JP2017142549A - Troubleshooting support apparatus, troubleshooting support program, and storage medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a troubleshooting support apparatus allowing a person inexperienced in troubleshooting to handle thereto similarly to that of a richly-experienced person, a troubleshooting support program, and a storage medium.SOLUTION: A troubleshooting support apparatus 1 includes: trouble message acquisition means 11; word extraction means 12; severity-determining classifier creation means 13 creating Bayesian classifier that, when the trouble message is generated, calculates a conditional probability P(F|S) representing to be a severe trouble message and, when a trouble message is generated, calculates a conditional probability P(N|S) representing not to be a severe trouble message; severity determination means 14 that, when the P(F|S) is larger than the P(N|S), determines that the trouble message is the severe trouble message; and display means 15 that displays the determination result for the trouble message.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a failure handling support device, a failure handling support program, and a storage medium, and more particularly, a failure handling support device that can be suitably used for handling a failure message transmitted from a monitoring tool for monitoring an IT device such as a computer. The present invention relates to a support program and a storage medium.

  A conventional failure response support apparatus acquires a log message (failure message) from log information storage means, and for each word (failure term) included in the log message, the appearance position of the word, the word, and the log A score is calculated based on a set of appearance frequencies for the number of words included in the message, and a template is generated by performing clustering based on the score. At this time, the clustered clusters are merged from the highest value, and merged when the total number of words in the log message and a predetermined threshold value for determining the range of clusters including critical words are exceeded. A set of words is a template. A critical message is extracted by acquiring log messages of a plurality of devices and performing matching with a generated template.

JP 2013-171471 A

  However, since the conventional failure response support apparatus generates a template based on cluster analysis, the responder must analyze the correctness of the template based on the experience. As a result, there is a problem that the analysis result differs depending on the experience of the responder, or a subjective result is obtained.

  Further, the conventional failure response support apparatus has a problem in the ease of failure response based on various viewpoints such as severity and urgency.

  Accordingly, the present invention has been made in view of these points, and a failure response support apparatus and a failure response support program that can respond to a responder who is unfamiliar with failure response in the same manner as an experienced responder. It is an object of the present invention to provide a storage medium.

  (1) In order to achieve the above-described object, the failure handling support apparatus according to the present invention includes a failure message obtaining unit that obtains a failure message indicating the content of a failure that has occurred in the monitored terminal, and one or more included in the failure message. , A prior probability P (S) that a failure message occurs, a prior probability P (F) that a serious failure message occurs, and a conditional probability P that a word is included in the serious failure message Based on (W | F), create a Bayesian classifier that obtains a conditional probability P (F | S) that a failure message occurs when it is a serious failure message, and prior probability P (S), non-critical The failure message is generated based on the prior probability P (N) of occurrence of the failure message and the conditional probability P (W | N) that a certain word is included in the non-critical failure message. Severity classifier creation means for creating a Bayes classifier for obtaining a conditional probability P (N | S) that is a non-serious failure message, and all words and Bayesian classifications extracted by the word extraction means When the conditional probability P (F | S) and the conditional probability P (N | S) are calculated based on the classifier and the conditional probability P (F | S) is larger than the conditional probability P (N | S) Determines that the failure message is a critical failure message and determines that the failure message is a non-critical failure message if the conditional probability P (F | S) is less than the conditional probability P (N | S). The apparatus includes: a severity determination unit; and a display unit that displays a determination result for the failure message.

  As a result, the failure handling support apparatus of the present invention has a conditional probability P (F | S) that is a serious failure message when a failure message occurs and a non-critical failure message when a failure message occurs. Since the severity of the failure message is objectively determined based on the comparison with a certain conditional probability P (N | S), the result of the severity determination for the failure message is displayed without depending on the experience of the responder. be able to.

  (2) Further, the failure response support apparatus of the present invention further includes response necessity evaluation requesting means for requesting a response person to perform a response necessity evaluation indicating whether or not it is necessary to respond to the failure message, The classifier creating means for determining the severity level learns that a failure message requiring response based on the response necessity evaluation is a serious failure message, and a response evaluated as not requiring response based on the response necessity evaluation. Preferably, the unnecessary failure message is learned to be a non-critical failure message.

  Thus, the failure support apparatus according to the present invention learns the failure message that the responder who has confirmed the failure message determined to be necessary as a serious failure message. Subjective judgment can be added.

  (3) Further, the failure response support apparatus of the present invention is urgent based on the urgency evaluation requesting means for requesting the responsiveness to evaluate the urgency level indicating whether or not the failure message needs to be urgently responded. A failure message evaluated as being an emergency failure message is learned, and a failure message evaluated as not urgent based on the urgency evaluation is learned as a non-emergency failure message, whereby a prior probability P (S) Based on the prior probability P (E) of occurrence of an emergency failure message and the conditional probability P (W | E) that a word is included in the emergency failure message, when the failure message occurs, it is an emergency failure message. A Bayesian classifier that calculates a certain conditional probability P (E | S) is created, and a prior probability P (S), a priori probability that a non-emergency failure message occurs. Based on P (M) and the conditional probability P (W | M) that a word is included in the non-emergency failure message, the conditional probability P (M | S) A urgency determination classifier creating means for creating a Bayes classifier, and a conditional probability P (E | S) and a conditional probability P based on all words extracted by the word extracting means and the Bayes classifier (M | S) is calculated, and when the conditional probability P (E | S) and the conditional probability P (M | S) are greater than each other, it is determined that the failure message is an emergency failure message, and the conditional probability P It is preferable to further include an urgency level determination unit that determines that the failure message is a non-emergency failure message when smaller than (E | S) and the conditional probability P (M | S).

  As a result, the failure handling support apparatus according to the present invention is a non-emergency failure message when the failure message is generated and the conditional probability P (E | S) that it is an emergency failure message. Based on the comparison with a certain conditional probability P (M | S), not only the severity of the failure message but also its urgency is objectively judged, so that the severity of the failure message is not dependent on the experience of the responder. The result of the combined determination of the degree and the urgency can be displayed.

  (4) Further, the failure handling support apparatus of the present invention further includes recommendation degree giving means for giving a recommendation degree to one or more similar failure target information recommended for the failure message, and displays The means preferably displays the similar failure target information in descending order of recommendation for the obtained failure message.

  As a result, the failure handling support apparatus according to the present invention applies to the similar failure target information that is easily understood by a responder even when there are two or more similar failure target information having the same importance and urgency. By assigning a high recommendation level, another responder can determine which similar failure target information is easy to understand.

  (5) Further, in the failure response support apparatus of the present invention, the severity determination classifier creating means or the urgent level determination classifier creating means satisfies a time condition, a time condition, and other predetermined conditions. It is preferable to create a classifier.

  Thereby, the failure handling support apparatus of the present invention can reduce the processing burden associated with the classifier creation.

  (6) Further, in order to achieve the above-described object, the failure handling support program of the present invention is characterized in that the computer functions as the failure handling support apparatus of the present invention described above.

  As a result, the failure handling support program of the present invention has a conditional probability P (F | S) that is a serious failure message when a failure message occurs and a non-critical failure message when a failure message occurs. Since the severity of the failure message is objectively determined based on the comparison with a certain conditional probability P (N | S), the result of the severity determination for the failure message is displayed without depending on the experience of the responder. be able to.

  (7) In order to achieve the above-described object, the storage medium of the present invention is characterized in that it is a computer-readable medium storing the above-described failure response support program of the present invention.

  Thus, the storage medium of the present invention can cause a computer connected to the storage medium to function as the failure support apparatus of the present invention.

  The failure handling support apparatus, the failure handling support program, and the storage medium of the present invention objectively determine the severity, urgency, or similar failure target information of a failure message by objectively judging based on a comparison of two conditional probabilities. Since the result of the determination regarding the recommendation level can be displayed, there is an effect that even a responder unaccustomed to dealing with a failure can respond in the same manner as an experienced responder.

FIG. 1 is a block diagram showing the overall configuration of the failure handling support apparatus of this embodiment. FIG. 2 is a flowchart showing a processing flow by the failure support program of the present embodiment. FIG. 3 is a conceptual diagram illustrating an example of various types of information displayed by the display unit of the present embodiment. FIG. 4 is a conceptual diagram showing an example of a list of failure messages and determination results displayed in the display step S of the present embodiment. FIG. 5 is a conceptual diagram showing an example of a request by the response necessity evaluation request unit of the present embodiment. FIG. 6 is a conceptual diagram showing another example of the request by the response necessity evaluation request unit of the present embodiment. FIG. 7 is a conceptual diagram showing an example of a request by the urgency evaluation requesting unit of the present embodiment.

  Hereinafter, the failure handling support apparatus, the failure handling support program, and the storage medium according to the present embodiment will be described with reference to the drawings.

[1] Configuration of the present embodiment [1-1] Failure response support apparatus 1
FIG. 1 is a block diagram showing the overall configuration of the failure handling support apparatus 1 of the present embodiment.

  The failure handling support apparatus 1 of the present embodiment includes a failure message obtaining unit 11, a word extracting unit 12, a severity determination classifier creation unit 13, a severity determination unit 14, a display unit 15, and whether or not a response is required. An evaluation request unit 16, an urgent level evaluation request unit 17, an urgent level determination classifier creation unit 18, an urgent level determination unit 19, and a recommendation level provision unit 20 are provided.

  Each means such as the failure message obtaining means 11 described above includes a processing device such as a CPU, a storage device such as a RAM, an auxiliary storage device such as an HDD and an SSD, an input / output device such as a keyboard and a display, and a communication device such as an Internet connection device. It is configured on the basis of general components constituting other computers.

[1-2] Failure response support program 2
The failure handling support program 2 of this embodiment is stand-alone application software or web application software for causing a computer to function as the failure handling support apparatus 1 of this embodiment. When the failure support program 2 of this embodiment operates on a computer, some or all of the general components of the computer become each means such as the failure message obtaining means 11 described above, so the computer is It functions as the failure handling support apparatus 1 in the form.

[1-3] Storage medium 3
The storage medium 3 of the present embodiment stores the failure support program 2 of the present embodiment. The storage medium 3 of the present embodiment is configured such that the failure support program 2 of the present embodiment stored in the storage medium 3 can be read by a computer. Specific examples of the storage medium 3 of the present embodiment include a CD, a DVD, a USB memory, and the like.

[2] Processing Flow of the Present Embodiment The failure handling support program 2 of the present embodiment is based on each step executed by each means such as the above-described trouble message obtaining means 11 and the following severity determination, urgency determination, And each process regarding the recommendation degree is performed.

[2-1] Processing Related to Severity Determination First, the flow of processing related to severity determination is shown below.

[2-1-1] Fault message obtaining step S11
FIG. 2 is a flowchart showing processing relating to the severity determination in the failure handling support program 2 of the present embodiment. FIG. 3 is a conceptual diagram showing an example of various information displayed by the display unit 15 of the present embodiment.

  As shown in FIG. 2, the failure message obtaining unit 11 performs a failure message obtaining step S <b> 11 for obtaining a failure message indicating the content of the failure that has occurred in the monitored terminal 51.

  Here, the monitored terminal 51 is an IT system such as a computer monitored by the monitoring tool 52 connected to the failure support apparatus 1 of the present embodiment. The failure content is a system problem that has occurred in the monitored terminal 51, such as an overload state of the CPU (central processing unit) of the monitored terminal 51, for example. The failure message is, for example, a failure message indicated by characters such as “CPU is in a bottleneck state. The current load value 99.00% exceeds the threshold value 95.00%”.

[2-1-2] Word extraction step S12
The word extraction means 12 performs a word extraction step S12 that extracts one or more words included in the failure message.

  Here, the words included in the failure message are words constituting the failure message such as “CPU”, “bottleneck”, “load”, “threshold”, and the like.

[2-1-3] Severity determination classifier creation step S13
The severity determination classifier creating means 13 performs a severity determination classifier creating step S13 for creating two Bayes classifiers for obtaining desired conditional probabilities shown below in order to determine the severity of a failure message. .

  A Bayesian classifier that determines the conditional probability P (F | S) that a failure message occurs when it is a serious failure message is created as follows.

  First, let the probability that a failure message occurs be a prior probability P (S), and let the probability that a serious failure message occur be a prior probability P (F). The serious failure message means that a certain failure message is a message that informs a serious failure, and that a responder who operates the failure handling support apparatus 1 of this embodiment or a setter who sets a setting item of the failure handling support apparatus 1 It is a message determined in advance or a message learned by the severity determination classifier creating means 13.

  At this time, assuming the prior probability P (S) that the failure message is generated, the probability P (S∩F) that the failure message is generated and the serious failure message is generated is as follows.

  On the other hand, when the prior probability P (F) that a serious failure message is generated is assumed, the probability P (F∩S) that a serious failure message occurs and a failure message occurs is as follows.

  Here, in Equations 1 and 2, “P (S∩F) = P (F に お い て S)” is established. From this, when the failure message occurs, the conditional probability P (F | S) that it is a serious failure message is expressed as shown in Equation 3 based on Equation 1 and Equation 2. The mathematical formula shown in Equation 3 is called Bayes' theorem.

Here, if the j-th word extracted from the failure message in the word extraction step S12 is W _j , all the words Wj extracted by the word extraction unit 12 are written in a certain failure message S at the same time. When this is expressed by a mathematical formula, it is as shown in Equation 4.

  From the above, the Bayesian classifier that obtains the conditional probability P (F | S) that a failure message occurs when it is a serious failure message can be expressed as follows.

Note that ΠP (W _j | F) is the sum of conditional probabilities P (W _j | F) in which a certain word Wj extracted by the word extracting means 12 when a serious failure message occurs is included in the serious failure message. It is.

  That is, when a failure message occurs, the Bayesian classifier that obtains the conditional probability P (F | S) that it is a serious failure message, as shown above, the prior probability P (S) that the failure message occurs, It is created based on the prior probability P (F) that the failure message occurs and the conditional probability P (W | F) that a certain word is included in the serious failure message.

  Further, in the above formula, when “prior probability P (F) that a serious failure message occurs” is replaced with “prior probability P (N) that a non-critical failure message occurs”, when a failure message occurs, A Bayesian classifier that obtains a conditional probability P (N | S) that is a non-critical failure message is obtained as shown in Equation 6.

  Note that a non-critical failure message is a message or severity determination classifier that is determined in advance by a responder or setter of the failure response support apparatus 1 of the present embodiment that a certain failure message is not a message notifying a serious failure. This message is learned by the creation means 13.

  That is, when a failure message occurs, the Bayesian classifier that obtains the conditional probability P (N | S) that it is a non-critical failure message, as shown above, has a prior probability P (S), a non-critical failure message Based on the prior probability P (N) that occurs and the conditional probability P (W | N) that a word is included in the non-critical fault message.

  The severity determination classifier creation step S13 is performed only when the severity determination classifier has already been created or input in advance and when the predetermined condition C1 is satisfied (C1 → S13). Is preferred. This is to reduce the processing burden of the failure support apparatus 1 that performs the severity determination classifier creation step S13. The predetermined condition in which the severity determination classifier creating step S13 of the present embodiment is performed is a temporal condition such as once a week. The predetermined condition is not limited to the time condition, but may be other conditions such as a frequency condition of avoiding 10 times after the creation of the Bayes classifier.

[2-1-4] Severity determination step S14
The severity determination means 14 performs a severity determination step S14. The severity determination step S14 includes the following calculation step and determination step.

(1) Arithmetic Step In the arithmetic step, a conditional probability P (F | S) that when a fault message occurs is a serious fault message based on all the words extracted by the word extraction means 12 and the Bayes classifier. And the conditional probability P (N | S) that it is a non-critical failure message when a failure message occurs.

For example, consider a case where the failure message is “CPU is in bottleneck state. Current load value 99.00% exceeds its threshold value 95.00%” and it is a serious failure message. At this time, the word Wj extracted by the word extracting unit 12 in the failure message is, for example, W ₁ “CPU”, W ₂ “bottleneck”, W ₃ “load value”, W ₄ “threshold”, or the like. Further, the conditional probability P (W _j | F) in which each of these words is included in the serious failure message is, for example, P (W ₁ | F) = 0.7, P ( It is assumed that W ₂ | F) = 0.6, P (W ₃ | F) = 0.5, and P (W ₄ | F) = 0.5. As a result, when only the conditional probability P (W _j | F) in each word is calculated (j = 1 to 4), ΠP (W _j | F) = 0.105.

On the other hand, since the failure message is either a serious failure message or a non-critical failure message, when the above failure message occurs, the conditional probability P (W _j | N) that each of these words is included in the non-critical failure message. Is as follows.

Therefore, the conditional probability P (W _j | N) in which each of these words is included in the non-critical failure message is P (W ₁ | N) = 0.3, P (W ₂ | N) = 0.4, P (W ₃ | N) = 0.5 and P (W ₄ | N) = 0.5. As a result, when only the conditional probability P (W _j | N) in each word is calculated (j = 1 to 4), ΠP (W _j | N) = 0.03.

  Here, assuming that a failure message always occurs, the prior probability P (S) can be replaced with the probability of the failure message as shown in Equation 8.

  Further, there is no opposite reason that the prior probability P (F) that a serious failure message occurs and the prior probability P (N) that a non-critical failure message occurs with the same probability. Therefore, P (F) and P (N) can be replaced as shown in Equation 9 based on the principle of insufficient reason.

That is, the conditional probability that a failure message occurs when it is a critical failure message is P (F | S), and the conditional probability that a failure message occurs when it is a non-critical failure message P (N The calculation result of | S) is as shown in the following formula 10 when limited to the above words W _{1 to} W ₄ .

(2) Determination process In the determination process, the conditional probability that a failure message is a serious failure message when it occurs is P (F | S), and when a failure message occurs, it is a non-critical failure message. By comparing with a certain conditional probability P (N | S), it is determined as follows.

  For example, in the case of the above specific example, the conditional probability P (F | S) is larger than the conditional probability P (N | S) as shown in Equation 10. In this case, it is determined that the failure message is a serious failure message.

  On the other hand, unlike the above specific example, when the conditional probability P (F | S) becomes smaller than the conditional probability P (N | S), it is determined that the failure message is a non-critical failure message.

[2-1-5] Display step S15
FIG. 4 is a conceptual diagram showing an example of a list of failure messages and determination results displayed in the display step S of the present embodiment.

  As shown in FIG. 4, the display unit 15 performs a display step S <b> 15 for displaying the determination result on the failure message in conjunction with the display of the failure message. As a result of the determination, it is preferable to display not only the severity described above but also the determination results such as the urgency level and the recommendation level described later.

  Further, the display unit 15 displays one or more similar failure target information recommended for the failure message. For example, when the failure message is “CPU is bottlenecked. The current load value is 99.00% exceeds the threshold value of 95.00%”, the similar failure target information is “business effect due to failure occurrence” Check the situation with the operator and inform the app team about the failure occurrence and business impact status. "

  As a method for selecting similar failure target information, for example, based on the appearance rate of each word included in a newly generated failure message and the appearance rate of each word included in a failure message that occurred in the past, similarity of the failure message The failure handling support apparatus 1 determines the sex. If it is determined that the new failure message is similar to a past failure message, the failure handling support apparatus 1 uses similar failure target information in which similar failure target information for a past failure message is recommended for a new failure message. To the display means 15. As a result, the display unit 15 displays the recommended similar failure target information.

[2-1-6] Response Necessity Evaluation Request Step S16
FIG. 5 is a conceptual diagram showing an example of a request by the response necessity evaluation request unit 16 of the present embodiment. FIG. 6 is a conceptual diagram showing another example of the request by the response necessity evaluation requesting means 16 of the present embodiment.

  As shown in FIGS. 5 and 6, the response necessity evaluation requesting means 16 performs a response necessity evaluation requesting step S16 for requesting the responder for a response necessity evaluation indicating whether or not it is necessary to respond to the failure message. .

  For example, as in the above example, if a failure message such as “CPU is in a bottleneck state. The current load value is 99.00% exceeds its threshold value of 95.00%”, a response necessity evaluation request is generated. The means 16 instructs the display means 15 to display options such as “response completed (response required)”, “response not required”, etc. (response necessity evaluation indicating whether or not it was necessary to respond to the failure message). Thus, a response necessity evaluation is requested to the responder of the failure response support apparatus 1.

  Then, when the responder of the failure response support apparatus 1 performs the response necessity evaluation by selecting the option “completion of response (necessary response)”, the severity determination means 14 designates the failure message as a serious failure message or a non-critical failure. Regardless of whether the message is determined to be a message, the above-described severity determination classifier creating unit 13 learns that a required failure message that is evaluated as required based on the response necessity evaluation is a serious failure message. In addition, when the responder of the failure support apparatus 1 performs a response necessity evaluation by selecting the “no action required” option, the severity determination unit 14 determines that the failure message is a serious failure message or a non-critical failure message. Regardless of the determination, the above-described severity determination classifier creating unit 13 learns that a response-unnecessary failure message evaluated as not required based on a response necessity evaluation is a non-critical failure message.

As a learning method, for example, the word extraction unit 12 extracted the word W ₁ “CPU” from 10 trouble messages that occurred in the past, and the word W ₁ was included in the serious trouble message seven times. Think about the case. In this case, the conditional probability word _{W 1} is included in the critical failure message P _(W 1 | F) is 0.7, and the conditional probability word _{W 1} is included in the non-critical fault message _{P (W} 1 | N) Becomes 0.3. Here, when the eleventh failure message including the word W ₁ “CPU” is generated and the responder of the failure response support apparatus 1 selects the option “completion of response (necessary response)”, the number of significant digits is small. If the third place, the conditional probability P (W ₁ | F) is 0.727 (= 8/11), and the conditional P (W ₁ | N) is 0.273 (= 3 / 11). Thus, the severity determination classifier creating means 13 learns.

  Further, when the responder selects “completion of response (= response required)”, the response necessity evaluation requesting means 16 requests the responder for a cause option such as “work mistake” as shown in FIG. Is preferred. On the other hand, when the responder selects “no action required”, the action necessity evaluation requesting means 16 preferably requests the responder for a cause option such as “ignorance target” as shown in FIG.

  Note that if there are too many serious failure messages and important failure messages that are important to the responder are buried in a large number of important failure messages that are not important, the response necessity evaluation requesting means 16 indicates that the response necessity evaluation is “response”. It is preferable to process a failure message as a serious failure message only when a specific combination of necessity evaluation and a cause combination such as “completion (= necessary response)” is selected and the cause is “operation error” or the like is selected. . As a result, the probability that the failure message is determined to be a serious failure message is reduced, so the response necessity evaluation requesting means 16 can make only a failure message important for the responder into a serious failure message.

  With the above flow, processing relating to the severity determination is performed.

[2-2] Process for Urgency Determination Next, the flow of the process for urgency determination is shown below.

  FIG. 7 is a conceptual diagram showing an example of a request by the urgency evaluation requesting unit 17 of the present embodiment.

[2-2-1] Urgency evaluation request process S17
The urgent level evaluation requesting unit 17 performs an urgent level evaluation requesting step S17 that requests an urgent level evaluation indicating whether or not an urgent response to the failure message is required.

  For example, consider a case where a responder has responded to a serious failure message that notifies an emergency stop of software that operates in the monitored terminal 51. At this time, as shown in FIG. 7, the urgency evaluation requesting means 17 needs to respond urgently to options of “normal” or “emergency” on the display screen on which the failure message is displayed (= severe failure message). Urgent evaluation indicating whether or not there was). Thereby, the urgency evaluation requesting means 17 requests the responder whether the urgency is “normal” or “emergency”. The responder inputs the urgency assessment to the urgency assessment requesting means 17 by selecting “normal” or “emergency” in response to the above request.

  Note that the setter of the failure support apparatus 1 according to the present embodiment considers that the responder does not respond urgently to a failure message that is not serious. Therefore, only when the failure message is a serious failure message and the response necessity result is “response completed (= response required)”, the urgency evaluation requesting unit 17 requests the input of the urgency level. The setter has set. Of course, by changing the setting, it is possible to set the urgency evaluation requesting means 17 to request the input of the urgency level for all failure messages.

[2-2-2] Urgency determination classifier creation step S18
The urgency determination classifier creating means 18 performs the urgency determination classifier creating process S18 based on the learning process and the classifier creating process.

  Here, in the following, the prior probability that a failure message occurs is P (S), the prior probability that an emergency failure message occurs is P (E), and the conditional probability that a word is included in the emergency failure message is P (W | E), the conditional probability that when a failure message occurs it is an emergency failure message is denoted as P (E | S). Also, a prior probability P (M) that a non-emergency failure message occurs, a conditional probability P (W | M) that a certain word is included in the non-emergency failure message, and a non-emergency failure when a failure message occurs A conditional probability that is a message is represented as P (M | S).

(1) Learning process The urgent level determination classifier creating unit 18 outputs a fault message that is evaluated as urgent based on the urgent level evaluation input to the urgent level evaluation request unit 17 in the learning step. Learn to be a message. Further, the urgency determination classifier creating means 18 learns that the failure message evaluated as not urgent based on the urgency evaluation is a non-emergency failure message, as described above.

The learning method is the same as the learning method by the severity determination means 14. For example, consider a case where the word extraction unit 12 extracts the word W ₁ “CPU” from seven serious failure messages that occurred in the past, and the word W ₁ is included in the emergency failure message four times. In this case, the conditional probability word _{W 1} is included in the emergency fault message P _(W 1 | E) is 0.571, and the conditional probability word _{W 1} is included in the non-urgent fault message _{P (W} 1 | M) Becomes 0.429. Here, when the eighth serious failure message including the word W ₁ “CPU” occurs and the responder of the failure response support apparatus 1 selects the “emergency” option, the significant number is the third decimal place. Then, the conditional probability P (W ₁ | E) is 0.625 (= 5/8), and the conditional P (W ₁ | M) is 0.375 (= 3/8). . Thus, the urgency determination classifier creating means 18 learns.

(1) Classifier creation step The urgency determination classifier creation means 18 obtains a conditional probability P (E | S) that a failure message occurs in the classifier creation step when it is an emergency failure message. Create a classifier and a Bayesian classifier that determines the conditional probability P (M | S) that a failure message occurs when it is a non-emergency failure message. A method for creating a classifier used for urgency determination is, for example, as follows, similar to the method for creating a classifier for severity determination.

  The emergency failure message is a message learned by the urgency determination classifier creating means 18 that the certain serious failure message is a message notifying an emergency requiring an emergency response, as long as the setting of the present embodiment is set, or the present embodiment. This message is determined in advance by a person who operates the failure handling support apparatus 1 or a setter who sets the setting items of the fault handling support apparatus 1.

  At this time, assuming the prior probability P (S) that the failure message is generated, the probability P (S∩E) that the failure message is generated and the emergency failure message is generated is as shown in Equation 11.

  On the other hand, when the prior probability P (E) that an emergency failure message occurs is assumed, the probability P (E∩S) that an emergency failure message occurs and a failure message occurs is expressed by Equation 12.

  Here, in Equations 11 and 12, “P (S∩E) = P (E∩S)” is established. From this, when the failure message occurs, the conditional probability P (E | S) that it is an emergency failure message is expressed as in Equation 13 based on Equations 11 and 12. The mathematical formula shown in Equation 13 is called Bayes' theorem.

Here, if the j-th word extracted from the failure message in the word extraction step S12 is W _j , all the words Wj extracted by the word extraction unit 12 are written in a certain failure message S at the same time. When this is expressed by a mathematical expression, it becomes as shown in Expression 14 like Expression 4.

  From the above, the Bayesian classifier that obtains the conditional probability P (E | S) that a failure message occurs when it is an emergency failure message can be expressed as follows.

Note that ΠP (W _j | E) is the sum of conditional probabilities P (W _j | E) that a certain word Wj extracted by the word extraction means 12 when the emergency failure message occurs is included in the emergency failure message. It is.

  That is, when a failure message occurs, the Bayesian classifier that obtains the conditional probability P (E | S) that it is an emergency failure message, as described above, the prior probability P (S) that the failure message occurs, the emergency It is created based on a prior probability P (E) that a failure message occurs and a conditional probability P (W | E) that a word is included in the emergency failure message.

  Also, in the above formula, if “prior probability P (E) that an emergency failure message occurs” is replaced with “priority probability P (M) that a non-emergency failure message occurs”, when a failure message occurs, A Bayesian classifier that obtains a conditional probability P (M | S) that is a non-emergency failure message is obtained as shown in Equation 16.

  Note that the non-emergency failure message is not a message indicating a failure requiring emergency response, and is a message learned by the emergency determination classifier creating means 18 or the response of the failure response support apparatus 1 of the present embodiment. This message is determined in advance by the user or the setter.

  That is, when a failure message occurs, a Bayes classifier that obtains a conditional probability P (M | S) that it is a non-emergency failure message, as shown above, a prior probability P (S) that a failure message occurs, It is created based on a prior probability P (M) that a non-emergency failure message occurs and a conditional probability P (W | M) that a word is included in the non-emergency failure message.

  The urgency determination classifier creation step S18 is performed only when the urgency determination classifier has already been created or input in advance and when the predetermined condition C2 is satisfied (C2 → S18). Is preferred. This is to reduce the processing burden of the failure support apparatus 1 that performs the emergency determination classifier creation step S18. The predetermined condition for performing the emergency level determination classifier creating step S18 of the present embodiment is a time condition such as once a week, for example. The predetermined condition is not limited to the time condition, but may be other conditions such as a frequency condition of avoiding 10 times after the creation of the Bayes classifier.

[2-2-3] Urgency determination step S19
The urgency level determination means 19 performs an urgency level determination step S19. The urgency level determination step S19 includes the following calculation step and determination step.

(1) Arithmetic Step In the arithmetic step, a conditional probability P (), when a fault message occurs, is an emergency fault message based on all the words extracted by the word extraction means 12 and the Bayes classifier for urgency determination. E | S) and the conditional probability P (M | S) that it is a non-emergency failure message when a failure message occurs.

For example, the conditional probability P (W _j | E) in which each word is included in the emergency failure message in the emergency failure message is, for example, P (W ₁ | E) = 0. 35, P (W ₂ | E) = 0.3, P (W ₃ | E) = 0.25, and P (W ₄ | E) = 0.25. As a result, when only the conditional probability P (W _j | E) in each word is calculated (j = 1 to 4), ΠP (W _j | E) = 0.00656.

  Here, as shown in Equation 8, P (S) ≠ 0 can be substituted.

  Further, there is no opposite reason that the prior probability P (E) that an emergency failure message occurs and the prior probability P (M) that a non-emergency failure message occurs with the same probability. Therefore, P (E) and P (M) can be replaced as shown in Equation 17 by the principle of insufficient reason and the prior probability P (F) = 0.5 (Equation 9) that a serious failure message occurs.

On the other hand, since the serious failure message is either an emergency failure message or a non-emergency failure message, when the above-mentioned serious failure message occurs, a conditional probability P (W _j | M) is as shown in Equation 18.

Therefore, the conditional probability P (W _j | M) in which each of these words is included in the non-emergency failure message is P (W ₁ | M) = 0.15, P (W ₂ | M) = 0.2, P (W ₃ | M) = 0.25, P (W ₄ | M) = 0.25. As a result, when only the conditional probability P (W _j | M) is calculated for each word (j = 1 to 4), ΠP (W _j | M) = 0.188.

That is, the conditional probability that it is an emergency failure message when a failure message occurs is P (E | S), and the conditional probability P (M that it is a non-emergency failure message when a failure message occurs The calculation result of | S) is as shown in Equation 19 below when limited to the above words W _{1 to} W ₄ .

(2) Determination process In the determination process, when a failure message occurs, the conditional probability that it is an emergency failure message is P (E | S), and when a failure message occurs, it is a non-emergency failure message. By comparing with a certain conditional probability P (M | S), it is determined as follows.

  For example, in the case of the above specific example, the conditional probability P (E | S) is larger than the conditional probability P (M | S) as shown in Equation 19. In this case, it is determined that the failure message is an emergency failure message.

  On the other hand, unlike the above specific example, when the conditional probability P (E | S) becomes smaller than the conditional probability P (M | S), it is determined that the failure message is a non-emergency failure message.

  The result of the emergency level determination by the emergency level determination unit 19 is transmitted to the display unit 15. Then, the display means 15 displays the urgency level as described above. As the display of the degree of urgency, for example, “emergency” is displayed in red and bold in the vicinity of the new failure message in the screen displaying the new failure message.

  With the above flow, processing relating to urgency determination is performed.

[2-3] Recommended Level Processing Finally, the flow of recommended level processing is shown below.

[2-3-1] Recommendation level giving step S20
The recommendation level assigning unit 20 performs a recommendation level giving step S20 for giving a recommendation level to one or more similar fault target information recommended for the fault message.

  For example, the following method is adopted as the recommendation degree assigning method in the present embodiment. The evaluation criteria for the recommendation level are, for example, objective evaluation such as (a) severity of failure message or (b) number of browsing of similar failure target information, and (c) click of “like” button on similar failure target information Such as subjective evaluation of responders.

  The recommendation degree assigning means 20 assigns a recommendation degree to the similar obstacle target information based on the evaluation calculation, such as the priority of the above-mentioned evaluation criteria, the sum or the sum, and the other evaluation methods, and is transmitted to the display means 15. . Further, the display unit 15 displays similar failure target information in descending order of recommendation for the obtained new failure message.

  With the above flow, the processing related to the recommendation level is performed.

[3] Effects of this embodiment Next, operations and effects of the failure handling support apparatus 1, the failure handling support program 2, and the storage medium 3 of this embodiment will be described.

  (1) The failure handling support apparatus 1 according to the present embodiment extracts a failure message obtaining unit 11 that obtains a failure message indicating the content of a failure that has occurred in a monitored terminal, and extracts one or more words included in the failure message. The word extraction means 12, the prior probability P (S) that a failure message occurs, the prior probability P (F) that a serious failure message occurs, and the conditional probability P (W | F) that a certain word is included in the serious failure message ) To create a Bayes classifier that obtains a conditional probability P (F | S) that a failure message occurs when a failure message occurs, and generates a prior probability P (S), a non-critical failure message Based on the prior probability of P (N) and the conditional probability P (W | N) that a word is included in the non-critical failure message, Severity determination classifier creating means 13 for creating a Bayes classifier for obtaining a conditional probability P (N | S) for which is a non-serious failure message, and all the words and Bayes classifiers extracted by the word extracting means 12 If the conditional probability P (F | S) is greater than the conditional probability P (N | S), the conditional probability P (F | S) and the conditional probability P (N | S) are calculated. Severity that determines that the message is a critical failure message and determines that the failure message is a non-critical failure message if the conditional probability P (F | S) is less than the conditional probability P (N | S) It is characterized by comprising a determination means 14 and a display means 15 for displaying a determination result for the failure message.

  As a result, the failure handling support apparatus 1 according to the present embodiment has a conditional probability P (F | S) that is a serious failure message when a failure message occurs and a non-serious failure when the failure message occurs. Since the severity of the failure message is objectively determined based on the comparison with the conditional probability P (N | S) that is the message, the result of the determination of the severity for the failure message can be obtained without depending on the experience of the responder. Can be displayed.

  (2) The failure handling support apparatus 1 of the present embodiment further includes handling necessity evaluation requesting means 16 for requesting a handling person whether or not it is necessary to deal with a failure message. The severity determination classifier creating means 13 learns that a required failure message that has been evaluated as required based on the response necessity evaluation is a serious failure message, and that no response is required based on the response necessity evaluation. It is preferable to learn that the evaluated unneeded failure message is a non-critical failure message.

  As a result, the failure handling support apparatus 1 according to the present embodiment learns the failure message that the responder who has confirmed the failure message determines that the response is necessary as a serious failure message, and therefore responds to the objective determination result. The subjective judgment of the person can be added.

  (3) Further, the failure handling support apparatus 1 according to the present embodiment uses the urgency assessment requesting means 17 for requesting the responder to perform urgency assessment indicating whether or not the failure message needs to be dealt with urgently. A failure probability evaluated as urgent based on the failure message is learned as an urgent failure message, and a failure message evaluated as not urgent based on the urgency evaluation is learned as a non-emergency failure message. (S), based on a prior probability P (E) that an emergency failure message occurs and a conditional probability P (W | E) that a certain word is included in the emergency failure message, when a failure message occurs, it is urgent Create a Bayesian classifier that calculates the conditional probability P (E | S) that is a failure message, and generate a prior probability P (S) and a non-emergency failure message Conditional probability P (M) and a conditional probability P (W | M) that a certain word is included in the non-emergency failure message, a conditional probability that when a failure message occurs, it is a non-emergency failure message Conditional probability P (E | S) based on the urgency determination classifier creating means 18 for creating a Bayes classifier for obtaining P (M | S) and all the words extracted by the word extracting means 12 and the Bayes classifier. And the conditional probability P (M | S) is calculated, and if the conditional probability P (E | S) and the conditional probability P (M | S) are greater than each other, it is determined that the failure message is an emergency failure message. And an urgency determining means 19 that determines that the failure message is a non-emergency failure message when the conditional probability P (E | S) and the conditional probability P (M | S) are smaller. Like .

  As a result, the failure handling support apparatus 1 according to the present embodiment enables the conditional probability P (E | S) that the failure message is an emergency failure message when the failure message occurs and the non-emergency failure when the failure message occurs. Based on the comparison with the conditional probability P (M | S) that is the message, not only the severity of the failure message but also the urgency of the failure is objectively determined, so that the failure message does not depend on the experience of the responder. It is possible to display the result of the combined determination of the severity and the urgency level for.

  (4) In addition, the failure handling support apparatus 1 of the present embodiment further includes a recommendation level giving unit 20 that gives a recommendation level to one or more similar failure target information recommended for the failure message. The display unit 15 preferably displays the similar failure target information in descending order of recommendation for the acquired failure message.

  As a result, the failure handling support apparatus 1 according to the present embodiment converts the similar failure target information that is easy for a certain responder to understand even when there are two or more similar failure target information having similar importance and urgency. By giving a high recommendation level, another responder can determine which similar failure target information is easy to understand.

  (5) Further, in the failure response support apparatus 1 of the present embodiment, the severity determination classifier creating unit 13 or the urgent level determination classifier creating unit 18 sets a time condition, a time condition, and other predetermined conditions. When satisfied, it is preferable to create a classifier.

  Thereby, the failure handling support apparatus 1 of the present embodiment can reduce the processing burden associated with the classifier creation.

  (6) Further, the failure handling support program 2 of the present embodiment is characterized in that it is for causing a computer to function as the failure handling support apparatus 1 of the present embodiment described above.

  Thus, the failure handling support program according to the present embodiment enables the conditional probability P (F | S) that the failure message is a serious failure message when the failure message is generated and the non-critical failure message when the failure message is generated. Since the severity of the failure message is objectively determined based on the comparison with the conditional probability P (N | S), the result of the severity determination for the failure message is displayed without depending on the experience of the responder. can do.

  (7) In addition, the storage medium 3 of the present embodiment is characterized in that it is a computer-readable medium storing the above-described failure support program 2 of the present embodiment.

  Thereby, the storage medium 3 of this embodiment can make the computer which connected the storage medium function as the failure support apparatus 1 of this embodiment.

  That is, the failure handling support apparatus, the failure handling support program, and the storage medium according to the present embodiment objectively determine the severity, urgency, or similar failure for the failure message based on a comparison of two conditional probabilities that face each other. Since the determination result regarding the recommendation level of the target information can be displayed, there is an effect that even a responder who is unaccustomed to handling a failure can respond in the same manner as an experienced responder.

  In addition, this invention is not limited to embodiment mentioned above etc., A various change is possible as needed.

DESCRIPTION OF SYMBOLS 1 Failure response support apparatus 2 Failure response support program 3 Storage medium 11 Failure message acquisition means 12 Word extraction means 13 Severity determination classifier creation means 14 Severity determination means 15 Display means 16 Response necessity evaluation request means 17 Urgent degree evaluation Requesting means 18 Urgent degree determination classifier creating means 19 Urgent degree judging means 20 Recommended degree assigning means 51 Monitored terminal 52 Monitoring tool S11 Fault message obtaining process S12 Word extracting process S13 Severity judging classifier creating process S14 Severity judgment Process S15 Display process S16 Response necessity evaluation request process S17 Urgency evaluation request process S18 Urgency determination classifier creation process S19 Urgency determination process S20 Recommended degree giving process

Claims (7)

A failure message obtaining means for obtaining a failure message indicating the content of the failure that has occurred in the monitored terminal;
Word extracting means for extracting one or more words included in the failure message;
Based on a prior probability P (S) that the failure message occurs, a prior probability P (F) that a serious failure message occurs, and a conditional probability P (W | F) that a word is included in the serious failure message, Create a Bayes classifier that determines the conditional probability P (F | S) that the failure message occurs when it is the critical failure message, and generate the prior probability P (S), a non-critical failure message Based on a prior probability P (N) and a conditional probability P (W | N) that a word is included in the non-critical failure message, when the failure message occurs, it is the non-critical failure message A severity classifier creating means for creating a Bayes classifier for obtaining a conditional probability P (N | S);
The conditional probability P (F | S) and the conditional probability P (N | S) are calculated based on all the words extracted by the word extracting means and the Bayes classifier, and the conditional probability P (F If | S) is greater than the conditional probability P (N | S), it is determined that the failure message is the critical failure message, and the conditional probability P (F | S) is the conditional probability P. Severity determination means for determining that the failure message is the non-critical failure message when smaller than (N | S);
Display means for displaying the determination result for the failure message;
A failure response support apparatus comprising: A response necessity evaluation requesting means for requesting a responder for a response necessity evaluation indicating whether or not it is necessary to respond to the failure message;
Is further provided,
The severity determination classifier creating means learns that a required failure message that is evaluated as required based on the response necessity evaluation is the critical failure message, and that no response is required based on the response necessity evaluation. The failure handling support apparatus according to claim 1, wherein the evaluated failure handling error message is learned as the non-serious failure message. An urgency evaluation requesting means for requesting an urgent evaluation indicating whether or not it is necessary to urgently respond to the failure message;
The failure message evaluated as urgent based on the urgency evaluation is learned as an urgent failure message, and the failure message evaluated as not urgent based on the urgency evaluation is a non-emergency failure message By learning, the prior probability P (S), the prior probability P (E) that the emergency failure message occurs, and the conditional probability P (W | E) that a certain word is included in the emergency failure message And generating a Bayes classifier for determining a conditional probability P (E | S) that the failure message is an emergency failure message when the failure message occurs, and the prior probability P (S) and the non-emergency failure message are Based on the prior probability P (M) that occurs and the conditional probability P (W | M) that a word is included in the non-emergency failure message, the failure message And | (S M) Urgency determination classifier creation means for creating a Bayesian classifier seeking, it the nonemergency disorder is a message conditional probability P when di occurs
The conditional probability P (E | S) and the conditional probability P (M | S) are calculated based on all the words extracted by the word extraction means and the Bayes classifier, and the conditional probability P (E | S) and the conditional probability P (M | S) are greater than the conditional probability P (M | S), it is determined that the failure message is an emergency failure message, and the conditional probability P (E | S) and the conditional probability P ( Urgency level determination means for determining that the failure message is a non-emergency failure message if smaller than M | S);
The failure response support apparatus according to claim 1, further comprising: A recommendation level giving means for giving a recommendation level to one or more similar fault target information recommended for the fault message;
Is further provided,
The failure handling support according to any one of claims 1 to 3, wherein the display unit displays the similar failure target information in descending order of the recommendation degree with respect to the acquired failure message. apparatus. The severity determination classifier creation means or the urgency judgment classifier creation means creates a classifier when a time condition, a frequency condition, or other predetermined conditions are satisfied. The failure support apparatus according to any one of claims 1 to 4.   A failure handling support program for causing a computer to function as the failure handling support apparatus according to any one of claims 1 to 6.   A computer-readable storage medium storing the failure handling support program according to claim 6.