the 2nd Embodiment of this invention. It is a flowchart which shows an example of the whole process sequence processed in the operation management apparatus by the 2nd Embodiment of this invention. It is a flowchart which shows an example of the detailed process sequence of a steady change analysis in the operation management apparatus by the 2nd Embodiment of this invention. It is explanatory drawing for demonstrating an example of the display screen displayed in the operation management apparatus by the 2nd Embodiment of this invention.

[Basic configuration of operation management device]
First, the basic configuration of the operation management apparatus will be described. The operation management apparatus (for example, reference numeral 100 shown in FIG. 4) of the present invention acquires performance information for each of a plurality of types of performance items from a plurality of managed apparatuses constituting the system, and manages the managed apparatus. It is intended for things.

  The operation management apparatus includes a correlation model generation unit (for example, reference numeral 123 shown in FIG. 4) that generates a correlation model including a correlation function between the performance information from the performance sequence information indicating the time series change of the performance information, and a new A correlation change analysis unit (for example, FIG. 4) that applies the detected performance information to the correlation function, analyzes whether the correlation indicated by the correlation function is maintained, and outputs information on the analysis result. The reference numeral 124 shown in FIG.

  In such an operation management apparatus, the correlation model generation unit performs a process of calculating a coefficient of the correlation function of one of the performance series information and the other for all the combinations of the performance series information to obtain the correlation model. Generate.

  In addition, the correlation change analysis unit calculates predicted performance information by applying one item of the newly detected performance information to the correlation function related to the performance information, and is identical to the predicted performance information. The prediction error is calculated by comparing the performance information actually detected for the item. When the prediction error satisfies a certain error range, a process for determining that the correlation indicated by the correlation function is maintained is applied to the correlation model related to the newly detected performance information. Perform for all the correlation functions included.

  As a result, it is possible to identify the location of the abnormality (the element with the abnormality) depending on whether the correlation generated during normal operation is broken, model the correlation of the detected performance information, and monitor the changes in the model. In addition, it is possible to accurately detect performance abnormalities such as response deterioration and signs of failures, and to identify the location of occurrence.

  Hereinafter, an example of a preferred embodiment in which the “operation management apparatus” of the present invention is applied to an “operation management system” will be specifically described with reference to the drawings.

[First Embodiment]
(Overall configuration of operation management system)
First, the specific configuration of the operation management system of the present embodiment will be described from the overall configuration, and then the detailed configuration of each unit will be described.

  FIG. 1 is a block diagram showing an example of an overall schematic configuration of an operation management system including an operation management apparatus according to the first embodiment of the present invention.

  As shown in FIG. 1, the operation management system 1 of the present embodiment is configured such that each computer 2 which is an example of a plurality of managed devices and each computer 2 can communicate with each computer 2 via a network N. And an operation management apparatus 3 that manages the operation of the system 2.

  The operation management apparatus 3 is configured to be able to acquire performance information for each of a plurality of types of performance items (for example, CPU usage rate, remaining memory capacity, etc.) from a plurality of computers 2.

  The computer 2 and the operation management device 3 operate under program control, and if they have network-related functions, they are desktops, laptop computers, servers, other information devices having wireless / wired communication functions, or the like. Any computer, such as a computer similar to the above, may be used.

  The hardware configuration of the operation management apparatus 3 includes a display unit (screen) for displaying various information and the like, and an operation input unit for operating and inputting data on the display screen (various input fields thereof). (For example, keyboard / mouse), transmission / reception unit (communication unit) for transmitting / receiving various signals / data, storage unit (for example, memory, hard disk) for storing various programs / various data, control for controlling these Part (for example, CPU etc.) etc.

  The computer 2 may be a network device, other devices, a main frame, or the like.

(Prerequisite configuration)
Here, before describing the characteristic configuration of the present embodiment, the configuration of the operation management apparatus which is the premise of the present embodiment will be described with reference to FIGS. 2 and 3.

  Referring to FIG. 2, the operation management apparatus 3 showing the precondition of the present embodiment includes a service execution unit 21, a performance information accumulation processing unit 12, an information collection unit 22, an analysis setting accumulation processing unit 14, , A failure analysis unit 26, an administrator dialogue unit 27, and a countermeasure execution unit 28.

  The service execution unit 21 provides information communication services such as a WEB service and a business service. The service execution unit 21 can also be configured by another independent computer or the like.

  The performance information accumulation processing unit 12 accumulates performance information of each element of the service execution unit 21.

  The information collection unit 22 detects and outputs the operation state of the service execution unit 21 and accumulates performance information included in the operation state in the performance information accumulation processing unit 12.

  The analysis setting accumulation processing unit 14 accumulates analysis settings for detecting an abnormality in the service execution unit 21.

  The failure analysis unit 26 receives the operation state from the information collection unit 22 and performs failure analysis according to the analysis setting of the analysis setting accumulation processing unit 14.

  The administrator dialogue unit 27 receives the result of the failure analysis from the failure analysis unit 26, presents it to the administrator, receives the administrator's input, and instructs the countermeasure execution unit 28 according to the administrator's input.

  The coping execution unit 28 executes a process for coping with a failure on the service execution unit 21 in accordance with an instruction from the administrator dialogue unit 27.

  FIG. 3 shows an example of performance information output from the information collection unit 22 and accumulated in the performance information accumulation processing unit 12. The performance information 12a indicates a list of performance information that is sequentially collected as the service execution unit 28 changes its state. Referring to the performance information 12a, each piece of performance information is composed of performance values at the same time, and these are listed at regular time intervals.

  The operation of the operation management apparatus 3 having the above-described configuration will be described with reference to FIGS.

  First, the information collection unit 22 in FIG. 2 detects the operating state of the service execution unit 21 and accumulates performance information in the performance information accumulation processing unit 12. For example, when the WEB service is executed by the service execution unit 21, the CPU usage rate and the remaining memory capacity of each server providing the WEB service are detected at regular time intervals.

  The performance information 12a in FIG. 3 is an example of performance information detected in this way. For example, “SV1.CPU” indicates the value of the CPU usage rate of one server, and the value of 17:25 on October 5, 2007 is 12. Further, values such as 15, 34, 63 are detected from 17:26 at intervals of 1 minute. Similarly, “SV1.MEM” detects the value of the remaining memory capacity of the same server, and “SV2.CPU” detects the value of the CPU usage rate of another server at the same time.

  Next, the failure analysis unit 26 performs failure analysis according to the analysis settings stored in the analysis setting storage processing unit 14. As the analysis setting, for example, it is specified that a warning message is presented to the administrator if the CPU usage rate is equal to or higher than a certain value, and according to this, from the value of the performance information detected by the information collecting unit 22, A threshold is used to determine whether the load on a specific server is high.

  The administrator dialogue unit 27 presents the result of such failure analysis to the administrator, and when the administrator inputs an instruction for some countermeasure, the countermeasure command is executed on the service execution unit 21 via the countermeasure execution unit 28. Execute.

  For example, the administrator knows that the CPU load is high, and can reduce the amount of work or change the configuration for load distribution.

  Thereafter, if the value of the performance information collected by the information collecting unit 22 is decreased at regular time intervals, the failure analyzing unit 26 determines that the failure has been recovered, and the result is sent via the administrator dialogue unit 27. It will be presented to the administrator. By repeating such information collection, analysis, and handling processes, the service execution unit 21 continues to handle failures.

  In addition to the presupposed configuration, the present embodiment has the following characteristic configuration.

(Characteristic configuration of the present embodiment)
Here, a characteristic configuration of the operation management apparatus according to the first embodiment of this invention will be described with reference to FIG. FIG. 4 is a block diagram illustrating an example of a characteristic configuration of the operation management apparatus according to the first embodiment of this invention.

  As shown in FIG. 4, the operation management apparatus 100 according to the first embodiment of the present invention has the same configuration as that of the operation management apparatus 3 shown in FIG. 2, and includes a service execution unit 121, a performance information accumulation processing unit 112, In addition to the information collection unit 122, the analysis setting accumulation processing unit 114, the failure analysis unit 126, the administrator dialogue unit 127, and the countermeasure execution unit 128, the correlation model generation unit 123, the correlation model information accumulation processing unit 116, and the correlation change analysis Part 124.

  The correlation model generation unit 123 extracts performance information for a certain period from the performance information accumulation processing unit 116, and converts one of the two time performance information values as an input and the other as an output. And a sequence of performance values generated by this conversion function and an actual detection value sequence of performance information to be output are compared, and weight information of the conversion function is calculated from the difference between the values. Furthermore, by repeating these processes for all performance information, a correlation model of the overall operating state of the service execution unit 121 is generated.

  The correlation model accumulation processing unit 116 accumulates the correlation model generated by the correlation model generation unit 123.

  The correlation change analysis unit 124 receives the newly detected performance information from the information collection unit 122, and the performance value included in the performance information is stored between the performance information of the correlation models stored in the correlation model information storage processing unit 116. Analyzes whether the relationship represented by the conversion function is satisfied within a certain error range, and outputs the result.

  The failure analysis unit 126 receives the analysis result of the correlation change analysis unit 124 and performs failure analysis together with other analysis such as threshold determination.

  Here, as shown in FIG. 5, each of these units can be configured as a plurality of functions exhibited by the control unit.

  The correlation change analysis unit 124 calculates predicted performance information about the second element based on the newly detected performance information about the first element and the correlation function, and the newly detected It is also possible to compare the performance information related to the second element and the predicted performance information to calculate a prediction error, and analyze whether or not the prediction error satisfies a certain error range.

  Further, the correlation change analysis unit 124 determines that the correlation between the first element and the second element is broken when the prediction error is outside the error range, and each element An abnormal score can also be calculated.

  In addition, the correlation change analysis unit 124 may control to rank and present each element based on the abnormality score.

(Correlation model generation)
Here, an outline of correlation model generation by the correlation model generation unit 123 will be described with reference to FIG. FIG. 6 is an explanatory diagram showing an example of the outline of correlation function generation of the operation management apparatus according to the present embodiment.

  The correlation function generation can be performed by processing of step S103 (correlation function generation function) for generating a correlation function (conversion function) and step S104 (weight information calculation function) for calculating an error shown in FIG.

  As shown in FIG. 6, the conversion function G300 receives “SV1.MEM” shown in the graph G101 when the “SV1.CPU” performance value series (first performance series information) shown in the graph G101 is input. A series of performance values (second performance series information) is output.

  This conversion function G300 is calculated by the process shown in the system identification process G301.

  As an example, in the conversion function represented by the expression “y = Ax + B”, values of “A = −0.6” and “B = 100” are calculated.

  Further, as shown by a graph G302, a weight w is generated from the difference between the predicted performance value series generated from the graph G101 by this conversion function and the actual performance value difference shown by the graph G102.

  FIG. 7 is an example of a correlation model of the operation management apparatus according to this embodiment. In the correlation model 116a, the name of the performance value series that is the input of the conversion function, the name of the performance value series that is the output, the value of each coefficient that specifies the conversion function, the weight information, and whether the correlation is valid And correlation determination information indicating invalidity. For example, as a result of calculating the conversion function shown in FIG. 6, “SV1.CPU” is input, “SV1.MEM” is output, and the conversion function represented by the expression “y = Ax + B” is the value of coefficient A Is stored as “−0.6”, the coefficient B is “100”, and the weight is “0.88”. Furthermore, the correlation is “valid”, which means that the correlation is not broken and maintained.

(About correlation change analysis)
The outline of the correlation change analysis by the correlation change analysis unit 124 will be described with reference to FIG. FIG. 9 is an explanatory diagram showing an example of the outline of the correlation change analysis of the operation management apparatus according to the present embodiment.

  A correlation graph G310 in FIG. 9 is an example of a correlation model of the correlation model information accumulation processing unit 116. The CPU usage rate and the CPU load of the three servers SV1 to SV3 are represented by elements A to F of the performance information, respectively. ing.

  For example, the element A is “SV1.CPU”, and the performance information related to the element A means the CPU usage rate of the first server. The element D is “SV3.MEM”, and the performance information regarding the element D means that the CPU load of the second server.

  A line connecting each element is a relationship represented by a transformation function of the correlation model, a weight information represented by a range of 0 to 1 is a relationship of 0.5 or more by a bold line, and other than that Things are represented by thin lines.

  For example, the correlation between the element A and the element B is a thick line, which means that the weight information of the correlation model is 0.5 or more. The correlation between element A and element F is a thin line, which means that the weight information of the correlation model is less than 0.5.

  Since the weight information is calculated from the error of the conversion function, the thickness of this line represents the strength of the relationship. For example, the correlation change analysis unit 124 extracts only a stable relationship having a weight of 0.5 or more from the correlation graph G310, and obtains a relationship such as a correlation model G311.

  FIG. 10 is an explanatory diagram showing an example of how the correlation is destroyed when new performance information is detected in the operation management apparatus according to the present embodiment. In the correlation graph G312 illustrated in FIG. 10, among the correlations illustrated in the correlation graph G311, the correlation between the element A and the element C and the correlation between the element B and the element C is broken (indicated by a dotted line).

(About processing procedure)
(Overall processing)
Next, the processing of each unit in the operation management apparatus having the above-described configuration can be realized as a method, and various processing procedures as an information processing method will be described with reference to FIGS. 11 to 13.

  FIG. 11 is a flowchart illustrating an example of a processing procedure in the operation management apparatus according to the first embodiment of the present invention.

  The information processing method according to the present embodiment performs information processing for controlling and managing the managed device based on performance information for each of a plurality of types of performance items acquired from a plurality of managed devices constituting the system. (For example, one or a plurality of computers or other devices).

  In this information processing method, as a basic configuration, when the performance item or the managed device is used as an element, first performance series information indicating a time series change of performance information related to at least the first element; A correlation function with the second performance sequence information indicating the time series change of the performance information related to the elements of the first, a correlation model is generated based on the correlation function, and the correlation model is obtained for the combination between the elements. Based on the model generation step (for example, step S11 shown in FIG. 11) and the performance information newly detected and acquired from the managed device, a correlation change analysis step for analyzing the change of the correlation model (for example, FIG. 11). Step S12 shown in FIG.

  Hereinafter, detailed processing of these “correlation model generation” and “correlation change analysis” will be described.

(Detailed processing of correlation model generation)
FIG. 12 is a flowchart illustrating an example of a detailed processing procedure for generating a correlation model in the operation management apparatus according to the first embodiment of the present invention.

  In the detailed processing of generating the correlation model in the present embodiment, first, the operation state of the service execution unit 121 is collected by the information collecting unit 122, and the performance information 12a shown in FIG.

  Here, the correlation model generation unit 123 reads the performance information 12a from the performance information accumulation processing unit 112 (step S101 shown in FIG. 12).

  Next, the presence / absence of unanalyzed performance information is determined (step S102).

  In the state where the correlation model has not been generated, there is unanalyzed performance information, and therefore the process proceeds to processing for calculating a conversion function between performance information (step S103).

  First, a conversion function of the performance value series “SV1.CPU” and the performance value series “SV1.MEM” of the performance information 12a is calculated.

  Referring to FIG. 6, a conversion function G300 having “SV1.CPU” as an input x and “SV2.MEM” as an output y is determined by the system identification process G301.

  In general, there are several methods for such system identification. For example, “y = Ax (t) + Bx (t−1) + Cx (t−2) + Dy (t−1) + Ey (t−2) ) + F ”, the conversion function can be calculated by determining the values of the variables A to F so that the time series value of y calculated from x is closest to the actually detected value.

  In the following, in order to simplify the description, description will be made in the form of determining A and B of the expression “y = Ax + B”, but the present invention is not limited to this example, and even if another system identification method is used, 1 is used. A similar effect can be obtained as long as the conversion function can calculate another performance value series from one performance value series.

  Referring to the system identification process G301 in FIG. 6, “y = Ax + B” is selected as a function, and “−0.6” and “100” are determined as values of A and B that can approximate the graph G102 from the graph G101, respectively. (Step S103 shown in FIG. 12).

  Further, as shown in the graph G302, the weight value information of the conversion function is calculated from the conversion error that is the difference between the predicted value series calculated by the conversion function of the graph G101 and the performance value series of the graph G102. (Step S104 shown in FIG. 12) <weight information calculation step or weight information calculation function>.

  Thereafter, the calculated conversion function and weight information are added to the correlation model (step S105).

  FIG. 7 is an example of the correlation model added in this way, and the values of A, B, and W are accumulated as the correlation between “SV1.CPU” and “SV2.MEM”.

  Thereafter, similarly, the processing from step S103 to step S105 is performed on all combinations of the performance value series included in the performance information 12a, so that the correlation model accumulation processing unit 116 is informed about the performance information of the current system. The correlation model is completed.

  The correlation model 116b in FIG. 8 is an example of the correlation model generated in this way. In addition to the correlation model 116a in FIG. 7, conversion functions relating to “SV3.CPU” and “SV2.CPU” are added. Yes.

(Detailed processing of correlation change analysis)
Next, detailed processing of correlation change analysis in the present embodiment will be described with reference to FIG. 13, FIG. 9, and FIG. FIG. 13 is a flowchart illustrating an example of a detailed processing procedure of correlation change analysis of the operation management apparatus according to the present embodiment.

  First, as shown in FIG. 13, the correlation change analysis unit 124 reads the correlation model from the correlation model information accumulation processing unit 116 (step S201 shown in FIG. 13), and selects the correlation according to the weight information included in the correlation model. (Step S202).

  A correlation graph G310 in FIG. 9 is an example of a correlation model of the correlation model information accumulation processing unit 116. The CPU usage rate and the CPU load of the three servers SV1 to SV3 are represented by elements A to F of the performance information, respectively. ing.

  A line connecting each element is a relationship represented by a transformation function of the correlation model, a weight information represented by a range of 0 to 1 is a relationship of 0.5 or more by a bold line, and other than that Things are represented by thin lines.

  Since the weight information is calculated from the error of the conversion function, the thickness of this line represents the strength of the relationship. For example, the correlation change analysis unit 124 extracts only a stable relationship having a weight of 0.5 or more from the correlation graph G310, and obtains a relationship such as a correlation model G311.

  In the correlation graph G312 illustrated in FIG. 10, among the correlations illustrated in the correlation graph G311, the correlation between the element A and the element C and the correlation between the element B and the element C is broken (indicated by a dotted line).

  Next, the correlation change analysis unit 124 acquires performance information newly detected and acquired from the information collection unit 122 (step S203).

  For example, in the performance information 12a of FIG. 3, when the performance information at the time “2007/11/07 8:30” in the bottom row is obtained, the conversion functions described in the correlation model 116b shown in FIG. 8 are sequentially searched. .

  That is, it is determined whether or not there is an unsearched correlation model (step S204). In this determination process, when it is determined that there is no unsearched correlation model, the process proceeds to step S208, and details of the destroyed correlation are output.

  On the other hand, in this determination process, when it is determined that there is an unsearched correlation model, the process proceeds to step S205, and a conversion error of the performance value is calculated.

  For example, for the value “20” of “SV1.CPU”, (−0.6) * (20) +100 is calculated to calculate a predicted value of “88”, and the detected value of “SV1.MEM” A value of error “9” is obtained as compared with a certain “79” (step S205).

  Subsequently, the ratio of this error to the detected value is calculated. Then, a process for determining whether or not this error is equal to or greater than a certain value (whether or not it is within a certain range) is performed (step S206).

  In this determination process, if it is determined that this error is not equal to or greater than a certain value, the process returns to step S204 and the subsequent processes are repeated.

  On the other hand, in this determination process, when it is determined that the error is greater than or equal to a certain value, the process proceeds to step S207, the correlation destruction abnormality score is calculated, and the process returns to step S204.

  For example, if the value is smaller than 20% that is predetermined in step S206, the correlation is maintained and the process returns to step S204.

  Similarly, the prediction error of “SV1.CPU” and “SV2.CPU” is calculated (step S205), and when it is detected that the value exceeds 20% (step S206), the correlation is broken. And the abnormal score of each element is calculated (step S207).

  Thereafter, all correlations are sequentially searched (step S204), and an analysis result including a list of destroyed correlations and an abnormal score is output to the failure analysis unit 126 (step S208).

  FIG. 10 shows the state of correlation destruction detected in this way. In the correlation graph G312, among the correlations shown in the correlation graph G311, the correlation between the element A and the element C and the correlation between the element B and the element C is broken (indicated by a dotted line).

  The failure analysis unit 126 receives such a result and presents it to the administrator together with other failure analysis results.

  An example of a display screen showing the result of such correlation change analysis is shown in FIG. FIG. 14 shows an example of a display screen displayed on the display unit of the operation management apparatus. In the figure, an example of a display screen (correlation change analysis result screen) in correlation change analysis is shown.

  As shown in FIG. 14, the display screen U100 (correlation change analysis result screen) displayed on the display unit includes a correlation graph display unit U140 that displays a correlation graph. The correlation graph display unit U140 can display the state and transition state of the correlation graph shown in FIGS. 9 and 10 described above. In this example, the correlation destruction is indicated by a bold line, and the element having a high abnormality score is indicated by a bold circle.

  Furthermore, the display screen U100 includes an abnormal score element list display unit U120 that lists elements with high abnormal scores in order. The abnormal score element list display unit U120 can display an element (performance item), the amount of abnormal score of the element, other information, and the like.

  Further, the display screen U100 displays the correlation change analysis result of the correlation failure rate in the correlation graph of the correlation graph display unit U140 and the element having the maximum abnormal score in the abnormal score element list of the abnormal score element list display unit U120. Has an analysis result display unit U110.

  Furthermore, the display screen U100 includes a correlated destruction number change graph display unit U130 that displays the change over time in the number of correlated destructions as a graph.

  Furthermore, the display screen U100 includes a first display operation unit U152 for displaying a list of destruction correlations. The display screen U100 includes a second display operation unit U154 for displaying detailed information of the selected element. The display screen U100 includes a third display operation unit U156 for ending the display of the correlation change analysis result screen.

  Further, as shown in FIG. 14, the display screen U100 shows that, as a result of the correlation change analysis, two correlations, which are 25% of the correlation shown in the correlation graph G311, are destroyed as a result of the correlation destruction. Since the two correlations are both related to the element C, the abnormal score ordering list indicates that the abnormal score of the element C “SV2.CPU” is high.

  By referring to this result, the administrator can know that an abnormality in the performance value has occurred and that it is caused by “SV2.CPU”.

  The correlation change analysis step can be performed by the above steps S201 to S208.

  In the correlation change analysis step, predicted performance information about the second element is calculated based on the newly detected performance information about the first element and the correlation function, and the newly detected first A prediction error can be calculated by comparing the performance information on the second element and the prediction performance information, and it can be analyzed whether or not the prediction error satisfies a certain error range.

  In the correlation change analysis step, when the prediction error is outside the error range, it is determined that the correlation between the first element and the second element is broken, and An abnormal score can be calculated.

  Furthermore, in the correlation change analysis step, the respective elements can be ranked and controlled to be presented based on the abnormality score.

  As described above, according to the present embodiment, the correlation model generation unit derives a conversion function when one is input and the other is output with respect to a time series of two arbitrary performance information values. To generate a correlation model. When the correlation change analysis unit newly detects performance information, it determines whether or not the performance value is in accordance with the conversion function of this correlation model, and the failure analysis unit stores information including the number and amount of broken correlations. Output to. In this way, the location of occurrence of an abnormality can be specified based on whether or not the correlation learned during normal operation is broken.

  As a result, there is an effect that it is possible to accurately detect performance anomalies such as response deterioration and specify a place, as compared with threshold information monitoring of performance information of related technology.

  In addition, compared to a method of calculating the correlation of performance information when the related technology is abnormal, there is an effect that the normal relationship and the abnormal relationship can be distinguished and presented.

  Furthermore, these analyzes do not require the preparation of knowledge data in advance, and it is not necessary to collect processing histories other than performance information, reducing the burden on the administrator and reducing the amount of system processing. An increase can be prevented.

  In the related art, since a model is generated as a time change function of one piece of performance information, it is determined whether one piece of performance information is the same as a previously predicted value.

  In contrast, in the present embodiment, it is possible to determine whether the relationship between the values of any two pieces of performance information is maintained by generating a model as a conversion function between the two pieces of performance information.

  Furthermore, in the related technology, a “correlation rule” between two pieces of performance information is used, but how to generate this rule is not described at all, and the burden of rule generation for finding singularities is not described. There was a problem that was large.

  In the related art, the correlation coefficient is a value, and a conversion function between two pieces of performance information is not calculated. The characteristics of the method for deriving the conversion function are different from those of other analysis methods. In the related art, as a result of the calculation, it is possible to derive which model is similar in advance, but the method for determining the contents of the prepared model is unknown.

  On the other hand, in the present embodiment, a model with few false alarms can be generated by extracting a strong correlation as shown in FIG. Further, by analyzing from a one-to-one conversion function, it is possible to rank the degree of abnormality for each element as shown in FIG.

  Here, some of the blocks (for example, reference numerals 123, 124, 121, 122, 126, 127, and 128) in the block diagram shown in FIG. 4 execute various programs stored in appropriate memories by the computer. Therefore, a software module configuration indicating a state functionalized by the program may be used.

  That is, the physical configuration is, for example, one or a plurality of CPUs (or one or a plurality of CPUs and one or a plurality of memories), etc., but the software configuration by each unit (circuit / means) is exhibited by the CPU by controlling the program. A plurality of functions are expressed as components by a plurality of units (means).

  When the CPU dynamically expresses a dynamic state (a state in which each procedure constituting the program is executed) executed by the program, each unit (means) is configured in the CPU. In a static state in which the program is not executed, the entire program (or each program part included in the configuration of each unit) that realizes the configuration of each unit is stored in a storage area such as a memory.

  The description of each part (means) described above can be interpreted as a computer functionalized by a program together with the function of the program, or a plurality of functions permanently functioning by specific hardware. Naturally, it can be interpreted that the device comprising the electronic circuit block is described. Therefore, these functional blocks can be realized in various forms by hardware only, software only, or a combination thereof, and is not limited to any one.

  In addition, each unit may be configured as a device including a dedicated computer capable of communication, and the operation management system may be configured by these devices.

[Second Embodiment]
Next, a second embodiment according to the present invention will be described with reference to FIG. In the following, description of the substantially similar configuration of the first embodiment will be omitted, and only different parts will be described. FIG. 15 is a block diagram showing an example of the second embodiment of the operation management apparatus of the present invention.

  The configuration in the present embodiment includes a change history information accumulation processing unit 218 and a steady change analysis unit 231 in addition to the configuration described with reference to FIG. 4 of the first embodiment.

  Specifically, as shown in FIG. 15, the operation management apparatus 200 according to the present embodiment includes a service execution unit 221, a performance information accumulation processing unit 212, and an information collection unit that are configured according to the first embodiment. 222, analysis setting accumulation processing unit 214, failure analysis unit 226, administrator dialogue unit 227, coping execution unit 228, correlation model generation unit 223, correlation model information accumulation processing unit 216, correlation change analysis unit 224, change history An information accumulation processing unit 218 and a steady change analysis unit 231 are included.

  The change history information accumulation processing unit 218 accumulates the correlation change history information analyzed by the correlation change analysis unit 224.

  The steady-state change analysis unit 231 reads the correlation destruction history from the change history information accumulation processing unit 218, and accumulates the correlation model information accumulation processing unit 216 when it finds a correlation that has been destroyed for a certain period of time. Invalidate the corresponding correlation in the correlation model.

  In addition, the steady change analysis unit 231 instructs the correlation model generation unit 223 to regenerate the correlation model when the invalidated correlation reaches a certain ratio.

  Here, as shown in FIG. 16, each of these units can be configured as a plurality of functions exhibited by the control unit.

  Further, the steady change analysis unit 231 can analyze whether or not the correlation of the correlation model is constantly destroyed.

  Further, the steady change analysis unit 231 can invalidate the correlation model in which the correlation is constantly destroyed.

  The steady change analysis unit 231 may instruct the correlation model generation unit to regenerate the correlation model when the invalidated correlation model occupies a certain ratio or more in all correlation models. it can.

  Further, the steady change analysis unit 231 controls to indicate that the correlation model needs to be regenerated when the invalidated correlation model occupies a certain ratio or more in all correlation models. be able to.

(About correlation destruction in steady-state analysis)
Here, an overview of correlation destruction in steady analysis by the steady change analysis unit 231 will be described with reference to FIG. FIG. 17 is an explanatory diagram showing an example of the outline of correlation destruction in the steady analysis of the operation management apparatus according to the present embodiment.

  As shown in FIG. 17, in the correlation graph G321, the correlation between the element D and the element E and between the element E and the element F is constantly broken (indicated by a dotted line).

  In the correlation model 116b shown in FIG. 8, the steady-state change analysis unit 231 has a correlation valid column between “SV3.CPU” and “SV3.MEM” and between “SV2.MEM” and “SV3.MEM”. By setting “x” to “x”, the correlation model as shown in the correlation model 216b shown in FIG. 18 is corrected.

  An example of the graph corresponding to the correlation model 216b is a graph G322 shown in FIG.

  Thereafter, the correlation change analysis unit 224 reads this correlation model and performs analysis only with the correlation that has not been invalidated, thereby preventing the destruction of these correlations from being constantly detected.

(About processing procedure)
Next, the processing of each unit in the operation management apparatus having the above-described configuration can be realized as a method, and various processing procedures as the operation management method will be described with reference to FIGS. 19 to 20. FIG. 19 is a flowchart illustrating an example of a processing procedure in the operation management apparatus according to the second embodiment of the present invention.

  The information processing method according to the present embodiment performs information processing for controlling and managing the managed device based on performance information for each of a plurality of types of performance items acquired from a plurality of managed devices constituting the system. (For example, one or a plurality of computers or other devices).

  In this information processing method, as a basic configuration, when the performance item or the managed device is used as an element, first performance series information indicating a time series change of performance information related to at least the first element; A correlation function with the second performance sequence information indicating the time series change of the performance information related to the elements of the first, a correlation model is generated based on the correlation function, and the correlation model is obtained for the combination between the elements. Based on the model generation step (for example, step S21 shown in FIG. 19) and the performance information newly detected and acquired from the managed device, a correlation change analysis step for analyzing the change of the correlation model (for example, FIG. 19). Step S22 shown in FIG.

  Furthermore, this information processing method can include a steady change analysis step (for example, step S23 shown in FIG. 19) for analyzing whether or not the correlation of the correlation model is constantly destroyed.

  Here, since the detailed processing of “correlation model generation” and “correlation change analysis” is the same as that described in the first embodiment, the detailed processing of “steady change analysis” will be described below. explain.

(Detailed processing of steady change analysis)
FIG. 20 is a flowchart illustrating an example of a detailed processing procedure of steady change analysis of the operation management apparatus according to the present embodiment.

  The correlation change analysis unit 224 according to the present embodiment accumulates the history in the change history information accumulation processing unit 218 when the destruction of the correlation is detected.

  As illustrated in FIG. 20, the steady change analysis unit 231 of the computer provided in the operation management apparatus reads the correlation destruction history and acquires the correlation destruction history information (step S301).

  Subsequently, it is determined whether or not there is a correlation that is constantly destroyed (step S302).

  In this determination process, when it is determined that there is no correlation that is constantly destroyed, the process ends.

  On the other hand, in this determination process, when it is determined that there is a correlation that is constantly destroyed, the process proceeds to step S303.

  That is, when there is a correlation that is continuously destroyed (step S302), the corresponding correlation among the correlation models stored in the correlation model information storage processing unit 216 is invalidated (step S303). .

  FIG. 17 shows an example of such correlation destruction. As shown in FIG. 17, in the correlation graph G321, the correlation between the element D and the element E and between the element E and the element F is constantly broken (indicated by a dotted line).

  In the correlation model 116b shown in FIG. 8, the steady-state change analysis unit 231 has a correlation valid column between “SV3.CPU” and “SV3.MEM” and between “SV2.MEM” and “SV3.MEM”. By setting “x” to “x”, the correlation model as shown in the correlation model 216b shown in FIG. 18 is corrected.

  Thus, a graph such as a graph G322 shown in FIG. 17 is obtained so as to correspond to the correlation model 216b.

  Thereafter, the correlation change analysis unit 224 reads this correlation model and performs analysis only with the correlation that has not been invalidated, thereby preventing the destruction of these correlations from being constantly detected.

  Further, the steady change analysis unit 231 performs a determination process as to whether or not the correlation thus invalidated exceeds a certain ratio in the correlation model (step S304).

  In this determination process, if it is determined that the invalidated correlation does not exceed a certain ratio, the process ends.

  On the other hand, in this determination process, if it is determined that the invalidated correlation has reached a certain ratio or more, the process proceeds to step S305.

  That is, in the correlation model, when the correlation invalidated in this way becomes a certain ratio or more (step S304), the steady change analysis unit 231 instructs the correlation model generation unit 223 to create a new correlation. A model is generated (step S305).

  FIG. 21 shows an example of the dialogue screen when the invalidation of the correlation model increases in this way. FIG. 21 shows an example of a display screen displayed on the display unit of the operation management apparatus.

  As shown in FIG. 21, the display screen U200 (model re-creation screen) displayed on the display unit includes a model-related information display unit U220 that displays model-related information such as a model name, creation date, correlation number, and steady fracture. Have.

  Furthermore, the display screen U200 includes a display unit U210 that displays a message related to model creation. Further, the display screen U200 includes a first display operation unit U242 for referring to the model. The display screen U200 includes a second display operation unit U244 for recreating a model under specific recreation conditions. The display screen U200 includes a third display operation unit U246 for ending the display of the model recreation screen.

  In this way, the administrator can know from the information from the system that the correlation model used for the analysis is no longer suitable for the current operation status.

  The steady change analysis step can be performed by the above steps S301 to S305. In the steady change analysis step, the correlation model in which the correlation is constantly destroyed can be invalidated.

  Further, in the steady change analysis step, when the proportion of the invalidated correlation model in all the correlation models becomes equal to or greater than a certain level, the regeneration of the correlation model can be instructed.

  Further, in the steady change analysis step, when the ratio of the invalidated correlation model to all correlation models becomes a certain ratio or more, control is performed so as to indicate that the correlation model needs to be regenerated. Can do.

  As described above, according to the present embodiment, the elements that are constantly destroyed by the correlation model once created by the steady-state change analysis unit are invalidated while having the same operational effects as the first embodiment. To do.

  Thereby, even when the characteristics of the system gradually change, unnecessary abnormality detection can be suppressed and accurate performance abnormality detection can be performed.

  Further, when the number of elements to be invalidated increases, the necessity of recreating the correlation model can be presented to the administrator, so that highly accurate analysis can always be maintained.

  Other configurations, other steps or functions, and the effects thereof are the same as those in the above-described embodiment. In the above description, the operation content of each step described above, the components of each unit, and the functions thereof may be programmed and executed by a computer.

[Other variations]
Also, although the apparatus and method according to the present invention have been described according to some specific embodiments thereof, the embodiments described in the text of the present invention can be used without departing from the spirit and scope of the present invention. Various modifications are possible.

  For example, the number, position, shape, and the like of the constituent members are not limited to the above-described embodiment, and can be set to a suitable number, position, shape, and the like in practicing the present invention. That is, in the above embodiment, the judgment whether or not the correlation when calculating the abnormal score in the correlation change analysis is broken has shown the case where the prediction error exceeds 20%. It does not limit the number.

  Further, the classification is not limited to two cases with correlation destruction and without correlation destruction, and may be classified into a plurality of stages.

  The operation management software of the present invention may be installed on a single PC, or may be configured to be used by terminals and servers in a client / server system and P2P. Various display screens may be accessible on the Web.

(program)
Further, the software program of the present invention that realizes the functions of the above-described embodiments is a program corresponding to the processing unit (processing means), functions, etc. shown in the various block diagrams in each of the above-described embodiments, Each processing program processed in the processing procedure, processing means, function, etc. shown in the flowchart etc., the method (step) generally described in this specification, the processing described, the data Including the whole or each part.

  Specifically, the operation management program of the present invention is provided with an operation management apparatus that acquires performance information for each of a plurality of types of performance items from a plurality of managed apparatuses constituting the system, and operates and manages the managed apparatus. It is possible to realize various functions on a computer.

  The operation management program includes, when the performance item or the managed device is an element, first performance series information indicating a time series change of performance information relating to at least the first element, and performance information relating to the second element. A correlation model generation function (for example, a function for generating a correlation model based on the correlation function and obtaining a correlation model for the combination between the elements) Correlation for analyzing changes in the correlation model based on the configuration such as reference numeral 123 shown in FIG. 4 and the function of step S11 shown in FIG. 11 and the performance information newly detected and acquired from the managed device. A computer can realize a function including a change analysis function (for example, a configuration such as reference numeral 124 shown in FIG. 4 and a function of step S12 shown in FIG. 11). Kill.

  In the correlation change analysis function, the operation management program calculates predicted performance information about the second element based on the newly detected performance information about the first element and the correlation function. The computer has a function of calculating a prediction error by comparing performance information relating to the newly detected second element and the predicted performance information, and analyzing whether the prediction error satisfies a certain error range. Can be realized.

  Further, the operation management program determines that the correlation between the first element and the second element is destroyed in the correlation change analysis function when the prediction error is outside the error range. In addition, it is possible to cause the computer to realize the function of calculating the abnormality score of each element.

  In addition, the operation management program can cause the computer to realize a function of ranking and controlling the elements based on the abnormality score in the correlation change analysis function.

  Further, the operation management program is configured to analyze whether or not the correlation of the correlation model is constantly destroyed (for example, a configuration such as reference numeral 231 shown in FIG. 15, step S23 shown in FIG. 19). Can be realized by a computer.

  In addition, the operation management program can cause the computer to realize a function of invalidating the correlation model in which the correlation is constantly destroyed in the steady change analysis function.

  Further, the operation management program includes a function for instructing regeneration of the correlation model when the ratio of the invalidated correlation model to all correlation models exceeds a certain level in the steady change analysis function. Can be realized.

  Further, the operation management program indicates that, in the steady change analysis function, the correlation model needs to be regenerated when the invalidated correlation model occupies a certain ratio or more in all correlation models. The function of controlling to be able to present can be realized in the computer.

  The program may be in any form such as an object code, a program executed by an interpreter, or script data supplied to the OS. The program can be implemented in a high level procedural or object oriented programming language, or in assembly or machine language as required. In either case, the language may be a compiler or interpreted language. Also included is a program in which the above-described program is incorporated into application software that can be operated on a general personal computer or a portable information terminal.

  As a method of supplying the program, it is also possible to provide the program from an external device that is communicably connected to the computer via an electric communication line (whether wired or wireless). For example, the program can be supplied by connecting to a homepage on the Internet using a browser on a computer and downloading the program itself or a compressed file including an automatic installation function from the homepage to a recording medium such as a hard disk. It can also be realized by dividing the program code constituting the program into a plurality of files and downloading each file from a different home page. That is, a server that allows a plurality of users to download a program file for realizing the functional processing of the present invention on a computer is also included in the scope of the present invention.

  According to the program of the present invention, if the control program is read into a computer (CPU) from a storage medium such as a ROM storing the control program and executed, or the control program is transmitted to the computer via communication means. If the device is executed after being downloaded, the above-described apparatus according to the present invention can be realized relatively easily. When the software of the apparatus is embodied as an embodiment of the idea of the invention, it naturally exists and is used on a storage medium storing such software.

  Moreover, the program is the same without any question about the copying stage of the primary copy product, the secondary copy product, etc. If the program is supplied using a communication line, the communication line becomes a transmission medium and the present invention is used. Of course, it can also be specified as a program invention. Furthermore, the dependent claims in the apparatus may be configured to correspond to the dependent claims in the method and the program.

(Information recording medium)
Moreover, the structure which recorded the above-mentioned program on the information recording medium may be sufficient. The information recording medium stores an application program including the above-described program, and the computer can read the application program from the information recording medium and install the application program on the hard disk. Thus, the program can be provided by being recorded on an information recording medium such as a magnetic recording medium, an optical recording medium, or a ROM. Use of an information recording medium in which such a program is recorded in a computer constitutes a convenient information processing apparatus.

  As an information recording medium for supplying the program, for example, ROM, RAM, semiconductor memory such as flash memory and SRAM, and an integrated circuit, or a USB memory, memory card, optical disk, magneto-optical disk, magnetic recording medium and the like including them. Further, flexible disk, CD-ROM, CD-R, CD-RW, FD, DVDROM, HDDVD (HDDVD-R-SL <1 layer>, HDDVD-R-DL <2 layers>, HDDVD-RW) -SL, HDDVD-RW-DL, HDDVD-RAM-SL), DVD ± R-SL, DVD ± R-DL, DVD ± RW-SL, DVD ± RW-DL, DVD-RAM, Blu-Ray Disk <registration Trademark> (BD-R-SL, BD-R-DL, BD-RE-SL, BD-RE-DL), MO It is recorded on a portable medium such as ZIP, magnetic card, magnetic tape, SD card, memory stick, non-volatile memory card, IC card, etc., a storage device such as a hard disk built in a computer system, etc. Good.

  Furthermore, the “information recording medium” is a medium that dynamically holds a program for a short time (transmission medium), such as a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. Or a transmission wave), a volatile memory inside a computer system serving as a server or a client in that case, and those holding a program for a certain period of time.

  In addition, when an OS running on a computer, an RTOS on a terminal (for example, a mobile phone) performs part or all of the processing, the same functions as those in the above embodiment can be realized and An effect can be obtained.

  Furthermore, the program is encrypted, stored in a recording medium such as a CD-ROM, distributed to the user, and the user who clears the predetermined condition is allowed to download key information for decryption from the homepage via the Internet, and It is also possible to execute the encrypted program by using the key information and install the program on a computer. In this case, the configuration of the present invention may include each component (various means, steps and data) of the program and encryption means for encrypting the program (various means, steps and data).

  In the above embodiment, the client server system has been described as an example. However, a system based on peer-to-peer (Peer To Peer) communication in which terminals form a network without passing through a server and transmit / receive data to / from each other may be used. . At this time, the management apparatus may be a master terminal in the peer-to-peer system. Also, the “system” in the above-described embodiment is integrated with other “information processing system”, and the entire system is the main terminal. The configuration as the “system” of the invention may be performed in any way. The “information processing system” includes an OS and hardware such as peripheral devices.

  In addition, the “system” in the above embodiments refers to a logical collection of a plurality of devices, and it does not matter whether the devices of each configuration are in the same housing. For this reason, this invention may be applied to the system comprised from a some apparatus, and may be applied to the apparatus which consists of one apparatus. The “system” may include hardware such as an OS and peripheral devices.

  Furthermore, as an information processing apparatus in which the above-described program or the like is installed, the server is not limited to a personal computer, for example, but includes various servers, EWS (engineering workstation), medium-sized computers, mainframes, and the like. In addition to the above examples, information terminals include portable information terminals, various mobile terminals, PDAs, mobile phones, wearable information terminals, various (such as portable) televisions, DVD recorders, various acoustic devices and their remote controllers, A configuration that can be used from home appliances equipped with an information communication function, game devices having a network function, and the like may also be used. Or what was improved as an application displayed on these terminals can also be included in the scope of the present invention.

  Further, the program may be for realizing a part of the above-described functions, and further, a program that can realize the above-described functions in combination with a program already recorded in a computer system, a so-called difference file ( Difference program).

  Further, in the present specification, the steps shown in the flowchart include processes that are executed in parallel or individually even if they are not necessarily processed in time series, as well as processes that are executed in time series according to the described procedure. It is a waste. In the implementation, the order in which the program procedures (steps) are executed can be changed. Further, certain procedures (steps) described herein can be implemented, removed, added, or rearranged as a combined procedure (step) as needed for implementation.

  Furthermore, the functions of the program such as each means of the apparatus, each function, and the procedure function of each step may be achieved by dedicated hardware (for example, a dedicated semiconductor circuit). Some of these functions may be processed by hardware, and other functions among all functions may be processed by software. In the case of dedicated hardware, each unit may be formed by an integrated circuit such as an LSI. These may be individually made into one chip, or may be made into one chip so as to include a part or all of them. Further, the LSI may include other functional blocks such as a streaming engine. Further, the method of circuit integration is not limited to LSI, and implementation with a dedicated circuit or a general-purpose processor is also possible. Further, if integrated circuit technology comes out to replace LSI's as a result of the advancement of semiconductor technology or a derivative other technology, it is naturally also possible to carry out function block integration using this technology.

  Further, in “communication”, wireless communication and wired communication as well as communication in which wireless communication and wired communication are mixed, that is, wireless communication is performed in a certain section and wired communication is performed in another section. There may be. Further, communication from one device to another device may be performed by wired communication, and communication from another device to one device may be performed by wireless communication.

  This communication includes a communication network. As a network constituting the communication network, for example, a cellular phone network (including a base station and an exchange system), a public phone network, an IP phone network, an ISDN network such as various network networks, the Internet (Nochi, TCP. Communication mode using IP protocol), intranet, LAN [including Ethernet (registered trademark), gigabit Ethernet (registered trademark), etc.], WAN, optical fiber communication network, power line communication network, various dedicated line networks compatible with broadband, etc. Any hardware configuration may be used. In addition to the TCP / IP protocol, the network may be any communication protocol such as a network using various communication protocols, a virtual network constructed in software, or a network including any network similar thereto. Further, the network is not limited to a wired network, but includes a wireless (including satellite communication, various high-frequency communication means, etc.) network (for example, a single carrier communication system such as a simple telephone system or a mobile phone, W-CDMA or IEEE 802.11b). Network including a spread spectrum communication system such as a wireless LAN, a multi-carrier communication system such as IEEE802.11a and HiperLAN / 2, etc., or a combination of these may be used. It may be a system connected to a network. Further, the network may take any form such as point-to-point, point-to-multipoint, multipoint-to-multipoint.

  In addition, in the communication structure between the operation management apparatus and another managed apparatus, the types of interfaces formed on one or both of them are, for example, a parallel interface, a USB interface, IEEE 1394, a network such as a LAN or WAN, and the like. Any interface that is similar to this or that will be developed in the future may be used.

  Furthermore, the method for generating the correlation model and performing the correlation change analysis is not necessarily limited to a substantial apparatus, and it can be easily understood that the method also functions as the method. For this reason, the invention relating to the method is not necessarily limited to a substantial apparatus, and there is no difference that the method is also effective. In this case, an operation management apparatus, an operation management system, or the like can be included as an example for realizing the method.

  By the way, such an operation management apparatus may exist alone, or may be used in a state of being incorporated in a certain device, but the idea of the invention is not limited to this and includes various aspects. It is a waste. Therefore, it can be changed as appropriate, such as software or hardware. When the software of the apparatus is embodied as an embodiment of the idea of the invention, it naturally exists on the storage medium storing the software and is used.

  Furthermore, it may be a case where a part is software and a part is realized by hardware, and a part is stored on a storage medium and is read as needed. It may be as a thing. When the present invention is realized by software, a configuration using hardware or an operating system may be used, or may be realized separately from these.

  The scope of the invention is not limited to the illustrated example.

  Further, the above embodiments include various stages, and various inventions can be extracted by appropriately combining a plurality of disclosed constituent elements. That is, examples include combinations of the above-described embodiments, or any of them and any of the modifications. In this case, even if not specifically described in the present embodiment, the obvious effects from the respective configurations disclosed in the embodiments and their modifications are naturally included as the effects of the embodiments. it can. On the contrary, the configuration capable of exhibiting all the effects described in the present embodiment is not necessarily an essential component of the essential features of the present invention. In addition, an embodiment based on a configuration in which some of the configuration requirements are deleted from all the configuration requirements shown in the embodiment, and a technical scope based on the configuration may be an invention.

  In addition, the description so far including each of the embodiments and the modifications thereof is intended to facilitate the understanding of the present invention. The embodiments of the invention are merely shown as examples of implementation, are illustrative, not limiting, and can be modified and / or modified as appropriate. The present invention can be implemented in various forms based on its technical idea or its main features, and the technical scope of the present invention should not be construed in a limited manner by each embodiment and its modifications. It will not be.

  Therefore, each element disclosed above is intended to include all design changes and equivalents belonging to the technical scope of the present invention.

  The present invention is applicable to all computers.

1 Operation management system 2 Computer (managed device)
3, 100, 200 Operation management device 12, 112, 212 Performance information storage processing unit 14, 114, 214 Analysis setting storage processing unit 21, 121, 221 Service execution unit 22, 122, 222 Information collection unit 26, 126, 226 Failure Analysis unit 27, 127, 227 Administrator dialogue unit 28, 128, 228 Countermeasure execution unit 116, 216 Correlation model accumulation processing unit 123, 223 Correlation model generation unit 124, 224 Correlation change analysis unit 218 Change history information accumulation processing unit 231 Stationary Change analysis department

Claims (12)

An operation management device for managing a system including a plurality of managed devices,
A generating unit that generates a correlation function representing a correlation between time series of performance information acquired from the managed device;
An analysis unit that analyzes whether the correlation is maintained by applying the newly acquired performance information to the correlation function;
A display instruction unit for giving an instruction to display a second abnormality degree indicating the abnormality degree of the system together with a first abnormality degree indicating the abnormality degree of each managed device calculated based on the analysis result;
An operation management apparatus comprising: The first degree of abnormality indicates the degree of abnormality of each component included in the managed device.
The operation management apparatus according to claim 1. The display instruction unit gives an instruction to rank and display the components based on the first degree of abnormality.
The operation management apparatus according to claim 2. The display instruction unit performs an instruction to distinguish and display a correlation in which the correlation is maintained and a correlation in which the correlation is not maintained in a graph representing a correlation between the components.
The operation management apparatus according to claim 2 or 3. The display instruction unit performs an instruction to distinguish and display a component having the first degree of abnormality larger than other components in a graph representing a correlation between the components.
The operation management apparatus according to claim 2. A system including a plurality of managed devices;
An operation management device;
With
The operation management device includes:
A generating unit that generates a correlation function representing a correlation between time series of performance information acquired from the managed device;
An analysis unit that analyzes whether the correlation is maintained by applying the newly acquired performance information to the correlation function;
A display instruction unit for giving an instruction to display a second abnormality degree indicating the abnormality degree of the system together with a first abnormality degree indicating the abnormality degree of each managed device calculated based on the analysis result;
Operation management system including Generate a correlation function representing a correlation between time series of performance information acquired from a plurality of managed devices included in the system,
Analyzing whether the correlation is maintained by applying the newly acquired performance information to the correlation function,
An instruction to display a second abnormality degree indicating the abnormality degree of the system together with a first abnormality degree indicating the abnormality degree of each managed device calculated based on the result of the analysis,
Information processing method. The first degree of abnormality indicates the degree of abnormality of each component included in the managed device.
The information processing method according to claim 7. When performing the instruction, an instruction to rank and display the components based on the first abnormality degree is given.
The information processing method according to claim 8. When performing the instruction, in the graph representing the correlation between the components, an instruction to distinguish and display the correlation in which the correlation is maintained and the correlation in which the correlation is not maintained,
The information processing method according to claim 8 or 9. In the case of performing the instruction, in the graph representing the correlation between the constituent elements, an instruction to distinguish and display the constituent elements having the first abnormality degree larger than the other constituent elements is performed.
The information processing method according to claim 8. On the computer,
Generate a correlation function representing a correlation between time series of performance information acquired from a plurality of managed devices included in the system,
Analyzing whether the correlation is maintained by applying the newly acquired performance information to the correlation function,
An instruction to display a second abnormality degree indicating the abnormality degree of the system together with a first abnormality degree indicating the abnormality degree of each managed device calculated based on the result of the analysis,
An operation management program that executes processing.

Images