JP2022081134A - System monitoring device and system monitoring method - Google Patents

Abstract

To solve the problem that, in order to determine an abnormal state from operation information, it is necessary to determine an abnormality value from operation information in abnormal states that occurred in the past or states indicating signs of abnormality, and predicting the abnormality sign is unfeasible when there is no data that can be clearly determined as an abnormality.SOLUTION: In a system monitoring device 10, a monitoring manager 40 acquires operation information for each process in each of computers 20 and 21 collected by monitoring agents 50 and 51, automatically selects a significant process to be monitored, and calculates collection conditions for its operation information. By collecting and accumulating detailed operation information for a long period of time according to the collection conditions, it becomes possible to diagnose changes in the value of the operation information from the past in detail and detect signs leading to failure.SELECTED DRAWING: Figure 1

Description

The present invention relates to a technique for monitoring the operating status of a computer system, and more particularly to a technique for preventing a system failure in a control computer system.

In recent years, computer systems that realize some functions have been operated. For example, computer systems provide services such as control of plants, water and sewage systems, infrastructure including power grids, financial institutions, and distribution. In these computer systems, the number of systems that require stable operation for 365 days is increasing. For this reason, we apply a technology that collects system operation information in real time at regular time intervals, and use the operation information to determine the presence or absence of abnormal signs from the collected operation information and to investigate the cause of the abnormality. It is operated using the technology that is used. As such a monitoring technique, for example, there is a technique disclosed in Patent Document 1 and Patent Document 2.

In Patent Document 1, in order to predict an abnormal event occurring in a plant before it occurs, a matching index is calculated by comparing the contribution of operation data that is an abnormality sign and the operation data at the time of the past abnormality sign with the current operation data. , It is configured to judge abnormal signs.

In Patent Document 2, a standard is set for specific operation information, and when the corresponding operation information tends to deviate from the standard, it is judged as an abnormal sign, and related operation information is collected in order to investigate the cause of the failure. It is composed.

Japanese Unexamined Patent Publication No. 2019-57164 Japanese Patent Application Laid-Open No. 2003-345629

In the conventional monitoring technique described above, in order to determine the abnormal value of the system using the collected operation information, the relevance and similarity with the operation information in the abnormal state or abnormal sign state that occurred in the past are used as the judgment basis. ing. Alternatively, a reference range recognized as normal operation of the operation information is set in advance, and if the reference range is exceeded, it is judged that the system shows an abnormal sign.

Here, when the system to be monitored is operating, a plurality of processes are "operating". Therefore, when monitoring, it is necessary to monitor each of a plurality of processes in the same way. In addition, when the system is operating, the process that "operates" changes dynamically according to the business content and the like.

For these reasons, in monitoring the operating status of the system, there is a problem that a load is applied when simply trying to monitor whether all the processes meet the reference range.

In order to solve such a problem, in the present invention, operation information is collected for a process executed in the target system according to the "importance" of the process.

More specifically, in a system monitoring device that monitors a computer system that realizes a predetermined function by executing a plurality of processes, a process management table that stores collection conditions for collecting operation information of each of the plurality of processes. According to the stored collection conditions, the operation information collection unit that collects the operation information of each process of the computer system and the importance indicating the importance of each process to the whole of the plurality of processes are determined, and the importance is determined. It is a system monitoring device having a process selection unit that specifies the collection conditions of the process and updates the stored collection conditions to the specified collection conditions.

The present invention also includes a system monitoring method using a system monitoring device and a computer program for making the system monitoring device function as a computer. The present invention also includes a storage medium in which the computer program is stored.

According to the present invention, it is possible to more easily realize monitoring of a computer system according to the importance of a process in the computer system.

It is a block diagram of the computer system which controls the plant equipment of one Embodiment of this invention. It is a functional block diagram which shows the software structure of the monitoring manager in one Embodiment of this invention. It is a functional block diagram which shows the software structure of the monitoring agent in one Embodiment of this invention. It is a figure which shows the process control table in one Embodiment of this invention. It is a figure which shows the operation information item table in one Embodiment of this invention. It is a flowchart which shows the process flow of the system monitoring apparatus in embodiment of this invention. It is a flowchart which shows the detail of the step S408 of FIG. 4 in one Embodiment of this invention. It is a flowchart which shows the detail of the step S410 of FIG. 4 in one Embodiment of this invention. It is a figure which shows an example of the hardware composition of the system monitoring apparatus 10 and the computer 20 which has one Embodiment of this invention.

Hereinafter, one embodiment of the present invention will be described in detail with respect to the drawings. FIG. 1 shows a computer system 1 that controls plant equipment by using computers 20 and 21 that are the monitoring targets of the present embodiment. In the computer system 1, a plurality of computers are connected to each other via a network communication path, and information data can be transmitted and received between the computers. As a result, the computer system 1 can realize predetermined functions such as control of plant equipment. Further, the computer system 1 includes a computer 20, a computer 21, and a communication path 30, and the system monitoring device 10 which is a means for realizing the present embodiment is similarly connected to the communication path 30.

Further, the monitoring manager 40, which is a program running on the system monitoring device 10, communicates with the monitoring agent 50 and the monitoring agent 51, which are programs running on the computer 20 and the computer 21. As a result, the system monitoring device 10 acquires the operation information used when diagnosing the operation status of the computer system 1.

In the present embodiment, the system monitoring device 10 is included in the computer system 1, but may be provided separately from the computer system 1. Further, the monitoring manager 40 and the monitoring agents 50 and 51 may be realized by hardware such as a circuit. In this case, each part of the monitoring manager 40 and the monitoring agents 50 and 51, which will be described later, will also be realized by hardware. Further, the monitoring agents 50 and 51 may be omitted. In this case, the computers 20 and 21 transmit the operation information to the system monitoring device 10 according to the instruction of the monitoring manager 40.

Next, the monitoring manager 40 and the monitoring agent 50 will be described with reference to FIGS. 2A and 2B. FIG. 2A is a functional block diagram of the software configuration of the monitoring manager 40 of the program running on the system monitoring device 10 according to the embodiment of the present invention.

FIG. 2B is a functional block diagram of the software configuration of the monitoring agent 50 operating on each computer according to the embodiment of the present invention. In FIG. 2A, the monitoring manager 40 collects operation information for each process so that the operation status of each computer can be confirmed by the operation information collection unit 200. The operation information to be collected is the information of the items defined on the operation information item table 230 created for each computer.

In addition, the operation information is collected at predetermined predetermined periods and stored in the operation information collection DB 250. Then, the system operation status diagnosis unit 210 diagnoses a sign of failure in the computer system 1 by using the accumulated operation information. In this diagnosis, the system operation status diagnosis unit 210 may calculate the change in the value of the operation information and the change in the mutual operation relationship, and use this result.

Further, the process selection unit 220 uses the process information stored in the process management table 240 created for each computer to be collected to determine the importance of the process. Further, the process selection unit 220 may select a process having a determined importance of a predetermined degree or higher as an important process that may affect the operation and business of the computer system 1. The operation information items of the operation information to be collected may be changed according to the importance. Furthermore, more detailed operation information or operation information of more operation information items may be collected for the selected important processes.

Here, the monitoring agent 50 shown in FIG. 2B is a program that operates on the computer 20, and collects operation information indicating the operation status of the computer. Since the monitoring agent 51 has the same functional configuration as the monitoring agent 51, the description thereof will be omitted.

Further, the process management table (agent) 270 stores the process information of the computers 20 and 21 in which the monitoring agents 50 and 51 are deployed among the process information of the process management table 240 of the monitoring manager 40. For this purpose, it is desirable that the corresponding process information in the process management table 240 is periodically copied to the process management table (agent) 270.

Similarly, the operation information item table (agent) 260 collects operation information collected by the computers 20 and 21 in which the monitoring agents 50 and 51 are deployed among the operation information of the operation information item table 230 on the monitoring manager 40. The item is stored. It is desirable that the corresponding operation information item in the operation information item table 230 is periodically copied to the operation information item table (agent) 260.

Further, in the present embodiment, the operation information collection unit (agent) 280 collects necessary operation information and records them in the collection data DB 290 while referring to the installation values of these tables.

When the monitoring manager 40 is realized by software, that is, a computer program, this can be realized as a monitoring manager program. In this case, each of the operation information collection unit 200, the system operation status diagnosis unit 210, and the process selection unit 220 can be realized by a module. Further, the operation information collection unit 200, the system operation status diagnosis unit 210, and the process selection unit 220 may be realized as the operation information collection program 2001, the system operation status diagnosis program 2101, and the process selection program 2201, respectively. This configuration will be described later with reference to FIG. 7. Then, these computer programs are stored in the storage medium. Further, these computer programs may be delivered to the system monitoring device 10 via the communication path 30.

Here, an example of the hardware configuration of the system monitoring device 10 having the monitoring manager 40 and the computer 20 having the monitoring agent 50 will be described with reference to FIG. 7. Since the configuration of the computer 21 is the same as that of the computer 21, it is omitted.

In FIG. 7, the system monitoring device 10 is realized by a so-called computer. Therefore, in the system monitoring device 10, the processing unit 101, the input / output unit 102, the main storage unit 103, and the auxiliary storage unit 104 are configured with each other via a bus or the like.

The processing unit 101 is realized by an arithmetic unit such as a CPU, and executes the processing described later according to each program expanded in the main storage unit 103. Further, the input / output unit 102 is connected to the communication path 30, and is connected to the computer 20 and the terminal device 60. Here, the terminal device 60 can be realized by a computer having a function of inputting an instruction to the system monitoring device 10 and outputting the calculation result of the system monitoring device 10. Further, the function of the terminal device 60 may be provided in the system monitoring device 10. Further, the input / output unit 102 may be divided into a lecturer connected to the communication path 30 and a configuration connected to the terminal device 60.

Further, the main storage unit 103 is realized by a so-called memory, and in the present embodiment, the above-mentioned operation information collection program 2001, system operation status diagnosis program 2101, and process selection program 2201 are deployed. Then, the processing unit 101 executes an operation according to these programs.

Further, the auxiliary storage unit 104 is realized by a storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The auxiliary storage unit 104 stores the operation information item table 230, the process management table 240, and the operation information DB 250, the details of which will be described later. Further, the auxiliary storage unit 104 stores various programs expanded in the main storage unit 103. The system monitoring device 10 may be realized as one configuration for providing so-called cloud computing. In this case, it is desirable that the communication path 30 is realized on the Internet.

Next, the configuration of the computer 20 will be described with reference to this figure. The computer 20 is also realized by a so-called computer. Therefore, in the computer 20, the processing unit 201, the input / output unit 202, the main storage unit 203, and the auxiliary storage unit 204 are configured with each other via a bus or the like. These can be realized similarly to the processing unit 101, the input / output unit 102, the main storage unit 103, and the auxiliary storage unit 104. Then, the operation information collection program 2801 corresponding to the operation information collection unit (agent) 280 is deployed in the main storage unit 203.

Further, the auxiliary storage unit 204 stores the operation information item table (agent) 260, the process management table (agent) 270, and the collected data DB 290. Further, the operation information collection program 2801 realized as the monitoring agent 50 shall be transmitted from the system monitoring device 10 and stored in the auxiliary storage unit 204.

Next, FIGS. 3A and 3B show two software management tables held by the monitoring manager 40. FIG. 3A is a diagram showing an operation information item table 230. FIG. 3B is a diagram showing the process management table 240.

The operation information item table 230 shown in FIG. 3A indicates the information type of the operation information to be collected, item 301. Item 301 includes column information of common information 302 to be collected and column information of detailed information 303 in which the item to be collected is selected by the information of the operation priority and the operation ratio for calculating the importance of the process.

Further, the process management table 240 shown in FIG. 3B stores the operation information indicating the operation state of the process. Here, a process means an execution body of a program that operates independently in each computer, and a plurality of different processes can operate in parallel. Especially in computer systems for control, it is important to complete the operation of the program within a certain elapsed time, and in order to achieve this, the operation priority of the process is set so that it can operate before other processes. It is defined. The high-priority process runs ahead of the low-priority process, and the low-priority process starts running after the high-priority process has finished processing. In general, a process with a high priority is an important process.

The process in this embodiment is not limited to the process in a narrow sense, and includes so-called tasks and the like. That is, the process of the present embodiment may be a unit of the execution body of the program.

In addition, the priority 351 of the process management table 240 distinguishes between a process having a high process operation priority and a process having a normal level. In this embodiment, two types of "high" and "normal" are distinguished, but in addition to these, "low" may be added to distinguish them into three or more types. Further, PID352 is an identifier that identifies each process, and indicates a different number for each process.

Operation level 353 indicates the priority in operation in each process. The priority 351 corresponds to the operation level 353 with each other. That is, the smaller the operation level value, the higher the priority 351. Here, values with operating levels from 1 to 9 are defined as "high" priority, and those with an operating level of 10 or higher are defined as "normal" priority. As described above, in the present embodiment, the priority 351 and the operation level 353 correspond to each other, but these may be independent values.

In addition, the process management table 240 includes an operation ratio 354 for each process. The operation ratio 354 indicates the ratio of the operation time of an individual process to the operation time of the entire process operating in a unit time. This operation ratio 354 is periodically calculated and updated by the operation information collecting unit 200. For example, an operation ratio of 8% means that the process was operating for 8% of the total time that the entire process was operated in 1 second. A process with a high operating ratio is generally an important process.

The collection cycle 355 is a value that specifies the cycle for collecting operation information for each process. When the collection cycle 355 is 100, the operation information is collected by the operation information collection function in a cycle of 100 msec. The collection cycle 355 is determined according to the importance. That is, it is calculated by the process selection unit 220 using the operation level 353 and the operation ratio 354, which are examples of the importance. As an example of this, the process sorting unit 220 calculates using the following (Equation 1) and periodically updates this collection cycle.

Collection cycle = (operation level x 100)-(operation ratio x 1000) ... (number 1)
(However, the minimum value is rounded up to 100, 10th place)
Further, the operation information item 356 indicates the selection result for the operation information indicated by the detailed information 303 in the operation information item table 230. That is, the operation information item 356 is set to the operation information item 356 indicating the operation information to be collected in the process having the priority 351 of "high". Therefore, the operation information collection unit 200 collects the operation information indicated by the operation information item 356 for the process having the priority 351 of "high". In the present embodiment, the operation information collection unit 200 collects the common information 302 as the operation information to be collected for the process of "normal" priority. However, the operation information item 356 may be set for a process having a "normal" priority. In this case, it is desirable that the "high" priority operation information item 356 has a larger number of items than the "normal" priority operation information item 356. These processes will also be described in the flowcharts shown in FIGS. 4 and 4.

Next, the details of the processing of the present embodiment will be described with reference to each flowchart shown in FIGS. 4 to 6. The main body of the processing shown in these flowcharts will be described using the configurations shown in FIGS. 2A and 2B.

FIG. 4 is a flowchart showing the processing flow of the system monitoring device 10 in the present embodiment. First, in step S401, the monitoring agent 50 is started on the computer for which the operation information is collected. This activation is executed when predetermined conditions such as activation of the computer 20, predetermined time (example: 7 o'clock every day), and activation instructions from the system monitoring device 10 and the terminal device 60 are satisfied. In each flowchart, the monitoring agent 51 is processed in the same manner as the monitoring agent 51, but the description thereof will be omitted.

Further, in step S402, the monitoring manager 40 on the system monitoring device 10 is started. It is desirable that this startup be executed in response to the startup of the monitoring agent 50. In this case, the monitoring agent 50 sends a start instruction. Further, this activation may be executed when predetermined conditions such as activation of the computer 20, a predetermined time (eg, 7 o'clock every day), and a activation instruction from the system monitoring device 10 or the terminal device 60 are satisfied. Further, the order of steps S401 and S402 may be reversed. In this case, it is desirable that the monitoring manager 40 sends a start instruction to the monitoring agent 50.

Next, in step S403, the operation information item table (agent) 260 is updated. For this purpose, first, the operation information collection unit 200 of the monitoring manager 40 sends an operation information collection instruction to the computer 20. For this purpose, the operation information collection unit 200 distributes the operation information collection item information of the operation information item table 230 to the computer 20.

As a result, the operation information collection unit (agent) 280 stores the distributed operation information collection item information in the operation information item table (agent) 260 on the computer 20. For example, the operation information collection unit (agent) 280 copies the operation information collection item information to the operation information item table (agent) 260 and updates the operation information collection item information.

Further, in step S404, the operation information collecting unit 200 initializes the process management table 240. For this purpose, the operation information collection unit 200 may set a predetermined value in the process management table 240, or collects information on the process operating on the computer 20, and has a priority of 351 and a PID 352 and an operation level of 353. You may take in the value for each process and set it. For example, at the time of initialization, the operation information collection unit 200 sets the operation ratio to 0%, the collection cycle to 5000 (5 seconds), and the operation information to be unset (all off) as initial values.

In addition, the operation information collection unit 200 sends the process management information of the initialized process management table 240 to the monitoring agent 50. Then, the monitoring agent 50 initializes the process management table (agent) 270 by setting the transmitted process management information.

Next, in step S405, the operation information of the computer 20 is collected. For this purpose, the operation information collection unit (agent) 280 of the monitoring agent 50 collects the operation information of the computer 20 according to the process management information stored in the process management table (agent) 270. Then, the monitoring agent 50 stores the collected operation information in the collected data DB 290.

Then, the operation information collection unit 200 collects the operation information stored in the collection data DB 290 for each process according to the collection cycle 355 and the operation information item 356 set in the process management table 240, and records the operation information in the operation information DB 250. do.

The operation information may be collected from the collected data DB 290 to the operation information DB 290 as follows. The operation information collection unit (agent) 280 reads from the collected data DB 290 and sends it to the operation information DB 290.

Next, in step S406, the operation information collection unit 200 determines whether the monitoring manager 40 has been instructed to stop the operation information collection process. As a result, if it is determined that the stop instruction has been given, the process proceeds to step S411. If it is determined that there is no stop instruction, the process proceeds to step S406.

In step S411, the operation information collection unit 200 sends a stop instruction to the monitoring agent 50 on the computer 20. As a result, the monitoring agent 50 stops functioning. Further, in step S412, the operation information collecting unit 200 stops the monitoring manager 40 and ends the monitoring process.

Further, in step S407, the process selection unit 220 confirms whether or not the process management table 240 exceeds a predetermined update cycle. In a normal control system, there are few batch processes that process a large amount of data. Therefore, as the update cycle, a value of about 1 hour may be used for a certain period of time on average. If the result in this step is not exceeded, the process returns to step S405 and the process is continued. If it is exceeded, the process proceeds to step S408.

In step S408, the process selection unit 220 determines the importance of the process running on the computer 20 to the target computer system 1. Here, as an example of the importance, the operation level 353 itself, the priority 351 based on the operation level 353, and other indicators are included. Then, in this step, the process selection unit 220 uses the importance to determine the collection conditions that are the conditions for collecting the operation information.

The determination of importance and collection conditions will be described below using two examples. As a first example, the process selection unit 220 determines the operation level 353 as the importance. This determination method will be described with reference to S501 in FIG. 5 described later. Next, the process selection unit 220 calculates the collection cycle 355, which is an example of the collection conditions, using the determined operation level 353 and the operation ratio 354 of the corresponding process. This calculation will be performed using the above-mentioned (Equation 1).

As a second example, the process selection unit 220 determines the priority 351 as the importance. As described above, it is desirable that the process sorting unit 220 specify the priority (“high” or “normal”) according to the operation level 353 specified in the first example. Next, the process selection unit 220 specifies the operation information item 356 defined for each priority 351 as a collection condition. Here, the priority 351 may be calculated by giving priority (weighting) to the operation level 353 over the operation ratio 354. Specifically, the process selection unit 220 determines that the operation level 353 is one digit, the priority 351 is "high", and the two digit is "normal". The process sorting unit 220 may sort in each priority in descending order of the operation ratio 354, and the sorted order may be specified as the importance. Further, the process sorting unit 220 is stored in the process management table 240 in the sorted order. The calculation of the collection cycle, which is the first example of this step, will be described with reference to FIG.

Next, in step S409, the process selection unit 220 stores the process importance and collection conditions determined in step S408 in the process management table 240. For example, the process sorting unit 220 stores the priority 351 and the operation information item 356. At this time, for the process to which the priority 351 belongs to the "high" priority, that is, the important process, the operation information item 356 is determined according to the collection cycle 355. As a result, the on / off value of the operation information item 356 to be collected is updated, and the number of the operation information item 356 can be increased as the process has a higher importance, that is, a priority 351.

As another example, the process selection unit 220 stores the operation level 353 and the collection cycle 355. The process management table 240 may be provided with items of importance and information collection information, and the process selection unit 220 may be configured to update these items.

Next, in step S410, the system operation status diagnosis unit 210 diagnoses the operation status of the computer system 1. Specifically, the system operation status diagnosis unit 210 reads the operation information of each process collected according to the setting value of the process management table 240 from the operation information DB 250. Then, the system operation status diagnosis unit 210 diagnoses whether or not there is a sign that the stable operation of the computer system 1 is hindered. The details of this step will be described later with reference to FIG.

Next, using FIG. 5, the details of step S408 in FIG. 4 will be described as an example of calculating the collection cycle. In this process, the process selection unit 220 executes the following steps for each process indicated by each process management information registered in the process management table 240.

First, in step S501, the process selection unit 220 determines the operation level of the process when performing this step by extracting it from the operation information data collected and stored in the operation information DB 250.

Next, in step S502, the process selection unit 220 calculates the ratio of the operating time of each individual process to the sum of the operating times of the operating processes during the update cycle period as the operating ratio 354.

Next, in step S503, the process selection unit 220 applies the calculated operation ratio 354 and operation level 353 to the above-mentioned (Equation 1) to calculate the operation information collection cycle 355. This is the end of the explanation of the flowchart of FIG.

Next, the details of step S410 in FIG. 4 will be described with reference to FIG. In this flowchart, the system operation status diagnosis unit 210 executes the following processing for each process indicated by each process management information registered in the process management table 240.

First, in step S601, the system operation status diagnosis unit 210 reads out the common information 302 (memory usage size, etc.) data of the operation information item table 230 among the operation information stored in the operation information DB 250. The common information 302 is an item that can be commonly used in the diagnosis of each process, and is, for example, the most basic information among the operation information, which is information that can remarkably find a change in the behavior of the process. As a more specific example, the system operation status diagnosis unit 210 reads the operation information, which is the data accumulated from the past 24 hours ago, from the operation information DB 250.

Next, in step S602, the system operation status diagnosis unit 210 diagnoses the data indicated by the read common information 302. More specifically, the system operation status diagnosis unit 210 makes a diagnosis by detecting a change in the data value of the read data. In this diagnosis, the system operation status diagnosis unit 210 diagnoses that there is a sign of a system failure when there is a data value outside the reference range specified for each data. Then, the system operation status diagnosis unit 210 outputs the data value and the PID 352, which is the identifier of the process, as the diagnosis result to the terminal device 60 as message data. Further, the system operation status diagnosis unit 210 may store the diagnosis result in the auxiliary storage unit 104 of the system monitoring device 10.

Next, in step S603, the system operation status diagnosis unit 210 determines whether or not the process to be diagnosed is an important process. This determination is made according to the value of priority 351 in the process management table 240. In the present embodiment, the system operation status diagnosis unit 210 determines that the process is important if the priority 351 is "high" predetermined information. If it is determined that the process is important, the process proceeds to step S604. If it is determined that the process is not important, the process shown in this flowchart is terminated.

next. In step S604, the system operation status diagnosis unit 210 reads the data corresponding to the item set in the operation information item 356 of the process management table 240 from the operation information DB 250. These data are classified as detailed information as operation information, and it is possible to confirm the operation status of a detailed process. As for the detailed information, for example, the data accumulated from the past 24 hours ago is read from the operation information DB 250.

Next, in step S605, the system operation status diagnosis unit 210 makes a diagnosis by detecting a change in the data value of the read data. Even in this diagnosis, the system operation status diagnosis unit 210 will be in trouble if it is out of the standard range specified for each data, or if the data changes are compared every hour and the form of the changes is significantly different. Judge that there are signs of reaching. Then, the system operation status diagnosis unit 210 outputs the diagnosis result as message data to the terminal device 60 together with the data value and the value of the PID 352 which is the identifier of the process. Further, the system operation status diagnosis unit 210 may store the diagnosis result in the auxiliary storage unit 104 of the system monitoring device 10. This is the end of the explanation of FIG.

According to the above embodiments, the following problems can also be solved. First, in order to determine the abnormal state of the operation information, it is necessary to have the operation information in the state showing the abnormal state or the sign of the abnormality that occurred in the past, and if there is no data that can be clearly judged to be abnormal, the abnormality sign I can't predict.

Secondly, if there is a change in the environment due to the addition or abolition of peripheral devices, or if there is a change inside or outside the computer system due to software updates, etc., there are the following problems. The operating information that identifies the past abnormal state or the state showing the sign of the abnormal state to be compared cannot be used as the basis for determining the abnormal state in the changed system. In addition, there may be a deviation in the reference range, and it is necessary to collect operation information used for discrimination and review the reference range each time, which makes it difficult to follow changes in the system.

Third, in order to accurately determine the abnormal state of the computer system or the state showing signs of abnormality, it is necessary to collect a large amount of information in a short period of time to collect operation information and execute recording. It doesn't become. For this reason, there arises a problem that the processing load becomes high in the computer in the system for collecting the operation information and the monitoring system for recording and holding the operation information. Therefore, in order not to put a heavy load on the computer system and not to affect the system operation work, it is necessary to prepare high-performance hardware.

That is, in the present embodiment, it is possible to automatically determine a process important for the operation of the system business other than the high-performance computer resource, and analyze the operating status of the important process in detail. For this reason, it becomes possible for the system to detect signs of failure in detail on a process-by-process basis, and by taking measures to prevent the occurrence of failures in a planned manner, it is possible to maintain stable operation of the entire computer system. It will be possible.

1 ... computer system, 10 ... system monitoring device, 20 ... computer, 21 ... computer, 30 ... communication path, 40 ... monitoring manager, 50 ... monitoring agent, 51 ... monitoring agent

Claims (8)

In a system monitoring device that monitors a computer system that realizes a predetermined function by executing multiple processes.
A process management table that stores collection conditions that collect operation information for each of the multiple processes,
An operation information collection unit that collects operation information of each process of the computer system according to the stored collection conditions.
The importance of each process to the whole of the plurality of processes is determined, the collection conditions of the processes are specified according to the importance, and the stored collection conditions are specified as the collection conditions. A system monitoring device with a process sorting unit to update to. In the system monitoring device according to claim 1,
In the process management table, as the collection conditions, the collection cycle of operation information in the process, the operation level according to the priority of the operation in the process, and the operation time of the process in the plurality of processes are displayed for each process. Memorize the operation ratio that indicates the ratio,
The process sorting unit is a system monitoring device that calculates the collection cycle of the operation information in each process as the collection condition by using the operation level and the operation ratio, which are the importance. In the system monitoring device according to claim 2,
The process selection unit further specifies the priority of the operation in each process according to the operation level as the importance, and determines the operation information item indicating the operation information to be collected according to the priority.
The process management table is a system monitoring device that stores the operation information item as the collection condition for each process. In the system monitoring device according to claim 3,
The process selection unit selects an important process from the plurality of processes according to the priority.
Further, a system monitoring device having a system operation status diagnosis unit that diagnoses the computer system using the operation information indicated by the operation information item for the selected important process. In a system monitoring method using a system monitoring device that monitors a computer system that realizes a predetermined function by executing multiple processes,
In the process management table of the system monitoring device, the collection conditions for collecting the operation information of each of the plurality of processes are stored.
The operation information collecting unit of the system monitoring device collects the operation information of each process of the computer system according to the stored collection conditions.
The process selection unit of the system monitoring device determines the importance of each process to the whole of the plurality of processes, specifies the collection conditions of the process according to the importance, and stores the above. A system monitoring method that updates the collection conditions to the specified collection conditions. In the system monitoring method according to claim 5,
In the process management table, as the collection conditions, the collection cycle of operation information in the process, the operation level according to the priority of the operation in the process, and the operation time of the process in the plurality of processes are displayed for each process. Memorize the operation ratio that indicates the ratio,
A system monitoring method in which the process sorting unit calculates the collection cycle of the operation information in each process as the collection condition by using the operation level and the operation ratio, which are the importance. In the system monitoring method according to claim 6,
The process selection unit further specifies the priority of the operation in each process according to the operation level as the importance, and determines the operation information item indicating the operation information to be collected according to the priority.
The process management table is a system monitoring method for storing the operation information item as the collection condition for each process. In the system monitoring method according to claim 7,
The process selection unit selects important processes from the plurality of processes according to the priority.
Further, a system monitoring method for diagnosing the computer system by using the operation information indicated by the operation information item for the important process selected by the system operation status diagnosis unit of the system monitoring device.

Images