JP5487914B2 - Operation information management system, operation information management method, operation information management program - Google Patents

Description

  The present invention relates to a system for managing operation information indicating an operation state such as a failure in a computer system.

Message-based operation management is performed as a method for monitoring and managing the operation state of a monitoring target device such as a computer device.
In a system (operation information management system) that manages information related to operations in monitored devices such as failure information on a message basis (operation information management system), for example, events that occurred in the monitored device and information recorded in an operation log are recorded as operation information messages ( (Hereinafter, referred to as “message”), a message important for system management is extracted from the collected message based on a preset condition (filtering condition information), and the extracted message is accumulated.

  In the message-based operation information management system, the stored message is marked to indicate, for example, in-progress / response completion, based on preset conditions, and the message is associated with a fault. In addition, it is possible to manage the operation status of the functional part corresponding to the failure information in the monitored device and information indicating the status for the failure.

  Further, the message-based operational information management system can change the operation and state of a desired system at an arbitrary time point based on an arbitrary condition instructed by an operator (user), for example, with respect to the accumulated message. It is possible to search for such a message and present the search result to the user.

  By the way, when setting the filtering condition information (filtering definition information) used for extracting the message, a failure that may occur in the monitored device during the design and construction stage of the operation information management system including the monitored device (Message) is assumed in advance, and it is desirable to determine filtering condition information reflecting the necessity and importance of management in the system.

  However, as computer systems that are management targets of operation information and network systems that use them become larger, the types of messages that can occur, such as operation information and failure information, are diversified. For this reason, the number and types of filtering condition information that must be defined are enormous.

For this reason, it is difficult to envisage the types and cases of messages that can occur at the design and construction stage of the system to be managed. In addition, messages that are important for operation management such as operation information and fault information are extracted. It is difficult to define the filtering definition to be determined in the system design stage without omission.
In addition, filtering condition information may not be taken into account or condition settings may be omitted, and filtering condition information necessary for system operation management may not be set, or important messages may not be extracted properly due to missing condition settings. Inconvenience occurs.

For this reason, in practice, the filter (filtering definition) is reviewed (updated and corrected) each time a failure occurs during the operation and use of the system.
As a result, important messages relating to system operation are extracted.

However, an important message related to system operation, such as an operation failure, is not extracted at the time when the operation failure occurs, because it is leaked from a preset filtering definition.
Also, messages that have been leaked from the filtering definition are not collected or extracted thereafter, and it is difficult to find the messages after that.

  Furthermore, in order to find and extract a message that has been leaked from the filtering definition, for example, check the log file that is the source of the information, and examine whether a message that can detect the event of the message has occurred. In order to find a message, there is an inconvenience of enormous effort and excessive processing load on the system.

  As a related technology for this, it is assumed that all messages are filtered to either output or suppressed, and if a certain number of messages that do not match it occur within a certain period of time, this is set in the filter. It is determined that the message is leaked, the user is notified, and the message is extracted as a filter, or whether the message is regarded as an unnecessary message and the filter is set so that these messages are not output. Has been disclosed (Patent Document 1).

  In addition, as a related technique, information generated in the system is collectively collected as a message, and filtering (merging) is performed on the message (data) based on a preset condition, so that a preset disk or database is set. An operation information management system stored in the above is disclosed (Patent Document 2).

  Furthermore, as a related technique, for example, the number of times of use of a filter condition used for filtering operation information (message) generated in the system is stored, and when the number of times of use exceeds a predetermined number, A method of optimizing the filter condition to be used by presenting the filter condition to the user and updating the filter condition is disclosed (Patent Document 3).

  In addition, as a related technique, a method is disclosed in which each “word” included in the information stored in the database is weighted and the information is managed based on the weighted value. (Patent Document 4).

JP 2009-64098 A JP 2006-244114 A JP 2001-101108 A Japanese Patent Laid-Open No. 08-292960

  However, in the related technique disclosed in Patent Document 1, the amount of messages to be collected is enormous, so that when a message management or filter design is attempted, a user finds an important message for system operation. This makes it difficult to miss important messages and to miss filter definitions.

  Further, Patent Document 1 is a configuration in which a filter setting omission is determined when a certain amount or more of the same type (or the same) message occurs within a certain period, and a message that generates a large amount of messages within a certain period. Since the function for optimizing the filter does not work unless a rush occurs, there is a possibility that a message important for system operation such as failure information is not collected when a large number of messages are not generated.

Further, in the related technique disclosed in Patent Document 3, the importance level of the filter condition is set (weighted) based on the number of times the filter condition is used, and the filter condition used based on the importance level is optimized. It has a configuration.
For this reason, for example, even if a trace was not obtained due to a specific filter condition, that is, the message to be extracted did not hit or many traces were obtained, the number of times the filter condition was used Since equal weighting is performed based on this, filter conditions that are frequently used are simply set, and there is a disadvantage that optimal filter conditions cannot be set according to the system operation mode.

  Furthermore, in the related art disclosed in Patent Document 4, the same value is always assigned as weighting for stored information. For example, if the weighting value for the word “university library” included in the “title” item of the record is once determined to be 2.089, it is stored without being changed unless the contents of the record are updated. There is an inconvenience that weighting according to the operation mode of the system cannot be performed on existing information.

[Object of invention]
The present invention provides an operation information management system, an operation information management method, and an operation information management program for improving the inconvenience of the related technology and presenting a message indicating an operation state in a monitored device according to the importance. And its purpose.

In order to achieve the above object, an operation information management system according to the present invention acquires an operation information message indicating an operation content in a computer device and filters the operation information message based on preset filter condition information. An operation information management system comprising a filter application unit for performing and a message storage unit for storing the operation information message extracted by the filtering, wherein the operation information message other than the operation information message extracted by the filtering is previously stored A message search unit that searches for operation information messages that match the set search condition information, a search use count that is the number of times each search condition information is used for the search, and the number of operation information messages that are hit by the search Search based on the relationship with the number of search hits indicating The weight value for the result is calculated, and the condition weight setting unit for weighting each search condition information by the weight value, and when the weight value of the search condition information exceeds a predetermined constant value, A configuration is provided that includes a search condition filtering setting unit that newly sets search condition information as the filter condition information .

The operation information method according to the present invention is an operation information management system having a filter application unit that performs filtering based on preset filter condition information for an operation information message indicating operation contents in a computer device. In the operation information management method for extracting a specific operation information message by the filtering, the operation information management system hits preset search condition information from an operation information message other than the operation information message extracted by the filtering. The search result is searched based on the relationship between the number of times the search is used that indicates how many times each search condition information has been used for the search and the number of search hits that indicates the number of action information messages that have been hit by the search. In addition to calculating weight values for Performs weighting by the weighting value for the condition information, newly setting the search condition information weighted by the weight value when the weight value exceeds a preset fixed value as the filter condition information, the It is characterized in that an operation information message is extracted based on the filter condition information .

An operation information management program according to the present invention includes an operation information management system including a filter application unit that acquires an operation information message indicating an operation content in a computer apparatus and performs filtering based on preset filter condition information. An operation information management program for accumulating the operation information messages extracted by the filtering, which is adapted to search condition information set in advance from operation information messages other than the operation information messages extracted by the filtering. There is a relationship between a message search function that searches for operation information messages, a search use count that is the number of times used for the search of each search condition information, and a search hit count that indicates the number of operation information messages hit by the search Based on the search result A condition weighting setting function for weighting by said weighting value for Rutotomoni each search condition information, the weighted search condition information for the filter condition information when the weight value exceeds a preset fixed value And a search condition filtering setting function to be set in a computer set in advance in the operation information management system.

  Since the present invention is configured and functions as described above, according to this, means for accumulating messages extracted based on preset filter conditions, and search conditions set in advance from messages other than the extracted messages Means for searching for a message that hits, means for weighting each search condition, and means for setting the search condition as a filter condition when the weighted value of each search condition exceeds a certain value As a result, it is possible to provide an operation information management system, an operation information management method, and an operation information management program that can effectively manage a message indicating an operation state in a monitoring target device according to the importance.

It is a schematic block diagram which shows one Embodiment in the operation information management system by this invention. It is a flowchart which shows the operation | movement process step when the manager apparatus in the operation information management system disclosed in FIG. 1 newly receives a message. It is a flowchart which shows the operation | movement process step in the case of searching a message from the monitoring terminal in the operation information management system disclosed in FIG. It is a flowchart which shows the operation | movement process step in the case of marking a message from the monitoring terminal in the operation information management system disclosed in FIG. It is explanatory drawing which shows an example of the data field which the search condition in the operation information management system disclosed in FIG. 1 has. It is explanatory drawing which shows an example of the data field which the search message in the operation information management system disclosed in FIG. 1 has.

[Embodiment]
Next, the basic configuration content of the embodiment of the present invention will be described.

  As shown in FIG. 1, the operation information management system according to the present embodiment includes a monitoring target device 4 that is a computer device, and an agent device that acquires operation information recorded in events and logs generated in the monitoring target device 4. 1, a manager device 2 that is connected to the agent device 1 and obtains the operation information and extracts (filters) a message based on a preset condition, and searches for messages stored in the manager device 2 While having a request, it has the structure provided with the monitoring terminal 3 which outputs and displays the message extracted according to the search request | requirement by the manager apparatus 2. FIG.

  As shown in FIG. 1, the agent device 1 constantly monitors the operation state of the monitoring target device 4 and acquires event information generated in the monitoring target device 4 and operation information (message) recorded in the log. Means 100 and failure information sending means 101 for sending the operation information acquired by the failure information detecting means 100 to the manager device 2 as a message.

  Here, the failure information detection unit 100 may be set to monitor the operation information generated by the monitoring target device 4 at regular intervals.

  As shown in FIG. 1, the manager device 2 includes a failure information receiving unit 200 that receives a message sent from the agent device 1, and a filter condition stored in the filter storage unit 202 in advance from the message received by the filter applying unit 201. Filter applying unit 201 that extracts a message that matches (matches) the message, a message storage unit 204 that stores the message extracted by the filter applying unit 201, and an extracted message among the messages received by the filter applying unit 201 A search condition applying unit 203 that extracts a message that matches a search condition stored in the search condition storage unit 207 in advance, and a message from the message storage unit 204 based on a search request sent from the search execution unit 208. Extract and send And a failure information transmitting unit 205.

  In addition, the manager device 2 sets search execution means 208 that performs message search in response to a request from the monitoring terminal 3 and a weight value that indicates the importance of the search condition stored in the search condition storage unit 207. A search condition registration unit 209 (which performs weighting), a marking execution unit 206 which marks a message stored in the message storage unit 204 for tracking an operation state in response to a request from the monitoring terminal 3, and a search condition When the set weight value is higher than a certain value, the filter registration execution unit 210 sets the search condition as a filter condition and registers it in the filter storage unit 202.

  The monitoring terminal 3 includes a failure information receiving unit 300 that receives a message transmitted by the failure information transmitting unit 205 of the manager device 2, a failure information display unit 301 that outputs and displays a message received by the failure information receiving unit 300, A search unit 302 for inputting a message search request (search request) to the search execution unit 208 of the manager device 2 and a mark unit 303 for requesting the mark execution unit 206 of the manager device 2 to mark the message. And a filter registration unit 304 that requests the filter registration execution unit 210 to register a preset filter condition (filter definition).

  In this embodiment, by having the configuration as described above, operation information (messages) having high importance according to the operation state of the system is stored in a state where it can be extracted regardless of the amount of messages generated within a predetermined time. For this reason, missed messages with high importance and omission of filter definitions can be effectively suppressed.

[Description of Operation of Embodiment]
Next, an outline of the operation of this embodiment will be described.
The message detected from the monitoring target device 4 is extracted and stored as a message that matches (matches) a preset filter condition, and the search condition application unit 203 applies in advance to a message other than the extracted message. A message that matches (matches) the set search condition is searched (message search step), and messages extracted (traced) by this search are accumulated.

  Next, the search condition applying unit 203 performs the search based on the relationship between the number of times the search has been used for each search condition and the number of search hits indicating the number of messages extracted by the search based on the written search condition. Calculate the weight value related to the result, and perform weighting for each search condition (condition weight setting process), and register the filter when the weight value weighted to each search condition exceeds a certain value The means 210 sets the search condition as the filter condition (search condition filtering setting step).

  Further, the search condition applying unit 203 weights each message that hits the search by the weight value of the search condition used in this search (message weight setting step), and a weight value equal to or greater than a certain value is set. The stored message is stored in the message storage unit 204.

  Here, the message search step, the condition weight setting step, the search condition filtering setting step, and the message weight setting step may be configured such that the execution contents are programmed and executed by a computer.

  Next, in the operation information management system according to the present embodiment, an operation when the manager device 2 receives a message that is operation information on the monitored device 4 from the agent device 1 will be described based on the flowchart of FIG.

  First, when the failure information receiving unit 200 of the manager device 2 receives a message sent from the agent device 1 (message reception: step S101), the filter applying unit 201 stores the message in the filter storage unit 202 in advance. It is determined whether or not the filter condition is met (matched) (step S102).

  Here, the filter application unit 201 stores, in the message storage unit 204, a message that matches an existing filter condition in the received message, that is, a message extracted by the filtering process based on the filter condition in the received message. (Accumulate messages: Step S111).

Here, the filter application unit 201 may set a weight value larger than the weight value for the search message for each extracted message.
As a result, a weight value indicating the importance can be set for each message extracted by the filtering process, and therefore, the important message can be easily searched and extracted.

  On the other hand, for a message that does not match (match) with the existing filter condition, that is, for a message that has not been extracted by the filtering process based on the filter condition, the search condition applying unit 203 searches the search condition storage unit 207 in advance. It is determined whether or not the condition information (hereinafter referred to as “search condition”) is matched (hit) (matches the search condition: step S103).

  Here, the search condition applying unit 203 discards a message that does not match the existing search condition stored in the search condition storage unit 207 among the messages that are not extracted by the filtering process (NO: Step S103).

  On the other hand, if there is a message that matches the existing search condition stored in the search condition storage unit 207 (hereinafter referred to as “search message”) in the message that has not been extracted by the filtering process, the search condition applying unit 203 A process of adding (increase) the number of hits of the search condition that matches the search message is performed (increase the number of hits of the search condition: step S104).

  As shown in FIG. 5, each search condition stored in the search condition storage unit 207 includes, in addition to the fields of the message, the number of searches set in correspondence with each search condition, the number of hits (the number of traces). , And attribute information (parameter field) relating to each search condition such as a weight value.

  Next, the search condition applying unit 203 recalculates a weighting value (weight value) indicating the importance of the search condition based on the number of hits to which the value is added (weighting recalculation: step S105).

  In the recalculation of the weighting, calculation using, for example, a calculation formula “(number of searches + number of marks) / number of hits” is performed based on attribute information (FIG. 5) of each search condition. Thereby, the weight value based on the attribute information of each search condition is calculated.

  The calculation formula may be set to use an appropriate calculation formula in accordance with the system configuration, usage method, and the like. Moreover, the setting which calculates a weight value based on a different calculation formula for every search condition may be sufficient.

Next, the search condition applying unit 203 compares the weight threshold value preset in the search condition storage unit 207 with the weight value of each search condition calculated as described above (the weight of the search condition is Whether the threshold has been exceeded: Step S106).
Here, when the calculated weight value exceeds the upper limit value which is a preset weight threshold value (exceeds the threshold value), the search condition applying unit 203 performs processing for filtering the search condition corresponding to the weight value. Is performed (step S107).

At this time, the search condition application unit 203 acquires a search condition whose weight value exceeds the upper limit value from the search condition storage unit 207, and uses this search condition as a filtering search condition to the filter registration execution unit 210. Send.
If the calculated weight value of the search condition falls below a lower limit value that is a preset weight threshold value (below the lower limit threshold value), the search condition application unit 203 searches for the search condition corresponding to this weight value. Processing for deleting from the condition storage unit 207 is performed (deleting the search condition: step S108).

  Note that the upper and lower thresholds can be arbitrarily changed and set by the user, for example. Further, the upper limit value and the lower limit value may not be set.

In addition, the process of filtering the search condition when the weight value of the search condition exceeds the upper limit weight threshold and the process of deleting the search condition when the weight value of the search condition falls below the lower limit weight threshold It may be automatically executed based on a set program.
Moreover, when performing the process which filters search conditions, and the process which deletes search conditions, the structure which requests | requires confirmation with respect to a user and performs according to user judgment may be sufficient.

  Here, the search condition applying unit 203 determines whether or not the message not extracted by the filtering process by the filter applying unit 201 also matches other search conditions stored in the search condition storage unit 207 (step). S109).

  Next, when the above determination is completed for all the search conditions (NO: Step S109), the search condition applying unit 203 determines each search message as shown in FIG. 6 based on the weight value set for each search condition. Is calculated (step S110).

The weight value (weight) of the search message is calculated as, for example, the weight value of the search condition that matches each search message. Here, when there are a plurality of search conditions that match the search message, the total value of the weight values of each search condition is set as the weight value of the search message.
Further, as a method for calculating the weight of the search message, for example, the largest value (weight value) among the weight values of the search condition that matches the message may be set as the weight value of the search message.

  As a result, each message can be weighted according to the operational state of the operational information management system. Further, the weight value (message weight value) in the message can be automatically determined based on the weight value (search condition weight value) set in the search condition.

  In addition, since it is possible to perform appropriate weighting according to the system operation state by the user for the message that has been leaked from the filtering by the filter applying unit 201, it is possible to extract a highly important message required by the user. Can be accumulated.

  Furthermore, even when the above filter conditions and search conditions are insufficient, appropriate condition information corresponding to the system operation status is extracted as the filter conditions and search conditions while the system is being operated. Thus, filter conditions and search conditions that can extract important messages are automatically set.

  After the weight values are calculated for all the search messages (FIG. 6), the search condition application unit 203 stores the search messages in the message storage unit 204 (step S111), and then the failure information transmission unit 205 The message stored in the message storage unit 204 is sent to the monitoring terminal device 3 (failure information receiving means 300) (step S112).

  Thereby, for example, a user can perform weighting on a message based on a history of operations (searching, marking, etc.) performed using the failure information receiving means 300 as a system operation management task. Thus, messages with high importance can be preferentially presented to the user.

(Message search)
Next, an operation when a message search is performed from the monitoring terminal 3 in the present embodiment will be described based on the flowchart of FIG.

First, the search unit 302 of the monitoring terminal 3 makes a search request to the search execution unit 208 of the manager device 2 by, for example, an operation from the user.
The search execution unit 208 searches for the message stored in the message storage unit 204 based on the content of the search request.
Here, the failure information sending unit 205 acquires the result of the search performed by the search execution unit 208 and sends it to the failure information receiving unit 300 of the monitoring terminal 3 (step S201).

  Next, the search condition registration unit 209 refers to the search condition stored in the search condition storage unit 207, and whether or not the search condition included in the content of the search request has already been registered in the search condition storage unit 207. Is determined (step S202).

  Here, when the search condition included in the content of the search request is not registered in the search condition storage unit 207, the search condition registration unit 209 stores the search condition acquired from the search execution unit 208 in the search condition storage unit 207. New registration is performed (step S203).

  On the other hand, when the search condition included in the content of the search request is already registered in the search condition storage unit 207, the search condition registration unit 209 sets the search frequency of the search condition registered in the search condition storage unit 207 to 1 The weight is increased (step S204), and the weight value of the search condition is recalculated based on the number of searches (recalculation of weight: step S205).

  Here, when the weight value of the search condition exceeds the upper limit value (specified weight) that is a preset weight threshold value by recalculation of the weight (YES: step S206), the search condition registration unit 209 This search condition is transmitted to the filter registration execution means, and the search condition is set as a filter condition (filtering the search condition: step S207).

  On the other hand, when the weight value of the search condition falls below (does not exceed) a preset weight upper limit value due to the recalculation of the weight (NO: step S206), the search condition registration unit 209 searches for a search that matches the search condition. The weight value set for the message (search message weight value) is recalculated (step S208).

Thereby, in the present embodiment, the filter condition (filter definition) set in accordance with the operation information management work contents such as the search contents by the user can be stored in the filter storage unit 202.
The filter application unit 201 can appropriately extract a highly important message in accordance with the operation state of the system by performing a filtering process based on the filter condition.

(With message mark)
Next, an operation of marking a message stored in the message storage unit 204 according to the present embodiment for tracking the operation state in the monitored device will be described with reference to the flowchart of FIG.

  When the marking unit 303 of the monitoring terminal device 3 marks the message (stored message) stored in the message storage unit 204, the marking unit 303 requests the marking unit 206 to perform a marking request. The marking execution unit 206 performs marking on the message stored in the message storage unit 204 in accordance with the content of the marking request (step S301).

Next, the marking unit 303 checks whether or not a search condition that matches the marked message is stored in the search condition storage unit 207, that is, whether there is a search condition that matches the message (step S302). ).
If the search condition storage unit 207 has a matching search condition (YES), the number of marks in the search condition is increased by 1 (step S303), and the weighting of the search condition is recalculated based on the number of marks (step S303). Step S304).

Next, the marking unit 303 determines whether or not the weight of the recalculated search condition exceeds a preset threshold value (weight threshold value) (step S305). When (weight threshold) is exceeded (YES: Step S305), this search condition is transmitted to the filter registration execution means 210 as filter condition information.
Here, the search condition sent by the filter registration execution means 210 is stored in the filter storage unit 202 as a filter condition (filtering the search condition: step S306).

  Next, the marking unit 303 determines whether the marked message matches the other search conditions stored in the search condition storage unit 207. Here, it is assumed that the marking unit 303 determines whether or not all the search conditions stored in the search condition storage unit 207 match (step S307).

If the search condition storage unit 207 has a matching search condition (YES: step S307), the number of marks in the search condition is increased by 1 (step S303).
If there is no matching search condition in the search condition storage unit 207 (NO: Step S307), the weight value of the search message that matches the search condition is recalculated based on the weight value set in the search condition. (Step S308).

  As described above, in this embodiment, not only the number of times the filter condition is used, but also the number of hits and the number of marks as search results and marking results can be fed back as weights for the filter conditions, and the contents of the filter conditions are Can be optimized based on information related to searches and marking operations performed during operation.

  For this reason, in this embodiment, a message with high importance extracted by the filter condition can be preferentially presented to the user.

  The present invention can be usefully applied to a system that remotely manages an operation state in a large-scale server device group to which an operation information message indicating operation contents is transmitted via a network.

DESCRIPTION OF SYMBOLS 1 Agent apparatus 2 Manager apparatus 3 Monitoring terminal 4 Monitored apparatus 100 Fault information detection means 101 Fault information transmission means 200 Fault information reception means 201 Filter application means 202 Filter storage part 203 Search condition application means 204 Message storage part 205 Fault information transmission means 206 Marking Execution Unit 207 Search Condition Accumulation Unit 208 Search Execution Unit 209 Search Condition Registration Unit 210 Filter Registration Execution Unit 300 Fault Information Receiving Unit 301 Fault Information Display Unit 302 Search Request Unit 303 Marking Request Unit 304 Filter Registration Request Unit

Claims (8)

A filter application unit that acquires an operation information message indicating an operation content in the computer device and filters the operation information message based on preset filter condition information, and a message that accumulates the operation information message extracted by the filtering An operation information management system comprising a storage unit,
A message search unit that searches for operation information messages that match search condition information set in advance for operation information messages other than the operation information messages extracted by the filtering;
While calculating the weight value for the search result based on the relationship between the number of times the search is used, which is the number of times each search condition information is used for the search, and the number of search hits indicating the number of operation information messages hit in the search A condition weighting setting unit for weighting each search condition information by the weight value;
A search condition filtering setting unit that newly sets the search condition information as the filter condition information when the weight value of the search condition information exceeds a predetermined constant value. Information management system. In the operation information management system according to claim 1,
A weight value weighted by the search condition information for each operation information message hit in the search based on the search condition information is set as a message weight value indicating the importance of each operation information message, and the message weight A message weighting unit for storing an operation information message in which a value is set in the message storage unit;
An operation information management system comprising: a message presentation unit that extracts the operation information message from the message storage unit based on the message weight value and outputs the message to a preset display device. In the operation information management system according to claim 1 or 2,
A message marking unit for marking the operation information message extracted by the filtering for tracking the operation information;
The condition weight setting unit calculates the number of marked operation information messages out of the operation information messages hit by the search based on each search condition information as the number of marks, and uses the number of search uses and the number of search hits. And a marking weight value calculation setting function for calculating the weight value based on the relationship between the number of marks and setting the weight value in the search condition information. In the operation information management system according to claim 2,
An operation information management system comprising: a search condition deleting unit that deletes the search condition when a weight value in the search condition information is below a preset lower limit value. In an operation information management method for extracting a specific operation information message by performing filtering based on preset filter condition information for an operation information message indicating operation contents in a computer device,
A search for operation information messages that hit preset search condition information from operation information messages other than operation information messages extracted by the filtering is performed,
While calculating the weight value for the search result based on the relationship between the number of times the search is used for each search condition information and the number of search hits indicating the number of operation information messages hit by the search , Each search condition information is weighted by the weight value,
When the weight value exceeds a preset constant value, search condition information weighted by the weight value is newly set as the filter condition information ,
An operation information management method characterized in that an operation information message is extracted based on the filter condition information . Operation provided with a filter application unit that performs filtering based on preset filter condition information for an operation information message indicating the operation content in the computer apparatus, and a message storage unit that stores the operation information message extracted by the filtering In the information management system, in the operation information management method of reading a specific operation information message from the message storage unit,
A search is made for an operation information message that hits preset search condition information for an operation information message other than the operation information message extracted by the filtering,
A weight value applied to the search result is calculated based on a relationship between a search usage count that is the number of times used for the search of each search condition information and a search hit count that indicates the number of operation information messages hit in the search,
Performing weighting by the weight value for each search condition information,
It said and sets the search condition information the filter condition information when the weight values assigned weights for each search condition information exceeds a preset fixed value, the extraction of the motion information message based on the filter condition information Stored in a preset message storage unit,
A weight value weighted to the search condition information is set as a message weight value indicating the importance of the operation information message for each of the operation information messages hit by the search based on the search condition information, and is set to a predetermined constant. An operation information management method, wherein the operation information message in which a message weight value equal to or greater than a value is set is stored in the message storage unit. An operation information management system comprising a filter application unit that obtains an operation information message indicating an operation content in a computer device and performs filtering based on preset filter condition information for the operation information message. An operation information management program for accumulating operation information messages extracted by filtering,
A message search function for searching for operation information messages that hit preset search condition information from operation information messages other than the operation information messages extracted by the filtering;
While calculating the weight value for the search result based on the relationship between the search usage count, which is the number of times each search condition information is used for the search, and the search hit count indicating the number of operation information messages hit by the search. A condition weight setting function for weighting each search condition information by the weight value;
A search condition for setting search condition information weighted by the weight value in the filter condition information when the weight value exceeds a preset constant value and extracting an operation information message based on the filter condition information Filtering setting function,
Is executed by a computer set in the operation information management system. An operation information management system including a filter application unit that performs filtering based on preset filter condition information with respect to an operation information message indicating an operation content in a computer device, the operation information message extracted by the filtering Operation information management program for storing
A message search function for searching for operation information messages that hit preset search condition information from operation information messages other than the operation information messages extracted by the filtering;
The search result is based on the relationship between the number of search uses, which is the number of times the search condition information is used for the search, and the number of search hits indicating the number of operation information messages hit by the search based on the search condition information. A condition weight setting function for calculating a weight value and weighting each search condition information with the weight value;
A search condition for setting search condition information weighted by the weight value in the filter condition information when the weight value exceeds a preset constant value and extracting an operation information message based on the filter condition information Filtering setting function,
A weight value weighted by the search condition information for each of the operation information messages hit by the search is set as a message weight value indicating the importance of the operation information message, and a message weight equal to or greater than a predetermined value set in advance. A message weighting setting function for storing the operation information message with a value set in a message storage unit provided in advance ;
Is executed by a computer set in the operation information management system.

Images