JP2018045637A - Monitoring system, information processing device, control method, and control program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a monitoring system, etc., that allows a supervisor to appropriately respond to alarm information outputted from a device being monitored.SOLUTION: The present invention is a monitoring system comprising a learning system and an information processing device. The learning system includes a first learning apparatus for dividing a plurality of alarm information for learning into a plurality of elements by using first definition data in which the degree of importance for learning that indicates the degree of necessity to respond is correlated to each alarm information for learning, and outputting a presumed degree of importance that is presumed for operating alarm information different from the alarm information for learning from the relationship between the plurality of divided elements and the degree of importance for learning that corresponds to each of a plurality of alarm information for learning. The information processing device inputs the alarm information outputted from each of a plurality of devices being monitored, as operating alarm information, to the first learning apparatus, and outputs a written procedure that indicates a procedure for responding to alarm information when the presumed degree of importance outputted from the first learning apparatus is higher than or equal to a first threshold.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a monitoring system that monitors a plurality of monitoring target devices.

  Conventionally, a monitoring system for monitoring a plurality of monitoring target devices connected via a network has been used.

  In Patent Document 1, an alarm signal input from each device is received, the received alarm is analyzed, the type of alarm and the correspondence between the device that generated the alarm and the alarm are specified, and the device that generated the alarm There is disclosed an alarm monitoring device that visually displays a correspondence relationship between an alarm and an alarm on a display device.

JP 2014-192554 A

  In general, each monitoring target device is connected to a network via a communication device such as a switch or a router, and outputs alarm information when the monitoring target device or the communication device fails. When the alarm information is output, the supervisor of the monitoring system determines the necessity of dealing with the alarm information, and needs to perform a specific countermeasure according to the necessity.

  However, depending on the technical level of the monitor and the presence or absence of response experience, the alarm information that the monitor needs to deal with may be missed, or the response of alarm information that does not need to be dealt with may take a long time.

  The present invention has been made to solve such conventional problems, and a monitoring system and an information processing apparatus that enable a monitor to appropriately respond to alarm information output from a monitoring target apparatus An object is to provide a control method and a control program.

  The monitoring system according to the present invention is a monitoring system having a learning system and an information processing device, and the learning system needs to cope with each of a plurality of learning alarm information and a plurality of learning alarm information. Using the first definition data associated with the learning importance indicating the degree, the plurality of learning alarm information is divided into a plurality of elements, and each of the divided plurality of elements and the plurality of learning alarm information is divided. The information processing apparatus includes a first learner that outputs a presumed importance level that is estimated for operation alarm information that is different from the plurality of learning alarm information that is input, from the relationship with the corresponding learning importance level. An alarm information acquisition unit that acquires alarm information output from each of the plurality of monitoring target devices, and the alarm information is input to the first learning device as operating alarm information. An importance level acquisition unit that acquires the estimated importance level output from the learning device, a procedure manual acquisition unit that acquires a procedure manual indicating a procedure for dealing with alarm information when the estimated importance level is equal to or greater than the first threshold, and a procedure And an output unit that outputs the procedure manual acquired by the document acquisition unit.

  In the monitoring system according to the present invention, the learning system relates to a plurality of learning alarm information, a monitoring target device that outputs each of the plurality of learning alarm information, and a device that causes each of the plurality of learning alarm information. Using the second definition data associated with the learning relevance level indicating the degree of sex, the plurality of learning alarm information is divided into a plurality of elements, and the plurality of divided elements and the plurality of learning alarm information A second learning device that outputs an estimated relevance level estimated for operating alarm information different from the plurality of input learning alarm information based on a relationship with the corresponding learning relevance level; The apparatus inputs the alarm information acquired by the alarm information acquisition unit to the second learning device as operation alarm information, and acquires the estimated relevance output from the second learning device. A continuousness acquisition unit, and a device candidate specifying unit that specifies a device candidate that causes alarm information when the estimated importance is less than the first threshold and the estimated relevance is less than the second threshold. Furthermore, it is preferable that the output unit outputs information indicating the candidates specified by the device candidate specifying unit.

  In the monitoring system according to the present invention, the learning system stores third definition data in which a plurality of learning alarm information and learning procedure manual information indicating a procedure manual corresponding to each of the plurality of learning alarm information are associated. To divide the plurality of learning alarm information into a plurality of elements, and from the relationship between the divided plurality of elements and the learning procedure manual information corresponding to each of the plurality of learning alarm information, A third learning device that further outputs a plurality of estimated procedure manual information estimated for operation alarm information different from the learning alarm information in descending order of accuracy indicating a procedure for dealing with the operation alarm information, and obtains the procedure manual. When the importance acquired by the importance acquisition unit is greater than or equal to the first threshold, the alarm information acquired by the alarm information acquisition unit is sent to the third learning device as operation alarm information. And force, by acquiring a plurality of speculation instructions information outputted from the third learning device acquires a plurality of instructions, an output unit preferably outputs side by side a plurality of instructions sequentially probable.

  In the monitoring system according to the present invention, the alarm information includes information indicating the monitoring target device that has output the alarm information, and the learning system outputs alarm information output from each of the plurality of monitoring target devices within a predetermined time. The learning target device is indicated by using the fourth definition data in which the information indicating the monitoring target device for learning included in the information and the learning candidate information indicating the candidate device that causes the alarm information are associated with each other. An operation alarm that divides information into a plurality of elements, and that is different from the plurality of learning alarm information that is input, based on the relationship between the divided elements and the learning candidate information corresponding to the information indicating the monitoring target device for learning Outputs multiple pieces of candidate information estimated for information indicating the monitoring target device included in the information in descending order of accuracy indicating candidate devices that cause operation alarm information. And the device candidate identification unit acquires the alarm information acquired by the alarm information acquisition unit when the estimated importance is less than the first threshold and the estimated relevance is less than the second threshold. The information indicating the device to be monitored included in is input to the fourth learning device, and a plurality of candidate information output from the fourth learning device is acquired to identify a plurality of device candidates that cause the alarm information. The output unit preferably outputs a plurality of pieces of estimation candidate information acquired by the apparatus candidate specifying unit in order of increasing accuracy.

  The information processing apparatus according to the present invention includes first definition data in which a plurality of learning alarm information and a learning importance indicating a degree of necessity of dealing with each of the plurality of learning alarm information are associated with each other. To divide a plurality of learning alarm information into a plurality of elements, and input a plurality of learning based on the relationship between the divided plurality of elements and the learning importance corresponding to each of the plurality of learning alarm information. An information processing apparatus that communicates with a learning system having a first learning device that outputs a presumed importance estimated for operational alarm information different from the alarm information for the alarm, and that is output from each of a plurality of monitoring target devices An alarm information acquisition unit that acquires information, and an alarm information that is input to the first learning device as operating alarm information, and an importance that acquires the estimated importance output from the first learning device An acquisition unit; a procedure manual acquisition unit that acquires a procedure manual indicating a procedure for handling alarm information when the estimated importance is equal to or greater than a first threshold; and an output unit that outputs the procedure manual acquired by the procedure manual acquisition unit; Have.

  The control method according to the present invention uses first definition data in which a plurality of learning alarm information and a learning importance indicating the degree of necessity of dealing with each of the plurality of learning alarm information are associated with each other. The plurality of learning alarm information is divided into a plurality of elements, and the plurality of learning inputs inputted from the relationship between the divided plurality of elements and the learning importance corresponding to each of the plurality of learning alarm information. A control method for an information processing apparatus that communicates with a learning system having a first learning device that outputs a presumed importance estimated for operation alarm information different from alarm information, and is output from each of a plurality of monitoring target devices. Obtained alarm information, input the obtained alarm information to the first learning device as operation alarm information, obtain the estimated importance output from the first learning device, and obtain the obtained guess If iodide is equal to or larger than the first threshold, it obtains the instructions illustrating a procedure of coping for alarm information, and outputs the acquired procedures involves.

  The control program according to the present invention uses first definition data in which a plurality of learning alarm information and a learning importance indicating a degree of necessity of dealing with each of the plurality of learning alarm information are associated with each other. The plurality of learning alarm information is divided into a plurality of elements, and the plurality of learning inputs inputted from the relationship between the divided plurality of elements and the learning importance corresponding to each of the plurality of learning alarm information. A control program for an information processing apparatus that communicates with a learning system having a first learning device that outputs a presumed importance estimated for operational alarm information different from alarm information, and is output from each of a plurality of monitoring target devices The obtained alarm information is input to the first learning device as operating alarm information, the estimated importance output from the first learning device is obtained, If obtained was presumed importance degree is smaller than the first threshold value, obtains the instructions illustrating a procedure of coping for alarm information, and outputs the acquired instructions, to be executed by the information processing apparatus that.

  The monitoring system, information processing apparatus, control method, and control program according to the present invention enable a monitor to appropriately respond to alarm information output from a monitoring target apparatus.

(A) is a schematic diagram which shows the flow in which the monitoring system 1 makes the learning system 4 learn 1st definition data, (b) is a schematic diagram which shows the state in which the monitoring system 1 is working. 1 is a diagram illustrating an example of a schematic configuration of a monitoring system 1. FIG. 2 is a diagram illustrating an example of a schematic configuration of an information processing device 3. FIG. It is a figure which shows an example of the data structure of 1st definition data. It is a figure which shows an example of the data structure of 2nd definition data. (A) is a figure which shows an example of the data structure of 3rd definition data, (b) is a figure which shows an example of the data structure of 4th definition data. It is a figure which shows an example of schematic structure of the learning apparatus 4a. An example of an operation sequence when the monitoring system 1 causes the learning system 4 to learn each definition data is shown. The flowchart of the process in the state in which the monitoring system 1 is working is shown.

  Hereinafter, various embodiments of the present invention will be described with reference to the drawings. However, it should be noted that the technical scope of the present invention is not limited to these embodiments, and extends to the invention described in the claims and equivalents thereof.

(System overview)
FIG. 1A is a schematic diagram illustrating a flow in which the monitoring system 1 causes the learning system 4 to learn the first definition data, and FIG. 1B is a schematic diagram illustrating a state in which the monitoring system 1 is in operation. .

  The monitoring system 1 is a system that monitors a plurality of monitoring target devices. The monitoring system 1 includes a plurality of monitoring target devices 2, an information processing device 3, and a learning system 4. The monitoring target device 2 is a device that outputs specific alarm information according to the state of each device during operation or when a failure occurs while providing a specific service, and the state is monitored by the information processing device 3. . The information processing device 3 is a computer that is used by an operator and a monitor of the monitoring system 1 to monitor the state of the monitoring target device 2. The learning system 4 includes a plurality of learning devices 4a to 4c. One or more learning devices among the plurality of learning devices 4 a to 4 c include a first learning device 431.

  As illustrated in FIG. 1A, when the monitoring system 1 causes the learning system 4 to learn the first definition data, the information processing device 3 acquires each alarm information output from each of the plurality of monitoring target devices 2. And used as learning alarm information (1). Next, the information processing device 3 sets a learning importance level indicating the degree of necessity of dealing with each learning alarm information in accordance with an operation by the operator of the monitoring system 1, and sets each learning alarm information and each learning alarm information. First definition data is created that associates and defines the importance for learning (2). Next, the information processing apparatus 3 transmits the first definition data to the learning system 4 to learn the relationship between the learning alarm information and the learning importance (3). Next, the first learning device 431 learns the relationship between the learning alarm information and the learning importance using the first definition data (4).

  The first learning device 431 performs learning by so-called “supervised learning”. The first learning device 431 divides each learning alarm information into a plurality of elements, and the operation alarm information is input from the relationship between each divided element and the learning importance corresponding to each learning alarm information. In this case, learning is performed so that the estimated importance is output. The operation alarm information is alarm information output from each monitoring target device 2 when the monitoring system 1 is in operation, and is different from learning alarm information. The estimated importance indicates the degree of necessity of handling that is estimated for the input operation alarm information.

  On the other hand, as shown in FIG. 1B, when the monitoring system 1 is in operation, the information processing device 3 acquires alarm information output from each of the plurality of monitoring target devices 2 (1). The information processing apparatus 3 inputs the acquired alarm information to the learning system 4 as operation alarm information (2). The first learning device 431 of the learning system 4 uses the first definition data to output the estimated importance for the input operation alarm information to the information processing device 3, and the information processing device 3 outputs the estimated importance of the output. (3). The information processing apparatus 3 determines whether or not the estimated importance is greater than or equal to the first threshold, and when the estimated importance is greater than or equal to the first threshold, shows a series of procedures for dealing with the operation alarm information. A procedure manual is displayed (4).

  As described above, the information processing device 3 uses the learning result learned in advance using the learning alarm information, determines the importance of the operation alarm information output from each monitoring target device, and is handled by the supervisor. If it is necessary, a procedure manual is output. This makes it possible to prevent the monitor from overlooking alarm information that needs to be dealt with or taking a long time to deal with alarm information that does not need to be dealt with. It is possible to appropriately respond to the alarm information output from.

  FIG. 2 is a diagram illustrating an example of a schematic configuration of the monitoring system 1.

  The monitoring system 1 has a plurality of monitoring target devices 2, an information processing device 3, a learning system 4 including learning devices 4a to 4c, and a procedure manual database 5.

  In the monitoring system 1, each of the plurality of monitoring target devices 2 is connected to the network 6 via a network device (not shown). The information processing device 3 is communicably connected to each monitoring target device 2 and the procedure manual database 5 via the network 6 and is communicably connected to the learning system 4 via the network 7. For example, the network 6 is an intranet, and the network 7 is the Internet.

  The monitoring target device 2 is a device that provides a specific service and outputs alarm information according to the state of each device when operating, when a failure occurs, and is a server, a network device, or the like.

  The procedure manual database 5 is a device that stores a plurality of procedure manuals, for example, a server. The procedure manual database 5 stores each procedure manual in association with identification information of each procedure manual.

  FIG. 3 is a diagram illustrating an example of a schematic configuration of the information processing apparatus 3.

  The information processing device 3 is a computer that is used by an operator and a monitor of the monitoring system 1 to monitor the state of the monitoring target device 2. The information processing apparatus 3 includes a storage unit 31, a communication unit 32, a display unit 33, an input unit 34, and a control unit 35.

  The storage unit 31 includes, for example, at least one of a semiconductor memory, a magnetic disk device, and an optical disk device. The storage unit 31 stores programs (driver program, operating system program, application program, etc.), data, and the like used for processing by the control unit 35. The computer program is a storage unit 31 using a known setup program or the like from a computer-readable portable recording medium such as a CD-ROM (compact disk read only memory) or a DVD-ROM (digital versatile disk read only memory). May be installed. The storage unit 31 stores first to fourth definition data and the like as data. Details of each definition data will be described later.

  The communication unit 32 includes a communication interface circuit for connecting the information processing apparatus 3 to the networks 6 and 7. The communication unit 32 supplies the data received from each external device to the control unit 35 and transmits the data received from the control unit 35 to each external device.

  The display unit 33 is an example of an output unit, and may be any device that can output a document file, a moving image, a still image, and the like. For example, the display unit 33 is a touch panel display device, a liquid crystal display, an organic EL (Electro -Luminescence) display. The display unit 33 displays a procedure manual or the like supplied from the control unit 35.

  The input unit 34 may be any device as long as data can be input, such as a keyboard, a mouse, a touch panel type input device, a keypad, and the like. For example, the operator or the monitor can input the first to fourth definition data using the input unit 34.

  The control unit 35 includes one or a plurality of processors or their peripheral circuits. The control unit 35 controls the overall operation of the information processing apparatus 3 and is, for example, a CPU (Central Processing Unit). The control unit 35 controls the operation of the communication unit 32 and the like so that various processes of the information processing apparatus 3 are executed in an appropriate procedure according to a program stored in the storage unit 31. The control unit 35 can execute a plurality of programs in parallel.

  The control unit 35 includes a first learning processing unit 351, a second learning processing unit 352, a third learning processing unit 353, a fourth learning processing unit 354, an alarm information acquisition unit 355, an importance level acquisition unit 356, and a procedure manual acquisition unit 357. , An association degree acquisition unit 358, a device candidate identification unit 359, and the like. Each of these units included in the control unit 35 is a functional module implemented by a program executed on a processor included in the control unit 35. Alternatively, these units may be mounted on the information processing apparatus 3 as independent integrated circuits, microprocessors, or firmware.

  FIG. 4 is a diagram illustrating an example of the data structure of the first definition data stored in the storage unit 31.

  As shown in FIG. 4, the first definition data is learning data in which an alarm number, learning alarm information, and learning importance indicating the degree of necessity of dealing with learning alarm information are associated with each other. It is. The alarm number is a number for uniquely identifying each learning alarm information. The alarm information includes, for example, the date and time when the alarm information was output, host name information indicating the monitoring target device 2 that output the alarm information, an error message, and the like. For example, the learning importance is set by the operator of the monitoring system 1 such that the higher the degree of necessity of dealing with the learning alarm information, the higher the value. The error message includes various messages such as a communication error, a process error, and a disk error.

  In the example illustrated in FIG. 4, the learning importance of the learning alarm information having a high degree of necessity to deal with, indicating that each monitoring target device 2 cannot provide the service is set to “30”. . On the other hand, the importance level for learning of the alarm information for learning, which indicates that the degree of necessity to deal with, indicating that each monitored device 2 cannot temporarily provide the service but automatically recovers, is “ 20 ". In addition, the learning importance of learning alarm information that indicates a low degree of necessity to deal with, indicating that it has recovered from an abnormal state, is set to “10”.

  FIG. 5 is a diagram illustrating an example of the data structure of the second definition data stored in the storage unit 31.

  As shown in FIG. 5, the second definition data includes the relationship between each alarm number, each learning alarm information, the monitoring target device that outputs each learning alarm information, and the device that causes each learning alarm information. Is a learning data associated with a learning relevance level indicating the degree of the above. The learning relevance level increases, for example, as the degree of relevance between the monitoring target device that outputs each learning alarm information and the device that causes each learning alarm information increases by the operator of the monitoring system 1. Is set as follows.

  In the example shown in FIG. 5, the learning relevance level of the learning alarm information having a high degree of relevance such that the device that causes each learning alarm information is the monitoring target device that outputs the learning alarm information is “ 3 ". On the other hand, the degree of relevance is moderate such that the device that causes each learning alarm information is a device that belongs to the same system as the monitoring target device that outputs the learning alarm information or a device that provides the same service. The learning relevance level of the learning alarm information is set to “2”. In addition, the learning alarm having a low degree of relevance such that the device that causes each learning alarm information is a device that belongs to a different system from the monitoring target device that outputs the learning alarm information or a device that provides a different service The relevance for learning of information is set to “1”.

  6A is a diagram illustrating an example of a data structure of third definition data stored in the storage unit 31, and FIG. 6B is an example of a data structure of fourth definition data stored in the storage unit 31. FIG.

  As shown in FIG. 6A, the third definition data is associated with each alarm number, each learning alarm information, and learning procedure manual information indicating a procedure manual corresponding to each learning alarm information. It is data for learning. The learning procedure manual information is, for example, a procedure manual number for uniquely identifying a plurality of procedure manuals. As the learning procedure manual information, for example, the operator of the monitoring system 1 sets a procedure manual number of a procedure manual showing a series of procedures for dealing with corresponding learning alarm information.

  As shown in FIG. 6B, the fourth definition data is a learning that indicates each alarm number and the monitoring target device for learning included in the alarm information output from each of the plurality of monitoring target devices within a predetermined time. This is learning data in which alarm device information for learning and learning candidate information indicating candidate devices that cause each alarm information are associated with each other. The alarm number included in the fourth definition data is the alarm number of all alarm information corresponding to the learning alarm device information. The learning alarm device information is host name information indicating the monitoring target device that has output the alarm information. The candidate information for learning is, for example, device name information of a device candidate (suspected device) that causes alarm information among a plurality of devices communicating with the monitoring target device.

  For example, in the example shown in FIG. 6B, “alarm 1, alarm 2, alarm 3, alarm 4, alarm 5” is set as the alarm number corresponding to the alarm information output from each of the plurality of monitoring target devices within a predetermined time. , Alarm 6 ”is grouped. Further, as the learning alarm device information corresponding to the alarm number, the host name “Node_A” included in the alarm information of alarm 1 shown in FIG. 4 and the like, the host name “Node_B” included in the alarm information of alarm 2, and the alarm The host name “L2SV” included in the alarm information of 3 to alarm 6 is extracted. Further, “device 1, device 2” is limited as candidate information for learning corresponding to the alarm device information for learning.

  FIG. 7 is a diagram illustrating an example of a schematic configuration of the learning device 4a.

  The learning device 4 a is one of computers that execute learning processing included in the learning system 4. Since the configurations of the learning devices 4a to 4c are the same, the configuration of the learning device 4a will be described below as a representative. As illustrated in FIG. 7, the learning device 4 a includes a second storage unit 41, a second communication unit 42, and a second control unit 43.

  The second storage unit 41 includes, for example, at least one of a semiconductor memory, a magnetic disk device, and an optical disk device. The second storage unit 41 stores programs (driver program, operating system program, application program, etc.), data, and the like used for processing by the second control unit 43. The computer program may be installed in the second storage unit 41 using a known setup program or the like from a computer-readable portable recording medium such as a CD-ROM or DVD-ROM. The 2nd memory | storage part 41 memorize | stores the 1st-4th definition data input from the information processing apparatus 3 as data.

  The second communication unit 42 includes a communication interface circuit for connecting the learning device 4 a to the network 7. The second communication unit 42 supplies data received from external devices to the second control unit 43 and transmits data received from the second control unit 43 to external devices.

  The second control unit 43 includes one or a plurality of processors or their peripheral circuits. The second control unit 43 controls the overall operation of the learning device 4a, and is, for example, a CPU. The second control unit 43 controls the operation of the second communication unit 42 and the like so that various processes of the learning device 4a are executed in an appropriate procedure according to the program stored in the second storage unit 41. . The second control unit 43 can execute a plurality of programs in parallel.

  The second control unit 43 includes a first learning device 431, a second learning device 432, a third learning device 433, a fourth learning device 434, and the like. Each of these units included in the second control unit 43 is a functional module implemented by a program executed on a processor included in the second control unit 43. Alternatively, each of these units may be implemented in the learning device 4a as an independent integrated circuit, a microprocessor, or firmware.

(Learning process)
FIG. 8 shows an example of an operation sequence when the monitoring system 1 causes the learning system 4 to learn each definition data.

  The operation sequence described below is based on the programs stored in the storage unit 31 and the second storage unit 41, mainly by the control unit 35 and the second control unit 43, and the information processing device 3 and the learning devices 4a to 4c. It is executed in cooperation with each element.

  First, the first learning processing unit 351 of the information processing device 3 creates first definition data in accordance with an operation by the operator of the monitoring system 1 using the input unit 34 (step S101). The first learning processing unit 351 displays each alarm information output from the monitoring target device 2 on the display unit 33 so that the operator can select it as alarm information for learning. When the learning alarm information is selected by the operator and the corresponding alarm number and the importance for learning are input, the first learning processing unit 351 receives the selected learning alarm information, the input alarm number, and The first definition data is created in association with the importance for learning.

  Next, the first learning processing unit 351 transmits the created first definition data to the first learning device 431 via the communication unit 32, and the relationship between the learning alarm information and the learning importance is first learned. The device 431 is made to learn (step S102).

  Next, the first learning device 431 uses the first definition data received via the second communication unit 42 to learn the relationship between the learning alarm information and the learning importance (step S103).

  The first learning device 431 divides each learning alarm information into a plurality of elements, and the operation alarm information is input from the relationship between each divided element and the learning importance corresponding to each learning alarm information. In this case, learning is performed so that the estimated importance is output.

  The first learning device 431 uses, for example, a well-known natural language analysis technique such as WORD2VEC to extract specific symbols or specific characters such as spaces and commas included in each learning alarm information, and the extracted symbols Alternatively, each learning alarm information is divided into a plurality of elements for each character. For example, the first learning device 431 divides each learning alarm information into elements such as date and time, host name information, and error messages. Next, the first learning device 431 converts each divided element into a feature vector. The first learning device 431 sets the feature vector of each element so that the feature vector of each element included in each learning alarm information whose corresponding learning importance matches or approximates. In particular, the first learner 431 increases the feature vector value of each element as the corresponding importance level for learning increases, and decreases the feature vector value of each element as the corresponding importance level for learning decreases. Set the feature vector of the element.

  Next, the first learning device 431 learns the relationship between the learning alarm information and the learning importance using, for example, a known machine learning technique such as deep learning. Deep learning is machine learning using a multilayered neural network composed of an input layer, an intermediate layer, and an output layer. A feature vector of each element obtained by dividing the learning alarm information is input to each node of the input layer. Each node in the intermediate layer outputs a sum of values obtained by multiplying each feature vector output from each node in the input layer by a weight, and the output layer outputs each feature vector output from each node in the intermediate layer. Outputs the sum of values multiplied by weight. The first learning device 431 learns so that the difference between the output value from the output layer and the importance for learning is reduced while adjusting each weight.

  For example, for alarm 1 in FIG. 5, features corresponding to the elements of date and time “Oct 31 01:07:20”, host name information “Node_A”, and error message “cannot communicate” for each node in the input layer Each weight is adjusted so that a vector is input and the output layer outputs a value close to “30”.

  Note that the information input to each node of the input layer has a predetermined value (for example, 1) when the feature vector of each element is included in the predetermined range, not the feature vector of each element, and is not included in the predetermined range In this case, the variable may be another value (for example, 0). Furthermore, the number of nodes in the input layer corresponding to one element of each learning alarm information is not limited to one, and may be plural. For example, for a specific node in the input layer, the feature vector corresponding to the error message becomes a predetermined value when it matches or approximates the feature vector corresponding to “cannot communicate”, and other times when it does not match or approximate The variable that becomes the value of is input. For other nodes, the feature vector corresponding to the error message has a predetermined value when it matches or approximates the feature vector corresponding to “failover”, and has another value when it does not match or approximate. Variables may be entered. Thereby, each weight can be set more finely, and the first learning device 431 can be learned so that the output value from the output layer is closer to the importance for learning.

  Next, the second learning processing unit 352 of the information processing device 3 creates second definition data in accordance with an operation by the operator of the monitoring system 1 using the input unit 34 (step S104). Similar to the first learning processing unit 351, the second learning processing unit 352 displays each alarm information output from the monitoring target device 2 on the display unit 33 so that the operator can select it as learning alarm information. When the learning alarm information is selected by the operator and the corresponding alarm number and the degree of association for learning are input, the second learning processing unit 352 receives the selected learning alarm information, the input alarm number, and The second definition data is created in association with the learning relevance.

  Next, the second learning processing unit 352 transmits the created second definition data to the second learning device 432 via the communication unit 32, and the second learning is performed on the relationship between the learning alarm information and the learning relevance. The device 432 is made to learn (step S105).

  Next, the second learning device 432 learns the relationship between the learning alarm information and the learning relevance using the second definition data received via the second communication unit 42 (step S106).

  Similar to the first learner 431, the second learner 432 divides each learning alarm information into a plurality of elements, and the relationship between each divided element and the learning relevance corresponding to each learning alarm information. From this, learning is performed so that the estimated relevance is output when the operation alarm information is input. The estimated relevance indicates the degree of relevance of the monitoring target device that outputs each operation alarm information and the device that causes each operation alarm information, which is estimated with respect to the input operation alarm information.

  Similar to the first learner 431, the second learner 432 divides each learning alarm information into a plurality of elements, and converts each divided element into a feature vector. The second learner 432 sets the feature vector of each element so that the feature vector of each element included in each learning alarm information whose corresponding learning relevance matches or approximates. In particular, the second learning unit 432 increases the feature vector value of each element as the corresponding learning relevance level increases, and decreases the feature vector value of each element as the corresponding learning relevance level decreases. Set the feature vector of the element.

  Next, the second learning device 432 learns the relationship between the learning alarm information and the learning relevance in the same manner as the first learning device 431. A feature vector of each element obtained by dividing the learning alarm information is input to each node of the input layer of the second learning device 432. Each node in the intermediate layer outputs a sum of values obtained by multiplying each feature vector output from each node in the input layer by a weight, and the output layer outputs each feature vector output from each node in the intermediate layer. Outputs the sum of values multiplied by weight. The second learning device 432 learns so as to reduce the difference between the output value from the output layer and the learning relevance while adjusting each weight.

  For example, for alarm 1 in FIG. 5, features corresponding to the elements of date and time “Oct 31 01:07:20”, host name information “Node_A”, and error message “cannot communicate” for each node in the input layer Each weight is adjusted so that a vector is input and the output layer outputs a value close to “3”.

  Similar to the first learning device 431, the information input to each node of the input layer has a predetermined value when the feature vector of each element is included in a predetermined range, not the feature vector of each element. It may be a variable that takes other values when not included in the range. Furthermore, the number of nodes in the input layer corresponding to one element of each learning alarm information is not limited to one, and may be plural.

  Next, the third learning processing unit 353 of the information processing device 3 creates third definition data in accordance with an operation by the operator of the monitoring system 1 using the input unit 34 (step S107). The third learning processing unit 353 generates alarm information (alarm information whose learning importance is equal to or higher than the first threshold value) in which the corresponding procedure manual exists among the alarm information output from the monitoring target device 2 by the operator. The information is displayed on the display unit 33 so that it can be selected as learning alarm information. When the learning alarm information is selected by the operator and the corresponding alarm number and the learning procedure manual information are input, the third learning processing unit 353 receives the selected learning alarm information and the input alarm number. The third definition data is created in association with the learning procedure manual information.

  Next, the third learning processing unit 353 transmits the created third definition data to the third learning device 433 via the communication unit 32, and an initial stage relating to the relationship between the learning alarm information and the learning procedure manual information. The learning process is executed by the third learning device 433 (step S108).

  Next, the third learning device 433 executes initial learning processing related to the relationship between the learning alarm information and the learning procedure manual information using the third definition data received via the second communication unit 42 ( Step S109).

  The third learning device 433 divides each learning alarm information into a plurality of elements, and from the relationship between each divided element and the learning procedure manual information corresponding to each learning alarm information, a plurality of estimation procedure manual information The initial learning process is executed so that outputs are output in descending order of accuracy indicating the procedure for dealing with the operation alarm information. The estimation procedure manual information indicates a procedure manual corresponding to each operation alarm information estimated for the input operation alarm information.

  The third learning device 433 divides each learning alarm information into a plurality of elements in the same manner as the first learning device 431.

  Next, the third learning device 433 learns the relationship between the learning alarm information and the learning procedure manual information using a known machine learning technique such as a decision tree. The decision tree is a tree-structured graph, and is configured such that input information is classified from a root (parent node) to a specific leaf (end point) through a plurality of nodes. A branch condition is set for each node, and the nodes or nodes and end points are connected by branches. A plurality of divided elements are input to the parent node, branch conditions corresponding to each element are set to each node, and learning procedure manual information corresponding to each learning alarm information is set to each end point Is done. For each learning procedure manual information set at each end point, the third learning device 433 has a set branch condition for the number of nodes through which the input learning alarm information passes until reaching each end point. The ratio of the number of satisfied nodes is calculated as the accuracy indicating the procedure for dealing with the operation alarm information. And the 3rd learning device 433 arranges and outputs the learning procedure manual information set to each end point as the estimated procedure manual information in descending order of the accuracy indicating the procedure for dealing with the operation alarm information.

  For example, for each node, “whether the date / time of the operating alarm information matches the date / time of the specific learning alarm information”, “the host name information of the operating alarm information matches the host name information of the specific learning alarm information” Branching conditions such as “Is the error message of the operation alarm information coincide with the error message of the specific learning alarm information” are set. When each learning alarm information included in the third definition data is input, the third learning device 433 creates a decision tree so as to reach the end point where the corresponding learning procedure manual information is set.

  Next, the fourth learning processing unit 354 of the information processing device 3 creates fourth definition data in accordance with an operation by the operator of the monitoring system 1 using the input unit 34 (step S110). The fourth learning processing unit 354 causes the display unit 33 to select host name information indicating the monitoring target device included in each alarm information output from the monitoring target device 2 as learning alarm device information. indicate. When the operator selects one or a plurality of learning alarm device information and inputs the corresponding alarm number and learning candidate information, the fourth learning processing unit 354 selects the selected learning alarm device information; The fourth definition data is created by associating the input alarm number with the candidate information for learning.

  Next, the fourth learning processing unit 354 transmits the created fourth definition data to the fourth learning device 434 via the communication unit 32, and the initial stage relating to the relationship between the learning alarm device information and the learning candidate information. The fourth learning device 434 is caused to execute learning processing (step S111).

  Next, the fourth learning device 434 executes an initial learning process related to the relationship between the learning alarm device information and the learning candidate information using the fourth definition data received via the second communication unit 42 ( Step S112).

  The fourth learning device 434 divides the learning alarm device information into a plurality of elements. The fourth learning device 434 has a certainty of indicating a plurality of guess candidate information from the relationship between each divided element and the learning candidate information corresponding to the learning alarm device information, indicating the device candidate that causes the alarm information. The initial learning process is executed so that the data is output in descending order. The estimation candidate information is the cause of the alarm information estimated for the operation alarm device information indicating the monitoring target device included in the operation alarm information output from each of the plurality of monitoring target devices within the predetermined time. Indicates a candidate for the device.

  The fourth learning device 434 divides the learning alarm device information into a plurality of elements. The fourth learning device 434 divides the learning alarm device information selected together by the operator included in the fourth definition data into one piece of host information.

  Next, as with the third learning device 433, the fourth learning device 434 learns the relationship between the learning alarm device information and the learning candidate information using a known machine learning technique such as a decision tree. To do. A plurality of divided elements are input to the parent node of the decision tree, a branch condition corresponding to each element is set to each node, and learning candidate information corresponding to the learning alarm device information is set to each end point Is set. For each learning candidate information set at each end point, the fourth learning device 434 has a set branch condition for the number of nodes through which the input learning alarm device information passes until reaching each end point. The ratio of the number of satisfied nodes is calculated as the accuracy indicating the candidate device that causes the alarm information. And the 4th learning device 434 arranges and outputs the candidate information for learning set to each end point as an estimation candidate information in order with the high probability which shows the candidate of the apparatus which causes alarm information.

  For example, in each node, “whether the input operation alarm device information includes host A”, “input operation alarm device information includes host B”, “input operation alarm device information includes A branch condition such as “is host C included” is set. When each learning alarm device information included in the fourth definition data is input, the third learning device 433 creates a decision tree so as to reach the end point where the corresponding learning candidate information is set.

(Monitoring process)
FIG. 9 shows a flowchart of processing in a state where the monitoring system 1 is in operation.

  First, the alarm information acquisition unit 355 acquires alarm information output from each monitoring target device 2 via the communication unit 32 (step S201).

  Next, the importance level acquisition unit 356 transmits the acquired alarm information as operation alarm information to the learning system 4 via the communication unit 32 and inputs it to the first learning device 431. Then, the importance level acquisition unit 356 receives and acquires the estimated importance level output from the first learning device 431 from the learning system 4 via the communication unit 32 (step S202).

  Next, the procedure manual acquiring unit 357 determines whether or not the estimated importance acquired by the importance acquiring unit 356 is equal to or greater than a first threshold (step S203).

  If the acquired estimated importance is greater than or equal to the first threshold (step S203: YES), the procedure manual acquisition unit 357 uses the alarm information acquired by the alarm information acquisition unit 355 as operation alarm information via the communication unit 32. 4 and input to the third learning device 433. Then, the procedure manual acquisition unit 357 outputs, via the communication unit 32, a plurality of guess procedure manual information output from the third learning device 433 and arranged in descending order of accuracy indicating a procedure for handling the operation alarm information. 4 is received and acquired (step S204).

  Next, the procedure manual acquisition unit 357 issues an acquisition request for procedure manuals corresponding to a predetermined number of guess procedure manual information in descending order of accuracy indicating a procedure for dealing with the operation alarm information among a plurality of acquired guess procedure manual information. The data is transmitted to the procedure manual database 5 via the communication unit 32. Then, the procedure manual acquisition unit 357 receives and acquires a plurality of corresponding procedure manuals from the procedure manual database 5 via the communication unit 32 as a response to the acquired acquisition request (step S205).

  Next, the procedure manual acquisition unit 357 displays the plurality of acquired procedure manuals on the display unit 33 in order of the accuracy indicating the procedure for dealing with the operation alarm information, and outputs (step S206).

  As described above, the information processing device 3 uses the learning result learned in advance using the learning alarm information, determines the importance of the operation alarm information output from each monitoring target device, and is handled by the supervisor. If it is necessary, a procedure manual is output. This makes it possible to prevent the monitor from overlooking alarm information that needs to be dealt with or taking a long time to deal with alarm information that does not need to be dealt with. It is possible to appropriately respond to the alarm information output from.

  Next, the procedure manual acquisition unit 357 accepts an operation for designating whether or not the displayed procedure manual or the order thereof is appropriate by the monitor of the monitoring system 1 using the input unit 34 (step S207).

  When it is designated that the displayed procedure manual or the order thereof is appropriate (step S207: YES), the procedure manual acquisition unit 357 does not perform any particular process and ends the series of steps.

  On the other hand, when it is specified that the displayed procedure manual or the order thereof is not appropriate (step S207: NO), the procedure manual acquisition unit 357 operates the alarm information by the monitor of the monitoring system 1 using the input unit 34. The specification of procedure manual information indicating an appropriate procedure manual corresponding to is accepted (step S208).

  Next, the third learning processing unit 353 adds the operation alarm information and the designated procedure manual information to the third definition data as learning alarm information and learning procedure manual information. Then, the third learning processing unit 353 transmits the updated third definition data to the third learning device 433 via the communication unit 32, and learning processing related to the relationship between the learning alarm information and the learning procedure manual information. Is executed by the third learning device 433 (step S209), and a series of steps is terminated.

  The third learning device 433 executes the learning process in the same manner as the initial learning process shown in step S109. When the newly added learning alarm information is input, the third learning device 433 reaches the end point where the corresponding learning procedure manual information is set by changing the arrangement of each node, the branch condition, and the like. Update the decision tree to

  In this way, the third learning device 433 can output the procedure manuals in a more appropriate order with respect to the operation alarm information by updating the decision tree according to the instruction from the supervisor. As a result, the supervisor can more easily identify the procedure manual corresponding to the operation alarm information.

  Note that the third learning processing unit 353 may transmit only the newly added learning alarm information and learning procedure manual information in the third definition data to the third learning device 433 to execute the learning process. . In that case, the processing load related to the learning process can be reduced.

  On the other hand, in step S203, when the estimated importance acquired by the procedure manual acquisition unit 357 is less than the first threshold (step S203: NO), the association degree acquisition unit 358 communicates the acquired alarm information as operation alarm information. The data is transmitted to the learning system 4 via the unit 32 and input to the second learning device 432. Then, the relevance level acquisition unit 358 receives and acquires the estimated relevance level output from the second learning device 432 from the learning system 4 via the communication unit 32 (step S210).

  Next, the apparatus candidate specifying unit 359 determines whether or not the estimated relevance degree acquired by the relevance degree acquisition unit 358 is equal to or greater than a second threshold (for example, 3) (step S211).

  When the acquired estimated relevance is equal to or higher than the second threshold (step S211: YES), the device candidate specifying unit 359 does not perform any particular process and ends a series of steps.

  On the other hand, when the acquired estimated relevance is less than the second threshold (step S211: NO), the device candidate specifying unit 359 causes the monitoring target included in the operation alarm information output from each monitoring target device 2 within a predetermined time. The operation alarm device information indicating the device is specified. The device candidate specifying unit 359 extracts operation alarm device information from the operation alarm information acquired by the alarm information acquisition unit 355 from a predetermined time to the present time. The device candidate specifying unit 359 transmits the extracted operation alarm device information to the learning system 4 via the communication unit 32 and inputs the information to the fourth learning device 434. And the apparatus candidate specific | specification part 359 is output from the 4th learning device 434 via the communication part 32 with the some candidate information arranged in order with the high probability which shows the candidate of the apparatus which becomes the cause of operation alarm information. Received from the learning system 4 and acquired (step S212). Thereby, the apparatus candidate specific | specification part 359 specifies the some candidate of the apparatus used as the cause of operation | movement alarm information.

  Next, the device candidate specifying unit 359 displays the plurality of pieces of acquired candidate candidate information on the display unit 33 in order of the accuracy indicating the device candidates that cause the operation alarm information, and outputs them (step S213).

  In this way, the information processing device 3 uses the learning result learned in advance using the learning alarm information to determine the relevance between each monitoring target device and the device that causes the operation alarm information. If the performance is low, a candidate device that causes operation alarm information is further output. Thereby, since the supervisor can identify the candidate of the apparatus that causes the operation alarm information, it is possible to appropriately cope with the operation alarm information.

  Next, the device candidate specifying unit 359 accepts an operation for designating whether or not the displayed estimated candidate information or the order thereof is appropriate by the monitor of the monitoring system 1 using the input unit 34 (step S214). .

  When it is designated that the displayed candidate information or its order is appropriate (step S207: YES), the apparatus candidate specifying unit 359 does not perform any particular process and ends the series of steps.

  On the other hand, when it is designated that the displayed candidate information or the order thereof is not appropriate (step S214: NO), the device candidate specifying unit 359 operates the operation alarm by the monitor of the monitoring system 1 using the input unit 34. The designation of appropriate guess candidate information corresponding to the device information is accepted (step S215).

  Next, the fourth learning processing unit 354 adds the operation alarm device information and the designated estimation candidate information to the fourth definition data as learning alarm device information and learning candidate information. And the 4th learning process part 354 transmits the updated 4th definition data to the 4th learning device 434 via the communication part 32, and the learning process which concerns on the relationship between the alarm apparatus information for learning, and the candidate information for learning Is executed by the fourth learning device 434 (step S216), and a series of steps is terminated.

  The fourth learning device 434 executes the learning process in the same manner as the initial learning process shown in step S112. When the newly added learning alarm device information is input, the fourth learning device 434 reaches the end point where the corresponding learning candidate information is set by changing the arrangement of each node, the branch condition, and the like. Update the decision tree to

  As described above, the fourth learning device 434 can output each estimation candidate information in a more appropriate order with respect to the operation alarm device information by updating the decision tree in accordance with the instruction from the supervisor. As a result, the supervisor can more easily identify the device that causes the operation alarm information.

  As described above, the monitoring system 1 inputs the operation alarm information different from the learning alarm information to the first learning device 431 learned using the first definition data, and the output estimated importance is the first threshold value. It is determined whether it is above. Moreover, since the monitoring system 1 displays a procedure manual showing a series of procedures for dealing with the operation alarm information when the estimated importance is equal to or higher than the first threshold value, the supervisor needs to deal with it. It is possible to appropriately respond to high alarm information.

  The present invention is not limited to the above embodiments. For example, the monitoring system 1 may include a plurality of information processing devices 3, and the plurality of information processing devices 3 may cooperate to share each function of the information processing device 3 described above.

  The importance level acquisition unit 356 may display the acquired estimated importance level on the display unit 33 in step S202. In step S210, the association degree acquisition unit 358 may display the acquired estimated association degree on the display unit 33. Thus, the supervisor can recognize the degree of necessity of dealing with the operation alarm information earlier.

  The information processing device 3 transmits the procedure manual acquired by the procedure manual acquisition unit 357 to another terminal other than the information processing device 3 via the communication unit 32 instead of displaying the procedure manual on the information processing device 3. May be displayed on the terminal. In that case, the communication unit 32 is an example of an output unit.

  Further, the information processing apparatus 3 may accept an update instruction for each definition data by an operator of the monitoring system 1 using the input unit 34 at an arbitrary timing. When the information processing apparatus 3 receives an instruction to update each definition data, the information processing apparatus 3 causes each learning device of the learning system 4 to relearn using the updated definition data. As a result, even when new alarm information (error message) is generated in the monitoring system 1, the monitor can appropriately deal with the new alarm information.

  It should be understood by those skilled in the art that various changes, substitutions and modifications can be made thereto without departing from the spirit and scope of the present invention.

DESCRIPTION OF SYMBOLS 1 ... Monitoring system 2 ... Monitoring object apparatus 3 ... Information processing apparatus 355 ... Alarm information acquisition part 356 ... Importance acquisition part 357 ... Procedure manual acquisition part 358 ... Relevance degree acquisition part 359 ... Device candidate specific | specification part 33 ... Output part 4 ... Learning system 431 ... 1st learning device 432 ... 2nd learning device 433 ... 3rd learning device 434 ... 4th learning device

Claims (7)

A monitoring system having a learning system and an information processing device,
The learning system uses first definition data in which a plurality of learning alarm information and learning importance indicating the degree of necessity of dealing with each of the plurality of learning alarm information are associated with each other, The plurality of learning alarm information is divided into a plurality of elements, and the relationship between the plurality of divided elements and the learning importance corresponding to each of the plurality of learning alarm information is input. A first learning device that outputs a presumed importance level estimated for operation alarm information different from the learning alarm information;
The information processing apparatus includes:
An alarm information acquisition unit for acquiring alarm information output from each of a plurality of monitoring target devices;
An importance level acquisition unit that inputs the alarm information as operation alarm information to the first learning device and acquires the estimated importance level output from the first learning device;
If the estimated importance is equal to or greater than a first threshold, a procedure manual acquisition unit that acquires a procedure manual indicating a procedure for handling the alarm information;
An output unit for outputting the procedure manual acquired by the procedure manual acquisition unit;
A monitoring system comprising: The learning system indicates a plurality of learning alarm information, a degree of relevance between a monitoring target device that outputs each of the plurality of learning alarm information and a device that causes each of the plurality of learning alarm information. Using the second definition data associated with the learning relevance level, the plurality of learning alarm information is divided into a plurality of elements, and each of the plurality of divided elements and the plurality of learning alarm information is supported. A second learning device that outputs a presumed relevance degree estimated for operation alarm information different from the plurality of learning alarm information inputted from the relationship with the relevance degree for learning,
The information processing apparatus includes:
Relevance level acquisition unit that inputs the alarm information acquired by the alarm information acquisition unit to the second learning device as the operation alarm information and acquires the estimated relevance level output from the second learning device;
A device candidate specifying unit that specifies device candidates that cause the alarm information when the estimated importance is less than the first threshold and the estimated relevance is less than the second threshold; And
The monitoring system according to claim 1, wherein the output unit outputs information indicating candidates specified by the device candidate specifying unit. The learning system uses the third definition data in which a plurality of learning alarm information is associated with learning procedure manual information indicating the procedure manual corresponding to each of the plurality of learning alarm information. The learning alarm information is divided into a plurality of elements, and the plurality of input learnings are obtained from the relationship between the divided plurality of elements and the learning procedure manual information corresponding to each of the plurality of learning alarm information. A third learning device that outputs a plurality of estimation procedure manual information estimated with respect to the operation alarm information different from the alarm information for use in descending order of accuracy indicating a procedure for dealing with the operation alarm information;
When the importance acquired by the importance acquisition unit is equal to or higher than the first threshold, the procedure manual acquisition unit inputs the alarm information acquired by the alarm information acquisition unit to the third learning device as the operation alarm information. And obtaining the plurality of procedure manuals by obtaining a plurality of the estimation procedure manual information output from the third learning device,
The monitoring system according to claim 1, wherein the output unit arranges and outputs the plurality of procedure manuals in descending order of the accuracy. The alarm information includes information indicating the monitoring target device that has output the alarm information,
The learning system includes information indicating a monitoring target device for learning included in alarm information output from each of a plurality of monitoring target devices within a predetermined time, and learning candidates indicating device candidates that cause the alarm information. Information indicating the monitoring target device for learning is divided into a plurality of elements using fourth definition data associated with candidate information, and information indicating the plurality of divided elements and the monitoring target device for learning From the relationship with the candidate information for learning corresponding to the plurality of candidate information for guessing with respect to the information indicating the monitoring target device included in the operation alarm information different from the inputted plurality of alarm information for learning , Further comprising a fourth learning device that outputs in descending order of accuracy indicating candidate devices that cause the operation alarm information,
The device candidate specifying unit includes the monitoring information included in the alarm information acquired by the alarm information acquiring unit when the estimated importance is less than the first threshold and the estimated relevance is less than the second threshold. Information indicating the target device is input to the fourth learner, and a plurality of candidates for the device that causes the alarm information are identified by acquiring the plurality of guess candidate information output from the fourth learner,
The monitoring system according to claim 2, wherein the output unit arranges and outputs a plurality of pieces of estimation candidate information acquired by the device candidate specifying unit in descending order of the accuracy. Using the first definition data in which a plurality of learning alarm information and learning importance indicating the degree of necessity of dealing with each of the plurality of learning alarm information are associated, the plurality of learning alarm information The alarm information is divided into a plurality of elements, and from the relationship between the plurality of divided elements and the learning importance corresponding to each of the plurality of learning alarm information, the plurality of learning alarm information input An information processing apparatus that communicates with a learning system having a first learning device that outputs estimated importance estimated for different operation alarm information,
An alarm information acquisition unit for acquiring alarm information output from each of a plurality of monitoring target devices;
An importance level acquisition unit that inputs the alarm information as operation alarm information to the first learning device and acquires the estimated importance level output from the first learning device;
If the estimated importance is equal to or greater than a first threshold, a procedure manual acquisition unit that acquires a procedure manual indicating a procedure for handling the alarm information;
An output unit for outputting the procedure manual acquired by the procedure manual acquisition unit;
An information processing apparatus comprising: Using the first definition data in which a plurality of learning alarm information and learning importance indicating the degree of necessity of dealing with each of the plurality of learning alarm information are associated, the plurality of learning alarm information The alarm information is divided into a plurality of elements, and from the relationship between the plurality of divided elements and the learning importance corresponding to each of the plurality of learning alarm information, the plurality of learning alarm information input A control method for an information processing apparatus that communicates with a learning system having a first learning device that outputs a presumed importance level estimated for different operation alarm information,
Acquire alarm information output from each of multiple monitored devices,
The acquired alarm information is input to the first learning device as operation alarm information, and the estimated importance output from the first learning device is acquired,
If the acquired estimated importance is greater than or equal to a first threshold, obtain a procedure manual indicating a procedure for dealing with the alarm information;
Outputting the acquired procedure manual;
A control method comprising: Using the first definition data in which a plurality of learning alarm information and learning importance indicating the degree of necessity of dealing with each of the plurality of learning alarm information are associated, the plurality of learning alarm information The alarm information is divided into a plurality of elements, and from the relationship between the plurality of divided elements and the learning importance corresponding to each of the plurality of learning alarm information, the plurality of learning alarm information input A control program for an information processing apparatus that communicates with a learning system having a first learning device that outputs a presumed importance level estimated for different operation alarm information,
Acquire alarm information output from each of multiple monitored devices,
The acquired alarm information is input to the first learning device as operation alarm information, and the estimated importance output from the first learning device is acquired,
If the acquired estimated importance is greater than or equal to a first threshold, obtain a procedure manual indicating a procedure for dealing with the alarm information;
Outputting the acquired procedure manual;
A control program that causes the information processing apparatus to execute

Images