JP4466615B2 - Operation management system, monitoring device, monitored device, operation management method and program - Google Patents

Description

  The present invention relates to an operation management technology that supports operation management of devices that provide information communication services and the like, and in particular, a monitoring device monitors the status of a monitored device based on operation information sent from the monitored device. It relates to operation management technology.

  With the advent of an advanced IT (Information Technology) society, the importance of network systems as a social infrastructure increases, and stable operation of network devices that provide such services has become important. Therefore, the monitored device including the service execution means for providing the service transmits the operation information of the service execution means to the monitoring device, and the monitoring device is based on the operation information transmitted from the monitored device. An operation management system that monitors the status of a monitored device has been put into practical use.

  By the way, in the conventional general operation management system, when the monitored device acquires the operation information of the service execution means, it is immediately transmitted to the monitoring device regardless of whether or not it is important. For this reason, the number of pieces of operation information per unit time received by the monitoring apparatus may become very large. Therefore, when configuring a monitoring device, it is necessary to provide sufficient system resources in order to cope with the case where a large amount of operation information is sent, and the system becomes expensive. There was a problem that.

  Therefore, in order to solve such problems, a technique has been proposed in which operation information acquired from service execution means is transmitted to a monitoring device by a transmission method according to the content (see, for example, Patent Document 1).

  The conventional technique described in Patent Document 1 includes a classification unit, an output unit, a priority buffer, and a normal buffer, and performs the following operations. The classifying unit determines whether the operation information acquired from the service execution unit is operation information to be preferentially transmitted based on the content, and if the operation information is to be preferentially transmitted, Write to the priority buffer, otherwise write to the normal buffer. If the operation information is stored in the priority buffer, the output means transmits it to the monitoring device. If the priority buffer is empty, the output means transmits the operation information stored in the normal buffer to the monitoring device. Further, the output means writes the operation information normally stored in the buffer to the logging file at regular time intervals. The operation information written in the logging file is transmitted to the monitoring device in response to a request from the monitoring device.

JP-A-5-250282

  According to the conventional technique described in Patent Document 1, since the number of operation information per unit time received by the monitoring device can be reduced, the cost of the operation management system can be reduced. However, the conventional technique described in Patent Document 1 has the following problems because the transmission method is fixedly determined according to the contents of the operation information.

  In the monitoring device, when the state of the monitored device is monitored based on the operation information sent from the monitored device, a failure determination may be performed by a logical product of a plurality of operation information. For example, when the operation information a, b, and c that satisfy the conditions A, B, and C are received at approximately the same time, the failure determination is performed based on the operation information analysis rule that the monitored device is considered to have failed. Sometimes. At this time, for example, if the transmission method of the operation information a and b that satisfies the conditions A and B is priority transmission, and the transmission method of the operation information c that satisfies the condition C is normal transmission, the operation information a and b Is immediately transmitted to the monitoring device when it occurs, but the operation information c is hardly transmitted to the monitoring device even if it occurs. Therefore, even if the operation information a, b, c is generated in the monitored device, the operation information c is not easily sent to the monitoring device, and it takes time to detect the failure of the monitored device. .

(Object of invention)
SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to make it possible to quickly detect the occurrence of a failure when detecting a failure that has occurred in a monitored apparatus using an operation information analysis rule including a plurality of conditions.

A first operation management system according to the present invention includes:
In an operation management system comprising a monitored device and a monitoring device that monitors the status of the monitored device based on operation information sent from the monitored device,
The monitoring device is
An operation information analysis rule storage unit in which operation information analysis rules used for monitoring the state of the monitored device are registered;
When an operation information analysis rule in which a part of a plurality of conditions is satisfied is generated by the operation information sent from the monitored device, an unsatisfied condition in the operation information analysis rule Transmission setting change request means for requesting the monitored device to change the transmission method of the operation information to establish the transmission method to the transmission method whose transmission timing is earlier than the current transmission method,
The monitored device is
A transmission setting storage unit in which a transmission method according to the content of the operation information is registered;
When transmitting the operation information of the own device to the monitoring device, referring to the transmission setting storage unit, the operation information transmitting means for transmitting by a transmission method according to the content of the operation information;
Transmission setting change means for changing the contents of the transmission setting storage unit in accordance with a request from the transmission setting change request means.

A second operation management system according to the present invention is the first operation management system,
In the transmission setting accumulation unit, the transmission method of each group when the operation information is classified into a plurality of groups according to the contents thereof is registered, and
When the transmission setting change requesting unit generates an operation information analysis rule in which a part of a plurality of conditions is satisfied by the operation information transmitted from the monitored device, the operation information Requesting the monitored apparatus to change the transmission method of the group to which the operation information satisfying the unsatisfied condition in the analysis rule belongs to a transmission method whose transmission timing is earlier than the current transmission method. Features.

A third operation management system according to the present invention is the first operation management system,
The transmission setting change request means
When an operation information analysis rule in which all of a plurality of conditions are satisfied is generated by the operation information sent from the monitored device, one of the plurality of conditions included in the operation information analysis rule is generated. The monitoring apparatus is requested to return the transmission method changed when the condition of the section is satisfied to the transmission method before the change.

A fourth operation management system according to the present invention is the third operation management system,
The transmission method that can be registered in the transmission setting storage unit includes a first transmission method that immediately transmits detected operation information, and a second transmission method that collectively transmits operation information detected during a certain period of time. And is included.

A fifth operation management system according to the present invention is the fourth operation management system,
The transmission setting change request means
When an operation information analysis rule in which a part of a plurality of conditions is satisfied is generated by the operation information sent from the monitored device, an unsatisfied condition in the operation information analysis rule Requesting the monitored apparatus to change the transmission method of the operation information that establishes the second transmission method from the second transmission method to the first transmission method.

A sixth operation management system according to the present invention is the first operation management system,
When the transmission setting change requesting unit generates an operation information analysis rule in which a part of a plurality of conditions is satisfied by the operation information transmitted from the monitored device, After receiving the permission, the monitored device is changed to a transmission method of operation information that establishes an unsatisfied condition in the operation information analysis rule to a transmission method that has a transmission timing earlier than the current transmission method. It is characterized by requesting.

The first monitoring device according to the present invention is:
A monitoring device that monitors the status of the monitored device based on operation information sent from the monitored device,
An operation information analysis rule storage unit in which operation information analysis rules used for monitoring the state of the monitored device are registered;
When an operation information analysis rule in which a part of a plurality of conditions is satisfied is generated by the operation information sent from the monitored device, an unsatisfied condition in the operation information analysis rule Transmission setting change requesting means for requesting the monitored device to change the operation information transmission method for establishing the transmission method to a transmission method whose transmission timing is earlier than the current transmission method. .

A second monitoring device according to the present invention is the first monitoring device,
When the transmission setting change requesting unit generates an operation information analysis rule in which a part of a plurality of conditions is satisfied by the operation information transmitted from the monitored device, the operation information Requesting the monitored apparatus to change the transmission method of the group to which the operation information satisfying the unsatisfied condition in the analysis rule belongs to a transmission method whose transmission timing is earlier than the current transmission method. Features.

A third monitoring apparatus according to the present invention is the first monitoring apparatus,
The transmission setting change request means
When an operation information analysis rule in which all of a plurality of conditions are satisfied is generated by the operation information sent from the monitored device, one of the plurality of conditions included in the operation information analysis rule is generated. The monitoring apparatus is requested to return the transmission method changed when the condition of the section is satisfied to the transmission method before the change.

The monitored device according to the present invention is:
A transmission setting storage unit in which a transmission method according to the content of the operation information is registered;
When transmitting the operation information of the own device to the monitoring device, referring to the transmission setting storage unit, the operation information transmitting means for transmitting by a transmission method according to the content of the operation information;
Transmission setting change means for changing the contents of the transmission setting storage unit in accordance with a request from the monitoring device.

A second monitored device according to the present invention is the first monitored device,
The transmission setting storage unit is registered with a transmission method of each group when the operation information is classified into a plurality of groups according to the contents thereof.

A first operation management method according to the present invention includes:
A monitoring device including an operation information analysis rule storage unit in which operation information analysis rules used for monitoring the status of the monitored device are registered. The monitoring device has a plurality of conditions according to the operation information sent from the monitored device. When a motion information analysis rule that satisfies some of the conditions is generated, a transmission method of motion information that satisfies the unsatisfied condition in the motion information analysis rule is transmitted more than the current transmission method. A first step of requesting the monitored device to change to a transmission method with earlier timing;
When the monitored device including the transmission setting storage unit in which the transmission method according to the content of the operation information is registered transmits the operation information of the own device to the monitoring device, the operation is referred to the transmission setting storage unit, and the operation A second step of transmitting by a transmission method according to the content of the information;
A third step in which the monitored device changes the content of the transmission setting storage unit in accordance with a request from the monitoring device.

A second operation management method according to the present invention is the first operation management method,
When an operation information analysis rule in which a plurality of conditions are all satisfied is generated by the operation information sent from the monitored device, the monitoring device includes a plurality of operations included in the operation information analysis rule. A fourth step of requesting the monitored apparatus to return the transmission method changed when some of the conditions are satisfied to the transmission method before the change is included.

The first program according to the present invention is:
A computer including an operation information analysis rule storage unit in which operation information analysis rules used for monitoring the status of a monitored device are registered;
When an operation information analysis rule in which a part of a plurality of conditions is satisfied is generated by the operation information sent from the monitored device, an unsatisfied condition in the operation information analysis rule Is made to function as a transmission setting change request means for requesting the monitored apparatus to change the transmission method of the operation information that establishes the transmission method to a transmission method whose transmission timing is earlier than the current transmission method.

The second program according to the present invention is the first program,
The transmission setting change request means
When an operation information analysis rule in which all of a plurality of conditions are satisfied is generated by the operation information sent from the monitored device, one of the plurality of conditions included in the operation information analysis rule is generated. The monitoring apparatus is requested to return the transmission method changed when the condition of the section is satisfied to the transmission method before the change.

The third program according to the present invention is:
A computer including a transmission setting storage unit in which a transmission method according to the content of the operation information is registered,
When transmitting the operation information of the own device to the monitoring device, an operation information transmitting unit that refers to the transmission setting storage unit and transmits the operation information according to the content of the operation information,
In accordance with a request from the monitoring device, it functions as transmission setting changing means for changing the contents of the transmission setting storage unit.

[Action]
The monitored device is provided with a transmission setting storage unit in which a transmission method according to the content of the operation information is registered, and the operation information transmitting unit transmits the operation information when transmitting the operation information of the own device to the monitoring device. With reference to the storage unit, transmission is performed by a transmission method according to the content of the operation information.

  The monitoring device is provided with an operation information analysis rule storage unit in which operation information analysis rules used for monitoring the state of the monitored device are registered. The transmission setting change request means in the monitoring device generates the above operation when an operation information analysis rule in which a part of a plurality of conditions is satisfied is generated by the operation information transmitted from the monitored device. The monitored device is requested to change the operation information transmission method that satisfies the unsatisfied condition in the information analysis rule to a transmission method that has a transmission timing earlier than the current transmission method.

  According to the present invention, when a failure occurring in a monitored apparatus is detected using an operation information analysis rule including a plurality of conditions, it is possible to quickly detect the occurrence of the failure.

  The reason for this is that when an operation information analysis rule in which a part of a plurality of conditions is satisfied is generated by the operation information sent from the monitored device, the operation information in the operation information analysis rule is not This is because there is provided transmission setting change requesting means for requesting the monitored apparatus to change the transmission method of the operation information for establishing the establishment condition to a transmission method whose transmission timing is earlier than the current transmission method.

  For example, it is assumed that an operation information analysis rule in which only the condition A among the conditions A, B, and C included therein is generated by the operation information a sent from the monitored apparatus. Here, as a transmission method of the operation information b and c that satisfies the conditions B and C, for example, a transmission method that is not easily transmitted even when operation information is generated is set, such as “INTERVAL (10 min, compress)”. If this is the case, it takes time until the monitoring device receives the operation information b and c. Therefore, it is impossible to quickly detect that a failure has occurred in the monitored device. Therefore, in the present invention, the monitored device is requested to change the transmission method of the operation information b and c to a transmission method (for example, “RAPID”) whose transmission timing is earlier than the current transmission method. . Thereby, since the transmission timing of the operation information b and c is advanced, it becomes possible to quickly detect a failure occurring in the monitored apparatus.

  Next, the best mode for carrying out the invention will be described in detail with reference to the drawings.

[Description of Configuration of First Embodiment]
FIG. 1 is a block diagram showing a configuration example of a first embodiment of an operation management system according to the present invention, which is composed of a plurality of monitored devices 1-1 to 1-n and a monitoring device 2. They are connected to each other via a network 3 such as the Internet.

  The monitored apparatus 1-1 is realized by a computer, and includes a service execution unit 11, an operation information detection unit 12, an operation information transmission unit 13, a transmission setting storage unit 14, and a transmission setting change unit 15. It has. The other monitored devices 1-2 to 1-n have the same configuration.

  The service execution unit 11 has a function of providing a user with a service such as an information communication service.

  The operation information detection unit 12 has a function of acquiring operation information from the service execution unit 11. FIG. 2 shows a configuration example of the operation information T1. As shown in the figure, the operation information T1 is message information including four items TEXT, SOURCE, STATE, and APPLICATION. The item TEXT contains the text indicating the contents of the operation information T1, the item SOURCE contains the device ID of the monitored device that is the source of the operation information T1, and the item APPLICATION contains the program of the application program that is the source of the operation information. In the item STATE, the state of the application program is set.

  The operation information transmission unit 13 has a function of transmitting the operation information detected by the operation information detection unit 12 according to the transmission setting information registered in the transmission setting storage unit 14.

  The transmission setting storage unit 14 is realized by a storage device such as a disk device, and registers the transmission method of each group when the operation information is classified into a plurality of groups according to the contents thereof. FIG. 3 is a diagram showing an example of the contents of the transmission setting storage unit 14. In the example of FIG. 3, m pieces of transmission setting information T21 to T2m are registered. Each transmission setting information T21 to T2m includes a number T2a, an analysis element T2b, and a transmission designation T2c.

  In the number T2a, a number for uniquely identifying the transmission setting information is set.

  In the analysis element T2b, a condition to be satisfied by the operation information to which the transmission setting information is applied is set. This condition can be designated by a character string included in the operation information, a generation source of the operation information, a size comparison between a numerical value included in the operation information and a threshold value, or the like.

  In the transmission designation T2c, a transmission method of operation information that satisfies the conditions set in the analysis element T2b is set. In the present embodiment, two types of transmission methods “RAPID” and “INTERVAL (10 min, compress)” can be set. “RAPID” indicates that the detected operation information is immediately transmitted, and “INTERVAL (10 min, compress)” indicates that the operation information detected during that time is compressed and transmitted collectively. The transmission method described above is an example, and a transmission method other than the above may be set.

  Here, the transmission setting information shown in FIG. 3 will be described.

  The transmission setting information T21 with the number T2a “1” indicates that the operation information including the character string “number of clients” is transmitted immediately after detection. Therefore, the operation information classified into the group including the character string “number of clients” is immediately transmitted to the monitoring device 2 after being detected by the operation information detecting unit 12.

  The transmission setting information T2k with the number T2a “k” indicates that the operation information in which STATE = error and APPLICATION = System is transmitted immediately after detection.

  The transmission setting information T2 (k + 1) with the number T2a “k + 1” indicates that the operation information including the character string “CPULOAD” is compressed and transmitted every 10 minutes.

  The transmission setting information T2m having the number T2a of “m” is transmitted by compressing operation information that does not satisfy the conditions set in the analysis element T2b in the operation setting information T21 to T2 (m−1) every 10 minutes. It shows that

  The transmission setting change unit 15 has a function of changing the contents of the transmission setting storage unit 14 in accordance with a transmission setting change request sent from the monitoring device 2.

  The monitored apparatus 1-1 having such a function can be realized by a computer, and when realized by a computer, for example, as follows. A disk, a semiconductor memory, and other recording media on which a program for causing the computer and the monitored device 1-1 to function are recorded are prepared, and the computer reads the program. The computer controls the operation of the computer according to the read program, thereby realizing the service execution unit 11, the operation information detection unit 12, the operation information transmission unit 13, and the transmission setting change unit 15 on the computer.

  The monitoring device 2 is a device that monitors the status of each monitored device 1-1 to 1-n based on the operation information sent from the monitored devices 1-1 to 1-n, and includes operation information collecting means. 21, an operation information storage unit 22, an operation information analysis unit 23, an operation information analysis rule storage unit 24, a transmission setting change request unit 25, and a transmission setting change request transmission unit 26.

  The operation information collection unit 21 has a function of registering operation information sent from each monitored device 1-1 to 1-n in the operation information storage unit 22 realized by a storage device such as a disk device.

  The operation information analysis rule accumulating unit 24 is realized by a storage device such as a disk device, and monitors the state (normal or faulty) of each monitored device 1-1 to 1-n. The operation information analysis rule used for the registration is registered.

  FIG. 4 is a diagram illustrating an example of the contents of the motion information analysis rule storage unit 24, in which a plurality of motion information analysis rules T31, T32,... Are registered. Each of the operation information analysis rules T31, T32,... Includes a number T3a, a detection condition T3b, and a handling instruction T3c.

  In the number T3a, a number for uniquely identifying the operation information analysis rule is set. In the detection condition T3b, a condition for firing the operation information analysis rule is set. In the handling instruction T3c, processing to be performed when the operation information analysis rule is fired is set.

  Here, the operation information analysis rule shown in FIG. 4 will be described.

  The operation information analysis rule T31 with the number T3a “1” includes one condition “APPLICATIONxxx is error”, and when operation information satisfying this condition is sent, the operation information analysis means 23 is instructed to deal with T3c. This is a rule for displaying the fault indicated by the.

  The operation analysis rule with the number T3a “2” includes three conditions “APPLICATIONaaa is error”, “APPLICATIONbbb is error”, and “CPU usage is 80% or more”, and sent from the same monitored device. This is a rule for causing the motion information analysis means 23 to perform the processing (in this example, fault display) instructed by the handling instruction T3c when all the above three conditions are satisfied by the motion information. Note that [transmission setting (k + 1)] described after the third condition “CPU usage rate is 80% or more” corresponds to operation information that satisfies the condition “CPU usage rate is 80% or more”. The transmission setting information number T2a is shown. Such a description exists only after the condition in which the operation information transmission method for satisfying the condition is “INTERVAL (10 min, compress)”. That is, among the three conditions included in the motion information analysis rule T32, the motion information transmission method that satisfies the first and second conditions is “RAPID”, and the third condition Only the transmission method of operation information that satisfies the condition is “INTERVAL (10min, compress)”.

  The motion information analysis means 23 is configured to monitor each of the monitored devices 1-1 to 1-1 based on the motion information stored in the motion information storage unit 22 and the motion information analysis rules stored in the motion information analysis rule storage unit 24. When the state of 1-n is monitored and the occurrence of a failure is detected, the countermeasure processing specified by the countermeasure information T3c in the action information analysis rule is performed.

  The operation setting change request unit 25 satisfies some conditions among a plurality of conditions based on the operation information of a certain monitored device 1 -k (1 ≦ k ≦ n) stored in the operation information storage unit 22. When a behavior information analysis rule is generated, the behavior information transmission method that satisfies the unsatisfied condition in the behavior information analysis rule is changed to a transmission method that has a transmission timing earlier than the current transmission method. A transmission setting change request to be requested, and a function of passing the generated transmission setting request and the device ID of the monitored apparatus 1-k to the transmission setting change request transmitting means 26. Further, the transmission setting change request unit 25 requests the transmission method to return to the original state when all the conditions in the operation information analysis rule are satisfied by the operation information of the monitored device 1-k. It has a function of generating a transmission setting change request and passing the generated transmission setting change request and the device ID of the monitored apparatus 1-k to the transmission setting change request transmitting means 26. The device ID of the monitored device 1-k can be known from the SOURCE of the operation information.

  The transmission setting change request transmission unit 26 has a function of transmitting the transmission setting change request passed from the transmission setting change request unit 25 to the monitored apparatus specified by the device ID passed from the transmission setting change request unit 25. .

  The monitoring device 2 having such a function can be realized by a computer. When the monitoring device 2 is realized by a computer, for example, the following is performed. A disk, a semiconductor memory, and other recording media recording a program for causing the computer to function as the monitoring device 2 are prepared, and the computer is caused to read the program. The computer controls its own operation in accordance with the read program, so that the operation information collecting unit 21, the operation information analyzing unit 23, the transmission setting change requesting unit 25, and the transmission setting change request transmitting unit 26 are provided on the computer. Realize.

[Description of Operation of First Embodiment]
Next, the operation of the present embodiment will be described in detail.

[Operation when collecting operation information]
First, the operation when collecting operation information will be described with reference to the flowchart of FIG. In the following description, a case where operation information of the monitored device 1-1 is collected will be described as an example. However, operation information of other monitored devices 1-2 to 1-n is also collected in the same manner. can do.

  The operation information detection unit 12 in the monitored apparatus 1-1 acquires the operation information from the service execution unit 11 at regular intervals, and immediately passes the acquired operation information to the operation information transmission unit 13 (step S51). For each piece of movement information received from the movement information detection unit 12, the movement information transmission unit 13 determines a transmission method based on the contents and the contents of the transmission setting storage unit 14, and transmits the determined transmission method to the monitoring device 2. Transmit (step S52). When the operation information is sent from the monitored device 1-1, the operation information collecting means 21 in the monitoring device 2 registers all the received operation information in the operation information storage unit 22 (step S53). If the operation information sent from the monitored device 1-1 is compressed, the operation information is decompressed and registered in the operation information storage unit 22.

  Here, the process performed in step S52 will be described in detail with reference to the flowcharts of FIGS.

  Referring to the flowchart in FIG. 6, when the operation information is transmitted from the operation information detection unit 12, the operation information transmission unit 13 starts from the transmission setting information T <b> 21 whose number T <b> 2 a registered in the transmission setting storage unit 14 is “1”. In turn, it is checked whether or not the analysis element T2b in the transmission setting information matches the operation information (steps S61 to S64). When the transmission setting information including the analysis element T2b that matches the operation information is found (YES in step S62), the transmission designation T2c in the transmission setting information is “RAPID” or “INTERVAL (10min, (compress) ”is checked (step S65).

  If it is “RAPID” (YES in step S65), the operation information is stored in a first queue (not shown) provided in the operation information transmitting means 13 (step S66). On the other hand, when “INTERVAL (10 min, compress)” is set (NO in step S65), the operation information is stored in a second queue (not shown) provided in the operation information transmitting means 13. Store (step S67). The operation information transmission unit 13 performs the above processing on each operation information passed from the operation information detection unit 12. If the transmission setting information matching the operation information cannot be found even after examining the last transmission setting information stored in the transmission setting storage unit 14 (NO in step S63), an error display or the like is displayed. This is performed (step S68).

  Now, for example, when the content of the transmission setting storage unit 14 is as shown in FIG. 3, the operation information including the character string “error: the number of clients has exceeded the upper limit” in the item TEXT from the operation information detection unit 12 If it is passed, the analysis element “TEXT = * number of clients *” in the transmission setting information T21 with the number T2a “1” matches the operation information (YES in step S62). The operation information is stored in the first queue according to “RAPID” of the transmission designation T2c in the setting information T21 (YES in steps S65 and S66).

  Referring to the flowchart of FIG. 7, the operation information transmitting unit 13 constantly monitors the first queue (not shown), and when the operation information is stored in the first queue (YES in step S71). ), The stored operation information is immediately transmitted to the monitoring device 2 (step S72).

  Referring to the flowchart of FIG. 8, the operation information transmitting unit 13 compresses the operation information stored in the second queue (not shown) every 10 minutes (every time step S81 becomes YES). And transmitted to the monitoring device (steps S82 and S83).

[Operation when analyzing operation information]
Next, operations performed at the time of motion information analysis will be described with reference to the flowcharts of FIGS.

  Referring to the flowchart of FIG. 9, the motion information analysis unit 23 first focuses on the motion information with the oldest storage time among the unfocused motion information stored in the motion information storage unit 22 (step S91). . Thereafter, the motion information analyzing means 23 determines whether the motion information analysis rule that has been ignited by the attentioned motion information (a part or all of the conditions included in the motion information analysis rule is satisfied). Thus, it is checked whether or not the action information analysis rule that satisfies all the conditions included therein is stored in the action information analysis rule storage unit 24 (step S92).

  If no such operation information analysis rule exists (step S92 is NO), the process proceeds to step S96.

  On the other hand, if there is a fired motion information analysis rule (YES in step S92), after performing processing according to the handling instruction T3c in the motion information analysis rule (step S93), transmission setting information It is determined whether it is necessary to restore the content (transmission method) of the transmission designation T2c in the middle (step S94). This determination is made based on, for example, whether or not the transmission setting information number is included in the detection condition T3b of the corresponding operation information analysis rule. For example, if the corresponding operation information analysis rule is the operation information analysis rule T31 shown in FIG. 4, the number of transmission setting information is not included in the detection condition T3b, so the content of the transmission designation T2c is used. Judge that there is no need to return. On the other hand, if the corresponding operation information analysis rule is the operation information analysis rule T32 shown in FIG. 4, the number of transmission setting information [transmission setting (k + 1)] is included in the detection condition T3b. Therefore, it is determined that it is necessary to restore the content of the transmission designation T2c.

  If it is determined that there is no need to restore the content of the transmission designation T2c (NO in step S94), the process of step S96 is performed.

  On the other hand, when it is determined that it is necessary to restore the content of the transmission designation T2c (YES in step S94), a restoration instruction is output to the transmission setting change request unit 25 (step S95). The process of step S96 is performed. In the restoration instruction, the number of the corresponding operation information analysis rule and the device ID set in the item “SOURCE” of the operation information noted in step S91 (the device ID of the monitored device 1-1). And are included.

  The transmission setting change request unit 25 executes the process shown in the flowchart of FIG. 10 when a restoration instruction or a change instruction described later is input from the operation information analysis unit 23. When the restoration instruction is input from the operation information analysis unit 23, the transmission setting change request unit 25 sends the operation information analysis rule specified by the number of the operation information analysis rule included in the operation information analysis rule storage unit 24. A search is performed, and the number of the transmission setting information is acquired from the detection condition T3b of the searched operation information analysis rule (step S101). For example, assume that (k + 1) is acquired as the number of the transmission setting information.

  After that, the transmission setting change request unit 25 is the transmission designation in the transmission setting information T2 (k + 1) of the number (k + 1) because the instruction input from the operation information analysis unit 23 is a restoration instruction (NO in step S102). A transmission setting change request for requesting to change the content of T2c to “INTERVAL (10 min, compress)” is generated and passed to the transmission setting change request transmitting means 26 (step S104). At that time, the device ID of the monitored device 1-1 included in the restoration instruction is passed as the transmission destination of the transmission setting change request. Thereby, the transmission setting change request transmission means 26 transmits a transmission setting request to the monitored apparatus 1-1.

  This transmission setting request is received by the transmission setting change unit 15 in the monitored apparatus 1-1, and the transmission setting change unit 15 transmits the transmission setting stored in the transmission setting storage unit 14 in accordance with the received transmission setting change request. The content of the transmission designation T2c in the information T2 (k + 1) is returned to “INTERVAL (10min, compress)”.

  Returning to the flowchart of FIG. 9 again, when the operation information analysis unit 23 outputs a restoration instruction to the transmission setting change request unit 25 (step S95), the operation information is included in the operation information noticed in step S91 for the first time. It is checked whether or not the motion information analysis rule for which a part of the plurality of conditions is satisfied is stored in the motion information analysis rule storage unit 24 (step S96). The process of step S96 is also executed when the determination result of steps S92 and S94 is NO.

  If no such operation information analysis rule exists (NO in step S96), the process of step S91 is performed again. On the other hand, when there is an operation information analysis rule in which some of the conditions are satisfied for the first time (YES in step S96), the content (transmission method) of the transmission designation T2c in the transmission setting information is transmitted. It is determined whether or not it is necessary to change to a transmission method that speeds up (step S97).

  This determination is made based on, for example, whether or not the transmission setting information number is included in the detection condition T3b of the corresponding operation information analysis rule. For example, if the corresponding operation information analysis rule is the operation information analysis rule T31 shown in FIG. 4, the number of transmission setting information is not included in the detection condition T3b, so the content of the transmission designation T2c is changed. Judge that it is not necessary. On the other hand, if the corresponding operation information analysis rule is the operation information analysis rule T32 shown in FIG. 4, the number of transmission setting information [transmission setting (k + 1)] is included in the detection condition T3b. Therefore, it is determined that it is necessary to change the content of the transmission designation T2c. That is, as described above, the operation information that satisfies the condition assigned the number of the transmission setting information has the transmission method “INTERVAL (10 min, compress)”, and there is not much operation information that satisfies the above condition. Since it may not be sent, it is determined that it is necessary to change the transmission method.

  If it is determined that there is no need to change (NO in step S97), the process of step S91 is performed again. On the other hand, if it is determined that it is necessary to change (YES in step S97), a change instruction is output to the transmission setting change request unit 25 (step S98), and then the process of step S91 is performed again. Do. The change instruction includes the number of the corresponding operation information analysis rule and the device ID set in the item “SOURCE” of the operation information noted in step S91 (the device ID of the monitored device 1-1). And are included.

  When the change instruction is input from the operation information analysis unit 23, the transmission setting change request unit 25 executes the process shown in the flowchart of FIG. When a change instruction is input from the operation information analysis unit 23, the transmission setting change request unit 25 sends an operation information analysis rule specified by the number of the operation information analysis rule included in the operation information analysis rule storage unit 24. A search is performed, and the number of the transmission setting information is acquired from the detection condition T3b of the searched operation information analysis rule (step S101). For example, assume that (k + 1) is acquired as the number of the transmission setting information.

  Thereafter, the transmission setting change request means 25 is the transmission designation in the transmission setting information T2 (k + 1) of the number (k + 1) because the instruction input from the operation information analysis means 23 is a change instruction (YES in step S102). A transmission setting change request requesting to change the content of T2c to “RAPID” is generated, and it is sent to the transmission setting change request transmitting means 26 (step S103). At that time, the device ID of the monitored device 1-1 included in the restoration instruction is passed as the transmission destination of the transmission setting change request. Thereby, the transmission setting change request transmission means 26 transmits a transmission setting request to the monitored apparatus 1-1.

  This transmission setting request is received by the transmission setting change unit 15 in the monitored apparatus 1-1, and the transmission setting change unit 15 transmits the transmission setting stored in the transmission setting storage unit 14 in accordance with the received transmission setting change request. The content of the transmission designation T2c in the information T2 (k + 1) is changed to “RAPID”.

[Effect of the first embodiment]
According to the present embodiment, when a failure that has occurred in a monitored device is detected using an operation information analysis rule that includes a plurality of conditions, it is possible to quickly detect the occurrence of the failure.

  The reason is that when an operation information analysis rule has been generated in which a part of a plurality of conditions included in the operation information sent from the monitored device 1-1 is satisfied, Transmission setting that requests the monitored apparatus 1-1 to change the transmission method of the operation information that satisfies the unsatisfied condition in the operation information analysis rule to a transmission method that has a transmission timing earlier than the current transmission method. This is because the change request means 25 is provided.

[Second Embodiment]
Next, a second embodiment of the operation management system according to the present invention will be described. The present embodiment is characterized in that when changing the transmission setting information, the transmission setting information is changed after obtaining the permission of the administrator.

[Description of Configuration of Second Embodiment]
FIG. 11 is a block diagram showing an example of the configuration of the second embodiment of the operation management system according to the present invention. The difference from the first embodiment shown in FIG. The monitoring device 2a is provided.

  The difference between the monitoring device 2a of the present embodiment and the monitoring device 2 of the first embodiment is that a transmission setting change request unit 25a is provided instead of the transmission setting change request unit 25, such as a keyboard. The point provided with the input device 27 and the point provided with a display device 28 such as an LCD.

  The difference between the transmission setting change request unit 25a and the transmission setting change request unit 25 of the first embodiment is that the transmission setting change request unit 25 of the first embodiment generates a transmission setting change request immediately after generating it. In contrast to the generated transmission setting change request being passed to the transmission setting change request transmitting unit 26, the transmission setting change request unit 25a of the present embodiment generates a transmission setting change request and then includes a change permission request including the changed contents. The screen is displayed on the display device 28, and the transmission setting change request is passed to the transmission setting change request transmitting means 26 only when the administrator permits the change through the change permission request screen.

  Note that the monitoring device 2a of the present embodiment can also be realized by a computer, and when realized by a computer, for example, as follows. A disk, a semiconductor memory, and other recording media recording a program for causing the computer to function as the monitoring device 2a are prepared, and the computer is caused to read the program. The computer controls the operation of the computer according to the read program, so that the operation information collection unit 21, the operation information analysis unit 23, the transmission setting change request unit 25a, and the transmission setting change request transmission unit 26 are provided on the computer. Realize.

[Description of Operation of Second Embodiment]
Next, the operation of the present embodiment will be described. Since the operation other than the operation of the transmission setting change request unit 25a is the same as that of the first embodiment, only the operation of the transmission setting change request unit 25a will be described here.

  FIG. 12 is a flowchart showing a processing example of the transmission setting change request unit 25a. The difference from the flowchart showing the processing example of the transmission setting change request unit 25 shown in FIG. 10 is that step S103a is replaced with step S103a. The point which performs a process and the point which the process of step S121-S123 is added.

  When a change instruction is input from the operation information analysis unit 23, the transmission setting change request unit 25a sends an operation information analysis rule specified by the number of the operation information analysis rule included in the operation information analysis rule storage unit 24. A search is performed, and the number of the transmission setting information is acquired from the detection condition T3b of the searched operation information analysis rule (step S101). For example, assume that (k + 1) is acquired as the number of the transmission setting information.

  Thereafter, the transmission setting change request unit 25a is the transmission designation in the transmission setting information T2 (k + 1) of the number (k + 1) because the instruction input from the operation information analysis unit 23 is a change instruction (YES in step S102). A transmission setting change request for requesting to change the content of T2c to “RAPID” is generated (step S103a).

  Next, the transmission setting change request unit 25a displays a change permission request screen 131 as shown in FIG. 13 on the display device 28 (step S121).

  In the change permission request screen 131 shown in FIG. 13, the content 132 of the transmission setting information to be changed, the content 133 of the changed transmission setting information, the device ID 134 of the monitored device to be changed, and the change are displayed. A permission button 135 that is operated by the administrator when permission is permitted and a non-permission button 136 that is operated by the administrator when change is not permitted are provided.

  When the change permission request screen 131 as shown in FIG. 13 is displayed on the display device 28, the administrator determines whether or not to permit the change based on the display content. When the change is permitted, the permission button 135 is operated using the input device 27, and when the change is not permitted, the non-permission button 136 is operated using the input device 27.

  When the permission button 135 is operated by the administrator (YES in Step S122), the transmission setting change request unit 25a passes the transmission setting change request generated in Step S103a to the transmission setting change request transmission unit 26 (Step S122). S123). At that time, the device ID of the monitored device 1-1 included in the restoration instruction is passed as the transmission destination of the transmission setting change request.

  On the other hand, when the non-permission button 136 is operated by the administrator (NO in step S122), the transmission setting change request unit 25a ends the process. Note that the operation when a restoration instruction is input from the operation information analysis unit 23 is the same as the operation of the first embodiment.

[Effects of Second Embodiment]
In addition to the effect obtained in the first embodiment, the present embodiment can provide an effect that it is possible to prohibit the change of the transmission setting information that the administrator determines to be inappropriate. The reason for this is that when an operation information analysis rule has been generated in which a part of a plurality of conditions included in the operation information sent from the monitored device 1-1 is satisfied. Transmission that requires the administrator's permission to change the transmission method of operation information that satisfies the unsatisfied condition in the operation information analysis rule to a transmission method that has a transmission timing earlier than the current transmission method This is because it includes transmission setting change requesting means 25a that transmits a setting change request to the monitored apparatus 1-1.

  According to the present invention, the present invention can be widely applied to an operation management system that collects and monitors operation information of a computer system serving as a monitored apparatus in a centralized manner and detects a failure of the monitored apparatus.

It is a block diagram which shows the structural example of 1st Embodiment of the operation management system concerning this invention. It is a figure which shows the structural example of operation information. 6 is a diagram illustrating an example of contents of a transmission setting storage unit 14. FIG. 4 is a diagram illustrating an example of contents of an operation information analysis rule accumulation unit 24. It is a flowchart which shows the example of a process at the time of operation information collection. It is a flowchart which shows the detail of a part process (process which determines a transmission method) of the processes performed by step S52 of FIG. 6 is a flowchart showing details of a part of processing (transmission processing of operation information whose transmission method is “RAPID”) in the processing performed in step S52 of FIG. 5. 6 is a flowchart showing details of a part of the processing performed in step S53 of FIG. 5 (operation information transmission processing whose transmission method is “INTERVAL (10min, compress)”). 5 is a flowchart showing an example of processing of motion information analysis means 23. 10 is a flowchart showing a processing example of a transmission setting change request unit 25. It is a block diagram which shows the structural example of 2nd Embodiment of the operation management system concerning this invention. It is a flowchart which shows the process example of the transmission setting change request means 25a. It is a figure which shows an example of the change permission request | requirement screen.

Explanation of symbols

1-1 to 1-n ... monitored apparatus 11 ... service execution means 12 ... operation information detection means 13 ... operation information transmission means 14 ... transmission setting storage unit 15 ... transmission setting change means 2 ... monitoring device 21 ... operation information collection means 22 ... Operation information storage unit 23 ... Operation information analysis unit 24 ... Operation information analysis rule storage unit 25, 25a ... Transmission setting change request means 26 ... Transmission setting change request transmission unit 27 ... Input device 28 ... Display device

Claims (4)

In an operation management system comprising a monitored device and a monitoring device that monitors the status of the monitored device based on operation information sent from the monitored device,
The monitoring device is
An operation information analysis rule storage unit in which operation information analysis rules used for monitoring the state of the monitored device are registered;
By the operation information sent from the monitoring device, when the operation information analysis rule some condition becomes to establishment of the plurality of conditions has occurred, the established criteria in said operating information analysis rule If the transmission method of the type of operation information necessary for determining success or failure of conditions other than the above is the first transmission method that transmits after waiting for the arrival of the transmission timing that repeatedly appears at regular time intervals, the type Requesting the monitored device to change to the second transmission method for immediately transmitting the operation information, and depending on the operation information sent from the monitored device, a plurality of conditions are satisfied. When a behavior information analysis rule that has all been satisfied occurs, the transmission method changed when some of the conditions included in the behavior information analysis rule are satisfied And a transmission setting change request means for requesting to said monitored device to be returned to the transmission method,
The monitored device is:
A transmission setting storage unit in which a transmission method is registered for each type of operation information ;
If the transmission method registered in the transmission setting storage unit corresponding to the determined type is the first transmission method, the type of the operation information detected by the own device is determined. Information is transmitted to the monitoring device waiting for the next transmission timing, and if it is the second transmission method, operation information transmitting means for immediately transmitting the detected operation information to the monitoring device ;
When a change in transmission method is requested from the monitoring device, among the transmission methods for each type of operation information registered in the transmission setting storage unit, transmission of the type of operation information requested to be changed from the monitoring device An operation management system comprising: transmission setting change means for changing a method to a transmission method requested by the monitoring device . A monitoring device that monitors the status of the monitored device based on operation information sent from the monitored device,
An operation information analysis rule storage unit in which operation information analysis rules used for monitoring the state of the monitored device are registered;
When an operation information analysis rule in which a part of a plurality of conditions is satisfied is generated by the operation information sent from the monitored device, the satisfied condition in the operation information analysis rule If the transmission method of the type of operation information necessary for determining success or failure of conditions other than the above is the first transmission method that transmits after waiting for the arrival of the transmission timing that repeatedly appears at regular time intervals, the type Requesting the monitored device to change to the second transmission method for immediately transmitting the operation information, and depending on the operation information sent from the monitored device, a plurality of conditions are satisfied. When a behavior information analysis rule that has all been satisfied occurs, the transmission method changed when some of the conditions included in the behavior information analysis rule are satisfied Monitoring device and a sending setting change request means for making a request to the monitored device to be returned to the transmission method. A monitoring device including an operation information analysis rule storage unit in which operation information analysis rules used for monitoring the status of the monitored device are registered. The monitoring device has a plurality of conditions according to the operation information sent from the monitored device. When a motion information analysis rule that satisfies some of the conditions is generated, the type of motion information necessary to determine whether a condition other than the satisfied condition in the motion information analysis rule is satisfied If the transmission method is the first transmission method that transmits after waiting for the arrival of the transmission timing that repeatedly appears at a constant time interval, the transmission method of the type of operation information is changed to the second transmission method that transmits immediately. A first step of requesting the monitored device to change;
A monitored device including a transmission setting storage unit in which a transmission method is registered for each type of operation information determines the type of operation information detected by the own device, and stores the transmission setting corresponding to the determined type. If the transmission method registered in the unit is the first transmission method, the detected operation information is transmitted to the monitoring device after the next transmission timing has arrived. A second step of immediately transmitting the detected operation information to the monitoring device;
When the monitored device is requested to change the transmission method from the monitoring device, the monitoring device is requested to change the transmission method for each type of operation information registered in the transmission setting storage unit. A third step of changing the transmission method of the type of operation information to the transmission method requested by the monitoring device;
When an operation information analysis rule in which a plurality of conditions are all satisfied is generated by the operation information sent from the monitored device, the monitoring device includes a plurality of operations included in the operation information analysis rule. And a fourth step of requesting the monitored apparatus to return the transmission method changed when some of the conditions are satisfied to the transmission method before the change. Management method. A computer including an operation information analysis rule storage unit in which operation information analysis rules used for monitoring the status of a monitored device are registered;
  When an operation information analysis rule in which a part of a plurality of conditions is satisfied is generated by the operation information sent from the monitored device, the satisfied condition in the operation information analysis rule If the transmission method of the type of operation information necessary for determining success or failure of conditions other than the above is the first transmission method that transmits after waiting for the arrival of the transmission timing that repeatedly appears at regular time intervals, the type Requesting the monitored device to change to the second transmission method for immediately transmitting the operation information, and depending on the operation information sent from the monitored device, a plurality of conditions are satisfied. When a behavior information analysis rule that has all been satisfied occurs, the transmission method changed when some of the conditions included in the behavior information analysis rule are satisfied Program for functioning as a transmission setting change request means for requesting to return to the transmission method with respect to the monitored device.

Images