JP4464655B2 - Computer monitoring apparatus and message processing method related to monitored computer - Google Patents

Description

  The present invention relates to a monitoring apparatus that monitors a computer system, and more particularly to filtering processing of messages received by the monitoring apparatus.

  In recent years, with the diversification of computer software and the improvement of hardware performance, system operation requirements have become more complex. For this reason, a monitoring apparatus that monitors the operation of a computer system has to acquire more information, such as information messages and failure messages, from each software and hardware. As a result, the number of messages that need to be processed becomes enormous, which may cause problems such as a decrease in the processing speed of the monitoring apparatus or an oversight of messages due to an increase in the burden on the operation operator. This becomes even more prominent when individual operation management tools are introduced for each software and hardware, and tools (integrated monitoring system) for monitoring these tools in an integrated manner are introduced.

  Therefore, in order to avoid such a situation, some monitoring apparatuses have a message filtering function that discards unnecessary messages and extracts only necessary messages (for example, non-patent literature). 1).

http://www-6.ibm.com/jp/software/tivoli/products/systems_mgr.html

  However, as the target system is monitored in more detail, the number of messages gathered in one monitoring apparatus increases, and the filtering processing load increases accordingly. As a result, if the filtering load increases, it is difficult to improve the processing performance of the entire monitoring apparatus even if filtering is performed.

  Therefore, an object of the present invention is to improve the performance of the filtering process of the monitoring device.

  According to one embodiment of the present invention, a computer monitoring apparatus applies a plurality of conditions to a receiving unit that receives a message about a computer to be monitored, and the message received by the receiving unit in a predetermined order. , If any one of the conditions is met, a message determination processing unit that does not apply the subsequent conditions, and based on the identification information of the matched conditions, accumulates the results of the match by the identification information, and the results And an order determining unit that determines the order in which the plurality of conditions are applied, and a storage unit that stores the message that does not match any of the plurality of conditions in the message determination processing unit.

  In a preferred embodiment, the order determination unit may count the number of matched matches for each identification information, and determine the order based on the number of matches.

  In a preferred embodiment, the order determination unit counts the number of matches for each matching time zone for each identification information and for each time zone. Then, the order can be determined based on the number of matches by time zone after a predetermined time zone.

  In a preferred embodiment, the number of matches by time zone is weighted by multiplying a larger count in the time zone closer to the current time. The order may be determined based on the weighted number of times.

  In a preferred embodiment, the number of matches is weighted according to the time required for the message determination processing unit to process each condition. The order may be determined based on the weighted number of times.

  In a preferred embodiment, the order determination unit deletes, from the plurality of conditions applied by the message determination processing unit, a condition in which the number of matches within a predetermined period is equal to or less than a predetermined number among the plurality of conditions. You may do it.

  In a preferred embodiment, the receiving unit may receive a message regarding the monitored computer transmitted from a plurality of other computer monitoring devices.

  Hereinafter, a computer integrated monitoring system according to an embodiment of the present invention will be described with reference to the drawings.

  The overall structure of this system is shown in FIG. This system includes an integrated monitoring device 1, a storage device 2, an external operation management device 3, and a display device 4 such as a CRT (Cathode Ray Tube) or a liquid crystal display device. The integrated monitoring device 1 and the external operation management device 3 are connected by a network 9 such as a LAN (Local Area Network) or the Internet.

  The integrated monitoring device 1 and the external operation management device 3 are both configured by, for example, a general-purpose computer system, and individual components or functions in the devices 1 and 3 described below execute, for example, a computer program Is realized.

  The integrated monitoring apparatus 1 monitors a computer (not shown) to be monitored. At this time, in the present embodiment, the integrated monitoring device 1 monitors via the external operation monitoring device 3. That is, each external operation monitoring device 3 monitors a computer that is a monitoring target.

  For example, the external operation management apparatus 3 individually monitors the software and hardware of each monitored computer. The external operation management apparatus 3 then displays information indicating the operating status of each monitored computer, for example, the operating status of the application program (whether it has been normally or abnormally terminated), the network communication status, the database update status, etc. get. Therefore, the external operation management apparatus 3 uses, for example, a job schedule tool that manages the operation of commercially available jobs, a network monitoring tool that monitors network failures, or a database monitoring tool that monitors the operating status of a database. it can.

  Each external operation monitoring device 3 transmits a message 50 relating to the monitoring target computer to the integrated monitoring device 1 based on the information indicating the operating state of the monitoring target computer.

  The integrated monitoring apparatus 1 receives the message 50 sent from the external operation monitoring apparatus 3, filters the message 50 according to a predetermined rule, and reduces the number of messages. Then, the integrated monitoring device 1 causes the display device 4 to display the message 50 remaining after filtering. Details of the filtering process will be described below.

  The storage device 2 stores a determination condition for filtering the message 50. As the storage device 2, for example, a hard disk or a CD-ROM can be used. The storage device 2 may be a storage device of another computer connected via a network.

  As shown in FIG. 1, the integrated monitoring apparatus 1 includes a determination condition acquisition unit 11, a determination condition storage unit 12, a message reception unit 13, a filtering processing unit 14, a display control unit 15, a buffer 16, and a message. A storage unit 17 and a determination order update unit 18 are provided. The determination rank update unit 18 includes a counter 19 and manages it.

  The determination condition acquisition unit 11 acquires a determination condition for message filtering stored in the storage device 2. The determination condition acquired here is stored in the determination condition storage unit 12. In order to perform the filtering process described below, the determination condition is stored in the determination condition storage unit 12 in advance.

  The determination condition storage unit 12 has, for example, a data structure as shown in FIG. That is, the determination item 121, the determination ID 122, and the determination condition 123 are included as data items. The determination condition storage unit 12 can store a plurality of determination condition records in which data of each item is set. The plurality of determination condition records may be sorted in the order of determination order 121 described below.

  The determination order 121 indicates the order in which the filtering processing unit 14 described later applies a plurality of determination conditions. That is, the filtering processing unit 14 determines whether or not the received message 50 matches the condition in order from the determination condition 123 whose determination order 121 is “1”. The determination order 121 is updated by the determination order update unit 18 as described later. The determination ID 122 is information for uniquely identifying the determination condition 123. The determination condition 123 indicates a condition in which the filtering processing unit 14 discards the message. That is, a message that matches the condition indicated by the determination condition 123 is discarded.

  Referring to FIG. 1, the message receiving unit 13 receives a message 50 sent from the external operation monitoring device 3 via the network 9. The message 50 received by the message receiving unit 13 is temporarily stored in the buffer 16.

  An example of the format of the message 50 received by the message receiving unit 13 is shown in FIG. The message 50 includes a message ID 51, a system name 52, a source node ID 53, a source AP name 54, a severity 55, a date and time 56, a message type 57, and a message text, as shown in FIG. 58 as data items.

  The message ID 51 is information for uniquely identifying a message. The system name 52 is the name of the system being monitored. The source node ID 53 is information for identifying the node computer in which the event notified by this message has occurred. The source AP name 54 is information for identifying an AP (application program) in which an event notified by this message has occurred. The severity 55 indicates the severity of the event notified by this message. The severity 55 is indicated by a numerical value corresponding to the magnitude of the severity, for example. Occurrence date and time 56 indicates the occurrence date and time of the event notified by this message. The message type 57 indicates the type of message such as error (E), warning (W), information (I), and the like. The message text 58 is an area for storing a character string. Each external operation monitoring device 3 can be set freely.

  Referring to FIG. 1, the filtering processing unit 14 performs a filtering process on the message 50 stored in the buffer 16. For example, the filtering processing unit 14 acquires one message 50 from the buffer 16 by first-in first-out. Then, the determination condition 123 stored in the determination condition storage unit 12 is applied to the acquired message, and it is determined whether or not the message 50 matches the determination condition. When a plurality of determination conditions 123 are stored in the determination condition storage unit 12, they are sequentially applied according to the determination order 121. When any one of the determination conditions 123 is met, the determination rank update unit 18 is notified of the determination ID 122 of the determination condition. If any one of the determination conditions 123 is met, the filtering processing unit 14 acquires the next message 50 from the buffer 16 without applying the determination condition 123 with the determination order 121 and thereafter, and performs a filtering process for the next message 50. Migrate to

  As a result of performing the filtering process, a message 50 that does not match any of the determination conditions 123 stored in the determination condition storage unit 12 is stored in the message storage unit 17. On the other hand, the message 50 that matches any of the determination conditions 123 is not stored in the message storage unit 17. As a result, the message 50 to be stored in the message storage unit 17 is selected by the filtering processing unit 14. That is, the number of messages stored in the message storage unit 17 is reduced by discarding the received messages 50 that match the determination condition as unnecessary messages.

  The display control unit 15 controls the display device 4 to display various information. For example, the display control unit 15 acquires the message 50 accumulated in the message storage unit 17 and causes the display device 4 to display it. The display order can be, for example, the order received (time series). Further, when a new message 50 is stored in the message storage unit 17, the display control unit 15 may display it on the display device 4 in real time.

  The buffer 16 is a storage device for temporarily storing the message 50 received by the message receiving unit 13.

  The message storage unit 17 is a storage unit for storing the message 50 that has passed the filtering in the filtering processing unit 14.

  Here, the processing procedure from when the integrated monitoring apparatus 1 receives a message to when it is filtered and displayed on the display apparatus 4 will be described with reference to the flowchart shown in FIG.

  First, the message receiving unit 13 receives a message from the external operation monitoring device 3, and stores the received message in the buffer 16 (S11).

  The filtering processing unit 14 extracts the message from the buffer 16 and determines whether or not the determination order 121 stored in the determination condition storage unit 12 matches the determination condition 123 of “1” (S12).

  If this determination condition 123 is met (S12: Yes), the processing for this message 50 is terminated. When the determination condition 123 is not met (S12: No), if the determination condition storage unit 12 has the determination condition 123 of the next determination order 121, it is acquired and the process returns to step S12 (S13: Yes).

  If there is no match even when the determination order 121 is applied up to the lowest determination condition 123 (S13: No), the message is stored in the message storage unit 17, and the display control unit 15 stores the message in the display device 4. It is displayed (S14).

  Note that the flowchart of FIG. 4 shows the procedure of processing performed for one message. However, since the buffer 16 and the message storage unit 17 are provided in the present embodiment, the message receiving unit 13, the filtering processing unit 14, and the display control unit 15 can also perform processing independently.

  With reference to FIG. 1 again, the description of the integrated monitoring apparatus 1 will be continued. The counter 19 stores the results of processing in the filtering processing unit 14. The determination order update unit 18 updates the determination order 121 of the determination condition storage unit 12 based on the processing results in the filtering processing unit 14. The timing at which the determination order update unit 18 performs update is arbitrary. For example, it may be updated automatically at predetermined time intervals, or may be updated upon receiving an instruction from the operator.

  In the present embodiment, the configuration of the counter 19 and the function of the determination order update unit 18 have a plurality of modes as described below. In the following description, unless otherwise specified, the determination order update unit 18 sets and updates the counter 19.

  The configuration of the counter 19 according to the first aspect is shown in FIG. That is, the counter 19 stores the number of times 192 matched in the filtering process in the filtering processing unit 14 for each determination ID 191. The number of times 192 is counted up every time a notification of the determination ID is received from the filtering processing unit 14. That is, the number of times 192 indicates the number of times that the determination condition 123 is matched in the filtering processing unit 14. The number of times 192 can be initialized at an arbitrary timing.

  In this case, the determination order update unit 18 updates the determination order 121 of the determination condition storage unit 12 in descending order of the number of times 192.

  Accordingly, since the filtering processing unit 14 is applied in order from the determination condition that is highly likely to match, the filtering process can be speeded up.

  The configuration of the counter 19 according to the second aspect is shown in FIG. That is, the counter 19 stores the number of times for each time zone for each judgment ID 191 (number of times by time zone 193). In the example of FIG. 6, the number of times the notification of the determination ID is received every hour is counted and recorded. Then, after the predetermined time zone, the number of times 193 by time zone for the latest three hours is held here. The total number of times 193 according to the time period for 3 hours is the total number 194.

  In this case, the determination order update unit 18 updates the determination order 121 of the determination condition storage unit 12 in descending order of the total number of times 194.

  As a result, the determination order of the determination conditions that have been matched a lot immediately before is higher, and is applied preferentially from these determination conditions when filtering is performed. As a result, the filtering can be further speeded up.

  In the third aspect, the counter 19 has a configuration as shown in FIG. That is, the counter 19 holds the number of times 193 for each time zone as in the second mode. In the example of FIG. 7, the counter 19 further has a weighting count 195 that is summed after appropriate weighting is performed on the timetable count 193. Weighting is performed by multiplying the time zone closer to the current time by a larger coefficient. For example, the previous hour (3: 00 to 4:00), the previous hour (2: 00 to 3:00), and the previous hour (1: 00 to 2:00) The weighting count 195 may be obtained by multiplying the different count 193 by 1, 0.5, or 0.25 as a coefficient.

  In this case, the determination order update unit 18 updates the determination order 121 of the determination condition storage unit 12 in descending order of the weighting count 195.

  This makes it possible to further speed up filtering when the same type of messages discarded by filtering are received in a relatively short time.

  In the fourth mode, the counter 19 has a calculation cost 196 and a number of times 197 reflecting the calculation cost, as shown in FIG. The calculation cost 196 is obtained by indexing the time required for the filtering processing unit 14 to apply the determination condition indicated by each determination ID 191 and determine whether or not the filtering condition is met. For example, a process for determining whether a specific character string is included in an item (character string type item) in which a character string can be freely stored, and an item in which only an integer is set (integer type item) is set to “1” The processing time is different from the processing for determining whether or not. Focusing on this point, a calculation cost 196 corresponding to the processing time (or expected processing time) is set in advance for each determination ID 191. Here, the shorter the processing time, the higher the priority is set.

  The number of times 197 reflecting the calculation cost is calculated by performing weighting based on the calculation cost 196 to the actual number of times 192 that has been matched by the filtering processing unit 14. In the example of FIG. 8, 1, 2, and 3 are assigned to the calculation cost 196 in order from the shortest processing time. The number of times 197 reflecting the calculation cost is calculated by multiplying the number of times 192 by {(1 + 2 + 3) / calculation cost}. Accordingly, the number of times 197 reflecting the calculation cost becomes larger as the processing time is shorter.

  In this case, the determination order update unit 18 updates the determination order 121 of the determination condition storage unit 12 in descending order of the number of times 197 reflecting the calculation cost.

  As a result, filtering is performed in accordance with the order in which the time required for calculation of each determination condition is added to the past results matched by the filtering, and a reduction in the overall processing time is expected.

  Note that the determination rank update unit 18 may delete records of determination conditions that satisfy certain conditions from the determination condition storage unit 12. Here, as a condition for deletion, for example, the number of matches within a predetermined time may be a predetermined value or less. Both the predetermined time and the predetermined value can be set arbitrarily. The predetermined value includes “0”, that is, a case where the predetermined value does not match at all (the determination processing ID is not notified from the filtering processing unit 14). Further, the predetermined time and the predetermined value may be common to all determination condition records, or may be different for each determination condition record. In addition, the determination condition deletion function can be applied to any of the above-described aspects.

  The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the gist of the present invention.

1 is a diagram illustrating an overall configuration of an integrated monitoring system according to an embodiment of the present invention. 3 is a diagram illustrating an example of a determination condition storage unit 12. FIG. It is a figure which shows an example of the format of the message 50. FIG. It is a flowchart which shows the procedure of a filtering process. It is a figure which shows the 1st aspect of the counter. It is a figure which shows the 2nd aspect of the counter. It is a figure which shows the 3rd aspect of the counter. It is a figure which shows the 4th aspect of the counter.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Integrated monitoring apparatus, 2 ... Memory | storage device, 3 ... External operation monitoring apparatus, 4 ... Display apparatus, 9 ... Network, 12 ... Judgment condition memory | storage part, 14 ... Filtering process part, 18 ... Judgment order update part, 19 ... Counter 50 ... Message.

Claims (8)

A receiver for receiving messages about the monitored computer;
Applying a plurality of conditions to the message received by the receiving unit according to a predetermined order, if any one of the conditions is met, a message determination processing unit that does not apply the subsequent conditions;
Based on the identification information of the matched condition, an order determination unit that accumulates the results of the match for each identification information, and determines the order of applying the plurality of conditions based on the results;
A storage unit that stores the message that did not match any of the plurality of conditions in the message determination processing unit ,
The order determination unit counts the number of times of matching by the time zone, which is matched by the identification information and by time zone,
Multiplying the number of matches by time zone by a larger coefficient in the time zone closer to the current time,
Monitoring device for a computer as stipulated the order based on the weighted number. A receiver for receiving messages about the monitored computer;
Applying a plurality of conditions to the message received by the receiving unit according to a predetermined order, if any one of the conditions is met, a message determination processing unit that does not apply the subsequent conditions;
Based on the identification information of the matched condition, an order determination unit that accumulates the results of the match for each identification information, and determines the order of applying the plurality of conditions based on the results;
A storage unit that stores the message that did not match any of the plurality of conditions in the message determination processing unit ,
The order determination unit counts the number of matching times for each identification information,
A weighting according to the time required for the message determination processing unit to process each condition is performed on the number of matches,
Monitoring device for a computer as stipulated the order based on the weighted number. The order determining unit, among the plurality of conditions, conditions, according to claim 1 or 2 wherein said message determination processor is removed from the plurality of conditions to be applied the match count in a given time period is equal to or less than a predetermined number of times Computer monitoring device. The reception unit has been transmitted from a plurality of other computer monitoring device, the monitoring device according to claim 1 or 2, wherein the computer receives a message related to the monitored computer. Receive messages about monitored computers,
In accordance with the order in which a plurality of conditions are determined for the received message, it is determined whether each condition is met,
If any one condition is met, another identification information of the conditions the match, and counts the time zone separately該合time zone matches the number of times of match,
Multiplying the number of matches by time zone by a larger coefficient in the time zone closer to the current time,
Changing the order of applying the plurality of conditions based on weighted times ;
A message processing method relating to a monitored computer, wherein the message is stored in a storage unit when none of the plurality of conditions is met. Receive messages about monitored computers,
In accordance with the order in which a plurality of conditions are determined for the received message, it is determined whether each condition is met,
If any one of the conditions is met, the number of matched times is counted according to the identification information of the matched conditions,
Weighting according to the time required to process each condition for the number of matches,
Changing the order of applying the plurality of conditions based on weighted times;
A message processing method relating to a monitored computer, wherein the message is stored in a storage unit when none of the plurality of conditions is met. When executed on a computer,
Receive messages about monitored computers,
In accordance with the order in which a plurality of conditions are determined for the received message, it is determined whether each condition is met,
If any one condition is met, another identification information of the conditions the match, and counts the time zone separately該合time zone matches the number of times of match,
Multiplying the number of matches by time zone by a larger coefficient in the time zone closer to the current time,
Changing the order of applying the plurality of conditions based on weighted times ;
A computer program for message processing relating to a computer to be monitored, which stores the message in a storage unit when none of the plurality of conditions is met. When executed on a computer,
Receive messages about monitored computers,
In accordance with the order in which a plurality of conditions are determined for the received message, it is determined whether each condition is met,
If any one of the conditions is met, the number of matched times is counted according to the identification information of the matched conditions,
Weighting according to the time required to process each condition for the number of matches,
Changing the order of applying the plurality of conditions based on weighted times;
A computer program for message processing relating to a computer to be monitored, which stores the message in a storage unit when none of the plurality of conditions is met.

Images