JP2020140525A - Notification system, notification device and notification method - Google Patents

Abstract

To provide a notification system, a notification device, and a notification method capable of suppressing delay in dealing with failures.SOLUTION: A notification system comprises: incident management means managing incident information of a monitored device; configuration management means managing configuration information of the monitored device; work management means managing work information on work performed to the monitored device; possibility calculation means calculating possibility of failure occurrence for a certain future period of a system to which the monitored device belongs based on the incident information, the configuration information, and the work information; and notification means notifying a manager of the possibility of failure occurrence.SELECTED DRAWING: Figure 1

Description

The present invention relates to a notification system, a notification device, and a notification method for notifying a failure that may be an incident.

Conventionally, there is known a technique for pre-detecting a failure that may be an incident in a cloud environment or a monitored system having a configuration considering failure tolerance. For example, Patent Document 1 proposes a sign detection device that detects a wide range of signs of an IT failure using a monitoring event and identifies an IT failure. Further, Patent Document 2 describes a system failure sign monitoring system that automatically generates failure sign determination conditions based on a message from a monitored system and automatically learns to improve the accuracy of failure predictive detection. A system failure sign monitoring method is disclosed.

Japanese Unexamined Patent Publication No. 2012-203648 Japanese Unexamined Patent Publication No. 2016-10060

The occurrence rate of failures can be reduced by the conventional prior detection technique as described in Patent Document 1 and Patent Document 2. Here, when the occurrence of a failure is detected in advance and a routine response cannot be made to the failure, the operation staff escalate the response method to the system engineer in charge. At this time, if the system engineer in charge cannot be contacted, the response to the failure will be delayed. Delays in responding to failures can lead to serious incidents that affect the entire system.

The present invention is based on the above problems, and an object of the present invention is to provide a notification system, a notification device, and a notification method capable of suppressing a delay in responding to a failure.

The notification system according to the present invention manages an incident management means for managing incident information of a monitored device, a configuration management means for managing the configuration information of the monitored device, and work information given to the monitored device. Based on the work management means, incident information, configuration information, and work information, the possibility calculation means for calculating the possibility of failure occurrence in the future fixed period of the system to which the monitored device belongs, and the notification for notifying the possibility of failure occurrence. Means and.

The notification device according to the present invention is based on the incident information of the monitored device, the configuration information of the monitored device, and the work information given to the monitored device, and the failure of the system to which the monitored device belongs in a certain future period. It is provided with a possibility calculating means for calculating the possibility of occurrence and a notification means for notifying the possibility of occurrence of a failure.

The notification method according to the present invention is based on the incident information of the monitored device, the configuration information of the monitored device, and the work information given to the monitored device, and the failure of the system to which the monitored device belongs in a certain future period. It includes a step of calculating the possibility of occurrence and a step of notifying the possibility of failure.

According to the notification system, the notification device, and the notification method according to the present invention, the occurrence of delay in response can be suppressed by calculating and notifying the possibility of future failure based on the incident information, the configuration information, and the work information. Can be done.

It is a schematic block diagram of the notification system in an embodiment. It is a flowchart of failure occurrence possibility notification processing in the notification system of embodiment.

(Explanation of configuration)
Hereinafter, embodiments of the notification system, notification device, and notification method of the present invention will be described in detail with reference to the drawings. FIG. 1 is a schematic configuration diagram of the notification system 1 according to the embodiment. The notification system 1 of the present embodiment is a system that calculates and notifies the possibility of failure occurrence in one or more monitoring target systems 80 including one or more monitoring target devices 81. The monitored device 81 is, for example, a server, a database, a terminal device (personal computer), or the like. The monitored system 80 has a configuration in which one or more monitored devices 81 are connected via a network. The monitoring target system 80 is connected to the notification system 1 via, for example, the Internet.

As shown in FIG. 1, the notification system 1 of the present embodiment includes a notification device 10, a configuration management device 20, a work management device 30, and an incident management device 40. The notification device 10 is communicably connected to the configuration management device 20, the work management device 30, and the incident management device 40. Further, the notification system 1 includes a failure information DB 500, a configuration information DB 600, and an incident information DB 700. In addition, "DB" is an abbreviation for "database".

The notification device 10 is composed of one or a plurality of computers including a CPU (Central Processing Unit) and a memory, calculates the possibility of failure in the monitored system 80, and notifies the persons concerned of the monitored system 80. The notification device 10 has a possibility calculation unit 101, a screen input / output unit 102, and a mail transmission unit 103. The possibility calculation unit 101, the screen input / output unit 102, and the mail transmission unit 103 are functional units realized by executing a program stored in the memory by the CPU included in the notification device 10.

The possibility calculation unit 101 calculates the possibility of failure for each monitored system 80 based on the incident information, the configuration information of the monitored device 81, and the work information. The failure occurrence possibility calculated by the possibility calculation unit 101 is stored in the failure occurrence possibility table 503 of the failure information DB 500. Further, the possibility calculation unit 101 stores the work information and the incident information used for calculating the possibility of failure in the work information table 501 and the incident information table 502 of the failure information DB 500, respectively.

The screen input / output unit 102 displays a notification mail including the possibility of failure on a display unit (not shown) included in the notification device 10. Further, the screen input / output unit 102 receives the notification information input via the operation unit (not shown) included in the notification device 10, and stores the notification information in the notification information table 504. The notification information includes the e-mail addresses of the person in charge of operation of the monitored system 80, the system engineer in charge, and the persons concerned in the department to which the system belongs.

The mail transmission unit 103 generates an e-mail including a failure possibility stored in the failure occurrence possibility table 503 of the failure information DB 500. Further, the mail transmission unit 103 transmits the generated mail to the operation person, the system engineer in charge, and the persons concerned in the department to which the mail is assigned, based on the notification information stored in the notification information table 504.

The configuration management device 20 is a device composed of one or a plurality of computers including a CPU and a memory, and manages the configuration of the monitored device 81 as configuration information. Specifically, the configuration management device 20 collects configuration information from the monitored device 81, including resource information of the monitored device 81 and information about the monitored system 80 to which the monitored device 81 belongs. Then, the configuration management device 20 stores or updates the collected configuration information in the configuration information table 601 of the configuration information DB 600. The configuration information of the monitored device 81 may be set by the system engineer in charge or the like and stored in the configuration information table 601. Further, the configuration management device 20 refers to the configuration information stored in the configuration information table 601 based on the control command from the notification device 10.

The work management device 30 is a device composed of one or a plurality of computers including a CPU and a memory, and manages the work performed on the monitored device 81. Specifically, the work management device 30 collects work information including a work schedule applied to the monitored device 81. The work information includes 81 monitored devices, a scheduled work date and time, and work contents. Further, the work management device 30 may generate a work process chart or manage the work progress in the monitored device 81 based on the collected work information. The work performed on the monitored device 81 is, for example, updating the software in the monitored device 81.

The incident management device 40 is a device composed of one or a plurality of computers including a CPU and a memory, and manages past incident information generated in the monitored device 81. Specifically, the incident management device 40 stores or updates the past incident information for each monitored device 81 in the incident information table 701 of the incident information DB 700. Incident information includes information from the occurrence of an incident to the response to the incident, the failure that caused the incident, and information on the response procedure for the failure. Further, the incident management device 40 refers to the incident information stored in the incident information table 701 based on the control command from the notification device 10.

(Explanation of operation)
FIG. 2 is a flowchart of a failure occurrence possibility notification process in the notification system 1 of the embodiment. This process is periodically executed by the notification device 10. The term "regular" means once a day, once a week, or once a month, and the period is set by the system engineer in charge. When this process is started, first, the failure occurrence possibility stored in the failure occurrence possibility table 503 of the failure information DB 500 is initialized (S1). For example, the failure occurrence probability of all the monitored systems 80 stored in the failure occurrence possibility table 503 is set to "0%".

Subsequently, the possibility of failure due to the work influence on the monitored device 81 is calculated. Specifically, first, it is determined whether or not work is scheduled for any of the monitored devices 81 within a predetermined prediction period (S2). The predetermined prediction period is a fixed period in the future from the date and time when the failure occurrence notification processing is started. For example, when the failure possibility notification process is executed once a day, it is determined whether the work for the monitored device 81 is scheduled within one day from the date and time when the failure possibility notification process is started. To. Here, based on the control command from the notification device 10, the work management device 30 transmits the work information within the prediction period collected from the monitored device 81 to the notification device 10. The notification device 10 determines whether or not the work is scheduled within the prediction period based on the work information received from the work management device 30.

Then, if no work is scheduled for all the monitored devices 81 (S2: No), the process proceeds to step S8. On the other hand, if work is scheduled for any of the monitored devices 81 within the prediction period (S2: Yes), the monitored system 80 to which the monitored device 81 scheduled for work belongs is specified (S2: Yes). S3). Specifically, first, the name of the monitored device to which the work is scheduled is identified from the work information. Then, the configuration information based on the identified monitored device name is acquired from the configuration information table 601 via the configuration management device 20. Subsequently, from the acquired configuration information, the monitoring target system 80 in which the identified monitoring target device 81 is a component is specified.

Then, a predetermined value is added to the failure occurrence possibility of the specified monitored system 80 stored in the failure occurrence possibility table 503 of the failure information DB 500 (S4). Here, it is estimated that the possibility of failure occurrence increases due to the influence of the scheduled work, and a predetermined value is added to the failure occurrence possibility table 503. As the predetermined value to be added, a different value may be added depending on the content of the scheduled work, or a uniform value may be added regardless of the content of the work.

Next, it is determined whether or not a failure due to the same work as the scheduled work has occurred in the corresponding monitored device 81 in the past (S5). Here, the incident information table 701 of the incident information DB 700 is referred to by the incident management device 40 under the control of the notification device 10. Then, in the incident information table 701, it is collated whether or not a failure due to the same work as the work scheduled this time has occurred in the corresponding monitored device 81 in the past.

Then, if a failure due to the same work as the scheduled work has not occurred in the corresponding monitored device 81 in the past (S5: No), the process proceeds to step S8. On the other hand, if a failure due to the same work as the scheduled work has occurred in the corresponding monitored device 81 in the past (S5: Yes), the corresponding monitored system is stored in the failure possibility table 503. A predetermined value is added to the possibility of failure of 80 (S6). As the predetermined value to be added, a different value may be added depending on the content of the failure that has occurred in the past, or a uniform value may be added regardless of the content of the failure. Further, the predetermined value to be added may be a larger value as the number of failures that have occurred in the past increases.

Subsequently, the response procedure information when a failure occurs is acquired from the incident information table 701 of the incident information DB 700 via the incident management device 40, and is stored in the incident information table 502 of the failure information DB 500 (S7).

Subsequently, the possibility of failure within the prediction period is calculated from the tendency of past incidents to occur. Specifically, first, past incidents are generated for each service provided by the monitored device 81 from the incident information table 701 of the incident information DB 700 via the incident management device 40 on an hourly, weekly, monthly, or yearly basis. The number of cases is acquired (S8).

Then, it is determined whether or not the processing conditions when the number of past incidents exceeds the threshold value and the processing conditions within the current prediction period match (S9). The processing conditions include, for example, the usage status of the CPU and memory of the monitored device 81. Then, if the processing conditions in which the number of past incidents exceeds the threshold value and the processing conditions within the current prediction period do not match (S9: No), the process proceeds to step S11. On the other hand, when the processing condition in which the number of past incidents exceeds the threshold value and the current processing condition match (S9: Yes), the corresponding monitored system 80 is stored in the failure occurrence possibility table 503. A predetermined value is added to the possibility of failure (S10). The predetermined value to be added may be a higher value as the number of past incidents increases, or a uniform value may be added regardless of the number of incidents.

After that, the failure occurrence possibility stored in the failure occurrence possibility table 503 is notified (S11). Specifically, the mail transmission unit 103 of the notification device 10 generates a notification mail including the possibility of failure stored in the failure occurrence possibility table 503 of the failure information DB 500 for each monitored system 80. Here, the notification mail may be generated only for the monitored system 80 whose failure possibility is other than "0%", or the notification mail may be generated for all the monitored systems 80. .. If the incident response procedure is stored in the incident information table 502 in step S7, the response procedure information may be included in the notification email. Further, the notification mail may be displayed on the display unit of the notification device 10 and edited by the person in charge of operation or the system engineer in charge. The generated notification e-mail is sent to the e-mail addresses of the operation person in charge of the monitored system 80, the system engineer in charge, and the persons concerned in the department to which the monitoring target system 80 is included in the notification information stored in the notification information table 504.

As described above, according to the present embodiment, the system engineer in charge and the persons concerned in the department to which the person in charge belongs can grasp the possibility of failure in a certain period in the future by the notification e-mail. As a result, it becomes possible to prepare for the response to the disorder while being aware of the possibility of receiving escalation, and it is possible to suppress the delay in the response. In addition, by preparing in advance, it is possible to shorten the incident response time.

The possibility calculation unit 101 of the embodiment corresponds to the "possibility calculation means", and the mail transmission unit 103 corresponds to the "notification means". Further, the "incident management device", "configuration management device", and "work management device" of the embodiment correspond to "incident management means", "configuration management means", and "work management means", respectively.

The above is the description of the embodiment of the present invention, but the present invention is not limited to the configuration of the above-described embodiment, and various modifications or combinations are possible within the scope of the technical idea. .. For example, in the above embodiment, three-step addition (steps S4, S6, S10 in FIG. 2) is performed for the possibility of failure using the work information and the occurrence tendency information of past incidents. The addition is not limited, and at least one of the additions may be performed. Further, in addition to the work information and the information on the tendency of occurrence of past incidents, a quantitative value may be calculated by using a predictive detection method of the prior art and added to the possibility of failure occurrence.

Further, in the above embodiment, the notification is sent by e-mail, but the present invention is not limited to this, and a pop-up message is displayed, a bulletin board is posted in the operation system, or other communication tools are used. It may be used to notify.

Further, in the present embodiment, a mode in which the notification device 10, the configuration management device 20, the work management device 30, and the incident management device 40 are separate devices has been described, but all or some of these devices have been described. The device or some functions may be integrated into one device. Further, in the above embodiment, the CPU of the notification device 10 is configured to execute the failure occurrence possibility notification process by executing the software (program), but it may be executed by various processors other than the CPU. In this case, the processor is a PLD (Programmable Logic Device) whose circuit configuration can be changed after manufacturing an FPGA (Field-Programmable Gate Array) or the like, and an ASIC (Application Specific Integrated Circuit) or the like in order to execute a specific process. An example is a dedicated electric circuit or the like, which is a processor having a circuit configuration designed exclusively for the purpose.

1 Notification system, 10 Notification device, 20 Configuration management device, 30 Work management device, 40 Incident management device, 80 Monitoring target system, 81 Monitoring target device, 101 Possibility calculation unit, 102 Screen input / output unit, 103 Mail transmission unit, 500 failure information DB, 501 work information table, 502 incident information table, 503 failure occurrence possibility table, 504 notification information table, 600 configuration information DB, 601 configuration information table, 700 incident information DB, 701 incident information table.

Claims (8)

Incident management means for managing incident information of monitored devices,
A configuration management means for managing the configuration information of the monitored device and
Work management means for managing work information applied to the monitored device, and
A possibility calculating means for calculating the possibility of failure occurrence in a certain future period of the system to which the monitored device belongs based on the incident information, the configuration information, and the work information.
The notification means for notifying the possibility of failure and
Notification system with. The possibility calculation means is
The first aspect of claim 1, wherein a predetermined value is added to the possibility of failure of the system to which the monitored device belongs when there is work to be performed on the monitored device within a certain period in the future. Notification system. The possibility calculation means is
When there is work to be performed on the monitored device within a certain period in the future, and when a failure due to the same work as the work has occurred in the monitored device in the past, the above-mentioned The notification system according to claim 1 or 2, wherein a predetermined value is added to the possibility of failure of the system to which the monitored device belongs. The possibility calculation means is
When there is work to be performed on the monitored device within a certain period in the future, and when a failure due to the same work as the work has occurred in the monitored device in the past, the above-mentioned The notification system according to any one of claims 1 to 3, which acquires and stores a procedure for dealing with a failure. The possibility calculation means is
When the processing conditions when the number of past incidents exceeds the threshold value and the processing conditions in the fixed period in the future match, a predetermined value is set for the possibility of failure of the system to which the monitored device belongs. The notification system according to any one of claims 1 to 4. The notification means is
The notification system according to any one of claims 1 to 5, which generates an e-mail containing the possibility of failure and sends it to a related party. Based on the incident information of the monitored device, the configuration information of the monitored device, and the work information given to the monitored device, the possibility of failure in the future fixed period of the system to which the monitored device belongs is calculated. Possibility calculation means and
The notification means for notifying the possibility of failure and
Notification device including. Based on the incident information of the monitored device, the configuration information of the monitored device, and the work information given to the monitored device, the possibility of failure in the future fixed period of the system to which the monitored device belongs is calculated. Steps to do and
The step of notifying the possibility of failure and
Notification methods including.

Images