JP2017045146A - Information provision device, information provision method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide similar past incidents.SOLUTION: An information provision system is configured to provide information that assists in monitoring equipment or facilities, and comprises; filter processing means for filtering chronologically pre-stored event information of the equipment or facilities; generation means for generating a plurality of event series containing pre-specified event information using the event information that has been filtered by the filter processing means; computation means for computing similarities among the plurality of event series generated by the generation means; storage means configured to sort the plurality of event series according to the similarities computed by the computation means to generate incident information and store the incident information in a predetermined storage area; and information provision means configured to compute similarity between event information output by the equipment or facilities and the incident information stored in the predetermined storage area and to output the incident information according to the similarity.SELECTED DRAWING: Figure 3

Description

  The present invention relates to an information providing apparatus, an information providing method, and a program.

  A method called multivariate statistical process control (MSPC) is conventionally known as a method for monitoring and diagnosing processes by analyzing operation data such as sensor measurement data.

  In addition, a technique for predicting an abnormality of a device by obtaining a relationship between a sequence of log data of an event that has occurred in the device and a failure is known (see, for example, Patent Document 1).

Japanese Patent No. 5364530

  However, in the above-described conventional technology, for example, a plant operator or the like may not be able to know what recovery operation should be performed when an abnormality occurs. Accordingly, for example, when the experience of the plant operator is inexperienced, it takes a long time to recover from the abnormality that has occurred.

  One embodiment of the present invention has been made in view of the above points, and aims to provide a similar past case.

  To achieve the above object, according to an embodiment of the present invention, there is provided an information providing apparatus that provides information for supporting monitoring of a device or facility, the event information in the device or facility being stored in advance in time series. Filter processing means for performing filtering, generation means for generating a plurality of event sequences including event information designated in advance from event information filtered by the filter processing means, and generated by the generation means Calculating means for calculating a similarity between a plurality of event series; classifying the plurality of event series based on the similarity calculated by the calculating means; generating case information; and storing the case information in a predetermined storage Storage means for storing in the area, event information output from the device or facility, and stored in the predetermined storage area It calculates the degree of similarity between the example information has an information providing means for outputting said case information in accordance with the degree of similarity.

  According to an embodiment of the present invention, similar past cases can be provided.

It is a figure which shows the structure of an example of the monitoring assistance system of 1st embodiment. It is a figure which shows the hardware constitutions of an example of the assistance apparatus, monitoring apparatus, and log | history management apparatus of 1st embodiment. It is a figure which shows the function structure of an example of the monitoring assistance system of 1st embodiment. It is a flowchart which shows an example of the filter process of 1st embodiment. It is a figure which illustrates creation of a document of a first embodiment typically. It is a figure which shows an example of a document management table. It is a figure which shows an example of an importance table. It is a figure which shows an example of an exclusion dictionary table. It is a flowchart which shows an example of the case data creation process of 1st embodiment. It is a figure which illustrates creation of a log data series of a first embodiment typically. It is a figure which shows an example of a similarity table. It is a figure which shows an example of case DB. It is a flowchart which shows an example of the information provision process of 1st embodiment. It is a figure which illustrates typically about the case where information is provided about the past operation procedure. It is a figure which illustrates typically the case where the information of a past cause candidate is provided. It is a figure which shows the function structure of an example of the monitoring assistance system of 2nd embodiment. It is a flowchart which shows an example of the creation process of the case data of 2nd embodiment. It is a figure which illustrates typically the production | generation of the log data series of 2nd embodiment. It is a flowchart which shows an example of the information provision process of 2nd embodiment. It is a figure which illustrates typically the case where information on the occurrence prediction of a target event is provided.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

[First embodiment]
<System configuration>
First, the system configuration of the monitoring support system 1 of the present embodiment will be described with reference to FIG. FIG. 1 is a diagram illustrating a configuration of an example of a monitoring support system according to the first embodiment.

  The monitoring support system 1 illustrated in FIG. 1 includes a support device 10, one or more monitoring devices 20, a history management device 30, and one or more device control devices 40. These devices are connected to be communicable via a network N such as a LAN (Local Area Network). One or more devices 50 are connected to the device control device 40.

  The operation of this system includes a “case creation” phase in which a past case such as a recovery operation procedure when a failure or abnormality occurs in the device 50, and a past case corresponding to an event or the like occurring in the device 50 There is an “information provision” phase presented in Basically, the “case creation” phase is offline processing, and the “information provision” phase is online processing.

  In the “case creation” phase, the support device 10 creates case data indicating past cases when a predetermined event occurs based on past event log data accumulated in the history management device 30. Further, in the “information provision” phase, the support apparatus 10 presents case data indicating past cases to the user in accordance with an event or the like that has occurred in the device 50.

  The monitoring device 20 displays past cases based on the case data presented from the support device 10 in the “information provision” phase. Thereby, for example, an operator such as a plant or a user such as an operator can know a recovery operation procedure to be performed after that when an event such as a failure or abnormality occurs in the device 50. As described above, the monitoring support system 1 according to the present embodiment provides information about past cases when an event such as a failure or abnormality occurs to assist the user in performing a recovery operation or the like.

  The history management device 30 manages history such as event log data received from the device control device 40 in time series.

  Here, the event log data is data indicating the occurrence of an event or the like transmitted from the device control apparatus 40 when any event occurs in the device 50. The event includes an alarm indicating a failure or abnormality occurring in the device 50, various operations in the device 50, various operations such as a change in the setting value of the device 50 by the user, a response of the device 50 to the operation, and the like. Hereinafter, the event log data is simply referred to as “event data”.

  The device control device 40 is a device that controls the device 50. The device control device 40 transmits event data to the history management device 30 when any event (for example, a state change of the device 50) occurs in the device 50 connected to the device control device 40.

  The device 50 is, for example, a gas turbine or a steam turbine, and is a facility, a plant, or the like controlled by the device control apparatus 40.

  In the monitoring support system 1 of the present embodiment, a plant, equipment, or the like is assumed as an example of the device 50, but is not limited thereto. The monitoring support system 1 according to the present embodiment is also applied to providing information on past cases when a failure or abnormality occurs in a network device using, for example, a router as the device 50 controlled by the device control apparatus 40. Can be done. Similarly, the present invention can also be applied to a case where various electronic devices are used as the device 50 and information on past cases when a failure or abnormality occurs in the various electronic devices.

<Hardware configuration>
Next, the hardware configuration of the support device 10, the monitoring device 20, and the history management device 30 of this embodiment will be described with reference to FIG. FIG. 2 is a diagram illustrating a hardware configuration of an example of the support device, the monitoring device, and the history management device according to the first embodiment. Since the support device 10, the monitoring device 20, and the history management device 30 have the same hardware configuration, the hardware configuration of the support device 10 will be mainly described below.

  The support device 10 illustrated in FIG. 2 includes an input device 11, a display device 12, an external I / F 13, and a RAM (Random Access Memory) 14. The support apparatus 10 illustrated in FIG. 2 includes a ROM (Read Only Memory) 15, a CPU (Central Processing Unit) 16, a communication I / F 17, and a storage device 18. These pieces of hardware are communicably connected via a bus B.

  The input device 11 is, for example, a keyboard, a mouse, a touch panel, or the like, and is used by a user to input each operation signal. The display device 12 is, for example, an LCD (Liquid Crystal Display) or the like, and displays a processing result. The input device 11 and / or the display device 12 may be connected to the bus B and used when necessary.

  The external I / F 13 is an interface with an external device. The external device includes a recording medium 13a. Thereby, the support apparatus 10 can read and / or write the recording medium 13a via the external I / F 13. Examples of the recording medium 13a include a flexible disk, a CD, a DVD, an SD memory card, and a USB memory. The recording medium 13a may store a program that realizes the present embodiment.

  The RAM 14 is a volatile semiconductor memory that can temporarily store programs and data. The ROM 15 stores programs and data such as BIOS (Basic Input / Output System), OS (Operating System) settings, and network settings that are executed when the support apparatus 10 is activated.

  The CPU 16 is an arithmetic device that implements control and functions of the entire support device 10 by reading a program and data from the ROM 15 and the storage device 18 onto the RAM 14 and executing processing.

  The communication I / F 17 is an interface for connecting the support apparatus 10 to the network N. Thereby, the support apparatus 10 can perform data communication via the communication I / F 17.

  The storage device 18 is a non-volatile memory that stores programs and data, and is, for example, an HDD (Hard Disk Drive), an SSD (solid state drive), or the like. The stored programs and data include a program that realizes the present embodiment, an OS that is basic software for controlling the entire support apparatus 10, and application software that provides various functions on the OS. The storage device 18 manages stored programs and data by a predetermined file system and / or DB.

  The support apparatus 10 according to the present embodiment can implement various processes described later by having the above hardware configuration.

<Functional configuration>
Next, the functional configuration of the monitoring support system 1 of the present embodiment will be described with reference to FIG. FIG. 3 is a diagram illustrating a functional configuration of an example of the monitoring support system according to the first embodiment.

  The history management apparatus 30 illustrated in FIG. 3 has a log data DB 310. The DB can be realized using the storage device 18.

  The log data DB 310 stores event data transmitted from the device control device 40 in time series. As described above, the history management apparatus 30 accumulates event data of events that have occurred in the device 50 in the log data DB 310.

  3 includes a filter processing unit 101, a target event setting unit 102, a case series creation unit 103, a first similarity calculation unit 104, a classification unit 105, and a naming unit 106. In addition, the support apparatus 10 includes a comparison series creation unit 107, a second similarity calculation unit 108, an acquisition unit 109, and an information provision unit 110. Each of these units is realized by processing that one or more programs installed in the support apparatus 10 cause the CPU 16 to execute.

  Further, the support device 10 illustrated in FIG. 3 includes a case DB 120. The DB can be realized using the storage device 18.

  The filter processing unit 101 performs filter processing on event data stored in the log data DB 310 in the “case creation” phase.

  Here, the filtering process is a process of excluding (excluding) predetermined event data from the event data stored in the log data DB 310. In other words, the event data stored in the log data DB 310 includes event data regularly transmitted from the device control device 40, such as event data indicating that the device 50 is operating. Such event data may act as noise in creating case data. Therefore, in the filtering process, event data that may act as noise is excluded from the log data stored in the log data DB 310.

  Note that the log data after the filter process is performed on the log data stored in the log data DB 310 is represented as “log data after the filter process”.

  In addition, the filter processing unit 101 includes a document creation unit 111, an importance calculation unit 112, a threshold setting unit 113, an exclusion dictionary creation unit 114, and a filter unit 115. Details of these parts will be described later.

  In the “case creation” phase, the target event setting unit 102 sets an event designated by the user as a case data creation target event (hereinafter referred to as “target event”).

  The case series creation unit 103 creates a plurality of log data series from the event data after the filtering process based on the target event in the “case creation” phase.

  The first similarity calculation unit 104 calculates the similarity between log data series in the “case creation” phase. Further, the first similarity calculation unit 104 normalizes the calculated similarity in the “case creation” phase.

  The classification unit 105 classifies a plurality of log data series based on the similarity calculated by the first similarity calculation unit 104 in the “case creation” phase.

  The naming unit 106 assigns a name designated by the user to the log data series classified by the classifying unit 105 in the “case creation” phase. Then, the naming unit 106 stores the log data series assigned the name in the case DB 120 as case data. As a result, in the monitoring support system 1 of the present embodiment, case data indicating past cases relating to the target event is created and held in the “case creation” phase.

  The comparison series creation unit 107 creates a log comparison data series from the most recent event among the event data stored in the log data DB 310 in the “information provision” phase.

  Here, the log comparison data series is a data series of event data for comparing the similarity with the log data series included in the case data stored in the case DB 120.

  In the “information provision” phase, the second similarity calculation unit 108 calculates the similarity between the log data series included in the case data stored in the case DB 120 and the log comparison data series.

  The acquisition unit 109 acquires the log data series from the case DB 120 based on the similarity calculated by the second similarity calculation unit 108 in the “information provision” phase. That is, the acquisition unit 109 acquires a log data series having a high degree of similarity with the log comparison data series. Thereby, in the monitoring support system 1 of this embodiment, the case data which shows the past case similar to the latest condition of the apparatus 50 are acquirable.

  In the “information provision” phase, the information providing unit 110 evaluates the log data series acquired by the acquisition unit 109 and transmits the evaluation result to the monitoring device 20. Thereby, in the monitoring support system 1 of this embodiment, the information of a past example is transmitted to the monitoring apparatus 20 as information provision. Therefore, a user such as an operator or an operator who operates the monitoring device 20 recovers from the failure or abnormality, for example, when a failure or abnormality is derived based on the information of the past cases provided. You can know the operation procedure to do. In other words, in the monitoring support system 1 of the present embodiment, for example, when a failure or abnormality occurs, recovery of the failure or abnormality can be supported.

  The case DB 120 stores case data. As described above, the case data is data in which a name is assigned to the log data series. Details of the case data will be described later.

  Here, the document creation unit 111, the importance calculation unit 112, the threshold setting unit 113, the exclusion dictionary creation unit 114, and the filter unit 115 included in the filter processing unit 101 will be described.

  The document creation unit 111 creates an event data group obtained by cutting out event data stored in the log data DB 310 at predetermined time intervals. Here, the event data group created by the document creation unit 111 is referred to as “document”. That is, the document creation unit 111 divides event data stored in the log data DB 310 into a plurality of documents.

  Further, the document creation unit 111 creates a document management table for managing the created document.

  The importance calculation unit 112 calculates, for each document created by the document creation unit 111, the importance for each event included in the document, and creates an importance table in which the importance is associated with each document and each event. To do. Here, the importance level calculation unit 112 of the present embodiment calculates tf-idf, which is the product of the tf index and the idf index, as the importance level.

  The threshold setting unit 113 sets a threshold of importance based on the importance table created by the importance calculation unit 112.

  Based on the threshold set by the threshold setting unit 113, the exclusion dictionary creation unit 114 creates an exclusion dictionary table that associates events to be excluded for each document.

  Based on the document management table and the exclusion dictionary table, the filter unit 115 excludes (deletes) event data indicating events associated with the exclusion dictionary table from the log data DB 310. Thereby, in the monitoring support system 1 of the present embodiment, for example, when the importance level of the event included in the document is equal to or lower than the threshold value, the event is deleted from the log data DB 310. In other words, in the monitoring support system 1 of the present embodiment, for example, an event that acts as noise can be deleted from the log data DB 310.

<Details of processing>
Next, details of processing of the monitoring support system 1 of the present embodiment will be described.

≪Filter processing≫
First, filter processing performed on event data stored in the log data DB 310 in the “case creation” phase will be described with reference to FIG. FIG. 4 is a flowchart illustrating an example of the filter processing according to the first embodiment.

  In step S <b> 401, the document creation unit 111 of the filter processing unit 101 creates a document obtained by cutting out event data stored in the log data DB 310 at predetermined time intervals.

  The event indicated by the event data is represented as a message such as “air blow valve, open” or “cooling equipment failure”. For this reason, by associating a message indicating an event with a symbol, the event can be represented as a symbol. In the present embodiment, the event will be described as being symbolized by one predetermined alphabet. Thus, for example, an event indicating “air blow valve, open” is represented by an event “A”, and an event indicating “cooling equipment failure” is represented by an event “K” or the like.

  Here, creation of a document will be described with reference to FIG. FIG. 5 is a diagram schematically illustrating document creation according to the first embodiment.

  As shown in FIG. 5, event data is stored in the log data DB 310 in chronological order. The document creation unit 111 according to the present embodiment creates a document from hourly event data.

  More specifically, the event data from the event “B” of “2015-05-01 00:00:00” to the event “C” of “2015-05-01 00:59:58” is cut out first. Document of

  Similarly, the event data from the event “B” of “2015-05-01 01:01:15” to the event “C” of “2015-05-01 01:59:58” is cut out to be the second document. To do.

  As described above, the document creation unit 111 cuts out (extracts) event data from the log data DB 310 every predetermined time, and creates a plurality of documents. In the present embodiment, the document creation unit 111 continues the description on the assumption that the first document, the second document,. Note that the user may set an arbitrary time as the predetermined time for creating the document by the document creation unit 111.

  Further, the document creation unit 111 creates a document management table for managing the start time and end time for extracting event data from the log data DB 310 for each created document. That is, the document creation unit 111 according to the present embodiment creates, for example, a document management table shown in FIG. FIG. 6 is a diagram illustrating an example of a document management table.

  As a result, in the document management table of the present embodiment, the first document is obtained by cutting out event data from “2015-05-01 00:00:00” to “2015-05-01 00:59:59”. It is managed that it has been created.

  Similarly, in the document management table of the present embodiment, event data from “2015-05-01 01: 00: 0” to “2015-05-01 01:59:59” is extracted from the second document. It is managed that it has been created. The same applies to other documents.

  In step S402, the importance calculation unit 112 of the filter processing unit 101 calculates the importance for each event included in the document for each document created by the document creation unit 111, and creates an importance table.

  Here, the importance level calculation unit 112 calculates tf-idf, which is the product of the tf index and the idf index, as the importance level.

For example, when the event type of the event data stored in the log data DB 310 is “event A”, “event B”,..., “Event T”, each event is expressed as “term t _i ”. . That is, “event A” is represented as “term t ₁ ”, “event B” as “term t ₂ ”,... “Event T” as “term t ₂₀ ”. The “jth document” is represented as “d _j ”. Then, tf _{i, j} indicating the tf index of the term t _i in the j-th document is expressed as follows.

Further, idf _i indicating the idf index terms _{t i} is expressed by the following.

Therefore, the importance calculation unit 112 according to the present embodiment calculates the product of tf _{i, j} and idf _i as the importance of the term t _i in the j-th document. The importance calculation unit 112 may normalize the product of tf _{i, j} and idf _i so as to be within a range of, for example, 0 or more and 1 or less, and use the normalized value as the importance. .

  As described above, the importance calculation unit 112 calculates the importance for each event included in the document for each document, and creates, for example, an importance table shown in FIG. FIG. 7 is a diagram illustrating an example of the importance level table.

  As shown in FIG. 7, in the importance level table, the importance level for each event is associated with each document. The importance calculation unit 112 according to the present embodiment calculates tf-idf, which is the product of the tf index and the idf index, as the importance, thereby calculating the importance of events appearing in many documents to be low. The degree of importance of an event that appears only in the document is calculated high. That is, in the importance calculation unit 112 of the present embodiment, for example, the importance of events that occur constantly and act as noise is calculated to be low.

  In step S <b> 403, the threshold setting unit 113 of the filter processing unit 101 sets the importance threshold based on the importance table created by the importance calculation unit 112.

  Here, the threshold setting unit 113 can set the importance threshold by various methods. For example, the threshold setting unit 113 may transmit the importance table to the monitoring device 20 or the like, and the monitoring device 20 or the like may set a value designated by the user as the threshold based on the importance table. .

  Further, the threshold setting unit 113 may set various statistics calculated from the importance stored in the importance table (for example, a constant multiple such as an average value or an intermediate value) as the threshold.

  In step S <b> 404, the exclusion dictionary creation unit 114 of the filter processing unit 101 creates an exclusion dictionary table based on the threshold set by the threshold setting unit 113. In other words, for example, in the importance table, the exclusion dictionary creation unit 114 creates an exclusion dictionary table by associating an event whose importance is equal to or less than a threshold with each document as an event to be excluded. The exclusion dictionary creation unit 114 of this embodiment creates, for example, the exclusion dictionary table shown in FIG. FIG. 8 is a diagram illustrating an example of the exclusion dictionary table.

  As shown in FIG. 8, in the exclusion dictionary table, for each document, a list of events to be excluded in the document is associated. For example, “event A” and “event B” are associated with the first document. Thus, in the exclusion dictionary table, for example, an event whose importance is equal to or less than a threshold in the importance table is associated with the document as an exclusion event.

  In step S405, the filter unit 115 of the filter processing unit 101 excludes event data indicated by an event associated with the exclusion dictionary table from the log data DB 310 based on the document management table and the exclusion dictionary table.

  That is, the filter unit 115 refers to the document management table and acquires the start time and end time for each document. Then, the filter unit 115 deletes the event data indicated by the event associated with the corresponding document in the exclusion dictionary table from the event data included in the start time and end time for each document in the log data DB 310. .

  For example, the filter unit 115 refers to the document management table and sets the start time “2015-05-01 00:00:00” and the end time “2015-05-01 00:59:59” of the first document. get. In the log data DB 310, the filter unit 115 includes “event A” and “event A” associated with the first document in the exclusion dictionary table among event data included between the start time and the end time. The event data of “Event B” is deleted.

  Similarly, the filter unit 115 refers to the document management table and starts the second document starting time “2015-05-01 01:00:00” and ending time “2015-05-01 01:59:59”. To get. Then, the filter unit 115 stores the event “event B” associated with the second document in the exclusion dictionary table among the event data included in the log data DB 310 from the start time to the end time. Delete the data. The same applies to other documents.

  As described above, in the monitoring support system 1 of the present embodiment, after calculating the importance level of the event, the event is deleted from the log data DB 310 according to the importance level. In other words, in the monitoring support system 1 of the present embodiment, events with low importance are deleted from the log data DB 310. For this reason, in the monitoring support system 1 of this embodiment, for example, an event that occurs constantly and acts as noise can be deleted. Therefore, in the monitoring support system 1 of the present embodiment, it is possible to create case data with less influence of noise in case data creation processing described later.

  In the following, it is assumed that log data after being filtered by the filter processing unit 101 is stored in the log data DB 310.

≪Case data creation process≫
Next, a process of creating case data in the “case creation” phase will be described with reference to FIG. FIG. 9 is a flowchart illustrating an example of the case data creation process according to the first embodiment.

  In step S901, the user designates an event for creating case data from the input device 11 or the like. Then, the target event setting unit 102 sets the event specified by the user as the target event. Here, the target event setting unit 102 may set two or more target events.

  In the following description, it is assumed that an event “K” indicating the occurrence of a failure of the device 50 is set as the target event.

  In step S <b> 902, the case series creation unit 103 creates a plurality of log data series from the filtered event data stored in the log data DB 310 based on the target event set by the target event setting unit 102.

  Here, creation of a log data series will be described with reference to FIG. FIG. 10 is a diagram schematically illustrating creation of a log data series according to the first embodiment.

  As shown in FIG. 10, the log data DB 310 stores event data after filter processing in time series. The case series creation unit 103 of this embodiment extracts and creates event data for 30 minutes before and after the event data indicating the target event “K” as a log data series.

  More specifically, event data indicating an event “D” and an event “G” that occurred 30 minutes before and after the event “K” is extracted to create a first log data series “DKG”.

  Similarly, event data indicating an event “C” and an event “A” that occurred 30 minutes before and after the event “K” are extracted to create a second log data series “CKA”.

  As described above, the case series creation unit 103 extracts events during a predetermined time before and after the target event, and creates a plurality of log data series. In the present embodiment, the description will be continued assuming that the first log data series, the second log data series,..., The Mth log data series are created by the case series creation unit 103. The predetermined time before and after the target event from which the event data is extracted by the case series creation unit 103 may be set by the user.

  In step S903, the first similarity calculation unit 104 calculates the similarity between log data series.

  That is, the first similarity calculation unit 104 calculates the similarity between the first log data series and each of the first log data series to the Mth log data series. Similarly, the first similarity calculation unit 104 calculates the similarity between the second log data and each of the second log data series to the Mth log data series. Similarly, the first similarity calculation unit 104 calculates the similarity between the third log data and each of the third log data series to the Mth log data series. As described above, the first similarity calculation unit 104 calculates the similarity between log data series including itself.

  Here, as a method of calculating the similarity between log data series, for example, when the log data series is regarded as generated data from a Hidden Markov Model (HMM), the amount of information between HMMs ( For example, there is a method of calculating the amount of similarity (Calbach-librar information amount) as the similarity.

  The method for calculating the similarity between log data series is, for example, the Levenshtein distance defined as the minimum cost of the procedure required to transform a log data series into another log data series. The method of calculating is mentioned.

  In step S904, the first similarity calculation unit 104 normalizes the similarity calculated in step S903 to be a value between 0 and 1, and creates a similarity table.

  Here, FIG. 11 shows an example of a similarity table in which the similarity normalized by the first similarity calculation unit 104 is stored. FIG. 11 is a diagram illustrating an example of the similarity table.

  The similarity table shown in FIG. 11 shows an example of a calculation result of normalized similarity between log data series. As shown in FIG. 11, in this embodiment, when the log data series are the same, the normalized similarity value is “1.0”, and the degree of similarity between the log data series is low. As the value increases, the similarity value after normalization decreases.

  In step S905, the classification unit 105 classifies the log data series based on the similarity table created by the first similarity calculation unit 104.

  Here, as a method of classifying the log data series, for example, a method of classifying the log data series into a number of clusters designated in advance by the user by using an agglomerative hierarchical clustering technique can be cited. In the aggregation hierarchical clustering method, the distance between clusters may be updated based on, for example, the Lance-Williams update formula.

  In step S906, the naming unit 106 assigns a name designated by the user to the log data series classified by the classification unit 105. Then, the naming unit 106 stores the log data series assigned the name in the case DB 120 as case data. Thus, the case data is stored in the case DB 120.

  Here, FIG. 12 shows case data stored in the case DB 120 when the log data series is classified into three clusters using the method of the agglomerative hierarchical clustering in the above step S906. FIG. 12 is a diagram illustrating an example of a case DB.

  As shown in FIG. 12, the case data in which the name “name α” is assigned to the first log data series, the third log data series, the Mth log data series, and the like are classified into the same cluster. . As described above, the monitoring support system 1 according to the present embodiment classifies the data as one or more log data series and assigns the names to the case data.

  In addition, it is preferable that an appropriate name is given to the case data classified into the same cluster by the user. For example, it is preferable to assign a name such as the name “recovery operation example of event“ K ”” to the case data of the log data series including the event sequence of the recovery operation procedure after the target event “K”.

  In addition, for example, it is preferable to assign a name such as a name “related alarm occurrence case” to the case data of the log data series including events such as related failures and abnormalities in addition to the target event “K”.

  As described above, the monitoring support system 1 according to the present embodiment creates case data before and after the target event has occurred based on the history of past event data that has been subjected to the filtering process. Then, the monitoring support system 1 of the present embodiment classifies the case data similar to each other, classifies them, and holds them as past cases. Thereby, in the information provision process mentioned later, the information of the similar past example can be shown to a user and the said user's operation assistance etc. can be performed.

≪Information provision process≫
Next, a process of providing information on case data indicating past cases to the user in the “information provision” phase will be described with reference to FIG. FIG. 13 is a flowchart illustrating an example of the information providing process according to the first embodiment.

  In step S1301, the comparison sequence creation unit 107 creates a log comparison data sequence from the latest event data among the filtered event data stored in the log data DB 310.

  That is, the comparison series creation unit 107 includes event data of events that have occurred during a predetermined time in the past (for example, the past 30 minutes) from the current time among the event data after the filtering process stored in the log data DB 310. Extract and create a comparison data series. More specifically, for example, when the current time is “03:30”, the comparison series creation unit 107 detects events that occurred between “03: 00: 00: 00” and “03:30:30”. Extract event data and create a comparison data series.

  In step S1302, the second similarity calculation unit 108 calculates the similarity between the case data stored in the case DB 120 and the log comparison data series. That is, the second similarity calculation unit 108 calculates the similarity between the log data series included in each case data and the log comparison data series.

  In step S1303, the acquisition unit 109 acquires the top N log data series having high similarity to the log comparison data series from among the log data series included in each case data. Note that the value of N can be arbitrarily set by the user, but may be, for example, about 2 to 3 (cases).

  Thereby, in the monitoring support system 1 of this embodiment, the log data series in the past case similar to the event that has occurred most recently is acquired.

  In step S1304, the information providing unit 110 evaluates the log data series acquired in step S1303, and transmits the evaluation result to the monitoring apparatus 20 as information provision.

  Here, an example of information provision by the information provision unit 110 will be described with reference to FIG. FIG. 14 is a diagram schematically illustrating a case where information on a past operation procedure is provided.

  As illustrated in FIG. 14, it is assumed that the log comparison data series is “BDCYK” and the log data series acquired in step S1304 is “BDCYKGGHYQG”. At this time, the information providing unit 110 evaluates that the operation “GHYQG” is performed after the event “K” occurs in the log data series “BDCYKGHYQG”. Therefore, for example, as a past example of the recovery operation procedure after occurrence of an event “K” indicating abnormality or failure, the information providing unit 110 monitors the operation procedure “GHYQG” together with the name assigned to the log data series. Transmit to device 20. Thereby, a user such as an operator or an operator can know past cases of the recovery operation procedure when an event such as abnormality or failure occurs in the device 50.

  Another example of information provision by the information provision unit 110 will be described with reference to FIG. FIG. 15 is a diagram schematically illustrating a case where information on past cause candidates is provided.

  As shown in FIG. 15, it is assumed that the log comparison data series is “TBCKE” and the log data series acquired in step S1304 is “CDEHDCTBCKE”. At this time, when the log data series is “CDEHDCTBCKE”, the information providing unit 110 evaluates that the candidate for the cause of occurrence of the event “K” is in the event sequence “CDEHDC”. Therefore, for example, when an event “K” indicating abnormality or failure occurs, the information providing unit 110 as a candidate for the cause of occurrence of the event in the past case, together with the name given to the log data series, The candidate “CDEHDC” is transmitted to the monitoring device 20. Thereby, a user such as an operator or an operator can know a candidate of the cause of occurrence when an event such as abnormality or failure occurs in the device 50.

  As described above, in the monitoring support system 1 of the present embodiment, similar past cases can be provided to the user according to the event that has occurred in the device 50 most recently. Thereby, in the monitoring assistance system 1 of this embodiment, when the event which shows a failure, abnormality, etc. generate | occur | produces, the recovery activity from the said failure, abnormality, etc. by a user can be assisted.

[Second Embodiment]
Next, the monitoring support system 1 of 2nd embodiment is demonstrated. In the description of the second embodiment, the differences from the first embodiment will be described, and the same reference numerals used in the description of the first embodiment will be used for portions having the same functional configuration as the first embodiment. The description is omitted.

  In the present embodiment, in the “information provision” phase, the occurrence prediction of the target event is provided to the user.

<Functional configuration>
Next, the functional configuration of the monitoring support system 1 of the present embodiment will be described with reference to FIG. FIG. 16 is a diagram illustrating a functional configuration of an example of a monitoring support system according to the second embodiment.

  The support device 10 illustrated in FIG. 16 includes a case series creation unit 103A and an information provision unit 110A.

  The case series creation unit 103A creates a log data series. At this time, the case series creation unit 103A of this embodiment creates a log data series from event data indicating events that occurred during a predetermined time before the occurrence of the target event.

  110 A of information provision parts evaluate the log data series acquired by the acquisition part 109, and transmit an evaluation result to the monitoring apparatus 20. FIG. At this time, the information providing unit 110 </ b> A according to the present embodiment transmits the evaluation result that predicts the occurrence of the target event to the monitoring device 20 as information provision. Therefore, a user such as an operator or an operator who operates the monitoring device 20 can take measures to avoid the occurrence of a target event indicating a failure or abnormality, and to reduce the risk.

<Details of processing>
Next, details of processing of the monitoring support system 1 of the present embodiment will be described.

≪Case data creation process≫
Case data creation processing according to the present embodiment will be described with reference to FIG. FIG. 17 is a flowchart illustrating an example of creation processing of case data according to the second embodiment. In addition, since the process of step S901 in FIG. 17 and step S903-step S906 is the same as that of 1st embodiment, the description is abbreviate | omitted.

  In step S1701, the case series creation unit 103A creates a plurality of log data series from the filtered event data stored in the log data DB 310 based on the target event set by the target event setting unit 102.

  Here, creation of a log data series in the present embodiment will be described with reference to FIG. FIG. 18 is a diagram schematically illustrating generation of a log data series according to the second embodiment.

  Similar to the first embodiment, the log data DB 310 stores event data after filtering in time series. The example series creation unit 103A of the present embodiment extracts and creates event data for 45 minutes before the occurrence of event data indicating the target event “K” as a log data series.

  More specifically, event data indicating an event “D” and an event “C” that occurred 45 minutes before the event “K” is extracted to create a first log data series “CDK”.

  Similarly, event data indicating an event “C” and an event “D” that occurred 45 minutes before the event “K” is extracted to create a second log data series “DCK”.

  As described above, the case series creation unit 103A of the present embodiment extracts events during a predetermined time before the occurrence of the target event, and creates a plurality of log data series. Thereby, in the log data series created by the case series creation unit 103A of the present embodiment, the last event included in the log data series is the target event.

≪Information provision process≫
Next, the information provision process of this embodiment is demonstrated, referring FIG. FIG. 19 is a flowchart illustrating an example of the information providing process according to the second embodiment. In addition, since the process of step S1301-step S1303 in FIG. 19 is the same as that of 1st embodiment, the description is abbreviate | omitted.

  In step S1901, the information providing unit 110A evaluates the log data series acquired in step S1303, and transmits the evaluation result to the monitoring device 20 as information provision.

  Here, an example of information provision by the information provision unit 110A of the present embodiment will be described with reference to FIG. FIG. 20 is a diagram schematically illustrating a case where information on occurrence prediction of a target event is provided.

  As illustrated in FIG. 20, it is assumed that the log comparison data series is “TDBC” and the log data series acquired in step S1303 is “TDBCDFGEK”. At this time, the information providing unit 110A evaluates that the occurrence of “DFGEK” can be predicted after the occurrence of the event string “TDBC” in the log data series “TDBCDFGEK”. That is, the information providing unit 110A evaluates that the target event “K” will occur after the event string “DFGE” occurs in the future. At this time, the information providing unit 110 </ b> A can also predict the occurrence time until the target event “K” occurs.

  Therefore, the information providing unit 110 </ b> A transmits “DFGAK” to the monitoring device 20 as a predicted event sequence together with the name given to the log data series. As a result, users such as operators and operators can know the occurrence of the target event and the time until the occurrence, and operations for avoiding the occurrence of the target event indicating a failure or abnormality And take action to reduce risk.

  Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications are possible within the scope of the gist of the present invention described in the claims.・ Change is possible.

1 monitoring support system 10 support device 20 monitoring device 30 history management device 40 device control device 50 device 101 filter processing unit 102 target event setting unit 103 case series creation unit 104 first similarity calculation unit 105 classification unit 106 naming unit 107 Comparison series creation unit 108 Second similarity calculation unit 109 Acquisition unit 110 Information provision unit 111 Document creation unit 112 Importance calculation unit 113 Threshold setting unit 114 Exclusion dictionary creation unit 115 Filter unit 120 Case DB
310 Log data DB
N network

Claims (6)

An information providing device that provides information for supporting monitoring of equipment or facilities,
Filter processing means for filtering event information in the device or facility stored in advance according to time series,
Generating means for generating a plurality of event sequences including event information designated in advance from the event information filtered by the filtering means;
Calculating means for calculating the similarity between a plurality of event series generated by the generating means;
Storage means for classifying the plurality of event series based on the similarity calculated by the calculation means, generating case information, and storing the case information in a predetermined storage area;
Information providing means for calculating the similarity between the event information output from the device or facility and the case information stored in the predetermined storage area, and outputting the case information according to the similarity;
An information providing apparatus. The filter processing means includes
The information providing apparatus according to claim 1, wherein filtering is performed by calculating an importance level of the event information and excluding the event information having the calculated importance level equal to or less than a predetermined threshold. The filter processing means includes
The information providing apparatus according to claim 2, wherein the event information is divided into a plurality of event information groups at predetermined time intervals, and the importance of the event information is calculated for each event information group. The filter processing means includes
The information providing apparatus according to claim 2, wherein the importance is a product of a tf index of the event information in the event information group and an idf index of the event information in the plurality of event information groups. An information providing method in an information providing apparatus for providing information for supporting monitoring of equipment or facilities,
A filtering process procedure for filtering event information in the device or facility stored in advance according to a time series;
A generation procedure for generating a plurality of event sequences including pre-specified event information from the event information after being filtered by the filter processing procedure,
A calculation procedure for calculating a degree of similarity between a plurality of event series generated by the generation procedure;
A storage procedure for classifying the plurality of event series based on the similarity calculated in the calculation procedure, generating case information, and storing the case information in a predetermined storage area;
An information providing procedure for calculating the similarity between the event information output from the device or the facility and the case information stored in the predetermined storage area, and outputting the case information according to the similarity,
A method for providing information. An information providing device that provides information that supports monitoring of equipment or facilities,
Filter processing means for filtering event information in the device or facility stored in advance according to time series,
Generating means for generating a plurality of event sequences including event information designated in advance from the event information filtered by the filtering means;
Calculating means for calculating a similarity between a plurality of event series generated by the generating means;
Storage means for classifying the plurality of event series based on the similarity calculated by the calculation means, generating case information, and storing the case information in a predetermined storage area;
Information providing means for calculating the similarity between the event information output from the device or facility and the case information stored in the predetermined storage area, and outputting the case information according to the similarity,
Program to function as.

Images