JP2019212046A - Control program, control method, and information processing device - Google Patents

Abstract

To more efficiently generate information useful for surveying a cause of an abnormaliry.SOLUTION: A control program causes a computer to execute processing for: when detecting that log information transmitted by a monitoring target machine at specific transmission intervals cannot be received at reception intervals corresponding to the transmission intervals, identifying an event that has occurred in a system on the basis of information acquired from the system in connection with the monitoring target machine ; and in a case where any one piece of log information has been received from the monitoring target machine, generating information that associates the information indicating the identified event with the log information which has been received.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a control program, a control method, and an information processing apparatus.

  A distributed system in which a plurality of virtual machines operate in cooperation is increasing. In such a system, in order to maintain availability during system operation, a function for monitoring the state of each virtual machine (hereinafter referred to as “monitoring function”) is provided to prepare for an operation stop due to an unexpected trouble.

  As a method of monitoring the state of the virtual machine, there is a method of transmitting a presence notification from the virtual machine side to the monitoring function at regular intervals. In this method, when the presence notification is not received for a certain period of time, the monitoring function determines that an abnormality has occurred in the virtual machine (for example, the virtual machine has gone down).

JP 2007-265215 A Japanese Patent Laying-Open No. 2015-503811 JP 2014-191491 A

  When the virtual machine goes down, the virtual machine is immediately restarted by a VM (Virtual Machine) manager or a hypervisor. In the restart, the original virtual machine is initialized (deleted), and a new virtual machine is generated. Therefore, log information and the like output by the original virtual machine, which can be useful for investigating the cause of the abnormality that the presence notification is not reached, are also deleted. As a result, there is little information useful for investigating the cause of the abnormality, making it difficult to investigate the cause of the abnormality.

  Thus, in one aspect, an object of the present invention is to improve the efficiency of generating information useful for investigating the cause of an abnormality.

  In one aspect, when the control program detects that the log information transmitted from the monitoring target machine at a specific transmission interval cannot be received at the reception interval corresponding to the transmission interval, the control program detects from the system related to the monitoring target machine. Based on the acquired information, an event that occurred in the system is specified, and when any log information has been received from the monitored machine, information indicating the specified event is included in the received log information. Causes the computer to execute processing for generating the associated information.

  As one aspect, the generation of information useful for investigating the cause of abnormality can be made efficient.

It is a figure which shows the system configuration example in embodiment of this invention. It is a figure which shows the hardware structural example of the management apparatus 10 in embodiment of this invention. It is a figure which shows the function structural example of the management apparatus 10 in embodiment of this invention. 5 is a flowchart for explaining an example of a processing procedure executed by the management apparatus 10; It is a figure which shows the state in which presence notification is transmitted repeatedly. It is a flowchart for demonstrating an example of the process sequence of an event specific process.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing an example of a system configuration in the embodiment of the present invention. In FIG. 1, a management apparatus 10 and one or more server apparatuses 20 are connected via a network system N1. The network system N1 is a set of networks (links) connected by a plurality of routers R.

  The server device 20 is a physical computer on which one or more virtual machines (VMs) 30 operate. Each virtual machine 30 may constitute a distributed system for providing a predetermined service via a network such as the Internet, for example. Since the server device 20 is connected to the network system N1, each virtual machine 30 can also be connected to the network system N1.

  The management apparatus 10 is an information processing apparatus that manages each virtual machine 30. Management refers to, for example, starting, stopping, and status monitoring.

  FIG. 2 is a diagram illustrating a hardware configuration example of the management apparatus 10 according to the embodiment of the present invention. The management device 10 in FIG. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, and the like that are mutually connected by a bus B.

  A program for realizing processing in the management apparatus 10 is provided by the recording medium 101. When the recording medium 101 on which the program is recorded is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data.

  The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 executes a function related to the management device 10 according to a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

  An example of the recording medium 101 is a portable recording medium such as a CD-ROM, a DVD disk, or a USB memory. An example of the auxiliary storage device 102 is an HDD (Hard Disk Drive) or a flash memory. Both the recording medium 101 and the auxiliary storage device 102 correspond to computer-readable recording media.

  FIG. 3 is a diagram illustrating a functional configuration example of the management apparatus 10 according to the embodiment of the present invention. In FIG. 3, the management device 10 includes a parent system 11 and a monitoring unit 12. The parent system 11 and the monitoring unit 12 are realized by processing that the CPU 104 executes one or more programs (control programs) installed in the management apparatus 10. The management apparatus 10 also uses the information storage unit 13. The information storage unit 13 can be realized by using, for example, a storage device that can be connected to the auxiliary storage device 102 or the management device 10 via a network.

  The parent system 11 is software that manages the life cycle of the virtual machine 30. A VM manager and a hypervisor are examples of the parent system 11. For example, the parent system 11 executes control related to activation (generation), deletion, and the like of the virtual machine 30.

  The monitoring unit 12 monitors the state of the virtual machine 30 and the like. In FIG. 3, the monitoring unit 12 includes a presence notification acquisition unit 121, an event identification unit 122, and the like.

  The presence notification acquisition unit 121 acquires (receives) a presence notification transmitted by the monitored virtual machine 30 at a plurality of timings (specific transmission intervals). The interval between the plurality of timings may be a fixed interval, for example. However, the interval between the presence notifications may not be strictly constant. The presence notification refers to information for notifying the outside that the virtual machine 30 is operating normally.

  In the present embodiment, the virtual machine 30 transmits the log information output by the virtual machine 30 in the presence notification. The log information includes messages indicating events occurring in the virtual machine 30 in time series. The event includes an error (abnormality) and the like. For example, an OS (Operating System) system log of the virtual machine 30 may be used as the log information. The presence notification acquisition unit 121 stores the log information included in the received presence notification in the information storage unit 13. Note that the log information included in a single presence notification may not be all of the log information output so far by the virtual machine 30. For example, a portion (for example, the latest 50 lines, the latest 1 Kbyte, etc.) that is limited to a range that is effective for the investigation of the presence notification stop may be included in one presence notification.

  The event specifying unit 122 acquires information from the system related to the virtual machine 30 when the presence notification cannot be acquired (when it is detected that the presence notification cannot be received at the reception interval corresponding to the transmission interval of the presence notification). Then, based on the acquired information, an event occurring in the system is specified. The event specifying unit 122 has received the log information acquired until the presence notification (log information) cannot be acquired as the information indicating the event (for example, the log information acquired last by the presence notification acquisition unit 121). The information associated with is generated, and the information is stored in the information storage unit 13. In the present embodiment, the systems related to the virtual machine 30 are the network system N1 and the parent system 11.

  Hereinafter, a processing procedure executed by the management apparatus 10 will be described. FIG. 4 is a flowchart for explaining an example of a processing procedure executed by the management apparatus 10.

  In step S <b> 101, the presence notification acquisition unit 121 waits for reception of a presence notification from the virtual machine 30 to be monitored (hereinafter referred to as “target machine”). If the presence notification is received (No in S103) before the standby time exceeds (Δt + α) seconds (α ≧ 0) (No in S103), the presence notification acquisition unit 121 includes the log included in the presence notification. The information is stored in the information storage unit 13 in association with the identification information (hereinafter referred to as “virtual machine ID”) of the target machine that is the transmission source of the presence notification (S102). At this time, the log information received last time may be overwritten by the newly received log information. Further, the IP address of the virtual machine 30 may be used as the virtual machine ID. Subsequently, the presence notification acquisition unit 121 repeats step S101 and subsequent steps.

  Therefore, steps S101 and S102 are repeated while the presence notification is repeatedly transmitted from the target machine at an interval (for example, a constant interval) within (Δt + α).

  FIG. 5 is a diagram illustrating a state in which the presence notification is repeatedly transmitted. FIG. 5 shows an example in which presence notifications are transmitted from the target machine to the presence notification acquisition unit 121 at regular intervals of Δt seconds.

  On the other hand, if the presence notification wait time exceeds (Δt + α) seconds at any timing (that is, the presence notification is not received even if (Δt + α) seconds have elapsed since the previous presence notification was received) (S103 Yes), the event identification unit 122 executes event identification processing (S104). In the event specifying process, events occurring in the network system N1 and the parent system 11 are specified. Note that the down of the parent system 11 may cause a failure to acquire the presence notification.

  When the event identification process is completed, the event identification unit 122 notifies the parent system 11 that the identification of the event has been completed (S105). The parent system 11 deletes (initializes) the target machine and restarts (recreates) the target machine in response to the notification from the event specifying unit 122. That is, the parent system 11 waits for the target machine to be restarted until receiving a notification from the event specifying unit 122.

  Next, details of step S104 will be described. FIG. 6 is a flowchart for explaining an example of the processing procedure of the event specifying process.

  In step S201, the event identification unit 122 acquires information (hereinafter referred to as “communication information”) indicating a communication state from each router R configuring the network system N1. For example, the event specifying unit 122 issues a ping command to each router R and the target machine, and generates information indicating whether or not there is a response as communication information for each router R and the target machine. Such communication information can be said to be information indicating whether or not each network (each link) composing a communication path between the target machine and the management apparatus 10 can be communicated.

  If the communication information cannot be acquired (or generated) for some reason (No in S202), the event specifying unit 122 generates information indicating that the acquisition of the communication information has failed as event information (S203), and step S212. Proceed to That is, in this case, an event that communication information cannot be acquired is specified.

  On the other hand, when the communication information can be acquired (Yes in S202), the event specifying unit 122 determines whether or not the communication state between the virtual machine 30 and the management apparatus 10 is normal based on the communication information. (S204). For example, when the communication information indicates that there is no response from any router R or the target machine, the event specifying unit 122 determines that the communication state is abnormal (No in S204), and the communication information is changed to the event. As information (S205), the process proceeds to step S212. That is, in this case, an event that the communication state is abnormal is specified.

  On the other hand, when the communication information indicates that there is a response from all the routers R and the target machine (No in S204), the event specifying unit 122 acquires the operation information of the target machine from the parent system 11 (S206). . The operation information is information indicating the operation state of the target machine, indicates whether the target machine is operating (down), and when the target machine is operating, for example, This information includes various resource loads (usage status) and the like. The information indicating the load of various resources is information indicating the usage rates of the CPU and the memory of the target machine, for example.

  If the operation information cannot be acquired for some reason (No in S207), the event specifying unit 122 generates information indicating that the acquisition of the operation information has failed as event information (S208), and the process proceeds to step S212. That is, in this case, an event that the operation information cannot be acquired is specified.

  On the other hand, when the operation information can be acquired (Yes in S207), the event specifying unit 122 determines whether the operation state of the target machine is normal based on the operation information (S209). If the operation information indicates that the target machine is not operating (down), or if the target machine is operating but any resource load is abnormal, specify the event The unit 122 determines that the operating state is abnormal. In this case (No in S209), the event identification unit 122 sets the operation information as event information (S210), and proceeds to step S212. That is, in this case, an event that the operation state of the target machine is abnormal is specified. Whether the resource load is normal or abnormal may be determined, for example, by comparing the load of each resource with a threshold value set in advance for the load.

  On the other hand, when the operation information indicates that the target machine is operating and the load of each resource is normal, the event specifying unit 122 determines that the operation state is normal. In this case (Yes in S209), there is a contradictory situation in which there is no abnormality in the network system N1, and no presence notification is received even though there is no abnormality in the operation state of the target machine. Therefore, the event identification unit 122 generates communication information with the target machine and information indicating that the operation state of the target machine is normal as event information (S211), and the process proceeds to step S212.

  In step S212, the event specifying unit 122 stores the event information generated in step S203, S205, S203, S210, or S211 in the information storage unit 13 in association with the virtual machine ID of the target machine. The information associated with is generated, and the generated information is stored in the information storage unit 13 (S212). When there are a plurality of corresponding log information, the event information may be associated with the latest log information. Note that the method of associating the log information with the event information is not limited to a specific method. For example, the same identifier may be assigned to the log information and the event information so that they may be associated with each other. The file storing the log information and the file storing the event information are stored in the same folder (or directory). By doing so, the two may be associated with each other.

  As described above, according to this embodiment, when the presence notification from the virtual machine 30 is no longer received, the log information acquired last from the virtual machine 30 and immediately after the presence notification is no longer received. Is generated in association with the event information acquired from the related system, and the information is stored in the information storage unit 13. Therefore, the generation of information useful for investigating the cause of abnormality can be made efficient. As a result, the investigator who causes the presence notification to stop can efficiently solve the cause based on the log information and the event information. That is, the investigator can identify whether the abnormality is in the network or the virtual machine 30 based on the event information. In the case of an abnormality in the virtual machine 30, the log information acquired last from the virtual machine 30 may include information indicating a sign that the abnormality will occur. Therefore, the investigator can investigate the cause of the abnormality in the virtual machine 30 with reference to the log information, and can reduce the work load for identifying the cause of the abnormality.

  In addition, the log information included in the presence notification is transmitted from the virtual machine 30 by repeating the log information of a certain period or a certain amount together with the presence notification. Therefore, even when the virtual machine 30 is down (stopped), it is possible to avoid a situation in which log information cannot be obtained at all.

  In addition, the log information stored in the information storage unit 13 can be easily identified with the latest log information, so that the last log information can be easily specified and the storage capacity of the information storage unit 13 can be increased. Consumption can be suppressed.

  Note that this embodiment may be applied to a case where a physical machine is a monitoring target. In other words, the monitored machine need not be limited to the virtual machine 30.

  In the present embodiment, the target machine is an example of a monitoring target machine. The management device 10 is an example of an information processing device. The presence notification acquisition unit 121 is an example of an acquisition unit. The event specifying unit 122 is an example of a specifying unit and a generating unit.

  Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications can be made within the scope of the gist of the present invention described in the claims. Deformation / change is possible.

Regarding the above description, the following items are further disclosed.
(Appendix 1)
When it is detected that log information transmitted from a monitoring target machine at a specific transmission interval cannot be received at a reception interval corresponding to the transmission interval, the system is based on information acquired from a system related to the monitoring target machine. Identify the events that occurred in
If any log information has been received from the monitored machine, information indicating the identified event is generated in association with the received log information.
A control program for causing a computer to execute processing.
(Appendix 2)
Generating information corresponding to the log information received last from the monitored machine, among the received log information, the information indicating the identified event;
The control program according to supplementary note 1, wherein
(Appendix 3)
The information indicating the event includes information indicating a communication state of a network to which the monitored machine is connected, or information indicating an operating state of the monitored machine.
The control program according to appendix 1 or 2, characterized in that:
(Appendix 4)
When it is detected that log information transmitted from a monitoring target machine at a specific transmission interval cannot be received at a reception interval corresponding to the transmission interval, the system is based on information acquired from a system related to the monitoring target machine. Identify the events that occurred in
If any log information has been received from the monitored machine, information indicating the identified event is generated in association with the received log information.
A control method characterized in that a computer executes a process.
(Appendix 5)
Generating information corresponding to the log information received last from the monitored machine, among the received log information, the information indicating the identified event;
The control method according to supplementary note 4, characterized by:
(Appendix 6)
The information indicating the event includes information indicating a communication state of a network to which the monitored machine is connected, or information indicating an operating state of the monitored machine.
The control method according to appendix 4 or 5, characterized in that:
(Appendix 7)
When it is detected that log information transmitted from a monitoring target machine at a specific transmission interval cannot be received at a reception interval corresponding to the transmission interval, the system is based on information acquired from a system related to the monitoring target machine. A specific part that identifies the event that occurred in
When any log information has been received from the monitored machine, a generation unit that generates information in which the information indicating the identified event is associated with the received log information;
An information processing apparatus comprising:
(Appendix 8)
The generation unit generates information corresponding to the log information received last from the monitoring target machine among the received log information, the information indicating the identified event,
The information processing device according to appendix 7, wherein
(Appendix 9)
The information indicating the event includes information indicating a communication state of a network to which the monitored machine is connected, or information indicating an operating state of the monitored machine.
The information processing apparatus according to appendix 7 or 8, characterized by the above.

DESCRIPTION OF SYMBOLS 10 Management apparatus 11 Parent system 12 Monitoring part 13 Information storage part 20 Server apparatus 30 Virtual machine 100 Drive apparatus 101 Recording medium 102 Auxiliary storage apparatus 103 Memory apparatus 104 CPU
105 Interface Device 121 Presence Notification Acquisition Unit 122 Event Identification Unit B Bus N1 Network System R Router

Claims (5)

When it is detected that log information transmitted from a monitoring target machine at a specific transmission interval cannot be received at a reception interval corresponding to the transmission interval, the system is based on information acquired from a system related to the monitoring target machine. Identify the events that occurred in
If any log information has been received from the monitored machine, information indicating the identified event is generated in association with the received log information.
A control program for causing a computer to execute processing. Generating information corresponding to the log information received last from the monitored machine, among the received log information, the information indicating the identified event;
The control program according to claim 1. The information indicating the event includes information indicating a communication state of a network to which the monitored machine is connected, or information indicating an operating state of the monitored machine.
The control program according to claim 1 or 2, characterized by the above. When it is detected that log information transmitted from a monitoring target machine at a specific transmission interval cannot be received at a reception interval corresponding to the transmission interval, the system is based on information acquired from a system related to the monitoring target machine. Identify the events that occurred in
If any log information has been received from the monitored machine, information indicating the identified event is generated in association with the received log information.
A control method characterized in that a computer executes a process. When it is detected that log information transmitted from a monitoring target machine at a specific transmission interval cannot be received at a reception interval corresponding to the transmission interval, the system is based on information acquired from a system related to the monitoring target machine. A specific part that identifies the event that occurred in
When any log information has been received from the monitored machine, a generation unit that generates information in which the information indicating the identified event is associated with the received log information;
An information processing apparatus comprising:

Images