JP2021182313A - Detection method, and detection program - Google Patents

Abstract

To facilitate grasping a use state of a resource for a business processing unit.SOLUTION: A detection apparatus sets, based on operation data and log data, a scope starting from an event occurrence log time determined as possible starting point of business processing indicating time when some event occurs. For example, in a graph 1500, a time range indicated by a broken line is set as the scope. The graph 1500 indicates the operation data. The detection apparatus detects, for example, change time when an index value is increased by a certain value or larger based on the operation data. The detection apparatus specifies contents of some event which occurred at the time corresponding to the detected change time. The detection apparatus determines an event occurrence log time indicating occurrence time of the event having the specified contents as possible starting point of the business processing to employ it as a scope starting point.SELECTED DRAWING: Figure 15

Description

The present invention relates to a detection method and a detection program.

Conventionally, it may be desired to analyze how much the resources of a device are used in each business process of a plurality of business processes executed by using a device such as a server. For example, in each business process, the device resource is used in the past as a standard for simulating how much the device resource will be used in each business process according to the future business volume predicted by the user. It is desirable to analyze how much it has been used.

Prior art, for example, calculates a solution of an optimization problem that minimizes the sum of the physical resources of a plurality of physical machines to which a virtual machine is assigned as an objective function, and derives an arrangement configuration. Further, for example, a technique for encoding the fluctuation direction of the load of a plurality of tasks, calculating the code product, and performing a chi-square test on the code product to determine whether or not there is a correlation in the fluctuation direction of the load. There is.

Japanese Unexamined Patent Publication No. 2012-159928 Japanese Unexamined Patent Publication No. 2014-078160

However, with the prior art, it is difficult to analyze how much equipment resources have been used in the past for each business processing unit. For example, when a plurality of business processes are executed using one device, the component values corresponding to each business process are integrated in the index value indicating the resource usage status of one device. Therefore, it is not possible to analyze the index value indicating the resource usage status of one device in the business processing unit.

In one aspect, it is an object of the present invention to make it easy to grasp the resource usage status in each business processing unit.

According to one embodiment, data indicating a time change of an index value indicating a resource usage status in a certain period is acquired, and based on the acquired data, a change time point of the index value satisfying a predetermined condition is detected. Then, a detection method and a detection program for setting a plurality of time zones for analyzing the similarity of the change tendency of the index value in the period based on the detected change time point are proposed.

According to one aspect, it becomes possible to easily grasp the resource usage status in each business processing unit.

FIG. 1 is an explanatory diagram showing an embodiment of a detection method according to an embodiment. FIG. 2 is an explanatory diagram showing an example of the business processing system 200. FIG. 3 is a block diagram showing a hardware configuration example of the detection device 100. FIG. 4 is an explanatory diagram showing an example of the stored contents of the operation table 400. FIG. 5 is an explanatory diagram showing an example of the stored contents of the scope unit table 500. FIG. 6 is an explanatory diagram showing an example of the stored contents of the vector table 600. FIG. 7 is an explanatory diagram showing an example of the stored contents of the component table 700. FIG. 8 is an explanatory diagram showing an example of the stored contents of the weight table 800. FIG. 9 is an explanatory diagram showing an example of the stored contents of the separation result table 900. FIG. 10 is an explanatory diagram showing an example of the stored contents of the log table 1000. FIG. 11 is an explanatory diagram showing an example of the stored contents of the extraction table 1100. FIG. 12 is a block diagram showing a hardware configuration example of the administrator-side device 202. FIG. 13 is a block diagram showing a functional configuration example of the detection device 100. FIG. 14 is a block diagram showing a specific functional configuration example of the detection device 100 in the operation example 1. FIG. 15 is an explanatory diagram (No. 1) showing the flow of operation of the detection device 100. FIG. 16 is an explanatory diagram (No. 2) showing the flow of operation of the detection device 100. FIG. 17 is an explanatory diagram (No. 1) showing an operation example 1 of the detection device 100. FIG. 18 is an explanatory diagram (No. 2) showing an operation example 1 of the detection device 100. FIG. 19 is an explanatory diagram (No. 3) showing an operation example 1 of the detection device 100. FIG. 20 is an explanatory diagram (No. 4) showing an operation example 1 of the detection device 100. FIG. 21 is an explanatory diagram (No. 5) showing an operation example 1 of the detection device 100. FIG. 22 is an explanatory diagram (No. 6) showing an operation example 1 of the detection device 100. FIG. 23 is an explanatory diagram (No. 7) showing an operation example 1 of the detection device 100. FIG. 24 is an explanatory diagram (No. 8) showing an operation example 1 of the detection device 100. FIG. 25 is an explanatory diagram (No. 9) showing an operation example 1 of the detection device 100. FIG. 26 is an explanatory diagram (No. 10) showing an operation example 1 of the detection device 100. FIG. 27 is an explanatory diagram (No. 11) showing an operation example 1 of the detection device 100. FIG. 28 is a flowchart showing an example of the overall processing procedure in the operation example 1. FIG. 29 is a block diagram showing a specific functional configuration example of the detection device 100 in the operation example 2. FIG. 30 is an explanatory diagram showing an operation example 2 of the detection device 100. FIG. 31 is a flowchart showing an example of the overall processing procedure in the operation example 2.

Hereinafter, the detection method according to the present invention and the embodiment of the detection program will be described in detail with reference to the drawings.

(Example of detection method according to the embodiment)
FIG. 1 is an explanatory diagram showing an embodiment of a detection method according to an embodiment. The detection device 100 is a business processing unit executed by using one or more devices included in the business processing system, and is a computer capable of outputting information regarding the resources of each device.

Here, the business processing system is, for example, an ICT (Information and Communication Technology) system. The device is, for example, an ICT device. The device is, for example, a server. A resource is, for example, a resource that forms an infrastructure. The resources are, for example, a CPU, a memory, a communication band, and the like. The business process is, for example, a series of processes realized by executing one or more processes on one or more devices.

The administrator of the ICT system may want to perform a simulation of resource usage at the time of executing a plurality of business processes in the ICT system.

The manager may consider performing a simulation, for example, in order to estimate the number of devices required when the business volume of business processing increases in the future. In addition, the administrator may consider performing a simulation, for example, in order to identify a resource that becomes a bottleneck for improving the performance of the business process when the business volume of the business process increases in the future.

In addition, the manager may consider performing a simulation, for example, when the amount of work suddenly increases and it is difficult to verify the actual machine. In addition, the administrator may want to perform a simulation to analyze the pattern of time change of resource usage that may occur in addition to the pattern of time change of resource usage during the assumed operation. ..

Therefore, as a criterion for simulation, it is desirable to specify how much equipment resources are used in each business process.

Here, if it is possible to measure the index value indicating the resource usage status at the time of independent execution of each business process and specify how much the resource is used in each business process, a simulation is performed. be able to.

However, it is difficult to measure the index value indicating the actual usage status of the resource at the time of independent execution of each business process, and to specify how much the resource is used in each business process.

For example, in an actual business processing system, a plurality of business processes tend to be executed at the same time, and a plurality of business processes may be executed using one device. Specifically, it is conceivable that one device may execute a process of accepting queries to the database from a plurality of business processes. In this case, since the component values corresponding to each business process are integrated in the index value indicating the resource usage status of one device, the resource usage status at the time of independent execution of each business process is represented. It is not possible to measure the index value.

On the other hand, for example, a method of performing component decomposition on time-series data indicating a time change of an index value indicating the usage status of the resource of the device can be considered. Specifically, by decomposing the time-series data into one or more component data that are the elements that form the time-series data by component decomposition, we try to specify how much resources are used in each business processing unit. Try.

In this method, it may be difficult to specify how much resources are used in each business processing unit even if the decomposed component data is referred to.

For example, it is not possible to specify a combination of component data corresponding to one business process from one or more component data for each device resource, and it is possible to specify how much resources are used in each business process. Can't. Specifically, since the time series data related to different resources are divided according to different criteria, the correspondence relationship of the component data between the resources is unknown, and the combination of the component data of different resources is associated with one business process. I can't. Further, for example, if the resource usage tendency is similar between business processes, data related to a plurality of business processes may be integrated in the component data divided from the time series data related to the resources.

On the other hand, it is conceivable to use the nature of business processing to specify the component values for the number of business processing among the index values indicating the usage status of the resource of the device. In this method, for example, the entire index value representing the resource usage status of the device is divided into a plurality of component values based on the change tendency of the index value representing the resource usage status of the device in time series. The nature of business processing is, for example, the first property that the business volume of business processing shows a periodic change tendency at regular time intervals such as day, week, or month, and the business volume of each business processing. The second property is that the usage status of each resource is determined based on the above.

This method has a problem that it is difficult to apply it to an environment in which business processing is performed irregularly. For example, in this method, since the business process is performed irregularly, the first property is that the business volume of the business process shows a periodic change tendency at regular time intervals such as day, week, or month. Difficult to apply to environments that are difficult to appear.

On the other hand, a time domain that is not a day, week, or month is adopted as the scope that is the decomposition unit, and while moving the scope by a small width, the time change of the index value that indicates the resource usage status of the equipment is changed. A method for analyzing the time-series data shown can be considered. In this method, let's specify how much resources are used in each business processing unit by using the similarity of the change tendency of the index value indicating the usage status of the resource of the device in each scope of two or more time points. Attempt.

In this method, the smaller the width of moving the scope, the larger the amount of processing. On the other hand, as the width to move the scope is increased, the accuracy of analyzing the time-series data indicating the time-dependent change of the index value indicating the usage status of the resource of the device is lowered, and the resource is selected in the business processing unit. It becomes difficult to specify how much to use.

Therefore, in the present embodiment, by outputting information about the resources of each device in the business processing unit, it is possible for the administrator to easily grasp the usage status of the resources of each device in the business processing unit. The detection method that can be performed will be described.

In the example of FIG. 1, (1-1) the detection device 100 acquires data indicating a time change of an index value indicating a resource usage status in a certain period. The data is, for example, time-series data in which index values representing the resource usage status at the time point are associated with each time point. Graph 101 in FIG. 1 is a graph showing the time change of the index value showing the resource usage status.

(1-2) The detection device 100 detects the time point of change of the index value satisfying a predetermined condition based on the acquired data. For the method of detecting the time of change, for example, Patent Document (International Publication No. 2016/111240) and the like can be referred to. The predetermined condition is, for example, that the index value increases by a certain amount or more. The detection device 100 detects, for example, change time points 110 and 120 in which the index value increases by a certain amount or more based on the acquired data.

(1-3) The detection device 100 sets a plurality of time zones for analyzing the similarity of the change tendency of the index value within a certain period based on the detected change time point. The time zone is set as the scope to be analyzed. For example, the detection device 100 sets a time zone 111 starting from the change time point 110 and a time zone 121 starting from the change time point 120 in a certain period as an analysis target.

(1-4) The detection device 100 extracts partial data indicating the time change of the index value in each of the set plurality of time zones from the acquired data. For example, the detection device 100 includes partial data indicating the time change of the index value in the time zone 111 starting from the change time point 110 and the time of the index value in the time zone 121 starting from the change time point 120 among the acquired data. Extract the partial data showing the change.

(1-5) The detection device 100 carries out an analysis process based on the extracted partial data. The analysis process is a series of processes for analyzing the similarity of the change tendency of the index value in a plurality of set time zones. By analyzing the similarity of the index value change tendency in multiple time zones, the analysis process identifies the change tendency of the component value indicating the resource usage status of the business processing unit, which appears in common in multiple time zones. It is a series of processes to be performed. The detection device 100 acquires data indicating a time change of a component value representing a resource usage status of a business processing unit, which appears in common in a plurality of time zones by analysis processing. Specific examples of the analysis process will be described later with reference to FIGS. 16 to 26, for example.

(1-6) The detection device 100 outputs the execution result of the analysis process. The detection device 100 outputs, for example, data indicating a time change of a component value representing a resource usage status of a business processing unit, which appears in common in a plurality of time zones. Specifically, the detection device 100 graphs and outputs the time change of the component value representing the usage status of the resource of the business processing unit.

As a result, the detection device 100 can output information regarding the resource usage status of each device in business processing units. Therefore, the detection device 100 makes it easy for the administrator to grasp the resource usage status of each device in the business processing unit. Then, the detection device 100 can enable the administrator to carry out a simulation in order to estimate the number of devices required when the business volume of business processing increases in the future.

The detection device 100 can be applied to an environment in which it is difficult to measure an index value indicating the actual usage status of resources at the time of independent execution of business processing. It is possible to easily grasp the resource usage status of each device. The detection device 100 can be applied to an environment in which business processing is performed irregularly, and even in such an environment, the administrator can easily grasp the resource usage status of each device for each business processing unit. Can be done.

The detection device 100 can suppress an increase in the number of time zones to be scoped. Therefore, the detection device 100 analyzes the time-series data indicating the time-series change of the index value indicating the usage status of the resource of the device while moving the time domain to be the scope by a minute width, as compared with the method of analyzing the processing amount. It is possible to suppress the increase. Further, the detection device 100 can suppress a decrease in the accuracy of analyzing data indicating a time change of an index value indicating the usage status of the resource of the device.

Here, the case where the detection device 100 performs the analysis process has been described, but the present invention is not limited to this. For example, the detection device 100 may set a plurality of time zones as the scope to be analyzed, and another computer may perform the analysis process based on the set plurality of time zones. Further, for example, the administrator may perform the analysis process based on a plurality of set time zones.

(Example of business processing system 200)
Next, an example of the business processing system 200 to which the detection device 100 shown in FIG. 1 is applied will be described with reference to FIG.

FIG. 2 is an explanatory diagram showing an example of the business processing system 200. In FIG. 2, the transaction processing system 200 includes a detection device 100, one or more transaction processing devices 201, and one or more administrator-side devices 202.

In the business processing system 200, the detection device 100 and the business processing device 201 are connected via a wired or wireless network 210. The network 210 is, for example, a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, and the like. Further, in the transaction processing system 200, the detection device 100 and the administrator side device 202 are connected via a wired or wireless network 210.

The detection device 100 is a business processing unit executed by using one or more resources of one or more devices included in the business processing system 200, and outputs information regarding the resource usage status of each device. The detection device 100 outputs, for example, time-series data indicating the time change of the component value indicating the usage status of the resource of each device in the business processing unit. The output destination is, for example, the administrator-side device 202.

Specifically, the detection device 100 has various tables described later in FIGS. 4 to 11. Specifically, the detection device 100 communicates with the business processing device 201 and acquires the entire operation data. More specifically, the detection device 100 collects index values representing the resource usage status of the business processing device 201 at a predetermined timing, and generates overall operation data summarizing the collected index values. The index value is, for example, the load amount of the resource. The index value is, for example, the amount of resources used. The entire operation data is stored, for example, by using the operation table 400 described later in FIG.

Specifically, the detection device 100 may communicate with the business processing device 201 and acquire log data recording the contents of the event generated in the business processing and the time of occurrence. More specifically, the detection device 100 collects the contents and the time of occurrence of the event generated in the business processing device 201 at a predetermined timing, and generates log data summarizing the contents of the collected events and the time of occurrence. The log data is stored, for example, using the log table 1000 described later in FIG.

Specifically, the detection device 100 sets a plurality of time zones to be the scope of the analysis target based on the entire operation data. The scope is, for example, a time zone of a predetermined length. More specifically, the detection device 100 detects a change time point of the index value based on the entire operation data, and sets a plurality of time zones to be analyzed based on the change time point. Specifically, the detection device 100 may set a plurality of time zones to be the scope of the analysis target based on the entire operation data and the log data.

Specifically, the detection device 100 divides the entire operation data into scope units. Specifically, the scope unit operation data divided for each scope is stored using the scope unit table 500 described later in FIG. Specifically, the detection device 100 vectorizes the scope unit operation data divided for each scope and generates a vector for each scope. Specifically, the vector of each scope is stored using the vector table 600 described later in FIG.

Specifically, the detection device 100 generates an operation data matrix including a vector of each scope as a column. Specifically, the detection device 100 performs non-negative matrix factorization on the generated operation data matrix based on the number of basis to generate a basis matrix and a weight matrix. Specifically, the basis matrix is stored using the component table 700 described later in FIG. 7. Specifically, the weight matrix is stored using the weight table 800 described later in FIG. The weighting coefficient forming the weighting matrix corresponds to an index value indicating the amount of work of business processing. For the non-negative matrix factorization, for example, the following Non-Patent Document 1 can be referred to.

Non-Patent Document 1: Hoyer, Patrik O. et al. "Non-negate machine learning factorints." Journal of machine learning recess 5. Nov (2004): 1457-1469.

Specifically, the detection device 100 separates one or more component values in the business processing unit included in the basis vector corresponding to the business processing unit included in the basis matrix for each resource. Specifically, the separated results are stored using the separation result table 900 described later in FIG. The detection device 100 may analyze the long-term change tendency of the usage status for each resource in the business processing unit based on the weight vector corresponding to the business processing unit included in the weight matrix.

The detection device 100 outputs the result of separating one or more component values for each resource in the business processing unit and the result of analyzing the long-term change tendency of the usage status for each resource in association with each other. The output destination is, for example, the administrator-side device 202. The detection device 100 is, for example, a server, a PC (Personal Computer), or the like.

The business processing device 201 is a computer for executing business processing and realizing a service. For example, the service is realized by sharing the business processing forming the service by the service execution platform 220 that collects the business processing devices 201. The service may be formed by only one business process. Business processing is, for example, a process. The business processing apparatus 201 executes, for example, any one or more processes forming a service. Further, the business processing device 201 has one or more resources, and periodically measures and stores an index value indicating the usage status of each resource, and transmits the index value to the detection device 100. The business processing device 201 is, for example, a server, a PC, or the like.

The administrator-side device 202 is a computer used by the administrator of the business processing system 200. The administrator-side device 202 receives information on the resource usage status of each device from the detection device 100 in business processing units. The administrator-side device 202 outputs the received information. The output format is, for example, display on a display, print output to a printer, transmission to an external device, or storage in a storage area. The administrator-side device 202 is, for example, a PC, a tablet terminal, a smartphone, or the like.

Here, the case where the business processing system 200 includes one detection device 100 has been described, but the present invention is not limited to this. For example, the business processing system 200 may include a plurality of detection devices 100. Then, a plurality of detection devices 100 may cooperate to realize the above-mentioned various processes.

Further, although the case where the detection device 100 is a device different from the business processing device 201 has been described here, the present invention is not limited to this. For example, the detection device 100 may be integrated with any business processing device 201. Further, here, the case where the detection device 100 is a device different from the administrator side device 202 has been described, but the present invention is not limited to this. For example, the detection device 100 may be integrated with the administrator-side device 202.

(Hardware configuration example of detection device 100)
Next, a hardware configuration example of the detection device 100 will be described with reference to FIG.

FIG. 3 is a block diagram showing a hardware configuration example of the detection device 100. In FIG. 3, the detection device 100 includes a CPU (Central Processing Unit) 301, a memory 302, a network I / F (Interface) 303, a recording medium I / F 304, and a recording medium 305. Further, each component is connected by a bus 300.

Here, the CPU 301 controls the entire detection device 100. The memory 302 includes, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), a flash ROM, and the like. Specifically, for example, a flash ROM or ROM stores various programs, and RAM is used as a work area of CPU 301. The program stored in the memory 302 is loaded into the CPU 301 to cause the CPU 301 to execute the coded process.

The network I / F 303 is connected to the network 210 through a communication line, and is connected to another computer via the network 210. The network I / F 303 controls an internal interface with the network 210 and controls the input / output of data from another computer. The network I / F 303 is, for example, a modem, a LAN adapter, or the like.

The recording medium I / F 304 controls read / write of data to the recording medium 305 according to the control of the CPU 301. The recording medium I / F 304 is, for example, a disk drive, an SSD (Solid State Drive), a USB (Universal Serial Bus) port, or the like. The recording medium 305 is a non-volatile memory that stores data written under the control of the recording medium I / F 304. The recording medium 305 is, for example, a disk, a semiconductor memory, a USB memory, or the like. The recording medium 305 may be detachable from the detection device 100.

The detection device 100 may include, for example, a keyboard, a mouse, a display, a printer, a scanner, a microphone, a speaker, and the like, in addition to the above-mentioned components. Further, the detection device 100 may have a plurality of recording media I / F 304 and recording media 305. Further, the detection device 100 does not have to have the recording medium I / F 304 or the recording medium 305.

(Memory contents of the operation table 400)
Next, an example of the stored contents of the operation table 400 will be described with reference to FIG. The operation table 400 is realized, for example, by a storage area such as a memory 302 or a recording medium 305 of the detection device 100 shown in FIG.

FIG. 4 is an explanatory diagram showing an example of the stored contents of the operation table 400. As shown in FIG. 4, the operation table 400 has fields for a server name, a date and time, and one or more resources. Records 400-a are stored in the operation table 400 by setting information in each field. a is an arbitrary integer.

In the server name field, the server name is set as the identification information for identifying the business processing device 201. In the date / time field, a combination of the date and the time when the index value indicating the resource usage status is measured by the business processing apparatus 201 is set. In the resource field, an index value indicating the resource usage status is set. The index value is, for example, the load amount of the resource. The index value is, for example, the amount of resources used.

The resource fields include, for example, a CPU usage rate [%] field and a disk IO (Input / Output) [IOPS (Input / Output Per Second)] field. In the field of the CPU usage rate [%], the CPU usage rate [%], which is an index value indicating the usage status of the CPU in the business processing device 201, is set. In the field of the disk IO [IOPS], the disk IO [IOPS], which is an index value indicating the usage status of the recording medium in the business processing apparatus 201, is set. The resource field may be, for example, a memory usage rate [%] field.

(Stored contents of scope unit table 500)
Next, an example of the stored contents of the scope unit table 500 will be described with reference to FIG. The scope unit table 500 is realized, for example, by a storage area such as a memory 302 or a recording medium 305 of the detection device 100 shown in FIG.

FIG. 5 is an explanatory diagram showing an example of the stored contents of the scope unit table 500. As shown in FIG. 5, the scope unit table 500 has fields for a server name, a date and time, and one or more resources. Records 500-b are stored in the scope unit table 500 by setting information in each field. b is an arbitrary integer.

The record of the scope unit table 500 is a record for one scope extracted from the record of the operation table 400 shown in FIG. Therefore, the same information as each field of the operation table 400 shown in FIG. 4 is set in each field of the scope unit table 500. Further, a combination of the date and time in the scope is set in the date and time field of the scope unit table 500.

(Memory contents of vector table 600)
Next, an example of the stored contents of the vector table 600 will be described with reference to FIG. The vector table 600 is realized, for example, by a storage area such as a memory 302 or a recording medium 305 of the detection device 100 shown in FIG.

FIG. 6 is an explanatory diagram showing an example of the stored contents of the vector table 600. As shown in FIG. 6, the vector table 600 has a field of operation data for each scope. The vector table 600 stores records 600-c by setting information in each field. c is an arbitrary integer.

In the field of operation data for each scope, a vector element obtained by vectorizing the operation data for each scope divided for each scope from the entire operation data is set. The vector element obtained by vectorizing the scope unit operation data is each of one or more index values representing the usage status of each of the one or more resources indicated by the scope unit operation data.

(Memory content of component table 700)
Next, an example of the stored contents of the component table 700 will be described with reference to FIG. 7. The component table 700 is realized, for example, by a storage area such as a memory 302 or a recording medium 305 of the detection device 100 shown in FIG.

FIG. 7 is an explanatory diagram showing an example of the stored contents of the component table 700. As shown in FIG. 7, the component table 700 has one or more component fields. Records 700-d are stored in the component table 700 by setting information in each field. d is an arbitrary integer.

In the component field, the component data for each resource indicated by the basis vector included in the basis matrix obtained by performing non-negative matrix factorization on the operating data matrix is set. Component data is a set of component values for a resource. In the component field, for example, each of one or more component values indicated by the basis vector included in the basis matrix obtained by performing non-negative matrix factorization on the working data matrix is set.

(Stored contents of weight table 800)
Next, an example of the stored contents of the weight table 800 will be described with reference to FIG. The weight table 800 is realized, for example, by a storage area such as a memory 302 or a recording medium 305 of the detection device 100 shown in FIG.

FIG. 8 is an explanatory diagram showing an example of the stored contents of the weight table 800. As shown in FIG. 8, the weight table 800 has fields for a component ID, a scope, and a weighting factor. The weight table 800 stores records 800-e by setting information in each field. e is an arbitrary integer.

In the component ID field, the component data for each resource, which is the destination of the weighting coefficient, which is an element of the weight vector included in the weight matrix obtained by performing non-negative matrix factorization on the operating data matrix, is stored. A component ID for identifying the indicated basis vector is set. Component data is a set of component values for a resource. The component ID is a column number of the component field of the component table 700 in which the component data for each resource indicated by the basis vector is set.

In the scope field, a combination of date and time for identifying when the weight indicated by the weighting coefficient, which is an element of the weight vector, corresponds to the business volume of the business processing is set in the scope unit. The weighting factor, which is an element of the weighting vector, is set in the weighting factor field. The weighting coefficient indicates a coefficient corresponding to the business amount of the business processing as the weight of the business processing.

(Stored contents of separation result table 900)
Next, an example of the stored contents of the separation result table 900 will be described with reference to FIG. 9. The separation result table 900 is realized, for example, by a storage area such as a memory 302 or a recording medium 305 of the detection device 100 shown in FIG.

FIG. 9 is an explanatory diagram showing an example of the stored contents of the separation result table 900. As shown in FIG. 9, the separation result table 900 has fields of a component ID, a server name, a sampling time, and one or more resources. Records 900-f are stored in the separation result table 900 by setting information in each field.

The component ID field includes the component data for each resource, and the component ID for identifying the basis vector that is the separation source of the component data for each resource is set. Component data is a set of component values for a resource. In the server name field, a server name indicating which business processing apparatus 201 the component value separated from the set of component values indicated by the basis vector is related to is set.

In the field at the time of sampling, a time indicating when the component value separated from the set of component values indicated by the basis vector is set in the scope unit is set. In the resource field, a component value indicating the usage status of any resource, which is separated from the set of component values indicated by the basis vector, is set.

The resource fields include, for example, a CPU usage rate [%] field and a disk IO (Input / Output) [IOPS (Input / Output Per Second)] field. In the field of the CPU usage rate [%], the CPU usage rate [%], which is an index value indicating the usage status of the CPU in the business processing device 201, is set. In the field of the disk IO [IOPS], the disk IO [IOPS], which is an index value indicating the usage status of the recording medium in the business processing apparatus 201, is set. The resource field may be, for example, a memory usage rate [%] field.

(Stored contents of log table 1000)
Next, an example of the stored contents of the log table 1000 will be described with reference to FIG. The log table 1000 is realized, for example, by a storage area such as a memory 302 or a recording medium 305 of the detection device 100 shown in FIG.

FIG. 10 is an explanatory diagram showing an example of the stored contents of the log table 1000. As shown in FIG. 10, the log table 1000 has fields for a server name, a date and time, and a log message. The log table 1000 stores records 1000-g by setting information in each field.

In the server name field, the server name is set as the identification information for identifying the business processing device 201. In the date / time field, a combination of a date and a time indicating an event occurrence time in the business processing apparatus 201 is set. In the log message field, a log message indicating the content of the event generated in the business processing device 201 is set.

(Stored contents of extraction table 1100)
Next, an example of the stored contents of the extraction table 1100 will be described with reference to FIG. The extraction table 1100 is realized, for example, by a storage area such as a memory 302 or a recording medium 305 of the detection device 100 shown in FIG.

FIG. 11 is an explanatory diagram showing an example of the stored contents of the extraction table 1100. As shown in FIG. 11, the extraction table 1100 has fields for a server name and a log message. The extraction table 1100 stores records 1100-h by setting information in each field.

In the server name field, the server name is set as the identification information for identifying the business processing device 201. In the log message field, a log message indicating the content of the event that is an index for setting the scope among the events that have occurred in the business processing apparatus 201 is set.

(Hardware configuration example of business processing device 201)
Since the hardware configuration example of the business processing device 201 is the same as the hardware configuration example of the detection device 100 shown in FIG. 3, the description thereof will be omitted.

(Hardware configuration example of device 202 on the administrator side)
Next, a hardware configuration example of the administrator-side device 202 included in the business processing system 200 shown in FIG. 2 will be described with reference to FIG.

FIG. 12 is a block diagram showing a hardware configuration example of the administrator-side device 202. In FIG. 12, the administrator-side device 202 includes a CPU 1201, a memory 1202, a network I / F 1203, a recording medium I / F 1204, a recording medium 1205, a display 1206, and an input device 1207. Further, each component is connected by a bus 1200.

Here, the CPU 1201 controls the entire control of the administrator-side device 202. The memory 1202 includes, for example, a ROM, a RAM, a flash ROM, and the like. Specifically, for example, a flash ROM or ROM stores various programs, and RAM is used as a work area of CPU 1201. The program stored in the memory 1202 is loaded into the CPU 1201 to cause the CPU 1201 to execute the coded process.

The network I / F 1203 is connected to the network 210 through a communication line, and is connected to another computer via the network 210. Then, the network I / F 1203 controls the internal interface with the network 210 and controls the input / output of data from another computer. The network I / F 1203 is, for example, a modem, a LAN adapter, or the like.

The recording medium I / F 1204 controls read / write of data to the recording medium 1205 according to the control of the CPU 1201. The recording medium I / F 1204 is, for example, a disk drive, an SSD, a USB port, or the like. The recording medium 1205 is a non-volatile memory that stores data written under the control of the recording medium I / F 1204. The recording medium 1205 is, for example, a disk, a semiconductor memory, a USB memory, or the like. The recording medium 1205 may be detachable from the administrator-side device 202.

The display 1206 displays data such as documents, images, and functional information, as well as cursors, icons, and toolboxes. The display 1206 is, for example, a CRT (Cathode Ray Tube), a liquid crystal display, an organic EL (Electroluminescence) display, or the like. The input device 1207 has keys for inputting characters, numbers, various instructions, and the like, and inputs data. The input device 1207 may be a keyboard, a mouse, or the like, or may be a touch panel type input pad, a numeric keypad, or the like.

The administrator-side device 202 may include, for example, a printer, a scanner, a microphone, a speaker, and the like, in addition to the above-mentioned components. Further, the administrator-side device 202 may have a plurality of recording media I / F 1204 and recording media 1205. Further, the administrator-side device 202 does not have to have the recording medium I / F 1204 or the recording medium 1205.

(Example of functional configuration of detection device 100)
Next, a functional configuration example of the detection device 100 will be described with reference to FIG.

FIG. 13 is a block diagram showing a functional configuration example of the detection device 100. The detection device 100 includes a storage unit 1300, an acquisition unit 1301, a detection unit 1302, a decomposition unit 1303, an integration unit 1304, an extraction unit 1305, a separation unit 1306, an analysis unit 1307, and an output unit 1308. include.

The storage unit 1300 is realized by, for example, a storage area such as the memory 302 or the recording medium 305 shown in FIG. Hereinafter, the case where the storage unit 1300 is included in the detection device 100 will be described, but the present invention is not limited to this. For example, the storage unit 1300 may be included in a device different from the detection device 100, and the stored contents of the storage unit 1300 may be visible from the detection device 100.

The acquisition unit 1301 to the output unit 1308 function as an example of the control unit. Specifically, the acquisition unit 1301 to the output unit 1308 may cause the CPU 301 to execute a program stored in a storage area such as the memory 302 or the recording medium 305 shown in FIG. 3, or the network I / F 303. To realize the function. The processing result of each functional unit is stored in a storage area such as the memory 302 or the recording medium 305 shown in FIG. 3, for example.

The storage unit 1300 stores various information referred to or updated in the processing of each functional unit. The storage unit 1300 stores, for example, time-series data indicating a time change of an index value indicating the usage status of each of one or more resources in a certain period.

The resources are, for example, a CPU, a memory, a communication band, and the like. The index value is, for example, the load amount or the usage amount of the resource. The index values are, for example, CPU usage rate, memory usage rate, disk IO, and the like. The time series data is included in the above-mentioned operation data, for example. Specifically, the storage unit 1300 stores the operation table 400 shown in FIG.

One or more resources may include, for example, different types of resources in the same device. The device is, for example, a business processing device 201. One or more resources may include, for example, resources in each of the different devices.

The storage unit 1300 stores, for example, log data recorded in association with the contents of each of a plurality of events that have occurred in a device having resources and the time of occurrence. The content is represented, for example, by a log message. Specifically, the storage unit 1300 stores the log table 1000 shown in FIG.

The storage unit 1300 stores the scope of the target for analyzing the similarity of the change tendency of the index value. The storage unit 1300 stores, for example, a plurality of time zones set as a scope. The time zone is, for example, a predetermined length. The time zone is set by, for example, the detection unit 1302.

The storage unit 1300 stores, for example, a matrix that is the target of non-negative matrix factorization. The matrix is generated, for example, based on time series data. Specifically, the matrix is generated based on the partial time-series data corresponding to the set scope of the time-series data. The matrix is generated, for example, by integration unit 1304.

The storage unit 1300 stores, for example, the basis matrix obtained as a result of non-negative matrix factorization. A basis matrix is a matrix that contains each of a predetermined number of basis vectors as columns or rows. The basis vector is a vector representing component data for each of one or more resources such that the change tendency in scope units is similar to each other. The component data is, for example, time-series data showing the time change of the component value in the scope unit.

The storage unit 1300 stores, for example, a weight matrix obtained as a result of non-negative matrix factorization. A weight matrix is a matrix containing each of a predetermined number of weight vectors as rows or columns. The weight vector is a vector representing the weight of business processing for each scope. The weight of the business process corresponds to, for example, the business volume of the business process. Specifically, the storage unit 1300 stores various tables shown in FIGS. 5 to 9.

The storage unit 1300 stores, for example, a predetermined number. The predetermined number is the base number. The number of basis determines the number of basis vectors contained in the basis matrix. The predetermined number is set based on the number of business processes executed using at least one of one or more resources. The predetermined number is set in advance by the administrator to be the same number as the number of business processes. Further, the predetermined number may be set based on the number of dimensions of the vector. For example, the predetermined number may be automatically set to the same number as the number of dimensions of the vector.

The acquisition unit 1301 acquires various information used for processing of each functional unit. The acquisition unit 1301 stores various acquired information in the storage unit 1300 or outputs it to each function unit. Further, the acquisition unit 1301 may output various information stored in the storage unit 1300 to each function unit. The acquisition unit 1301 acquires various information based on, for example, the operation input of the administrator. The acquisition unit 1301 may receive various information from a device different from the detection device 100, for example.

The acquisition unit 1301 acquires, for example, time-series data indicating a time change of an index value representing the usage status of each of one or more resources in a certain period. Specifically, the acquisition unit 1301 indicates operation data indicating a time change of an index value indicating the usage status of one or more resources for each business processing device 201 for a certain period from one or more business processing devices 201. By collecting and summarizing, the entire operation data is acquired.

The acquisition unit 1301 acquires log data recorded in association with the contents of each of the plurality of events that occurred in the device having the resource and the time of occurrence in a certain period. Specifically, the acquisition unit 1301 collects and summarizes correspondence information associated with the content of the event that occurred for each business processing device 201 and the time of occurrence for a certain period from one or more business processing devices 201. By doing so, log data is acquired.

The acquisition unit 1301 may accept a predetermined number by, for example, an operation input of an administrator. The predetermined number is the base number.

The acquisition unit 1301 may accept a start trigger to start processing of any of the functional units. The start trigger is, for example, that there is a predetermined operation input by the administrator. The start trigger may be, for example, the receipt of predetermined information from another computer. The start trigger may be, for example, that any functional unit outputs predetermined information.

The acquisition unit 1301 accepts, for example, the acquisition of time-series data as a start trigger for starting the processing of the detection unit 1302 to the analysis unit 1307. The acquisition unit 1301 accepts, for example, the acquisition of time-series data and log data as a start trigger for starting the processing of the detection unit 1302 to the analysis unit 1307.

The detection unit 1302 detects one or more time points of change in the index value satisfying a predetermined condition based on the acquired time-series data. The predetermined condition is, for example, that the index value has increased or decreased by a certain amount or more. The predetermined condition may be, for example, that the index value is out of the predetermined range. The detection unit 1302 detects one or more time points of change in which the index value increases by a certain amount or more based on the acquired time-series data.

Based on the acquired log data, the detection unit 1302 identifies the content of the event that occurred in the device at the time of occurrence corresponding to the detected change time point, and among a plurality of events, the time point of occurrence of the event corresponding to the specified content. May be specified by 1 or more.

The time of occurrence corresponding to the time of change is, for example, the time of occurrence that coincides with the time of change, the time of occurrence that is less than a certain difference from the time of change, or the time of occurrence that is closest to the time of change. The event corresponding to the specified content is an event having the same content as the specified content, an event having the content related to the specified content, or the like.

For example, the detection unit 1302 identifies the content of the event that occurred at the time of occurrence that coincides with the detected change time based on the acquired log data, and among a plurality of events, the event having the same content as the specified content. Identify the time of occurrence.

The detection unit 1302 may determine whether or not the correlation between the time of occurrence of the event corresponding to the specified content and the time of the detected change among the plurality of events is equal to or higher than a certain level. Correlation is expressed, for example, by the ratio of the number of occurrence points that match the detected change time point to the number of occurrence time points of the event corresponding to the specified content in a certain period.

Here, when the correlation is a certain value or more, the detection unit 1302 specifies one or more time points of occurrence of the event corresponding to the specified content. On the other hand, when the correlation is less than a certain value, the detection unit 1302 does not have to specify the time point of occurrence of the event corresponding to the specified content.

The detection unit 1302 sets a plurality of time zones to be scoped within a certain period based on the detected change time point. The detection unit 1302 sets, for example, a plurality of time zones having a predetermined length including each of the detected change time points as a target. For example, the detection unit 1302 may set a plurality of time zones having a predetermined length including the specified occurrence time points as targets.

The decomposition unit 1303 extracts the partial time-series data indicating the time change of the index value in each of the plurality of time zones set as the scope from the acquired time-series data. For example, the decomposition unit 1303 divides the acquired time-series data into partial time-series data for each scope. Specifically, the disassembly unit 1303 divides the acquired operation data for each scope and acquires the scope unit operation data. As a result, the decomposition unit 1303 can process the acquired time-series data in order to enable the non-negative matrix factorization that utilizes the changing tendency of the business amount of the business processing.

The integration unit 1304 to the separation unit 1306 perform an analysis process for analyzing the similarity of the change tendency of the index value in a plurality of time zones set as a scope based on the extracted partial time series data. The analysis process is a series of processes for analyzing the similarity of the change tendency of the index value in a plurality of time zones set as a scope. By analyzing the similarity of the index value change tendency in multiple time zones, the analysis process identifies the change tendency of the component value indicating the resource usage status of the business processing unit, which appears in common in multiple time zones. It is a series of processes to be performed. The analysis process is realized by non-negative matrix factorization. Specific examples of the analysis process will be described later with reference to FIGS. 16 to 26, for example.

Based on the extracted partial time-series data, the integration unit 1304 generates a vector for each scope having an index value representing the usage status of each of one or more resources as an element. The integration unit 1304 generates, for example, a vector for each scope having one or more index values indicated by the divided partial time series data as elements. Specifically, the integration unit 1304 vectorizes the scope unit operation data by arranging each of the one or more index values indicated by the scope unit operation data as an element at a predetermined position according to a predetermined rule. Generate a vector for each scope. As a result, the integration unit 1304 can generate a vector that is a column or row of a matrix.

The extraction unit 1305 generates a matrix containing each of the vectors for each scope whose elements are index values as columns or rows. The extraction unit 1305 generates, for example, an operation data matrix including a vector of each scope as a column. As a result, the extraction unit 1305 can collect index values related to resources for each scope and process them as each column or row of the matrix, and the nature of business processing is reflected in the result of non-negative matrix factorization. Can be made to. Therefore, the extraction unit 1305 can extract the component data for each resource having a similar change tendency for each scope, which corresponds to the component data for each resource in the business processing unit by the non-negative matrix factorization.

Further, the extraction unit 1305 can integrate index values related to different resources of different business processing devices 201 into columns or rows of a matrix so that they can be processed. Therefore, the extraction unit 1305 can extract a combination of component data corresponding to the same business process from the time series data related to each of a plurality of resources in a format that can be specified by non-negative matrix factorization. can. Further, when the usage tendency of any of the resources by a plurality of business processes is similar, the extraction unit 1305 can extract the component data corresponding to each business process in a separable format by non-negative matrix factorization. can do.

Next, the extraction unit 1305 performs non-negative matrix factorization on the generated matrix. The extraction unit 1305 defines, for example, an operation data matrix by the product of a basis matrix and a weight matrix, and performs non-negative matrix factorization. Extraction unit 1305 generates a basis matrix as a result of non-negative matrix factorization. The basis matrix contains each of a predetermined number of basis vectors as columns or rows. As a result, the extraction unit 1305 can extract the component data for each resource having a similar change tendency, which corresponds to the component data for each resource in the business processing unit, as a basis vector.

Further, the extraction unit 1305 generates a weight matrix that represents the generated matrix by the product of the base matrix as a result of the non-negative matrix factorization. As a result, the extraction unit 1305 can generate information useful for analyzing the long-term change tendency of the business amount in the business processing unit.

Separation unit 1306 separates one or more component values represented by each of the predetermined number of basis vectors included in the generated basis matrix for each of the one or more resources. Here, for example, there is a correspondence between the basis vector included in the basis matrix and the vector included in the operation data matrix in the position of the element. Therefore, the separation unit 1306, for example, refers to a predetermined rule and separates one or more component values indicated by the basis vector for each of the one or more resources. As a result, the separation unit 1306 can acquire the component data for each resource of the business processing unit.

The analysis unit 1307 generates information about each of a predetermined number of weight vectors included in the generated weight matrix. The analysis unit 1307 generates, for example, based on the weight vector, information indicating an increase / decrease tendency of the weight coefficient included in the weight vector with the passage of time. As a result, the analysis unit 1307 can analyze the long-term change tendency of the business volume in the business processing unit. Further, the detection device 100 may make the weight vector referable to the administrator as it is without analyzing the long-term change tendency of the business amount in the business processing unit. In this case, the detection device 100 does not have to have the analysis unit 1307.

The output unit 1308 outputs the processing result of any of the functional units. The output format is, for example, display on a display, print output to a printer, transmission to an external device by a network I / F 303, or storage in a storage area such as a memory 302 or a recording medium 305. As a result, the output unit 1308 can notify the administrator of the processing result of any of the functional units, and can improve the convenience of the detection device 100.

The output unit 1308 outputs, for example, the result of separating one or more component values represented by each of a predetermined number of basis vectors for each of one or more resources. As a result, the output unit 1308 can enable the administrator to refer to the component data for each resource of the business processing unit. Then, the output unit 1308 can facilitate the administrator to analyze the time series data for each business process, and can easily analyze the usage tendency of each of one or more resources in the scope for each business process. ..

The output unit 1308 outputs, for example, information about each of a predetermined number of weight vectors. Specifically, the output unit 1308 associates each weight vector with the component data indicated by the basis vector corresponding to the weight vector, and provides information indicating an increase / decrease tendency of the weight coefficient included in the weight vector over time. Output. As a result, the analysis unit 1307 can allow the manager to refer to the long-term change tendency of the business volume in the business processing unit.

The output unit 1308 may output each of a predetermined number of weight vectors, for example. Thereby, the output unit 1308 can provide the manager with information useful for analyzing the long-term change tendency of the business amount in the business processing unit. The output unit 1308 may output the contents of the specified event, for example. As a result, the output unit 1308 can make it easier for the administrator to specify which business process the usage tendency of each of one or more resources of the business processing unit corresponds to.

(Specific functional configuration example of the detection device 100 in operation example 1)
Next, a specific functional configuration example of the detection device 100 in the operation example 1 will be described with reference to FIG.

FIG. 14 is a block diagram showing a specific functional configuration example of the detection device 100 in the operation example 1. In the following description, it is assumed that the business processing device 201 is a server.

In the example of FIG. 14, log data 1401 and operation data 1402 exist. The detection device 100 acquires the log data 1401 and the operation data 1402. The log data 1401 is stored using, for example, the log table 1000. The operation data 1402 is stored using, for example, the operation table 400.

The detection device 100 includes an event occurrence log extraction unit 1410. The event occurrence log extraction unit 1410 extracts the event occurrence log time indicating the time when some event has occurred, which is determined to be the start point of the business process, based on the operation data 1402 and the log data 1401.

The event occurrence log extraction unit 1410 detects, for example, a change time in which the index value increases by a certain amount or more based on the operation data 1402. The event occurrence log extraction unit 1410 identifies log messages of events that have occurred within a certain period of time before and after the detected change time, for example, based on the log data 1401. The event occurrence log extraction unit 1410 generates, for example, a list 1411 of event occurrence log times corresponding to the specified log message. The list 1411 is stored, for example, using the extraction table 1100.

The detection device 100 includes an operation data decomposition unit 1420. The operation data decomposition unit 1420 extracts a plurality of scope unit operation data 1421 from the operation data 1402. The operation data decomposition unit 1420 sets a scope having a predetermined length starting from each event occurrence log time based on the event occurrence log time list 1411. The operation data decomposition unit 1420 extracts the scope unit operation data 1421 corresponding to each set scope from the operation data 1402. The scope unit operation data 1421 is stored using, for example, the scope unit table 500.

The detection device 100 includes an operation data vectorization processing unit 1430. The operation data vectorization processing unit 1430 vectorizes the scope unit operation data 1421 and generates the operation data vector 1431 for each scope. Specifically, the operation data vector 1431 of each scope is stored using the vector table 600.

The detection device 100 includes a component and weighting factor extraction unit 1440. The component and weighting factor extraction unit 1440 generates an operation data matrix including the operation data vector 1431 of each scope as a column. The component and weighting factor extraction unit 1440 performs non-negative matrix factorization on the generated operation data matrix based on the number of basis to generate the basis matrix and the weight matrix.

The component and weighting factor extraction unit 1440 calculates, for example, each component 1441 forming a basis matrix and a weighting coefficient applied to each component 1441 of the basis matrix by forming a weight matrix by non-negative matrix factorization. The basis matrix is stored, for example, using the component table 700. The weight matrix is stored, for example, using the weight table 800. The weighting coefficient forming the weighting matrix corresponds to an index value indicating the amount of work of business processing.

The detection device 100 includes an extraction component separation unit 1450. One or more components 1441 in the business processing unit included in the basis vector corresponding to the business processing unit included in the base matrix are separated for each resource of the business processing device 201. Specifically, the separated component 1451 is stored using the separation result table 900.

The detection device 100 includes a long-term trend analysis unit 1460. The long-term trend analysis unit 1460 analyzes the long-term change tendency of the usage status of each resource in the business processing unit based on the weight vector 1442 included in the weight matrix corresponding to the business processing unit. The long-term trend analysis unit 1460 analyzes the long-term change tendency of the usage status of each resource in the business processing unit based on the weight vector 1442 corresponding to the business processing unit, and obtains the long-term tendency 1461 of each component 1451. Generate.

The detection device 100 outputs the component 1451 separated for each resource for each business processing device 201 in association with the long-term trend 1461 of the usage status for each resource in the business processing unit. The output destination is, for example, the administrator-side device 202. As a result, the detection device 100 can output information regarding the resource usage status of each device in business processing units. Therefore, the detection device 100 makes it easy for the administrator to grasp the resource usage status of each device in the business processing unit.

(Operation example 1 of the detection device 100)
Next, operation example 1 of the detection device 100 will be described with reference to FIGS. 15 to 27. First, the operation flow of the detection device 100 will be described with reference to FIGS. 15 and 16.

15 and 16 are explanatory views showing the flow of operation of the detection device 100. As shown in FIG. 15, the detection device 100 sets a scope starting from the event occurrence log time indicating the time when some event has occurred, which is determined to be the start point of the business process. For example, in the graph 1500, the time zone of the broken line portion is set as the scope. Graph 1500 is a graph of operation data.

As a result, the detection device 100 can suppress an increase in the number of scopes and can suppress an increase in the processing amount. Further, since the detection device 100 adopts the event occurrence log time determined to be the start point of the business process as the start point, it is suitable for the purpose of specifying the time change of the component value indicating the resource usage status in the business process unit. It is possible to make it easier to set the scope. Specifically, the detection device 100 determines, based on the operation data and the log data, which event occurrence log time, which indicates the time when the event has occurred, can be the start point of the business process. Here, the process proceeds to the description of FIG.

As shown in FIG. 16, the detection device 100 detects a change time in which the index value increases by a certain amount or more based on the operation data. The detection device 100 detects, for example, the change time corresponding to the arrow portion in the graph 1600. The detection device 100 identifies the content of some event that occurred at the time corresponding to the detected change time based on the log data.

The detection device 100 calculates, for example, the ratio of the number of event occurrence log times that match the detected change time to the number of event occurrence log times indicating the time when the event of the specified content occurs as a correlation. When the calculated correlation is equal to or greater than the threshold value, the detection device 100 determines that the event occurrence log time indicating the time when the event of the specified content has occurred can be the start point of the business process, and adopts it as the start point of the scope. The threshold is, for example, 0.8. The detection device 100 adopts, for example, the event occurrence log time corresponding to the logs 2, 3, 6, and 8 shown in FIG. 16 as the start point of the scope.

Here, since the index value is, for example, a load amount, it tends to increase as the business process starts. Therefore, the detection device 100 can easily specify the event occurrence log time indicating the time when some event has occurred, which can be the start point of the business process, based on the change time when the index value has increased by a certain amount or more. Then, the detection device 100 can easily set a scope suitable for the purpose of specifying the time change of the component value representing the resource usage status in the business processing unit.

Here, the detection device 100 identifies the content of some event that occurred at the time corresponding to the detected change time, and adopts the event occurrence log time indicating the time when the event of the specified content occurs as the start point of the scope. However, the case is not limited to this. For example, the detection device 100 may adopt the detected change time as the start point of the scope. A specific example in this case will be described later as Operation Example 2 with reference to FIGS. 29 and 30.

17 to 27 are explanatory views showing an operation example 1 of the detection device 100. In operation example 1, the detection device 100 calculates the correlation between the time when the event of the log data occurs and the time of change when the index value of the operation data increases, and specifies the content of the event whose correlation is equal to or higher than the threshold value. .. The index value is, for example, a load amount. The detection device 100 sets a scope as a decomposition unit starting from the occurrence time of the event corresponding to the specified content, and decomposes the operation data into the scope unit operation data.

The detection device 100 integrates the scope unit operation data into one vector, generates an operation data matrix X, and decomposes the operation data matrix X into a product of a basis matrix U and a weight matrix A by non-negative matrix factor decomposition. The detection device 100 separates each basis vector of the basis matrix U for each resource of each server. The detection device 100 analyzes the increasing / decreasing tendency and periodicity of the weighting coefficient applied to each basis vector. Next, the description shifts to FIG.

In FIG. 17, the detection device 100 detects a change time point in which the index value changes by a certain amount or more for each resource based on the operation table 400 in which the operation data is stored. In the example of FIG. 17, the detection device 100 detects the CPU change time point as the CPU usage rate change time point, and detects the disk change time point as the disk IO change time point. In the example of FIG. 17, ↑ is a mark at the time of change when the index value increases by a certain amount or more. ↓ is a mark at the time of change when the index value decreases by a certain amount or more. Next, the description proceeds to FIG.

In FIG. 18, the detection device 100 specifies a combination of a server name and a log message at a date and time corresponding to a change time point in which the index value increases by a certain amount or more, based on the log table 1000. In the example of FIG. 18, the detection device 100 identifies a combination of the server name “AP01” and the log message “Data transport process start.”.

The detection device 100 calculates the number of appearances of the specified combination in the log table 1000. In the example of FIG. 18, the detection device 100 calculates the number of occurrences 23. The detection device 100 calculates the number of change points at which the index value increases by a certain amount or more. In the example of FIG. 18, the detection device 100 calculates the number 19. The detection device 100 calculates the correlation and determines whether or not it is equal to or greater than the threshold value. The threshold is, for example, 0.8. In the example of FIG. 18, the detection device 100 determines that the correlation = 19/23 ≧ 0.8. If the correlation is equal to or greater than the threshold value, the detection device 100 registers the specified combination in the extraction table 1100. Next, the description proceeds to FIG.

In FIG. 19, the detection device 100 specifies the event occurrence time corresponding to the combination registered in the extraction table 1100 as the start point of the scope based on the log table 1000. The detection device 100 sets a time zone from the specified start point to a certain time later as a scope. The fixed time is, for example, 2 hours. Next, the description shifts to FIG.

In FIG. 20, the detection device 100 extracts the scope unit operation data corresponding to the set scope from the operation table 400 and stores it in the scope unit table 500. In the example of FIG. 20, the detection device 100 extracts the scope unit operation data corresponding to the scope 1 and stores it in the scope unit table 500-1. The detection device 100 extracts the scope unit operation data corresponding to the scope 2 and stores it in the scope unit table 500-2. Next, the description proceeds to FIG.

In FIG. 21, the detection device 100 vectorizes the scope unit operation data. For example, the detection device 100 arranges and vectorizes one or more index values indicated by the scope unit operation data stored in the scope unit table 500 as elements according to a predetermined rule, and stores the index values using the vector table 600. The scope unit operation data of the scope 1 is stored in the vector table 600 as _{, for example, a vector x 1.} The scope unit operation data of the scope 2 is stored in the vector table 600 as _{, for example, a vector x 2.} In the example of FIG. 21, the vector dimension is 96 dimensions. Next, the description proceeds to FIG. 22.

In FIG. 22, the detection device 100 refers to the vector table 600, and the operation data matrix X = (x ₁ , x ₂ , _{x n) corresponding to the vectors x 1} , x ₂ , ..., X n corresponding to each scope. ..., X _n ) is generated. n is the number of scopes. In the following description, for example, n = 90. The operation data matrix X is a 96 × 90 matrix. The detection device 100 performs non-negative matrix factorization on the operation data matrix X to generate a basis matrix U and a weight matrix A. U = (u ₁ , u ₂ , ..., u _N ). u _i is a basis vector. A = (a ₁ , a ₂ , ..., a _N ) = (a _ij ). a _i is a weight vector.

For example, the operation data matrix X is expressed by the following equation (1) as a product of the basis matrix U and the weight matrix A. Therefore, for example, the detection device 100 applies non-negative matrix factorization to the following equation (1) expressed in a matrix format, and includes a basis vector corresponding to the component data for each resource in the business processing unit. To generate. For the non-negative matrix factorization, for example, the above-mentioned Non-Patent Document 1 can be referred to.

X = UA ... (1)

As the Sparseness Constrants in Non-Patent Document 1, for example, the L1 norm is used. In the non-negative matrix factorization, specifically, the weight A and the basis U that minimize the following equation (2) are estimated. || z || _FRO is the Frobenius norm. The terms α || A || ₁ and β || U || ₁ are Spanceness Constrants. For example, α = β = 0.01.

(A ^* , U ^* ) = argmin _{A, U} (1/2 || X-UA || _FRO ² ) + α || A || ₁ + β || U || ₁ ... (2)

In this way, _{by using the terms α || A || 1} and β || U || ₁ , the weight and the basis are derived to be 0 as much as possible. Therefore, according to the non-negative matrix factorization using the above equation (2), it is possible to easily generate the component data for each resource in the business processing unit in a format that is easy for the user to understand.

For example, according to Non-Patent Document 2 below, non-negative matrix factorization has the property of extracting frequently occurring components of each vector of the target matrix. Frequent components are components that show a similar tendency to change. Therefore, if non-negative matrix factorization is performed on the operating data matrix, it is considered possible to extract component data showing a similar change tendency over the entire scope as frequent components. Specifically, it is considered that the component data for each resource in the business processing unit corresponding to the frequently occurring components can be extracted as each basis vector of the basis matrix.

Non-Patent Document 2: Hiroshi Sawada. “Non-negative matrix factorization NMF basics and application to data / signal analysis.” Shingaku Journal 95.9 (2012): 829-833.

At this time, it is assumed that the detection device 100 has preset the number of bases = 4. Therefore, the detection device 100 defines the basis matrix U = (u ₁ , u ₂ , u ₃ , u ₄ ). The basis matrix U is a 96 × 4 matrix. Further, the detection device 100 defines the weight matrix A = (a ₁ , a ₂ , a ₃ , a _N ) = (a _ij ). The weight matrix A is a 4 × 90 matrix.

As a result, the detection device 100 generates a basis matrix U including the basis _{vectors u 1} , u ₂ , u ₃ , u _{4 as shown in graphs 2201 to 2204.} Further, the detection device 100 generates a weight matrix A including weight _{vectors a 1} , a ₂ , a ₃ , and a _{4 as shown in graphs 2211 to 2214.} The weight vector a ₁ = (a ₁ , 1, ..., a _1,90 ). The weight vector a ₂ = (a ₂ , 1, ..., a _2,90 ). The weight vector a ₃ = (a _3,1 , ..., a _3,90 ). The weight vector a ₄ = (a _4,1 , ..., a _4,90 ).

Here, the case where the number of bases is preset has been described, but the present invention is not limited to this. For example, the number of dimensions of the vector forming the working data matrix may be used as the number of bases. In this case, the weighting coefficient applied to the basis vector, which is not preferable as the component data of the business processing unit, tends to be 0 due to the terms _{α || A || 1} and β || U || _{1 in} the above equation (2). .. Therefore, the detection device 100 can accurately generate the basis matrix U by excluding the basis vector u _{i corresponding to the weight vector a i} in which the sum of the weight coefficients becomes 0. Next, the description shifts to FIG. 23.

In FIG. 23, the detection device 100 stores the generated basis vector of the basis matrix using the component table 700. The dimensions of the basis vector are 96 dimensions, similar to the vectors that form the working data matrix. The detection device 100 stores the weight vector of the generated weight matrix using the weight table 800. The dimension of the weight vector corresponds to the number of scopes and becomes 90 dimensions. Next, the description proceeds to FIG. 24.

In FIG. 24, the detection device 100 _{separates the component values of the basis vectors u 1} , u ₂ , u ₃ , and u ₄ shown in graphs 2201 to 2204 for each resource, and acquires the component data for each resource. The detection device 100 separates the component values of the basis vectors u ₁ , u ₂ , u ₃ , and u ₄ into component values 2411 to 2414, 2421 to 2424, 2431 to 2434, and 2441 to 2444 at 24 points, which are the sampling numbers. And get it as component data for each resource. Next, the description shifts to FIG. 25.

In FIG. 25, as a result of the separation, the detection device 100 acquires component data 2511 to 2514 for each CPU usage rate and disk IO of the server AP01 and the server DB01 corresponding to one business process. Further, as a result of the separation, the detection device 100 acquires the component data 2521 to 2524 about the CPU usage rate and the disk IO of each of the server AP01 and the server DB01 corresponding to one business process.

Further, as a result of the separation, the detection device 100 acquires the component data 2531 to 2534 for the CPU usage rate and the disk IO of each of the server AP01 and the server DB01 corresponding to one business process. Further, as a result of the separation, the detection device 100 acquires the component data 2541 to 2544 about the CPU usage rate and the disk IO of each of the server AP01 and the server DB01 corresponding to one business process. Next, moving to the description of FIG. 26, how the detection device 100 separates the component values from the component table 700 for each resource will be described.

In FIG. 26, the detection device 100 separates component values from the component table 700 for each resource according to a predetermined rule. In the example of FIG. 21, when the detection device 100 arranges and vectorizes one or more index values indicated by the scope unit operation data as elements according to a predetermined rule, the CPU usage rate of the server AP01 is the first to 24 of the vector. They are arranged as the elements up to the second. Therefore, when the detection device 100 separates the component values from the component table 700 for each resource, the detection device 100 separates the component values from the first to the 24th of the basis vector as the component values related to the CPU usage rate of the server AP01. Become.

Specifically, the component value group 2601 of the component table 700 is stored in the separation result table 900 as a component value related to the CPU usage rate of the server AP01. Further, the component value group 2602 of the component table 700 is stored in the separation result table 900 as a component value related to the disk IO of the server AP01. Further, the component value group 2603 of the component table 700 is stored in the separation result table 900 as a component value related to the CPU usage rate of the server DB 01. Further, the component value group 2604 of the component table 700 is stored in the separation result table 900 as a component value related to the disk IO of the server DB 01. At this time, unlike the operation data, the date information does not exist in the separation result table 900. Next, the description shifts to FIG. 27.

In FIG. 27, it will be described that component data for each resource is acquired in a preferred format by the operation of the detection device 100 of FIGS. 17 to 26.

For example, it is preferable to extract component data including the respective loads of the CPU usage rate of the server AP01 and the disk IO of the server DB01 that occurred at the same time as the component data corresponding to the same business process. .. On the other hand, as shown by reference numeral 2701, the detection device 100 includes components corresponding to one business process including the respective loads of the CPU usage rate of the server AP01 and the disk IO of the server DB01 that occurred at the same time. Data can be extracted.

Further, for example, it is preferable to separately include the load of the disk IO of the server DB 01 in each of the two component data related to the disk IO corresponding to different business processes. On the other hand, in the detection device 100, as shown by reference numeral 2702, the load of the disk IO of the server DB 01 is separately included in each of the two component data related to the disk IO corresponding to different business processes. , Component data can be extracted.

Further, for example, it is preferable to extract the load of the CPU usage rate of the server DB 01, which occurs irregularly without periodicity, as component data corresponding to one business process. On the other hand, as shown by reference numeral 2703, the detection device 100 can extract component data corresponding to one business process including the load of the CPU usage rate of the server DB 01.

As described above, the detection device 100 can identify and extract a combination of component data corresponding to the same business process from the time series data for each of one or more resources by non-negative matrix factorization. Further, when the usage tendency of any of the resources by a plurality of business processes is similar and the component data corresponding to each business process is similar, the detection device 100 performs non-negative matrix factorization for each business process. The corresponding component data can be separated and extracted. The detection device 100 may analyze the long-term change tendency of the business amount in the business processing unit based on the _{weight vectors a 1} , a ₂ , a ₃ , and a ₄ as shown in the graphs 2211 to 2214.

The detection device 100 displays the component data 2511 to 2514, 2521 to 2524, 2531 to 2534, and 2541 to 2544, which are the results of the separation, so that the administrator can refer to them. Further, the detection device 100 can be referred to by the user by associating each of the component data 2511 to 2514, 2521 to 2524, 2531 to 2534, and 2541 to 2544 with the long-term change tendency of the workload as the analysis result. It may be displayed in.

As a result, the administrator considers the expansion of the resources of the business processing device 201 and the expansion of the business processing device 201 included in the business processing system 200 in consideration of the load on the resources of the business processing device 201. Can be done.

Here, the case where the detection device 100 uses the same operation table 400 for the operation of specifying the combination of the server name and the log message and the operation of extracting the operation data for each scope has been described, but the present invention is limited to this. No. For example, the detection device 100 may specify in advance the combination of the server name and the log message based on the operation table 400 corresponding to a certain period. After that, the detection device 100 may extract the scope unit operation data based on the operation table 400 corresponding to another period.

(Overall processing procedure in operation example 1)
Next, an example of the overall processing procedure in the operation example 1 executed by the detection device 100 will be described with reference to FIG. 28. The entire processing is realized by, for example, the CPU 301 shown in FIG. 3, a storage area such as a memory 302 or a recording medium 305, and a network I / F 303.

FIG. 28 is a flowchart showing an example of the overall processing procedure in the operation example 1. In FIG. 28, the detection device 100 receives a start trigger (step S2801). The start trigger is, for example, a trigger that is automatically generated at a periodic timing, or a trigger that is generated by an operation input of an administrator.

Next, the detection device 100 collects log data and operation data from each business processing device 201 of one or more business processing devices 201 (step S2802). Then, the detection device 100 detects the time point of change of the rise in the operation data (step S2803).

Next, the detection device 100 calculates an index value representing the correlation between the detected change time point of the rise and the event occurrence point in the log data, and specifies the type of event in which the calculated index value becomes a certain value or more (. Step S2804). The detection device 100 specifies, for example, the type of event whose index value is equal to or greater than the threshold value. The threshold is, for example, 0.8. Then, the detection device 100 sets a scope starting from each occurrence point of the specified type of event (step S2805).

Next, the detection device 100 divides the operation data of each of the collected plurality of operation data into scope units (step S2806). Then, the detection device 100 collectively vectorizes the divided operation data in units of scopes, and generates an operation data matrix in which the vectors of each scope are arranged as columns (step S2807).

Next, the detection device 100 performs non-negative matrix factorization on the generated operation data matrix based on the number of basis to generate a basis matrix and a weight matrix (step S2808). Then, the detection device 100 separates one or more component values in the business processing unit included in the basis vector corresponding to the business processing unit included in the basis matrix for each resource (step S2809).

Next, the detection device 100 analyzes the long-term change tendency of the business amount in the business processing unit based on the weight vector corresponding to the business processing unit included in the weight matrix (step S2810). Then, the detection device 100 outputs the result of separating one or more component values for each resource in the business processing unit and the result of analyzing the long-term change tendency of the business amount in association with each other (step S2811).

After that, the detection device 100 ends the whole process. As a result, the detection device 100 makes it easy for the administrator to grasp the resource usage status in the business processing unit, and makes it easy to analyze the change tendency of the business amount in the business processing unit.

(Specific functional configuration example of the detection device 100 in operation example 2)
Next, a specific functional configuration example of the detection device 100 in the operation example 2 will be described with reference to FIG. 29.

FIG. 29 is a block diagram showing a specific functional configuration example of the detection device 100 in the operation example 2. In the following description, it is assumed that the business processing device 201 is a server. In the example of FIG. 29, the operation data 2901 exists. The detection device 100 acquires the operation data 2901. The operation data 2901 is stored, for example, using the operation table 400.

The detection device 100 includes a rise change time detection unit 2910. The rise change time detection unit 2910 detects the rise change time in which the index value has increased by a certain amount or more, which is determined to be a start point of the business process, based on the operation data 2901, and generates a list of rise change times 2911.

The detection device 100 includes an operation data decomposition unit 2920. The operation data decomposition unit 2920 extracts a plurality of scope unit operation data 2921 from the operation data 2901. The operation data decomposition unit 2920 sets a scope having a predetermined length starting from each rise change time based on the list of rise change times 2911, and corresponds to each set scope from the operation data 2901. Scope unit operation data 2921 is extracted. The scope unit operation data 2921 is stored using, for example, the scope unit table 500.

The detection device 100 includes an operation data vectorization processing unit 2930. The operation data vectorization processing unit 2930 vectorizes the scope unit operation data 2921 and generates the operation data vector 2931 for each scope. Specifically, the operation data vector 2931 of each scope is stored using the vector table 600.

The detection device 100 includes a component and weighting factor extraction unit 2940. The component and weighting factor extraction unit 2940 generates an operation data matrix including the operation data vector 2931 of each scope as a column. The component and weighting factor extraction unit 2940 performs non-negative matrix factorization on the generated operation data matrix based on the number of basis to generate the basis matrix and the weight matrix.

The component and weighting factor extraction unit 2940 calculates, for example, each component 2941 forming a basis matrix and a weighting coefficient applied to each component 2941 of the basis matrix by forming a weight matrix by non-negative matrix factor decomposition. The basis matrix is stored, for example, using the component table 700. The weight matrix is stored, for example, using the weight table 800. The weighting coefficient forming the weighting matrix corresponds to an index value indicating the amount of work of business processing.

The detection device 100 includes an extraction component separation unit 2950. One or more components 2941 in the business processing unit included in the basis vector corresponding to the business processing unit included in the basis matrix are separated for each resource of the business processing apparatus 201. Specifically, the separated component 2951 is stored using the separation result table 900.

The detection device 100 includes a long-term trend analysis unit 2960. The long-term trend analysis unit 2960 analyzes the long-term change tendency of the usage status of each resource in the business processing unit based on the weight vector 2942 corresponding to the business processing unit included in the weight matrix. The long-term trend analysis unit 2960 analyzes, for example, the long-term change tendency of the usage status of each resource in the business processing unit based on the weight vector 2942 corresponding to the business processing unit, and obtains the long-term tendency 2961 of each component 2951. Generate.

The detection device 100 outputs the component 2951 separated for each resource for each business processing device 201 in association with the long-term tendency 2961 of the usage status for each resource in the business processing unit. The output destination is, for example, the administrator-side device 202. As a result, the detection device 100 can output information regarding the resource usage status of each device in business processing units. Therefore, the detection device 100 makes it easy for the administrator to grasp the resource usage status of each device in the business processing unit. The detection device 100 can also be applied to a situation in which log data is not collected from the business processing device 201.

FIG. 30 is an explanatory diagram showing an operation example 2 of the detection device 100. In the operation example 2, the detection device 100 detects the rise change time when the index value of the operation data increases. The index value is, for example, a load amount. The detection device 100 sets a scope as a decomposition unit starting from the detected rise change time, and decomposes the operation data into the scope unit operation data.

The detection device 100 integrates the scope unit operation data into one vector, generates an operation data matrix X, and decomposes the operation data matrix X into a product of a basis matrix U and a weight matrix A by non-negative matrix factor decomposition. The detection device 100 separates each basis vector of the basis matrix U for each resource of each server. The detection device 100 analyzes the increasing / decreasing tendency and periodicity of the weighting coefficient applied to each basis vector. Next, the process proceeds to the description of FIG.

In FIG. 30, the detection device 100 detects a change time point in which the index value changes by a certain amount or more for each resource based on the operation table 400 in which the operation data is stored. In the example of FIG. 30, the detection device 100 detects the CPU change time point as the CPU usage rate change time point, and detects the disk change time point as the disk IO change time point. In the example of FIG. 30, ↑ is a mark at the time of change when the index value increases by a certain amount or more. ↓ is a mark at the time of change when the index value decreases by a certain amount or more.

The detection device 100 specifies the detected ascending / changing time point in which the index value increases by a certain amount or more as the starting point of the scope. The detection device 100 sets a time zone from the specified start point to a certain time later as a scope. The fixed time is, for example, 2 hours. After that, the detection device 100 performs the same operation as in FIGS. 20 to 26 in the operation example 1.

As a result, the detection device 100 can identify and extract a combination of component data corresponding to the same business process from the time series data related to each of one or more resources by non-negative matrix factorization. Further, when the usage tendency of any of the resources by a plurality of business processes is similar and the component data corresponding to each business process is similar, the detection device 100 performs non-negative matrix factorization for each business process. The corresponding component data can be separated and extracted. The detection device 100 may analyze the long-term change tendency of the business amount in the business processing unit based on the _{weight vectors a 1} , a ₂ , a ₃ , and a ₄ as shown in the graphs 2211 to 2214.

The detection device 100 displays the component data 2511 to 2514, 2521 to 2524, 2531 to 2534, and 2541 to 2544, which are the results of the separation, so that the administrator can refer to them. Further, the detection device 100 can be referred to by the user by associating each of the component data 2511 to 2514, 2521 to 2524, 2531 to 2534, and 2541 to 2544 with the long-term change tendency of the workload as the analysis result. It may be displayed in.

As a result, the administrator considers the expansion of the resources of the business processing device 201 and the expansion of the business processing device 201 included in the business processing system 200 in consideration of the load on the resources of the business processing device 201. Can be done.

(Overall processing procedure in operation example 2)
Next, an example of the overall processing procedure in the operation example 2 executed by the detection device 100 will be described with reference to FIG. 31. The entire processing is realized by, for example, the CPU 301 shown in FIG. 3, a storage area such as a memory 302 or a recording medium 305, and a network I / F 303.

FIG. 31 is a flowchart showing an example of the overall processing procedure in the operation example 2. In FIG. 31, the detection device 100 receives a start trigger (step S3101). The start trigger is, for example, a trigger that is automatically generated at a periodic timing, or a trigger that is generated by an operation input of an administrator.

Next, the detection device 100 collects log data and operation data from each business processing device 201 of one or more business processing devices 201 (step S3102). Then, the detection device 100 detects the time point of change of the rise in the operation data (step S3103).

Next, the detection device 100 sets a scope starting from the detected change time point (step S3104). Then, the detection device 100 divides each operation data of the collected plurality of operation data into scope units (step S3105).

Next, the detection device 100 collectively vectorizes the divided operation data in units of scopes, and generates an operation data matrix in which the vectors of each scope are arranged as columns (step S3106). Then, the detection device 100 performs non-negative matrix factorization on the generated operation data matrix based on the number of basis to generate a basis matrix and a weight matrix (step S3107).

Next, the detection device 100 separates one or more component values in the business processing unit included in the basis vector corresponding to the business processing unit included in the basis matrix for each resource (step S3108). Then, the detection device 100 analyzes the long-term change tendency of the business amount in the business processing unit based on the weight vector corresponding to the business processing unit included in the weight matrix (step S3109).

Next, the detection device 100 outputs the result of separating one or more component values for each resource in the business processing unit and the result of analyzing the long-term change tendency of the business amount in association with each other (step S3110). .. Then, the detection device 100 ends the entire processing. As a result, the detection device 100 makes it easy for the administrator to grasp the resource usage status in the business processing unit, and makes it easy to analyze the change tendency of the business amount in the business processing unit.

As described above, according to the detection device 100, it is possible to acquire data indicating the time change of the index value indicating the resource usage status in a certain period. According to the detection device 100, it is possible to detect the time point of change of the index value satisfying a predetermined condition based on the acquired data. According to the detection device 100, it is possible to set a plurality of time zones for which the similarity of the change tendency of the index value is analyzed in the period based on the detected change time point. Thereby, the detection device 100 can analyze the time change of the component value representing the resource usage status of each device in the business processing unit by the analysis processing.

According to the detection device 100, it is possible to extract partial data indicating the time change of the index value in each of the set plurality of time zones from the data. According to the detection device 100, it is possible to perform an analysis process for analyzing the similarity of the change tendency of the index value in a plurality of set time zones based on the extracted partial data. As a result, the detection device 100 can analyze the time change of the component value representing the resource usage status of each device in the business processing unit by the analysis processing, and can output it so that the administrator can grasp it. ..

According to the detection device 100, it is possible to generate a matrix containing each of the vectors for each time zone having the index value as an element as columns or rows based on the extracted partial data. According to the detection device 100, non-negative matrix factorization can be performed on the generated matrix to generate a basis matrix containing each of a predetermined number of basis vectors as columns or rows. According to the detection device 100, it is possible to output the result of separating the component values of one or more represented by each of the predetermined number of basis vectors included in the generated basis matrix with respect to the resource. As a result, the detection device 100 can output component data indicating the time change of the component value indicating the usage status of the resource of each device in the business processing unit.

According to the detection device 100, it is possible to detect a change time point in which the index value has increased by a certain amount or more based on the acquired data. As a result, the detection device 100 can avoid detecting the time point at which the index value is slightly changed, which is determined to be noise. Further, the detection device 100 can detect a change time point in which the index value is considered to have increased by a certain amount or more due to the start of the business process, which is determined to correspond to the start time point of the business process. Therefore, the detection device 100 can improve the accuracy of the analysis process.

According to the detection device 100, it is possible to detect a plurality of time points of change of the index value satisfying a predetermined condition. According to the detection device 100, it is possible to set a plurality of time zones having a predetermined length including the detected change time points as targets. Thereby, the detection device 100 can be applied to the situation where the log data does not exist.

According to the detection device 100, it is possible to acquire log data recorded by associating the contents of each of a plurality of events that have occurred in a device having resources with the time of occurrence. According to the detection device 100, the content of the event that occurred in the device at the time of occurrence corresponding to the detected change time is specified based on the acquired log data, and the event corresponding to the specified content among the plurality of events is specified. It is possible to specify multiple time points of occurrence. According to the detection device 100, it is possible to set a plurality of time zones having a predetermined length including the specified occurrence time points as targets. As a result, the detection device 100 can set the target based on the log data by using the occurrence time point that does not correspond to the change time point, and can improve the accuracy of the analysis process.

According to the detection device 100, when the correlation between the occurrence time of the event corresponding to the specified content and the detected change time is more than a certain value among the plurality of events, the occurrence time of the event corresponding to the specified content is determined. Multiple can be specified. Thereby, the detection device 100 can determine whether or not it is preferable to set the target based on the occurrence time of the event corresponding to the specified content based on the correlation. Then, when it is preferable to set the target, the detection device 100 can set the target based on the time when the event corresponding to the specified content occurs, and can improve the accuracy of the analysis process.

According to the detection device 100, the specified contents can be output. As a result, the detection device 100 determines by the administrator which business process the information indicating the time change of the component value indicating the resource usage status of each device in the business processing unit specifically corresponds to. Can be made easier.

According to the detection device 100, it is possible to acquire data showing the time change of the index value representing the usage status of each of the plurality of resources. As a result, the detection device 100 can be applied to a situation where a plurality of resources exist.

According to the detection device 100, it can be applied to a situation in which a plurality of resources include different types of resources in the same device. As a result, when one business process affects different types of resources in the same device, the detection device 100 has a format corresponding to one business process, and component data of different types of resources in the same device. Can be obtained.

According to the detection device 100, it can be applied to a situation in which a plurality of resources include resources in different devices. As a result, when one business process affects the resources in different devices, the detection device 100 can acquire the component data of each resource in different devices in a format corresponding to one business process.

According to the detection device 100, a predetermined number may be set based on the number of business processes executed using at least one of one or more resources. As a result, the detection device 100 can accurately acquire information indicating the time change of the component value indicating the usage status of each of one or more resources in the business processing unit, and by reducing the number of basis vectors, the non-negative value. It is possible to reduce the amount of processing required for matrix factor decomposition.

According to the detection device 100, a number set based on the number of dimensions of the vector can be adopted as the predetermined number. As a result, even if the number of business processes is unknown, the detection device 100 can accurately acquire information indicating the time change of the component value representing the usage status of each of the one or more resources in the business process unit.

According to the detection device 100, a non-negative matrix factorization is performed on the generated matrix, each of a predetermined number of weight vectors is included as a row or a column, and the generated matrix is represented by a product of the basis matrix. You can generate a matrix. According to the detection device 100, it is possible to output information about each of a predetermined number of weight vectors included in the generated weight matrix. As a result, the detection device 100 makes it easy for the user to grasp the long-term change tendency of the business amount for each business process.

The detection method described in this embodiment can be realized by executing a program prepared in advance on a computer such as a PC or a workstation. The detection program described in this embodiment is recorded on a computer-readable recording medium and executed by being read from the recording medium by the computer. The recording medium is a hard disk, a flexible disk, a CD (Compact Disc) -ROM, an MO (Magnet Optical disc), a DVD (Digital Versaille Disc), or the like. Further, the detection program described in this embodiment may be distributed via a network such as the Internet.

The following additional notes are further disclosed with respect to the above-described embodiment.

(Appendix 1) Obtain data showing the time change of the index value showing the resource usage status in a certain period.
Based on the acquired data, the time point of change of the index value satisfying a predetermined condition is detected.
Based on the detected change time point, a plurality of time zones for which the similarity of the change tendency of the index value is analyzed is set in the period.
A detection method characterized by the computer performing the process.

(Appendix 2) From the data, partial data indicating the time change of the index value in each of the set multiple time zones is extracted.
Based on the extracted partial data, an analysis process for analyzing the similarity of the change tendency of the index value in the set plurality of time zones is performed.
The detection method according to Appendix 1, wherein the processing is executed by the computer.

(Appendix 3) The processing to be carried out is
Based on the extracted partial data, a matrix containing each of the vectors for each time zone having the index value as an element is generated as a column or a row, and a non-negative matrix factor decomposition is performed on the generated matrix. , A basis matrix containing each of a predetermined number of basis vectors as a column or a row is generated, and one or more component values represented by each of the predetermined number of basis vectors included in the generated basis matrix are described. The detection method according to Appendix 2, wherein the result of separation of resources is output.

(Appendix 4) The detection process is
The detection method according to any one of Supplementary note 1 to 3, wherein the time point of change in which the index value increases by a certain amount or more is detected based on the acquired data.

(Appendix 5) The detection process is
A plurality of time points of change of the index value satisfying the predetermined condition are detected.
The process to be set is
The detection method according to any one of Supplementary note 1 to 4, wherein a plurality of time zones having a predetermined length including each of the detected change time points are set as the target.

(Appendix 6) Obtain log data recorded by associating the contents of each of a plurality of events that occurred in the device having the resource with the time of occurrence.
Based on the acquired log data, the content of the event that occurred in the device at the time of occurrence corresponding to the detected change time is specified, and the time of occurrence of the event corresponding to the specified content among the plurality of events. To identify multiple
The computer executes the process,
The process to be set is
The detection method according to any one of Supplementary note 1 to 5, wherein a plurality of time zones having a predetermined length including the specified time of occurrence are set as the target.

(Appendix 7) The specified process is
When the correlation between the occurrence time of the event corresponding to the specified content and the detected change time is more than a certain value among the plurality of events, the occurrence time of the event corresponding to the specified content is specified. The detection method according to Appendix 6, wherein the detection method is characterized by the above.

(Supplementary Note 8) The detection method according to Supplementary note 6 or 7, wherein the computer executes a process for outputting the specified contents.

(Appendix 9) The process to be acquired is
The detection method according to any one of Supplementary note 1 to 8, wherein the data indicating the time change of the index value indicating the usage status of each of the plurality of resources is acquired.

(Supplementary Note 10) The detection method according to Supplementary note 9, wherein the plurality of resources include different types of resources in the same device.

(Supplementary Note 11) The detection method according to Supplementary note 9 or 10, wherein the plurality of resources include resources in different devices.

(Appendix 12) Non-negative matrix factorization is performed on the generated matrix, each of the predetermined number of weight vectors is included as a row or a column, and the generated matrix is represented by a product with the basis matrix. Generate a weight matrix,
Information about each of the predetermined number of weight vectors included in the generated weight matrix is output.
The detection method according to Appendix 3, wherein the processing is executed by the computer.

(Supplementary Note 13) The detection method according to Supplementary note 3 or 12, wherein the predetermined number is set based on the number of business processes executed by using the resource.

(Supplementary note 14) The detection method according to Supplementary note 3 or 12, wherein the predetermined number is set based on the number of dimensions of the vector.

(Appendix 15) Obtain data showing the time change of the index value showing the resource usage status in a certain period, and acquire the data.
Based on the acquired data, the time point of change of the index value satisfying a predetermined condition is detected.
Based on the detected change time point, a plurality of time zones for which the similarity of the change tendency of the index value is analyzed is set in the period.
A detection program characterized by having a computer perform processing.

100 Detection device 101,1500,1600,2201,202,2203,2204,221,212,2213,2214 Graph 110,120 Time of change 111,121 Time zone 200 Business processing system 201 Business processing device 202 Administrator side device 210 Network 220 Service execution platform 300,1200 Bus 301,1201 CPU
302,1202 Memory 303,1203 Network I / F
304, 1204 Recording medium I / F
305,1205 Recording medium 400 Operation table 500 Scope unit table 600 Vector table 700 Component table 800 Weight table 900 Separation result table 1000 Log table 1100 Extraction table 1206 Display 1207 Input device 1300 Storage unit 1301 Acquisition unit 1302 Detection unit 1303 Decomposition unit 1304 Integration Part 1305 Extraction part 1306 Separation part 1307 Analysis part 1308 Output part 1401 Log data 1402,2901 Operation data 1410 Event occurrence log extraction part 1411, 2911 List 1420, 2920 Operation data decomposition part 1421,2921 Scope unit operation data 1430, 2930 Operation data Vectorization processing unit 1431,2931 Operation data vector 1440,2940 Component and weight coefficient extraction unit 1441,1451,2941,2951 Component 1442,2942 Vector 1450,2950 Extraction component separation unit 1460,2960 Long-term trend analysis unit 1461,2961 Long-term trend 2411,241,2413,2414,2421,242,2423,2424,2431,2432,2433,2434,2441,244,2443,2444 Component value 2511,251,2513,2514,2521,2522,2523,2524,2531 , 2532, 2533, 2534, 2541,254,2543, 2544 Component data 2601,260,2603,2604 Component value group 2701,270,2703 Code 2910 Rise change time detector

Claims (9)

Acquire data showing the time change of the index value showing the resource usage status in a certain period,
Based on the acquired data, the time point of change of the index value satisfying a predetermined condition is detected.
Based on the detected change time point, a plurality of time zones for which the similarity of the change tendency of the index value is analyzed is set in the period.
A detection method characterized by the computer performing the process. From the data, partial data indicating the time change of the index value in each of the set plurality of time zones is extracted.
Based on the extracted partial data, an analysis process for analyzing the similarity of the change tendency of the index value in the set plurality of time zones is performed.
The detection method according to claim 1, wherein the processing is executed by the computer. The processing to be carried out is
Based on the extracted partial data, a matrix containing each of the vectors for each time zone having the index value as an element is generated as a column or a row, and a non-negative matrix factor decomposition is performed on the generated matrix. , A basis matrix containing each of a predetermined number of basis vectors as a column or a row is generated, and one or more component values represented by each of the predetermined number of basis vectors included in the generated basis matrix are described. The detection method according to claim 2, wherein the results separated for the resources are output. The process to be detected is
The detection method according to any one of claims 1 to 3, wherein the time point of change in which the index value increases by a certain amount or more is detected based on the acquired data. The process to be detected is
A plurality of time points of change of the index value satisfying the predetermined condition are detected.
The process to be set is
The detection method according to any one of claims 1 to 4, wherein a plurality of time zones having a predetermined length including each of the detected change time points are set as the target. The log data recorded by associating the contents of each of the plurality of events that occurred in the device having the resource with the time of occurrence is acquired.
Based on the acquired log data, the content of the event that occurred in the device at the time of occurrence corresponding to the detected change time is specified, and the time of occurrence of the event corresponding to the specified content among the plurality of events. To identify multiple
The computer executes the process,
The process to be set is
The detection method according to any one of claims 1 to 5, wherein a plurality of time zones having a predetermined length including the specified time of occurrence are set as the target. The specific process is
When the correlation between the occurrence time of the event corresponding to the specified content and the detected change time is more than a certain value among the plurality of events, the occurrence time of the event corresponding to the specified content is specified. The detection method according to claim 6, wherein the detection method is characterized by the above. The detection method according to claim 6 or 7, wherein the computer performs a process of outputting the specified contents. Acquire data showing the time change of the index value showing the resource usage status in a certain period,
Based on the acquired data, the time point of change of the index value satisfying a predetermined condition is detected.
Based on the detected change time point, a plurality of time zones for which the similarity of the change tendency of the index value is analyzed is set in the period.
A detection program characterized by having a computer perform processing.

Images