JP2020144909A - Operation support system and method - Google Patents

Abstract

To provide a technique for supporting creation of an operation procedure document.SOLUTION: In an operation support system including a management server and a management client, a management server 100 for supporting creation of an operation procedure document has a rule management unit 120 for executing procedure analysis processing 122. Procedure analysis processing 1201 includes processing of reading a procedure document 1501 and processing of specifying a relationship between procedures in the procedure document 1501. The procedure document 1501 includes a plurality of procedures related to operation of an operation object. Processing of specifying the relationship between procedures includes similar relationship extraction processing that is grouping of procedures having a similar expression and inclusion relationship estimation processing for specifying a procedure used as a component of other procedures. The rule management unit 120 holds information on an inter-procedure relationship obtained by the procedure analysis processing 122.SELECTED DRAWING: Figure 3

Description

The present invention generally relates to techniques for supporting the operation of objects such as computer systems, applications, and services.

As an operation target, for example, there is a computer system. In the operation of a computer system, performance values such as response time and conditions such as downtime are often defined in advance and operated so as to satisfy these conditions.

Therefore, it is necessary to deal with the abnormal state promptly, but it is difficult to predict the timing of the abnormal state. In addition, it is not realistic to constantly monitor the status of a large amount of system resources such as servers individually. Therefore, an event is issued when the computer system becomes a specific state such as the timing when the performance value falls below the threshold value or the timing when the error is output to the log. The operation manager can grasp the state of the computer system by monitoring the event, and can quickly detect the abnormality.

On the other hand, in order to take appropriate measures according to the content of the abnormality and the location where the abnormality occurred, knowledge of information technology and knowledge of the computer system to be operated are required, and an advanced skill set is required. Become. Human resources with such an advanced skill set are scarce, and it is difficult to secure enough personnel to monitor events and operate computer systems safely.

Therefore, in general, human resources with advanced skill sets (hereinafter referred to as operation managers) described what kind of event should occur under what conditions and what kind of response should be taken. A system is adopted in which a procedure manual is prepared, and based on the procedure manual, human resources with insufficient skill sets (hereinafter referred to as operators) monitor the computer system. This system can be adopted because the computer system to be operated is a system that has been rigorously designed and developed on it, and the scale of the system is slow to expand.

However, in recent years, cloud computing has made it possible to procure physical system resources flexibly and quickly, and the scale expansion of computer systems has been accelerated. On the other hand, the operation of logical system resources such as virtual servers and applications cannot be outsourced to cloud computing providers in general due to problems such as data confidentiality. In the above operation system, the operation of the computer system depends on the procedure manual and the operator, so the operation becomes a bottleneck for the expansion of the scale of the computer system.

Therefore, it is desired to reduce the operational load. In order to reduce the operational load, it is conceivable to use the technique disclosed in Patent Document 1. Patent Document 1 discloses a flow editing technique. The flow editing technique is a technique for inputting a logical expression in the form of a flowchart. According to Patent Document 1, it is possible to reduce the amount of description when describing a flowchart based on the flowchart template.

US7,277,875

In general, a large number of procedures are accumulated in a procedure manual. In the above-mentioned Patent Document 1, it is necessary to create a flowchart or search for a template to be applied for each procedure, and then input a value. Therefore, the burden of converting the procedure into a flowchart cannot be substantially reduced.

In order to convert the procedure into a flowchart, it is necessary to understand the description contents of the procedure, and the person who prepares the procedure manual is usually an operation manager as described above. Therefore, it is difficult for a person other than the operation manager to convert the procedure into a flowchart. However, the number of operation managers is generally small with respect to the scale of the computer system to be operated, and therefore the operation load is concentrated on the operation manager. For this reason, it is difficult for the operation manager to generate a large man-hour such as converting the procedure into a flowchart for each procedure.

The procedure manual is written in natural language. By editing the procedure manual itself so that it can be easily converted into a machine-readable (understandable) format, it can be expected that the procedure will be automatically converted into a flowchart. However, the procedure manual may include procedures related to operational know-how, and therefore it is desirable to avoid editing the procedure manual itself.

The above-mentioned problem may be a case where the operation target is a target other than the computer system. In addition, the converted structure of the procedure expressed in natural language may be a structure other than the flowchart.

The operation support system receives the selection of the first procedure from the procedure manual including a plurality of procedures related to the operation of the operation target. The operation support system is based on the abstract structure in which the second abstract procedure included in the first abstract procedure corresponding to the first procedure is structured and the selected first procedure, and the first procedure Display an estimated structure that is at least partially structured.

According to the present invention, it is possible to reduce the input work load for converting the procedure manual into a format that can be read by a machine.

FIG. 1 shows an outline of an embodiment. FIG. 2 shows the overall system configuration according to the embodiment. FIG. 3 shows the hardware configuration of the management server according to the embodiment. FIG. 4 shows an example of a procedure manual according to an embodiment. FIG. 5 shows an example of a procedure table according to an embodiment. FIG. 6 shows an example of the conversion sequence table according to the embodiment. FIG. 7 shows an example of event information according to the embodiment. FIG. 8 shows an example of the condition type table according to the embodiment. FIG. 9 shows an example of the operation table according to the embodiment. FIG. 10 shows an example of an abstract procedure table according to an embodiment. FIG. 11 shows an example of the abstract procedure relation table according to the embodiment. FIG. 12 shows an example of an abstract procedure pattern table according to an embodiment. FIG. 13 shows an example of a table of the same part of the abstract procedure according to the embodiment. FIG. 14 shows an example of a flow table according to an embodiment. FIG. 15 shows an example of the procedure flow correspondence table according to the embodiment. FIG. 16 shows an example of a dendrogram. FIG. 17 shows a procedure analysis process according to an embodiment. FIG. 18 shows a procedure generalization process according to an embodiment. FIG. 19 shows a similarity extraction process according to an example. FIG. 20 shows the inclusion relationship estimation process according to the embodiment. FIG. 21 shows the inclusion relationship check process according to the embodiment. FIG. 22 shows the same part identification process according to the embodiment. FIG. 23 shows a procedure conversion order determination process according to an embodiment. FIG. 24 shows the entire sequence of procedure flowchart conversion according to the embodiment. FIG. 25 shows the flow storage process according to the embodiment. FIG. 26 shows a flow decomposition process according to an embodiment. FIG. 27 shows a flow estimation process according to an embodiment. FIG. 28 shows the premise of a specific example in the embodiment. FIG. 29 shows the first part of the transition example of the flow editor screen in the embodiment. FIG. 30 shows the second part of the transition example of the flow editor screen in the embodiment. FIG. 31 shows the third part of the transition example of the flow editor screen in the embodiment. FIG. 32 shows the fourth part of the transition example of the flow editor screen in the embodiment.

An embodiment will be described with reference to the drawings. It should be noted that the examples described below do not limit the invention according to the claims, and that all the elements and combinations thereof described in the examples are indispensable for the means for solving the invention. Not exclusively.

In the following description, various information may be described by the expression of "aaa table", but various information may be expressed by a data structure other than the table. The "aaa table" can be called "aaa information" to show that it does not depend on the data structure.

Further, in the following description, the "interface unit" may include one or more interface devices, specifically, at least one of a user interface unit and a communication interface unit. The user interface unit includes at least one I / O device of one or more I / O devices (for example, an input device (for example, a keyboard and a pointing device) and an output device (for example, a display device)) and a display computer. Good. The communication interface unit may include one or more communication interface devices. One or more communication interface devices may be one or more communication interface devices of the same type (for example, one or more NIC (Network Interface Card)) or two or more different types of communication interface devices (for example, NIC and HBA (Host Bus)). Adapter)) may be used.

Further, in the following description, the "storage unit" includes one or more memories. At least one memory with respect to the storage unit may be a volatile memory. The storage unit is mainly used during processing by the processor unit.

Further, in the following description, the "processor unit" includes one or more processors. The at least one processor is typically a microprocessor such as a CPU (Central Processing Unit). Each of the one or more processors may be single core or multi-core. The processor may include hardware circuits that perform some or all of the processing. The processor unit may include a hardware circuit (for example, FPGA (Field-Programmable Gate Array) or ASIC (Application Specific Integrated Circuit)) that performs a part or all of the processing.

Further, in the following description, the "management system" is an example of an operation support system, and may be composed of one or more computers. Specifically, for example, when the management computer has a display device and the management computer displays information on its own display device, the management computer may be a management system. Further, for example, when a management computer (for example, a server) transmits display information to a remote display computer (for example, a client) and the display computer displays the information (when the management computer displays information on the display computer). ), A system including at least a management computer among a management computer and a display computer may be a management system. The management system may have an interface unit, a storage unit, and a processor unit to which they are connected. When a computer in a management system "displays display information", it may mean that the display information is displayed on a display device of the computer, or the computer transmits the display information to the display computer. It may be present (in the latter case, the display information is displayed by the display computer).

Further, in the following description, the function may be described by the expression of "kkk part" (excluding the interface part, the storage part and the processor part), but the function is executed by one or more computer programs by the processor part. It may be realized by the above, or it may be realized by one or more hardware circuits (for example, FPGA or ASIC). When the function is realized by executing the program by the processor unit, the function is regarded as at least a part of the processor unit because the defined processing is appropriately performed by using the storage unit and / or the interface unit. May be good. The process described with the function as the subject may be a process performed by a processor unit or a device having the processor unit. The program may be installed from the program source. The program source may be, for example, a program distribution computer or a computer-readable recording medium (eg, a non-temporary recording medium). The description of each function is an example, and a plurality of functions may be combined into one function, or one function may be divided into a plurality of functions.

Further, in the following description, the "procedure" is composed of one or more procedure sentences, and when the countermeasure contents for the system abnormality (for example, the operator escalate to the operation manager) and the countermeasure contents are implemented. It includes conditions for determining (for example, the host name that issued the event and the time zone when the event was issued). A "procedure sentence" is a natural sentence in a procedure. A "procedure manual" is a document that describes a plurality of procedures. The procedure manual may be saved in the form of an electronic file, for example.

Further, in the following description, the “flow chart” is used to simplify the description as a typical logical expression example in a machine-readable (understandable) format regarding the structure after conversion of the procedure. In the present invention, the format of the structure after conversion of the procedure may be any format that can be described by humans and can express the logical structure, and is an expression format other than the flowchart (tree structure expression, logical expression expression, table). It may be a structural expression, a rule expression of If Then, etc.).

Further, in the following description, the operation target is a target system (computer system), but in the present invention, a target other than the computer system, for example, an application, a service, or a device may be used.

(1-1) Outline of this embodiment

FIG. 1 shows an outline of this embodiment.

The management system is a system including a management server 100 and a management client 200.

The management server 100 includes a rule management unit 120. The rule management unit 120 can refer to the flow table 1508. The flow table 1508 holds information about the flowchart.

The management client 200 executes the flow editor 220, which is an example of a computer program (for example, an application program). The flow editor 220 displays the flow editor screen 60. The flow editor screen 60 is a screen displayed on the management client 200 by the flow editor (not shown) in the management server 100. The flow editor screen 60 is a GUI (Graphical User Interface) in this embodiment, but is not limited to the GUI.

The outline of this embodiment will be described with reference to FIG.

First, in the management server 100, the rule management unit 120 executes the procedure analysis process 1201. The procedure analysis process 1201 includes a process of reading the procedure manual 1501 and a process of specifying the relationship between the procedures in the procedure manual 1501. Procedure manual 1501 includes a plurality of procedures relating to the operation of the operation target. The processes for specifying the relationships between procedures include the similarity relationship extraction process, which is a grouping of procedures with similar expressions, and the inclusion relationship estimation process, which is a process for identifying procedures used as components of other procedures. Including. The rule management unit 120 holds information on the inter-procedure relationship obtained by the procedure analysis process 1201.

After that, the operation manager describes (inputs) a flowchart corresponding to the procedure in the flow editor 220 on the management client 200, for example. In this embodiment, the flow editor screen 60 has display areas such as a procedure list 221 and a procedure display 222, and a flow input 223. A list of procedures is displayed in the procedure list 221. The operation manager selects a procedure from the procedure list 221 and starts inputting the flowchart. The order of the procedures in the procedure list 221 is, for example, an order in which the burden of the flowchart input work performed by the operation manager can be minimized, specifically, an order in which the abstract procedure contains few words. The "abstract procedure" means an abstraction of the procedure in the procedure manual 1501. A "word" in an abstract procedure is a component of the abstract procedure, and is, for example, an expression of a conditional clause or a countermeasure content described later in the abstract procedure.

When the operation manager selects a procedure from the procedure list 221, the content (details) of the selected procedure is displayed on the procedure display 222. The operation manager inputs a flowchart corresponding to the content to the flow input 223. If the selected procedure is similar to the procedure corresponding to the input flowchart (for example, when the similarity described later is equal to or higher than the threshold value), the rule management unit 120 may use the input flowchart (or , A flowchart in which a parameter value specified from the selected procedure is assigned to a parameter in the flowchart) is provided to the flow editor 220 as an estimation flowchart, and the flow editor 220 displays the estimation flowchart in the flow input 223. ..

Therefore, if there is no flowchart input in the past, the rule management unit 120 cannot display the estimated flowchart because there is no information necessary for estimating the flowchart. Therefore, the operation manager inputs a flowchart to the flow editor 220 based on the selected procedure, and issues a save instruction. Upon receiving the save instruction, the flow editor 220 transmits the procedure (or procedure ID) and the flowchart to the management server 100. The rule management unit 120 of the management server 100 receives the flowchart and the procedure, and registers the information about the flowchart associated with the procedure in the flow table 1508. The rule management unit 120 has a flowchart corresponding to a procedure similar to the received procedure (for example, a procedure using the received procedure itself as a component) based on the information on the relationship between the procedures. Estimate part or all of the above based on the received flowchart.

Next, the operation manager selects another procedure (hereinafter, the second procedure in this paragraph) similar to the previously selected procedure (hereinafter, the first procedure in this paragraph) on the flow editor screen 60. Suppose you did. In this case, there is a possibility that a part or all of the flowchart corresponding to the second procedure has already been estimated based on the flowchart saved earlier (the flowchart corresponding to the first procedure). If there is an estimated flowchart, the estimated flowchart is displayed by the flow editor 220 and the rule management unit 120 in association with all or part of the second procedure corresponding to the estimated flowchart. (For example, when a procedure statement that is all or part of the second procedure is selected by the operation manager, the estimation flowchart corresponding to the procedure statement is highlighted). By editing the estimated flowchart (for example, modifying or adding a logical expression), the operation manager inputs (completes) the flowchart corresponding to the second procedure to the flow editor 220, and gives a save instruction. put out.

By repeating the above (that is, by repeating the set of accepting the selection of the procedure and accepting the input (editing) of the flowchart), the management server 100 (rule management unit 120) learns the correspondence between the procedure and the flowchart. , The estimation accuracy of the flowchart can be improved.

As will be described later, the rule management unit 120 can perform the following processing. For example, the rule management unit 120 describes parameters (parameter items) for each of the same type of condition and countermeasure content (operation type) for a plurality of procedures constituting the procedure manual 1501 and for the condition clauses and countermeasure contents included in those procedures. ) And then get multiple abstract steps. Each abstract procedure is a common pattern extracted from one or more similar procedures. The rule management unit 120 performs hierarchical clustering for a plurality of abstract procedures and identifies similar relationships between the abstract procedures. Then, the rule management unit 120 estimates the inclusion relationship between the abstract procedures based on the specified similarity relationship and the inclusion relationship of the type of conditional clause (condition type) included in each abstract procedure. When a logical expression corresponding to an arbitrary procedure is given (for example, when input is made by an operation manager), the rule management unit 120 is given based on the relationship between the procedure and the abstract procedure and the inclusion relationship between the abstract procedures. Estimate the logical representation corresponding to other procedures related to the procedure. Further, the rule management unit 120 distinguishes and displays the estimated portion and the other portion of the other procedure.

Hereinafter, this embodiment will be described in detail.

(1-2) Overall system configuration

FIG. 2 shows the overall system configuration according to the embodiment.

The management server 100, the management client 200, and the target system 300 are connected to a network 400 such as a LAN (Local Area Network).

The management server 100 includes a rule management unit 120 that manages the procedure manual 1501 and the flowchart 121, a configuration management unit 130 that manages the configuration of the target system 300, and a system monitoring unit 140 that monitors the target system 300. The rule management unit 120, the configuration management unit 130, and the system monitoring unit 140 may be arranged in independent computers, and the configuration is not limited.

The configuration management unit 130 manages the setting file 131 and the configuration information 170. The configuration file 131 may be, for example, a configuration file for an application or service, or a definition file for a server automatic configuration tool that automatically generates a configuration file for the management server 100 or an application. , VM (Virtual Machine) or a definition file that defines the configuration of the container. Further, the configuration information 170 includes, for example, server configuration information indicating the configuration of the management server 100.

The system monitoring unit 140 monitors the target system 300 (for example, collects various information from the target system 300), and updates the monitoring information 160 including information on the monitoring result. The monitoring information 160 includes, for example, event information including an event issued by the target system 300, performance information including information indicating the performance of each element of the target system 300, and log information including a log related to the target system 300. Including.

The management client 200 is a computer including an interface unit, a storage unit, and a processor unit, and has, for example, a display, a keyboard, and a pointer device, and executes an application such as a flow editor 220. The flow editor 220 may be executed on the management server 100 instead of the management client 200, and the Web browser of the management client 200 may display the flow editor screen 60 from the flow editor 220. There may be a plurality of management clients 200. Further, the management client 200 may be formed integrally with the management server 100 (for example, a stand-alone machine including both the management server 100 and the management client 200 may be an example of the management system).

The target system 300 is an example of an operation target, and is a monitoring target system (computer system as an operation management target) of an operation manager or an operator. For example, the target system 300 includes physical system resources such as servers, storage and networks, and logical system resources such as VMs, containers, applications and services.

FIG. 3 shows the hardware configuration of the management server 100.

The management server 100 includes a memory 110, a storage device 150, a processor 180, and an I / F (communication interface device) 190. The I / F 190 is connected to the network 400. The processor 180 is connected to the I / F 190, the memory 110 and the storage device 150. The I / F 190 is an example of the interface unit. At least the memory 110 of the memory 110 and the storage device 150 is an example of the storage unit. At least a part of the information stored in the storage device 150 is stored in an external storage device (not shown) communicably connected to the management server 100 in place of or in addition to the storage device 150. May be good. The storage device 150 itself may be an external storage device thereof. The processor 180 is an example of a processor unit.

A program executed by the processor 180 and performing various processes is arranged in the memory 110. Specifically, for example, the memory 110 is arranged with a monitoring display unit 1102, a rule management unit 120, a configuration management unit 130, and a system monitoring unit 140. The rule management unit 120 executes the procedure analysis process 1201, the flow storage process 1202, and the flow estimation process 1203. The rule management unit 120 displays the flow editor screen 60, displays the flowchart, and edits the flowchart via the flow editor screen 60. The configuration management unit 130 executes the configuration collection process 1301. The system monitoring unit 140 executes the monitoring collection process 1401 and the alert process 1402.

The monitoring display unit 1102 displays various information collected by the system monitoring unit 140 on the management client 200.

The configuration collection process 1301 is a process of collecting configuration information of the system resource from each system resource constituting the target system 300.

The monitoring and collection process 1401 is a process for collecting event information, various logs, and performance information from each system resource constituting the target system 300.

The alert process 1402 is a process of generating event information from various logs and performance information based on a preset threshold value and abnormality log information (for example, information indicating a condition corresponding to the abnormality log). .. For example, the alert process 1402 includes a process of generating event information for a certain log if the certain log meets the conditions indicated by the abnormal log information. Further, for example, the alert process 1402 includes a process of generating event information for a resource related to the performance value when the performance value (metric value) indicated by the performance information exceeds the threshold value. In this way, the event information may be generated in the system monitoring unit 140 or may be received from the target system 300.

The storage device 150 may be, for example, an auxiliary storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive), or an external storage device such as NAS (Network Attached Storage). .. The storage device 150 stores various information. Specifically, for example, the storage device 150 includes a procedure manual 1501, a procedure table 1502, a conversion sequence table 1503, an abstract procedure table 1504, an abstract procedure relation table 1505, an abstract procedure pattern table 1506, an abstract procedure same part table 1507, and a flow. The table 1508, the procedure flow correspondence table 1509, the condition type table 1510, the operation table 1511, the monitoring information 160, and the configuration information 170 are stored. The monitoring information 160 includes, for example, an event table 1601 that stores event information for each event. The configuration information 170 includes, for example, a server configuration table 1701 that stores information indicating a physical server name and a correspondence relationship between a virtual machine and a physical server.

(1-3) Contents of various tables

FIG. 4 shows a procedure manual 1501.

The procedure manual 1501 is a document describing a plurality of procedures. The procedure manual 1501 is a table having an entry for each procedure (the data format of the procedure manual 1501 may be a data format other than the table). Each entry stores information such as procedure 15011 and procedure ID 15010. Hereinafter, one procedure will be taken as an example (referred to as "target procedure" in the description of FIG. 4).

Procedure ID 15010 indicates the ID of the target procedure. Procedure 15011 is the target procedure itself, and is, for example, a natural sentence that "if an event of xxx message occurs between 12:00 and 12:30 on host AAA, escalation is not performed". Procedure 15011 includes countermeasure contents and conditions. The contents of the measures are, for example, "perform escalation" and "do not perform escalation". The conditions are, for example, a server name (for example, a physical server name), a time zone (for example, a start time and an end time), and a message content.

FIG. 5 shows a procedure table 1502.

The procedure table 1502 stores information regarding the details of each procedure constituting the procedure manual 1501. Specifically, for example, the procedure table 1502 has an entry for each word in the procedure. Each entry stores information such as procedure ID 15020, procedure sentence ID 15021, word 15022, condition type ID 15023, operation ID 15024, abstract procedure ID 15025, and abstract procedure sentence ID 15026. Hereinafter, one word in the procedure will be taken as an example (referred to as "target word" in the explanation of FIG. 5). The "word" in the procedure is a component of the procedure and is a character string (for example, a word, a phrase, a clause) which is a set of one or more characters.

Procedure ID 15020 indicates the ID of the procedure including the target word. The procedure sentence ID 15021 indicates the ID of the procedure sentence including the target word. The word 15022 indicates a target word. The condition type ID 15023 indicates the ID of the condition type when the target word corresponds to the condition clause. The operation ID 15024 indicates the ID of the countermeasure content (action) when the target word corresponds to the countermeasure content. The abstract procedure ID 15025 indicates the ID of the abstract procedure which is an abstraction of the procedure including the target word. The abstract procedure sentence ID 15026 indicates the ID of the abstract procedure sentence which is an abstraction of the procedure sentence including the target word.

When the target word corresponds to the condition, the rule management unit 120 stores a valid value as the condition type ID 15023 and stores an invalid value (for example, “−”) as the operation ID 15024. When the target word corresponds to the countermeasure content, the rule management unit 120 stores a valid value as the operation ID 15110 and stores an invalid value as the condition type ID 15023. When the target word is neither a condition nor a countermeasure content, the rule management unit 120 stores invalid values as the condition type ID 15023 and the operation ID 15024, respectively.

The rule management unit 120 extracts a common pattern of words (for example, a character string) in a plurality of procedures in the same cluster, and stores an abstract procedure including the extracted common pattern for each of the plurality of procedures. When the target word is included in the above-mentioned common pattern, the rule management unit 120 stores the ID of the abstract procedure including the common pattern as the abstract procedure ID 15025, and stores the ID of the abstract procedure sentence including the common pattern. It is stored as an abstract procedure statement ID 15026. When the target word is not included in the common pattern, the rule management unit 120 stores invalid values (for example, “−”) as the abstract procedure ID 15025 and the abstract procedure sentence ID 15026, respectively.

FIG. 6 shows a conversion sequence table 1503.

The conversion order table 1503 is a table that manages the order of procedures in the procedure list 221 of the flow editor screen 60, that is, an appropriate procedure conversion order presented to the user. The conversion sequence table 15030 is generated or modified, for example, in the procedure analysis process 1201.

The conversion sequence table 1503 has an entry for each procedure. Each entry stores information such as conversion order 15030 and procedure ID 15031. Hereinafter, one procedure will be taken as an example (referred to as "target procedure" in the description of FIG. 6).

Procedure ID 15031 indicates the ID of the target procedure. The conversion order 15030 indicates the order in which the target procedure is converted into a flowchart.

The conversion order 15030 of the two or more procedures may be the same. In the procedure list 221 of the flow editor screen 60, two or more lines corresponding to two or more procedures having the same conversion order 15030 may be arranged consecutively. Other formats may be adopted as the display format of two or more procedures having the same conversion order 15030.

FIG. 7 shows the event table 1601.

The event table 1601 has, for example, an entry for each event. Each entry stores event ID 16010 (event ID) and event information. The event information may include event ID 16010. The event information includes server name 16011 (name of the server that issued the event), time 16012 (time when the event occurred), importance 16013 (for example, event importance such as "error" and "notification"), and message 16014. Includes information such as.

FIG. 8 shows a condition type table 1510.

The condition type table 1510 is a table that holds information about the condition type. Specifically, for example, the condition type table 1510 has an entry for each condition type. Each entry stores information such as condition type ID 15100, condition type 15101, condition value 15102, acquisition source table 15103, acquisition source column 15104, estimation flag 15105, and flow ID 15106. Hereinafter, one condition type will be taken as an example (referred to as “target condition type” in the description of FIG. 8).

The condition type ID 15100 indicates an ID of the target condition type. The condition type 15101 indicates a fixed character string that identifies the target condition type. The condition value 15102 indicates an expression example of a condition (for example, a condition clause) corresponding to the target condition type. The acquisition source table 15103 indicates the name of the table in which the condition value expression corresponding to the target condition type is stored. The acquisition source column 15104 indicates the name of the column (or information element) in which the expression as the condition value 15102 corresponding to the target condition type is stored. The estimation flag 15105 indicates whether or not the condition value 15102 corresponding to the target condition type is an estimated value. The estimation flag 15105 “Yes” means that the condition value 15102 is an estimated value. The flow ID 15106 is an ID of a flowchart including a logical expression corresponding to the expression as the condition value 15102 corresponding to the target condition type.

When a valid value is stored as the acquisition source table 15103 and the acquisition source column 15104, the rule management unit 120 sets an invalid value (for example, “-”) indicating that the value is not stored as the condition value 15102. May be stored.

Further, the rule management 120 may specify information having a similar expression as a condition value with respect to the target condition type from the configuration information 170 and the monitoring information 160, and the specified condition value may be used as an estimated value. In that case, the rule management unit 120 sets the estimation flag 15105 corresponding to the target condition type to “Yes”.

FIG. 9 shows an operation table 1511.

The operation table 1511 is a table that manages expression examples of specific countermeasure contents included in the procedure in association with the operation type. Specifically, for example, the operation table 1511 has an entry for each operation. Each entry holds information such as operation ID 15110, operation type 15111, operation expression 15112, and flow ID 15113. Hereinafter, one operation will be taken as an example (referred to as "target operation" in the description of FIG. 9).

The operation ID 15110 indicates the ID of the target operation (countermeasure content). The operation type 15111 indicates a fixed character string that identifies the target operation (countermeasure content). The operation expression 15112 shows an expression example of the target operation (countermeasure content). The flow ID 15113 indicates the ID of the flowchart including the logical expression corresponding to the operation expression 15112 corresponding to the target operation (countermeasure content).

FIG. 10 shows an abstract procedure table 1504.

The abstract procedure table 1504 is a table that holds information about the abstract procedure. Specifically, for example, the abstract procedure table 1504 has an entry for each word in the abstract procedure. Each entry stores information such as abstract procedure ID 15040, abstract procedure sentence ID 15041, word 15042, condition type ID 15043, and operation ID 15044. Hereinafter, one word in the abstract procedure will be taken as an example (referred to as "target word" in the explanation of FIG. 10).

The abstract procedure ID 15040 indicates the ID of the abstract procedure including the target word. The abstract procedure sentence ID 15041 indicates the ID of the abstract procedure sentence including the target word. The word 15042 indicates a target word. The condition type ID 15043 indicates the ID of the condition type when the target word corresponds to the condition clause. The operation ID 15044 indicates the ID of the countermeasure content (action) when the target word corresponds to the countermeasure content.

When the target word corresponds to the condition, the rule management unit 120 stores a valid value as the condition type ID 15043 and stores an invalid value (for example, “−”) as the operation ID 15044. When the target word corresponds to the countermeasure content, the rule management unit 120 stores a valid value as the operation ID 15044 and stores an invalid value as the condition type ID 15043. When the target word is neither a condition nor a countermeasure content, the rule management unit 120 stores invalid values as the condition type ID 15043 and the operation ID 15044, respectively.

FIG. 11 shows an abstract procedure relation table 1505.

The extraction procedure relationship table 1505 is a table that holds information indicating the inclusion relationship between abstract procedures. Specifically, for example, the extraction procedure relation table 1505 has an entry for each extraction procedure. Each entry stores information such as abstraction procedure ID 15050, child abstraction procedure ID 15051, and parent abstraction procedure ID 15052. Hereinafter, one abstract procedure will be taken as an example (referred to as “object abstract procedure” in the description of FIG. 11).

The abstract procedure ID 15050 indicates the ID of the target abstract procedure.

The child abstraction procedure ID 15051 is the ID of the child abstraction procedure of the target abstraction procedure, that is, the larger abstract procedure including the target abstraction procedure (typically, the abstract procedure including all the conditional clauses of the target abstraction procedure). Indicates an ID. It is possible that there may be one or more additional child abstract procedures that include the child abstract procedures of the target abstract procedure. Hereinafter, each of all abstract procedures including the target abstract procedure is referred to as a "sub-abstract procedure", and the sub-abstract procedure bounced from the target abstract procedure may be particularly referred to as a "child abstract procedure".

The parent abstraction procedure ID 15052 is the ID of the parent abstraction procedure of the target abstraction procedure, that is, the smaller abstraction procedure included in the target abstraction procedure (typically, some conditional clauses of all the conditional clauses of the target abstraction procedure). Indicates the ID of the abstract procedure) that includes as all the conditional clauses. It should be noted that there may be one or more additional parent abstract procedures included in the parent abstract procedure of the target abstract procedure. Hereinafter, each of all the abstract procedures included in the target abstract procedure may be referred to as a "super-abstract procedure", and the super-abstract procedure bounced back to the target abstract procedure may be particularly referred to as a "parent abstract procedure".

FIG. 12 shows an abstract procedure pattern table 1506.

The abstract procedure pattern table 1506 is a table that holds phrases that are common parts between abstract procedures that are inclusive. Specifically, for example, the abstract procedure pattern table 1506 has an entry for each phrase. Each entry stores information such as phrase ID 15060 and phrase 15061. Hereinafter, one phrase will be taken as an example (referred to as "target phrase" in the explanation of FIG. 12).

Phrase ID 15060 indicates the ID of the target phrase. Phrase 15061 indicates the target phrase (character string pattern) itself.

FIG. 13 shows an abstract procedure same part table 1507.

The abstract procedure same part table 1507 is a table that holds information indicating a place where a phrase appears. Specifically, for example, the abstract procedure same part table 1507 has an entry for each phrase. Each entry stores information such as abstract procedure ID 15070, abstract procedure sentence ID 15071, start position 15072, end position 15073, and phrase ID 15074. Hereinafter, one phrase will be taken as an example (referred to as "target phrase" in the explanation of FIG. 13).

The abstract procedure ID 15070 indicates the ID of the abstract procedure including the target phrase. The abstract procedure sentence ID 15071 indicates the ID of the abstract procedure sentence including the target phrase. The start position 15072 indicates the start position of the target phrase (for example, the number of characters existing between the first character of the target phrase and the first character of the abstract procedure including the target phrase). The end position 15073 indicates the end position of the target phrase (for example, the number of characters existing between the last character of the target phrase and the first character of the abstract procedure including the target phrase). Phrase ID 15074 indicates the ID of the target phrase.

FIG. 14 shows a flow table 1508.

The flow table 1508 is a table that holds a logical expression (flow chart in this embodiment) corresponding to the procedure. A part of the logical representation may be an inferred logical representation. Specifically, for example, the flow table 1508 has an entry for each flowchart. Each entry holds information such as flow ID 15080 and logical representation 15081. Hereinafter, one flowchart will be taken as an example (referred to as “target flowchart” in the description of FIG. 14).

Flow ID 15080 indicates the ID of the target flowchart. The logical expression 15081 shows a logical expression as a target flowchart.

The logical expression 15081 may be a program expression such as “SERVER_NAME_COND_1 == AAA and [flow ID = 2]” as illustrated in FIG. 14, or may be in the form of a flowchart. In the above example, "SERVER_NAME_COND_1" is the condition type 15101 and "AAA" is the condition value 15102.

Further, "[flow ID = 2]" means to replace with a logical expression of flow ID 15080 "2". As described above, the logical expression 15081 may have a nested structure. As a result, a plurality of flowcharts can be managed as a single flowchart.

FIG. 15 shows a procedure flow correspondence table 1509.

The procedure flow correspondence table 1509 is a table that holds information indicating the correspondence between procedures, abstract procedures, phrases, and flowcharts. Specifically, for example, the procedure flow correspondence table 1509 has an entry for each phrase. Each entry stores information such as procedure ID 15090, procedure sentence ID 15091, abstract procedure ID 15092, abstract procedure sentence ID 15093, start position 15094, end position 15095, phrase ID 15096, flow ID 15097, and representative flag 15098. Hereinafter, one phrase will be taken as an example (referred to as "target phrase" in the explanation of FIG. 15). In this embodiment, the phrase may be the smallest unit, and the phrase may be one word.

The procedure ID 15090 indicates an ID in the target procedure including the target phrase. The procedure sentence ID 15091 indicates the ID of the procedure sentence including the target phrase. The abstract procedure ID 15092 indicates the ID of the abstract procedure including the target phrase. The abstract procedure sentence ID 15093 indicates the ID of the abstract procedure sentence including the target phrase. The start position 15094 indicates the start position of the target phrase in the procedure. The end position 15095 indicates the end position of the target phrase in the procedure. Phrase ID 15096 is the ID of the target phrase. The flow ID 15097 is an ID of a flowchart including a flowchart portion corresponding to the target phrase. The representative flag 15098 indicates whether or not the flowchart is a representative flowchart.

The procedure flow correspondence table 1509 is set at the following timings, for example, at the timing when the operation manager saves the flowchart through the flow editor 220, and at the timing when the flowchart is estimated in at least one of the flow storage process 1202 and the flow estimation process 1203. Will be updated.

The representative flag 15098 is a flag for uniquely identifying the flowchart corresponding to the abstract procedure when there are a plurality of patterns of the flowchart corresponding to the abstract procedure. This is because the abstract procedure is extracted from a set of procedures with similar texts, and this set of procedures may contain procedures with different intentions. For example, the procedures of "when XXX occurs in Server A and Server B" and "when XXX occurs in Server A or Server B" include "Server A" and "Server B" as conditional clauses, but the logical structure of those procedures. Is completely different from and and or. However, the similarity as a natural language is high and there is a possibility that they are put together in the same procedure set, and at this time, the flowcharts input corresponding to each procedure may vary.

On the other hand, in this embodiment, an example is shown in which a flowchart having a logical structure included in a large number of flowcharts is used as a representative flowchart among the flowcharts corresponding to each procedure in the procedure set (flow decomposition process S8000). That is, when there are a plurality of candidates, the representative flowchart is displayed as the estimation flowchart.

The above does not limit the method of obtaining the representative flowchart. If a plurality of flowcharts corresponding to the abstract procedure are generated, the procedure set is divided for each pattern of the flowchart, and the abstract procedure and the similarity relationship between the abstract procedures are recalculated. And so on.

There are multiple update timings for the procedure flow correspondence table 1509. For example, values can be stored as shown in (1) to (6) below. As shown below, in this embodiment, the "flow chart" may exist for the entire procedure or for an abstract procedure, or part of a procedure or abstract procedure (eg, all or part of a procedure statement or abstract procedure statement (eg). For example, it may exist for the phrase)). In the following description, the components of the flowchart may be referred to as "nodes". The node may be the flowchart itself. That is, the nodes are all or part of the flowchart.
(1) A flow ID 15097 indicating a flowchart of the entire procedure corresponding to the specified procedure ID 15090 is stored.
(2) The flow ID 15097 indicating the flowchart of the procedure sentence corresponding to the designated procedure ID 15090 and the procedure sentence ID 15091 is stored.
(3) The flow ID 15097 indicating the flowchart of the designated procedure ID 15090, procedure sentence ID 15091, start position 15094, and procedure sentence portion corresponding to the end position is stored.
(4) A flow ID 15097 indicating a flowchart of the entire abstract procedure corresponding to the specified abstract procedure ID 15092 is stored.
(5) The flow ID 15097 indicating the flowchart of the abstract procedure statement corresponding to the designated abstract procedure ID 15092 and the abstract procedure statement ID 15093 is stored.
(6) The flow ID 15097 indicating the flowchart corresponding to the designated abstract procedure ID 15092, abstract procedure sentence ID 15093, start position 15094, end position 15095, and abstract procedure sentence part (phrase) corresponding to phrase ID 15096 is stored.

(1-4) Details of processing performed in this embodiment

FIG. 17 shows the procedure analysis process 1201. The procedure analysis process 1201 is executed as a pre-processing before converting each procedure into a flowchart. The rule management unit 120 identifies the relationship between the procedures included in the procedure manual 1501 in the procedure analysis process.

First, the rule management unit 120 reads the procedure manual received as an input (for example, stores it in the memory 110) (S1000).

Next, the rule management unit 120 extracts the procedures included in the procedure manual and performs morphological analysis on each procedure (S1010). As a result, each procedure is broken down into words. For example, the rule management unit 120 may extract only words corresponding to a specific part of speech (for example, a noun or a verb) from each procedure, or means a plurality of words for at least one of one or more steps. It may be regarded as one word by grouping it into a certain unit. In the steps after S1020, for each procedure extracted in S1010, the word string (one or more words) obtained in S1010 is treated as a "procedure".

Next, the rule management unit 120 executes a procedure generalization process (FIG. 18) in S1020 (S1020). In the procedure generalization process, the rule management unit 120 specifies a conditional expression of a conditional clause included in the procedure and a word string indicating the operation of the countermeasure content. In the steps after S1030, a word in which the word specified in S1020 is replaced with the corresponding condition type 15101 or operation type 15111 is treated as a "procedure". In the following description, the condition type 15101 and the operation type 15111 and the word cut out in S1010 are referred to as "words" without distinction.

Next, the rule management unit 120 executes a similarity extraction process (FIG. 19) (S1030). In the similarity relationship extraction process, the rule management unit 120 identifies a procedure set that is similar and stores a word string pattern common to the procedure set as an abstract procedure. Therefore, the abstract procedure is common to one or more procedures belonging to the procedure set. Further, since the abstract procedure is a word string pattern, the abstract procedure sentence is a part or all of the word string pattern as the abstract procedure.

Next, the rule management unit 120 executes the inclusion relationship estimation process (FIG. 20) (S1040). The rule management unit 120 estimates the inclusion relationship between the abstract procedures generated in S1030 in the similarity relationship extraction process.

Finally, the rule management unit 120 executes the procedure conversion order determination process (FIG. 23) (S1050). The rule management unit 120 orders the procedures based on the similarity relationship and the inclusion relationship between the procedures in the procedure conversion order determination process.

FIG. 18 shows a procedure generalization process (S1020).

The rule management unit 120 performs S2020 to S2090 for each word in each procedure (for example, a word corresponding to a conditional clause and a word corresponding to a countermeasure content). Hereinafter, one word in one procedure will be taken as an example (referred to as "target procedure" and "target word" in the description of S2020 to S2090). The "target word" may be the minimum word (word as the minimum unit) or a combination of the minimum words (a set of two or more minimum words). Specifically, for example, the "target word" may be N-Gram (N is an integer of 1 or more).

If the target word is a word corresponding to the countermeasure content, the rule management unit 120 determines whether or not there is an operation expression 15112 similar to the target word (S2020). The similarity (similarity) of a character string such as a target word can be specified by a method such as calculating the Levenshtein distance of the character string. If there is at least one motion expression 15112 having a degree of similarity with the target word of a certain value or more, the determination result of S2020 is true.

When the determination result of S2020 is true (S2020: Yes), the rule management unit 120 selects a similar operation expression 15112 (for example, the operation expression 15112 having the highest degree of similarity), and corresponds to the selected operation expression 15112. The operation ID 15110 is registered as the operation ID 15024 in the corresponding entry in the procedure table 1502 (the entry in which the word 15022 indicating the target word is registered) (S2030). In S2030, the procedure ID 15020 of the target procedure, the procedure sentence ID 15021 of the procedure sentence including the target word, and the word 15023 indicating the target word may also be registered in the corresponding entry.

When the determination result of S2020 is false (S2020: No), the rule management unit 120 determines whether or not there is a condition value 15102 similar to the target word if the target word is a word corresponding to the conditional clause. (S2040).

When the determination result of S2040 is false (S2040: No), the rule management unit 120 starts from the grid pattern information 170 or the monitoring information 160 (specifically, the information pointed to by the acquisition source table 15103 and the acquisition source column 15104). , It is determined whether or not there is a value (expression) similar to the target word (S2050).

When the determination result of S2040 or S2050 is true (S2040: Yes or S2050: Yes), the rule management unit 120 has a condition type corresponding to a value similar to the target word (for example, condition value 15102 or expression). The condition type ID of is registered as the condition type ID 15023 in the corresponding entry of the procedure table 1502 (S2060). In S2060, the procedure ID 15020 of the target procedure, the procedure sentence ID 15021 of the procedure sentence including the target word, and the word 15023 indicating the target word may also be registered in the corresponding entry.

If the determination result of S2050 is false (S2050: No), there is a possibility that the condition type of the condition clause to which the target word corresponds is an unknown condition type (condition type not in the condition type table 1510). Therefore, the rule management unit 120 determines whether or not a value (expression) similar to the target word exists in the configuration information 170 or the monitoring information 160 (S2070).

When the determination result of S2070 is true (S2070: Yes), the rule management unit 120 generates a condition type corresponding to the similar value and a condition type ID of the condition type, and generates the generated condition type. Condition type 15101 shown, condition type ID 15100 indicating the generated condition type ID, condition value 15102 indicating the similar value, acquisition source table 15103 and acquisition source column 15104 indicating the acquisition source of the value, and estimation flag 15015 "Yes". Is registered in the condition type table 1510 (S2080). Further, the rule management unit 120 registers the registered condition type ID 15100 as the condition type ID 15023 in the corresponding entry of the procedure table 1502 (S2090). In S2090, the procedure ID 15020 of the target procedure, the procedure sentence ID 15021 of the procedure sentence including the target word, and the word 15023 indicating the target word may also be registered in the corresponding entry.

FIG. 19 shows a similarity extraction process (S1030). In the similarity relationship extraction process, the rule management unit 120 summarizes similar procedures by a method such as clustering, and extracts a common word string pattern as an abstract procedure from a procedure set that is one or more procedures having the similar relationship. ..

The rule management unit 120 performs S3010 to S3030 for each procedure. Hereinafter, one procedure will be taken as an example (referred to as "target procedure" in the description of S3010 to S3030).

The rule management unit 120 generates a word string composed of one or more words indicated by one or more words 15022 corresponding to the target procedure (S3010). At this time, if each of the one or more words constituting the word string has a valid value as the condition type ID 15023 or the operation ID 15024 corresponding to the word, the rule management unit 120 sets the word as the ID. Is replaced with the information (word) indicated by the condition type 15101 or the operation type 15111 corresponding to (S3020). Then, the rule management unit 120 vectorizes the word string (S3030). As a vectorization method, for example, a known method such as TF-IDF can be used.

As described above, the procedures having different condition values 15102 can be treated as the same procedure depending on S3010 to S3030. Specifically, for example, even if the procedures have the same contents, if the configurations are different (for example, the server name is different), the procedures will be expressed differently. According to S3010 to S3030, such procedures are used. It is possible to recognize procedures having different configurations as the same procedure.

Next, the rule management unit 120 clusters each procedure (word string). As a clustering method, a known method (for example, k-means method or agglomeration type clustering) can be used.

Next, the rule management unit 120 performs S306 to S3100 for each cluster. As a result, an abstract procedure, which is a common pattern of multiple procedures, is required. Hereinafter, one cluster will be taken as an example (referred to as "target cluster" in the description of S306 to S3100).

The rule management unit 120 acquires a procedure set that is all the procedures belonging to the target cluster (S3060).

The rule management unit 120 extracts a common word string pattern from the acquired procedure set (S3070). Specifically, for example, the rule management unit 120 generates one or more procedure pairs for the procedure set. Then, the rule management unit 120 obtains the Levenshtein distance in word units for each of the one or more procedure pairs, and extracts a word string pattern composed of words whose Levenshtein distance is equal to or more than an arbitrary threshold value. To do. The word string pattern may include words that are found at an arbitrary frequency or higher for one whole procedure pair. Further, the word string pattern may be, for example, an arbitrary 0 or more words removed from the procedure set. The word string pattern extracted in S3070 is an abstract procedure.

The rule management unit 120 registers the information related to the abstract procedure (word string pattern) extracted in S3070 in the abstract procedure table 1504 (S3080). Specifically, for example, the rule management unit 120 generates the abstract procedure ID 15040 and the abstract procedure sentence ID 15041 without duplication, and registers the abstract procedure ID 15040 and the abstract procedure sentence ID 15041 in the abstract procedure table 1504. Further, when the word included in the abstract procedure includes any condition type 15101, the rule management unit 120 registers the condition type ID 15100 corresponding to the condition type 15101 in the abstract procedure table 1504 as the condition type ID 15043. .. Similarly, when the word included in the abstract procedure includes any operation type 15111, the rule management unit 120 registers the operation ID 15110 corresponding to the operation type 15111 in the abstract procedure table 1504 as the operation ID 15044. .. In S3080, the word included in the abstract procedure may be registered as word 15042.

After that, the rule management unit 120 performs S3100 for each procedure constituting the procedure set acquired in S3060. Hereinafter, one procedure will be taken as an example (referred to as "target procedure" in the description of S3100).

The rule management unit 120 registers information about the abstract procedure corresponding to the target procedure in the procedure table 1502 (S3100). Specifically, for example, the rule management unit 120 identifies a word corresponding to a word in the abstract procedure (word string pattern) extracted in S3070 from the target cluster. For this, a method such as regular expression pattern matching can be used. Then, the rule management unit 120 includes the abstract procedure ID 15025 indicating the ID of the abstract procedure and the word corresponding to the specified word in the corresponding entry (entry including the word 15022 indicating the specified word) in the procedure table 1502. The abstract procedure statement 15026 indicating the ID of the abstract procedure statement is registered.

FIG. 20 shows the inclusion relationship estimation process (S1040).

The rule management unit 120 acquires all abstract procedures (word string patterns) from the abstract procedure table 1504 (S4000). At this time, if each of the one or more words constituting the abstract procedure has a valid value as the condition type ID 15043 or the operation ID 15044 corresponding to the word, the rule management unit 120 uses the word. Replace with the information (word) indicated by the condition type 15101 or the operation type 15111 corresponding to the ID.

The rule management unit 120 converts the abstract procedure (word string pattern) acquired in S4000 into a vector representation in the same manner as in S3030, and performs aggregate clustering (S4010). When agglomeration clustering is performed, abstract procedures with high similarity are sequentially grouped into clusters. As a result, the finally generated cluster can be represented as a binary tree called a dendrogram.

FIG. 16 shows an example of a dendrogram, specifically, an example in which abstract procedures A to E are summarized by aggregate clustering. Cluster 1 is a cluster that combines abstract procedures A and B. Cluster 2 is a cluster in which target procedures C and D are put together. Cluster 3 is a cluster that combines cluster 2 and cluster 1. Cluster 4 is a cluster that combines cluster 3 and abstract procedure E.

In the dendrogram, how similar the components of a cluster are is called "similarity". The degree of similarity is 0 or more and 1 or less. The dendrogram is drawn with the leaf position as the similarity "1" and the root position as the similarity "0". Then, the dendrogram draws the connection points of the nodes at a height corresponding to the similarity of the components of the cluster. In the future, for the sake of simplicity, the subtrees on the left and right of the connection point will be referred to as the trees on the left and right of the cluster. The similarity of the left and right nodes indicated by the height of the connection point is called the similarity of the cluster indicated by the subtree.

As shown in FIG. 16, in aggregate clustering, a plurality of clusters are hierarchically configured, but abstract procedures belonging to smaller clusters have less excess or deficiency of word strings and are more similar. The possibility is high.

Utilizing this feature, the rule management unit 120 selects clusters in descending order of similarity for the clustering generated in S4010, compares the abstract procedures included in the clusters, and estimates the inclusion relationship in sequence. The rule management unit 120 performs S403 to S4090 for each cluster. Hereinafter, one cluster will be taken as an example (referred to as “target cluster” in the description of S403 to S4090).

The rule management unit 120 selects one abstract procedure from each of the left and right trees in the target cluster, and generates an abstract procedure pair that is a pair of the selected abstract procedures (S4030). For the target cluster, S4050 to S4090 are performed for each abstract procedure pair. Hereinafter, one abstract procedure pair will be taken as an example (referred to as "object abstract procedure pair" in the description of S4050 to S4090). If the similarity of the cluster is less than an arbitrary threshold value, there is a high possibility that the abstract procedures included in the left and right trees in the cluster are not similar, so even if processing such as ending the loop is adopted. Good.

The rule management unit 120 executes the inclusion relationship check process for the target abstract procedure pair (S4050). In the inclusion relationship check process, it is checked (estimated) whether or not the target abstract procedure pair has an inclusion relationship.

If the check result is false (S4060: No), the rule management unit 120 selects the next abstract procedure pair without performing the processing after S4070.

On the other hand, when the check result is true (S4060: Yes), the rule management unit 120 performs S4070 to S4090 for the target abstract procedure pair.

That is, the rule management unit 120 determines whether or not the information regarding the target abstract procedure pair is not registered in the abstract procedure relation table 1505 (S4070).

When the determination result of S4070 is true (S4070: Yes), the rule management unit 120 registers the information regarding the target abstract procedure pair in the abstract procedure relation table 1505 (S4080).

Specifically, the rule management unit 120 specifies the parent-child relationship of the target abstract procedure pair from the result of the inclusion relationship check process. Regarding the abstract procedure of the parent in the target procedure pair, the rule management unit 120 indicates that if there is an entry containing the ID of the parent abstract procedure as the abstract procedure ID 15050, the entry contains the abstract procedure of the child in the target abstract procedure pair. The ID is registered as the child abstraction procedure ID 15051. Further, regarding the abstract procedure of the child in the target abstract procedure pair, if there is an entry including the ID of the child abstract procedure as the abstract procedure ID 15050, the rule management unit 120 includes the entry of the parent in the target abstract procedure pair. The abstract procedure ID is registered as the parent abstract procedure ID 15052. If there is no corresponding entry, the rule management unit 120 newly generates an entry in the abstract procedure relation table 1505. In S4080, if the ID of the child abstract procedure in the target abstract procedure pair is registered as the child abstract procedure ID 15051 of the child abstract procedure including any existing abstract procedure, the rule management unit 120 has registered the target abstract. The ID of the child abstraction procedure in the procedure pair may not be registered as the child abstraction procedure ID 15051. Similarly, if the ID of the parent abstract procedure in the target abstract procedure pair is registered as the parent abstract procedure ID 15052 of the parent abstract procedure included in any of the existing abstract procedures, the rule management unit 120 determines the target abstract procedure. The ID of the parent abstraction procedure in the pair may not be registered as the parent abstraction procedure ID 15052.

The rule management unit 120 executes the same unit identification process for the target abstract procedure pair (S4090).

FIG. 21 shows the inclusion relationship check process (S4050). The inclusion relationship check process is a process of determining whether or not the two abstract procedures constituting the input target abstract procedure pair have an inclusion relationship.

The rule management unit 120 totals the number of condition types included in the abstract procedure for each abstract procedure that constitutes the target abstract procedure pair (S5000). If the relationship between the abstract procedures that make up the target abstract procedure pair is inclusive, it is considered that the similarity between the target procedures is high and the contained condition types and the number of condition types are inclusive. Be done. Therefore, in the rule management unit 120, whether or not the target abstract procedure pair has an inclusion relationship based on the condition types and the number thereof aggregated for each abstract procedure in S5000 (two abstract procedures constituting the target abstract procedure pair). Is in an inclusive relationship) (S5010). For example, if the first abstract procedure includes all of the condition types included in the second abstract procedure, the target abstract procedure pair has an inclusion relationship. On the other hand, if the first abstract procedure does not include at least one condition type including the second abstract procedure, the target abstract procedure pair has no inclusion relationship. The rule management unit 120 sets the determination result (true (Yes) or false (No)) of S5010 as the check result, and returns the check result as the return value.

FIG. 22 shows the same part identification process (S4090). The same part identification process is a process of identifying a common word string pattern from an object abstract procedure pair presumed to be inclusive.

The rule management unit 120 specifies the correspondence of the abstract procedure statements with respect to the target abstract procedure pair (S6000). Specifically, for example, the rule management unit 120 replaces the abstract procedure statement with a vector expression by a method such as the Levenshtein distance or TF-IDF, and sets an abstract procedure statement pair in which the vector distance is equal to or less than a certain threshold value. It may be obtained, or it may be restricted so that the order of appearance of the abstract procedure statements matches.

After that, the rule management unit 120 selects the abstract procedure having the smaller number of abstract procedure statements (S6010). Then, the rule management unit 120 performs S6030 to S6050 for each abstract procedure statement in the selected abstract procedure. Hereinafter, one abstract procedure sentence will be taken as an example (referred to as "object abstract procedure sentence" in the description of S6030 to S6050).

The rule management unit 120 determines whether or not the abstract procedure statement corresponding to the target abstract procedure statement is specified in S6000 (S6030).

If the determination result of S6030 is true (S6030: No), the rule management unit 120 compares the target abstract procedure statement with the abstract procedure statement corresponding to the target abstract procedure statement, and compares those abstract procedure statements. It is determined whether or not there is a common part (phrase) in (S6040). Here, for example, the rule management unit 120 may cut out the word string included in one abstract procedure sentence by N-Gram and determine whether or not it is included in the other abstract procedure sentence. Further, for example, the phrase may be a simple match part or a part as a regular expression as included in both abstract procedures.

If the determination result of S6040 is true (S6040: Yes), the rule management unit 120 updates the extraction procedure pattern table 1506 and the abstract procedure same unit table 1507 (S6050). Specifically, for example, the rule management unit 120 generates the phrase ID 15060 so as not to overlap, and registers the phrase ID 15060 and the phrase 15061 in the extraction procedure pattern table 1506. Further, the rule management unit 120 sets the positions (start position 15072 and end position 15073) where the phrase extracted in S6040 appears and the phrase ID 15074 (the same ID as the generated phrase ID 15060) of the target abstract procedure sentence. Abstract procedure Register in the same part table 1507.

FIG. 23 shows a procedure conversion order determination process (S1050). The procedure conversion order determination process is a process of determining a recommended order for converting a procedure into a flowchart based on the relationship between the procedures extracted by the similarity relationship extraction process and the inclusion relationship estimation process.

The rule management unit 120 refers to the abstract procedure relation table 1506 and selects the abstract procedure that is the most ancestor (for example, the abstract procedure with the fewest words (conditional clauses)) among the abstract procedures that are inclusive and unselected (for example, the abstract procedure with the fewest words (conditional clauses)). S7000).

The rule management unit 120 determines whether or not there is an unselected upper abstract order among the upper abstract procedures of the abstract procedure selected in S7000 (S7010). If the determination result of S7010 is true (S7010: Yes), the rule management unit 120 selects one upper abstract procedure from the unselected upper abstract procedures (S7020) and makes the determination of S7010. ..

If the determination result of S7010 is false (S7010: No), the rule management unit 120 selects the relevant abstract procedure (abstract procedure selected in S7000) (S7030).

Next, the rule management unit 120 selects all the procedures corresponding to the abstract procedure ID 15025 of the abstract procedure selected in S7030 from the procedure table 1502 (S7040).

After that, in the rule management unit 120, the conversion order 15030 of each procedure corresponding to the abstract procedure selected in S7030 is a serial number of the conversion order of each procedure corresponding to the parent abstract procedure of the abstract procedure selected in S7030 (next order). ) Is generated, and the conversion order 15030 and the procedure ID 15031 of the procedure selected in S7040 are registered in the procedure conversion order table 1503 (S7050).

As described above, S7000 to S7050 are repeated for all abstract procedures (S7600). As a result, for each abstract procedure belonging to the same inclusion relationship, the conversion order of each procedure corresponding to the abstract procedure is the order following the conversion order of each procedure corresponding to the parent abstract procedure of the abstract procedure. Specifically, for example, when the first abstract procedure is the parent abstract procedure of the second abstract procedure and the conversion order of each procedure corresponding to the first abstract procedure is X (X is a natural number), the second The conversion order of each procedure corresponding to the abstract procedure of is X + 1.

FIG. 24 shows the entire sequence of procedure flowchart conversions.

The flow editor 220 of the management client 200 receives a procedure flowchart conversion operation from the operation manager, and transmits a procedure list request according to the operation to the management server 100. The rule management unit 120 of the management server 100 receives the procedure list request. In response to the request, the rule management unit 120 transmits a list of sets of the conversion order 15030 and the procedure 15011 (which may further include the procedure ID 15010) to the management client 200. The flow editor 220 of the management client 200 displays a list of procedures arranged in the conversion order 15030 on the procedure list 221 of the flow editor screen 60.

The flow editor 220 receives the procedure selection from the procedure list 221 from the operation manager, and transmits the procedure ID of the selected procedure (instead of or in addition to the procedure ID, the procedure itself) to the management server 100. .. The rule management unit 120 of the management server 100 executes the flow estimation process 1203 including receiving the procedure ID of the selected procedure, and estimates all or a part of the selected procedure and the estimation flowchart of the selected procedure, and the selected procedure. At least one of the estimated parts (procedure sentences or phrases) is transmitted to the management client 200. The flow editor 220 of the management client 200 displays the procedure and the estimation flowchart on the procedure display 222 and the flow input 223 based on the received information. When a procedure part such as a procedure sentence, a phrase or a word is specified by an input device such as a mouse, the flow editor 220 has an estimated flowchart part corresponding to the specified procedure part (for example, the entire node or the inside of the node). The corresponding part in the character string) can be highlighted by inquiring to the rule management unit 120 and specifying it (or by referring to the procedure flow correspondence table 1509).

The flow editor 220 receives from the operation manager the selection of the entire procedure, the procedure sentence or the phrase, and the input of the flowchart corresponding to the selected part in the procedure display 222. At this time, as described above, the flow editor 220 may highlight the estimated flow location corresponding to the selected portion and then receive the modification of the flowchart. The flow editor 220 holds the input flowchart and the procedure correspondence relationship (at least two relationships of the entire procedure, the procedure sentence, and the phrase). When the flow editor 220 receives an instruction to save the flowchart from the operation manager, the flow editor 220 transmits the input flowchart and the held procedure correspondence relationship to the management server 100. The rule management unit 120 of the management server 100 executes the flow storage process 1202 for saving the flowchart and the correspondence, and notifies the flow editor 220 of the completion notification.

In the procedure list 221, other than the procedure may be displayed. For example, the estimated flow may be displayed, or the ratio (coverage) of the estimated portion of the procedure may be displayed. In addition, the storage instruction does not necessarily have to be explicitly given by the operation manager. For example, the flow storage process 1202 may be executed at the same time as the input of the flowchart without any explicit storage instruction. At this time, the display of the procedure list 221 may be updated as described above.

FIG. 25 shows the flow storage process 1202. The flow storage process 1202 is a process for storing the received flowchart.

In the flow table 1508, as shown in FIG. 14, another flow ID 1508 may be referred to from the logical representation 15081. For example, the flowchart corresponding to the phrase may be referred to from the flowchart corresponding to the procedure sentence. Therefore, the rule management unit 120 first executes the flow decomposition process (S8000). As a result, the received procedure portion can be decomposed into abstract procedures and phrases, which are units of finer particles, and a flowchart corresponding to those units can be obtained. S801 to S8050 are performed for each flowchart. Hereinafter, one flowchart will be taken as an example (referred to as “target flowchart” in the description of S801 to S8050).

The rule management unit 120 determines whether or not the information regarding the target flowchart has been registered in the procedure flow correspondence table 1509 (S8010). Specifically, for example, in the rule management unit 120, IDs corresponding to the target flowchart (for example, procedure ID, procedure sentence, abstract procedure ID, abstract procedure sentence ID, subset of start position and end position) correspond to the procedure flow. Determine if it has been registered in Table 1509.

If the determination result of S8010 is false (S8010: No), the rule management unit 120 registers the ID corresponding to the target flowchart in the procedure flow correspondence table 1509 (S8020). At this time, the representative flag 15098 associated with the ID is set to "Yes".

On the other hand, if the determination result of S8010 is true (S8010: Yes), the rule management unit 120 generates a flowchart in which the difference between the target flowchart and the flowchart corresponding to the existing ID is eliminated as a representative flowchart. .. Specifically, the rule management unit 120 performs S8030 to S8050.

That is, the rule management unit 120 acquires a flowchart group (one or more flowcharts) that matches the ID corresponding to the target flowchart and has the representative flag 15098 “No” from the procedure flow correspondence table 1509 (S8030).

Then, the rule management unit 120 compares the flowchart group acquired in S8030 with the target flowchart and generates a representative flowchart (S8040). Specifically, for example, the rule management unit 120 selects a condition type and an operation type existing in a flowchart of a majority (an example of a predetermined ratio) in the flowchart group. Then, when the logical connection relationship between the nodes indicating the selected condition type or operation type exists in the majority of the flowcharts, the rule management unit 120 determines the conditions in the target flowchart in the logical connection relationship. Connect the nodes that indicate the type and operation type. As a result, a representative flowchart is generated in the form of a plurality of graphs.

After that, the rule management unit 120 registers the information regarding the representative flowchart generated in S8040 in the procedure flow correspondence table 1509 (S8050). At this time, the representative flag 15098 is set to "Yes" for the flowchart.

After S8000 to S8050 (after registering the received flowchart), the rule management unit 120 determines the conditional clause estimated in the procedure generalization process (S1020) based on the received flowchart.

Specifically, first, the rule management unit 120 extracts the node of the conditional clause in which the conditional expression is described from the received flowchart (S8060).

Then, the rule management unit 120 includes an entry corresponding to the condition type included in the extracted node (an entry in the condition type table 1510, for example, a condition value 15102, or a table portion pointed to by the acquisition source table 15103 and the acquisition source column 15104. Based on the information of the condition value expression), the procedure part corresponding to the condition clause corresponding to the node extracted in S8060 is specified (S8070). For example, the rule management unit 120 may search for a word similar to the above conditional expression from the procedure. If there is no entry in the condition type table 1510 that includes information about the condition clause corresponding to the node extracted in S8060, the rule management unit 120 adds such an entry to the condition type table 1510.

If the estimation flag 15105 in the entry specified in S8070 (entry in the condition type table 1510) is "Yes", the rule management unit 120 changes the estimation flag 15105 to "No" and sets the condition value 15102. , The expression of the procedure portion specified in S8070 is registered (S8080).

FIG. 26 shows a flow decomposition process (S8000).

The rule management unit 120 receives the flowchart and the procedure correspondence relationship (S1500). The rule management unit 120 determines whether or not the procedure correspondence relationship includes a procedure sentence (S1510). When the determination result of S1510 is false (S1510: No), the rule management unit 120 refers to the procedure table 1511 and extracts the IDs of all the procedure sentences included in the procedure (S1520).

S1530 to S1560 are performed for each procedure sentence specified from the procedure correspondence relationship. Hereinafter, one procedure sentence will be taken as an example (referred to as "target procedure sentence" in the description of S1530 to S1560).

The rule management unit 120 refers to the procedure table 1511 and specifies an abstract procedure statement corresponding to the target procedure statement (S1530). Then, the rule management unit 120 specifies a flowchart portion (node in the flowchart) corresponding to the condition type and the operation type included in the specified abstract procedure statement in the received flowchart (S1540). At that time, the rule management unit 120 removes the conditional clauses and operation nodes that do not correspond to the specified abstract procedure statement from the received flowchart. This creates a partial flowchart.

Next, the rule management unit 120 refers to the abstract procedure pattern table 1506 and the abstract procedure same unit table 1507, and specifies all the phrases included in the abstract procedure statement (S1550). S1560 is performed for each specified phrase. Hereinafter, one phrase will be taken as an example (referred to as "target phrase" in the explanation of S1560).

Similar to S1540, the rule management unit 120 identifies the flowchart corresponding to the target phrase from the received flowchart (S1560).

After executing S1530 to S1560, the rule management unit 120 identifies a flowchart corresponding to the entire abstract procedure from the received flowchart as in S1540 (S1570).

The rule management unit 120 identifies the correspondence of the specified flowcharts so as to correspond to the correspondences of the procedure, the procedure sentence, the abstract procedure, the abstract procedure sentence, and the phrase, and removes the duplication of the flowchart (S1580). Then, the rule management unit 120 returns the specified flowchart, the correspondence between the flowchart and the procedure portion, and the duplication exclusion result between the flowcharts.

FIG. 27 shows the flow estimation process 1203.

The rule management unit 120 receives the procedure ID of the selected procedure (S9000), first refers to the procedure flow correspondence table 1509, and identifies the flow ID 15097 corresponding to the received procedure ID (S9010). After that, the rule management unit 120 refers to the flow table 1508 and specifies the logical expression 15081 (hereinafter, described as a representative example flowchart in the description of FIG. 27) corresponding to the specified flow ID 15097 (S9020).

Next, the rule management unit 120 determines whether or not the flow ID is included in the specified flowchart (S9030).

If the determination result of S9030 is true (S9030: Yes), the rule management unit 120 extracts the flowchart corresponding to the included flow ID from the flow table 1508 (S9040), and extracts the extracted flowchart from S9020. One flowchart is generated by merging with the flowchart specified in (S9500).

On the other hand, if the determination result of S9030 is false (S9030: No), the rule management unit 120 returns the flowchart (the flowchart generated in S9050 or the flowchart specified in S9020).

Hereinafter, an example of the transition of the flow editor screen 60 will be described with reference to FIGS. 28 to 32. In the following description, the procedure with the procedure ID “M” (M is a natural number) is referred to as “procedure M”. The abstract procedure with the abstract procedure ID "N" (N is a natural number) is called "abstract procedure N". The flowchart of the flow ID “P” (P is a natural number) is called “flow chart P”. Further, the display control of the flow editor screen 60 is performed by at least one of the flow editor 220 and the rule management unit 120 (specifically, for example, the rule management unit in response to a request from the flow editor 220). It is done by the flow editor 220 based on the information received from 120). Hereinafter, for the sake of simplicity, it is assumed that the display control of the flow editor screen 60 is performed by the rule management unit 120 through the flow editor 220. The display control may be performed by the flow editor 220 referring to various tables managed by the management server 100.

Assume that there are exemplary steps 1 and 2 in FIG. The rule management unit 120 obtains abstract procedures 1 and 2 for procedures 1 and 2 via S1010 to S1030. Specifically, for example, it is as follows.
-"HostA" in the procedure 1 is abstracted to the condition type "SERVER_NAME_COND_1" in the abstract procedure 1. This is because it was determined that "HostA" corresponds to the server name (in the acquisition source column 15104 "server name"), and therefore the condition type 15101 "SERVER_NAME_COND_1" was presumed.
-"" XXX is an error "" in step 1 is abstracted to the condition type "MSG_COND_1" in abstract step 1. This is because it was determined that "" XXX is an error "" in step 1 corresponds to the message (in the acquisition source column 15104 "message"), and the condition type 15101 "MSG_COND_1" was presumed for the hot water.
-"No escalation" in procedure 1 is abstracted to the operation type "NO_ESCALATION" in abstract procedure 1. This is because "do not escalate" in step 1 corresponds to the operation expression 15112 "do not escalate".

Further, as shown in FIG. 28, the rule management unit 120 specifies that the abstract procedures 1 and 2 have an inclusion relationship with respect to the abstract procedures 1 and 2 through S101 to S1030. Specifically, the abstract procedure 2 is the parent abstract procedure of the abstract procedure 1. This is because the abstract procedure 2 has fewer conditions (condition nodes) than the abstract procedure 1.

Further, as shown in FIG. 28, the flow chart 2 is associated with the condition type 15101 “SERVER_NAME_COND_1”, and the flowchart 1 is associated with the condition type 15101 “MSG_COND_1”. Both flowcharts 2 and 1 are logical representations of conditional clauses.

According to the example of FIG. 28, as shown in FIG. 29, in the procedure list 221 the conversion order of the procedure 2 is ahead of the conversion order of the procedure 1. Specifically, the order of procedure 2 (conversion order) is "1", and the order of procedure 1 is "2". This is because the abstract procedure 2 is the parent abstract procedure of the abstract procedure 1.

First, as shown in FIG. 29, it is assumed that the operation manager selects step 2 in the order “1”. In this case, as shown in FIGS. 29 and 30, the rule management unit 120 displays the procedure 2 on the procedure display 222, and inputs the estimated flowchart 1 and the flowchart 4 corresponding to the selected procedure 2 to the flow input 223. It is displayed (note that the logical representation of the flowchart 4 illustrated in FIG. 30 is the logical representation after manual addition described later). Taking the display of Flowchart 1 as an example, it is as follows. That is, the rule management unit 120 specifies the abstract procedure 2 corresponding to the selected procedure 2. The rule management unit 120 specifies the condition type ID 15043 corresponding to the abstract procedure 2 from the abstract procedure table 1504. The rule management unit 120 specifies the flow ID 15106 corresponding to the specified condition type ID 15043 from the condition management table 1510. The rule management unit 120 identifies the logical expression 15081 corresponding to the specified flow ID 15106 from the flow table 1508, and displays the flowchart 1 (node) representing the specified logical expression 15081 on the flow input 223. At that time, the rule management unit 120 substitutes the parameter value “YYY alert” specified from the procedure 2 into the [variable] (parameter) in the logical expression 15081. As a result, a node (flow chart) having the expression "alert with MESSAGE = YYY" is displayed on the flow input 223.

After that, as shown in FIG. 30, the operation manager abstracted the non-abstracted portion “between 17:00 and 18:00” in step 2, and the expression “17:00 <= TIME and TIME <= 18: It is assumed that "00" is input to the flow input 223 and a save instruction is issued (for example, the "save" button 10 is clicked). Since the condition type corresponding to the expression is not in the condition type table 1510, the rule management unit 120 adds the condition type 15101 “TIME_COND_1” corresponding to the expression and the entry including the condition value to the condition type table 1510. Further, the rule management unit 120 adds a flowchart 3 (logical expression) corresponding to the expression to the flow table 1508. Further, the rule management unit 120 updates the flowchart 4 (logical expression) corresponding to the operation type. Further, the rule management unit 120 may update the procedure list (procedure order) on the flow editor screen by performing the similarity relationship extraction process, the inclusion relationship estimation process, and the procedure conversion order determination process.

Next, as shown in FIG. 31, it is assumed that the operation manager selects step 1 in the order “2”. In this case, as shown in FIG. 31, the rule management unit 120 displays the procedure 1 on the procedure display 222, and inputs the estimated flowcharts 1, 3 and 4 corresponding to the parent abstract procedure 2 of the abstract procedure 1 to the flow input 223. Display in. At that time, the rule management unit 120 substitutes the parameter value "XXX is an error" (parameter value corresponding to the condition type corresponding to the flowchart 1) specified from the procedure 1 into [variable] in the flowchart 1. Further, the rule management unit 120 sets the parameter values “12:00” and “12:30” (parameter values corresponding to the condition types corresponding to the flowchart 3) specified from the procedure 1 in the [variable] in the flowchart 3. substitute.

Further, as shown in FIG. 32, the rule management unit 120 displays the flowchart 2 corresponding to the condition type “SERVER_NAME_COND_1”, which is not included in the abstract procedure 2 among the condition types corresponding to the abstract procedure 1, in the flow input 223. .. At that time, the rule management unit 120 substitutes the parameter value “HostA” (parameter value corresponding to the condition type “SERVER_NAME_COND_1”) specified from the procedure 1 into [variable] in the flowchart 2 (logical expression).

As shown in FIG. 32, the operation manager manually connects the nodes (for example, connects the nodes with arrows) to complete the flowchart corresponding to the procedure 1.

According to FIGS. 31 and 32, the operation manager describes the procedure 1 corresponding to the child abstraction procedure 1 of the abstract procedure 2 (about the procedure 1 which is the next order of the procedure 2 corresponding to the registered flowchart). There is virtually no need to manually add or edit flowcharts. When the operation manager determines that the flowchart for step 1 is correct in the estimated flowchart (flow chart shown in FIG. 32), the operation manager issues a save instruction. In this case, the rule management unit 120 adds a new flowchart 5 (a new logical expression including the flow ID “2”) corresponding to the operation type to the flow table 1508.

Although one embodiment has been described above, this is an example for explaining the present invention, and the scope of the present invention is not limited to this embodiment. The present invention can also be implemented in various other forms.

For example, other methods such as deep learning may be adopted instead of morphological analysis.

Further, for example, the rule management unit 120 corresponds to the value in the configuration information 170 indicating the configuration of the target system 300, the first abstract procedure (abstract procedure corresponding to the first procedure), and the second abstract procedure (corresponding to the second procedure). If the words included in at least one of the above abstract procedures) are similar, the condition type for the word may be estimated based on the value in the configuration information 170.

Further, for example, the rule management unit 120 sets the value in the monitoring information 160 indicating the monitoring result of the target system 300, the first abstract procedure (abstract procedure corresponding to the first procedure), and the second abstract procedure (in the second procedure). If the words contained in at least one of the corresponding abstract procedures) are similar, the condition type for that word may be estimated based on the value in the monitoring information 160.

Further, for example, in the flow editor 220 (or the rule management unit 120), in the procedure list 221 the order of the second procedure corresponding to the second abstract procedure included in the first abstract procedure corresponds to the first abstract procedure. It may precede the order of the first procedure. Further, for example, the flow editor 220 (or the rule management unit 120) includes the second abstract procedure in the third abstract procedure corresponding to the third procedure in the procedure manual 1501 (plural steps). , When the 1st abstract procedure and the 3rd abstract procedure are not inclusive, in the procedure list 221, the smaller number of condition types among the 1st abstract procedure and the 3rd abstract procedure among the 1st procedure and the 3rd procedure. The order of the procedure corresponding to the abstract procedure of may come first. By converting the procedure into a flowchart in such an order, it is expected that the input work load on the operation manager will be reduced.

100 ... management server, 200 ... management client, 300 ... target system

Claims (13)

An interface unit that includes one or more interface devices,
A storage unit containing one or more memories,
It has an interface unit and a processor unit which is one or more processors connected to the storage unit.
The processor section
Received the selection of the first procedure from the procedure manual that includes multiple procedures related to the operation of the operation target
Based on the abstract structure in which the second abstract procedure included in the first abstract procedure corresponding to the first procedure is structured and the first procedure, at least a part of the first procedure is structured. Display the estimated structure that is an abstraction,
Operations support system. Each of the plurality of steps comprises one or more natural sentences.
The first abstract procedure is a common pattern in the first procedure set, which is one or more procedures having a similar relationship including the first procedure.
The second abstract procedure is a common pattern in the second procedure set, which is one or more procedures having a similar relationship including the second procedure.
The operation support system according to claim 1. The processor section
The first abstract procedure, which is a common pattern extracted from the first procedure set, is generated.
The second abstract procedure, which is a common pattern extracted from the second procedure set, is generated.
Judging whether or not the first abstract procedure and the second abstract procedure have an inclusive relationship,
When it is determined that the second abstract procedure is included in the first abstract procedure, the abstract structure which is a structure of the common part between the second abstract procedure and the first abstract procedure is generated. To do
The operation support system according to claim 2. The abstract structure is a logical representation including parameters.
The estimated structure is a logical expression in which the parameter values in the first procedure are substituted for the parameters of the abstract structure.
The operation support system according to claim 2. When the processor unit has a part of the first abstract procedure that is not common to the second abstract procedure and specifies a logical expression for the part that is not common, the second abstract procedure and the first abstract procedure An estimated common logical expression that is a logical expression in which the parameter value in the first procedure is assigned to the logical expression of the common part, and a logic in which the parameter value in the first procedure is assigned to the logical expression of the non-common part. Display the estimated difference logical representation, which is the representation,
The operation support system according to claim 4. The determination as to whether or not the first abstract procedure and the second abstract procedure have an inclusive relationship is a determination made when the first abstract procedure and the second abstract procedure are similar to each other. According to the condition type and the number of conditional expressions in the first abstract procedure and the condition type and the number of conditional expressions in the second abstract procedure.
The operation support system according to claim 3. When the value in the configuration information indicating the configuration of the operation target is similar to the word contained in at least one of the first abstract procedure and the second abstract procedure, the processor unit is included in the configuration information. Estimate the condition type for the word based on the above value of
The operation support system according to claim 6. When the value in the monitoring information regarding the monitoring result of the operation target is similar to the word contained in at least one of the first abstract procedure and the second abstract procedure, the processor unit is in the monitoring information. Estimate the condition type for the word based on the above value of
The operation support system according to claim 6. When the processor unit has a part of the first abstract procedure that is not common to the second abstract procedure and a logical expression for the part that is not common is not found.
The common as a logical expression added to the presumed common logical expression, which is a logical expression in which the parameter value in the first procedure is assigned to the logical expression of the common part of the second abstract procedure and the first abstract procedure. In response to the difference logical expression, which is the logical expression in which the parameter value in the first procedure is assigned to the logical expression of the part that does not
Register the abstract difference logic expression in which the parameter value assigned from the difference logic expression is replaced with the parameter.
The operation support system according to claim 4. The processor unit displays a list of procedures and displays a list of procedures.
In the procedure list, the order of the second procedure corresponding to the second abstract procedure included in the first abstract procedure is earlier than the order of the first procedure.
The operation support system according to claim 1. When the second abstract procedure is included in the third abstract procedure corresponding to the third procedure among the plurality of procedures, and the first abstract procedure and the third abstract procedure are not in an inclusion relationship. In the procedure list, of the first procedure and the third procedure, the procedure corresponding to the abstract procedure having the smaller number of condition types among the first abstract procedure and the third abstract procedure is in order. Beyond,
The operation support system according to claim 10. Received the selection of the first procedure from the procedure manual that includes multiple procedures related to the operation of the operation target
Based on the abstract structure in which the second abstract procedure included in the first abstract procedure corresponding to the first procedure is structured and the first procedure, at least a part of the first procedure is structured. Display the estimated structure that is an abstraction,
Operation support method. Received the selection of the first procedure from the procedure manual that includes multiple procedures related to the operation of the operation target
Based on the abstract structure in which the second abstract procedure included in the first abstract procedure corresponding to the first procedure is structured and the first procedure, at least a part of the first procedure is structured. Display the estimated structure that is an abstraction,
A computer program that lets one or more calculators do things.