JP5506906B1 - Event response support apparatus, event response support method, and program - Google Patents

Abstract

To support a user so that a response to an event occurring in a device or the like can be executed quickly and accurately.
An event response support apparatus specifies support information related to log information of a monitored device from a support information storage unit, and acquires a response method for an event related to the log information from the specified support information To do. Further, history information associated with the identified support information is specified from the history information storage unit, and supplementary information for the handling method is acquired from the specified history information. In addition, the acquired handling method and supplementary information are output.
[Selection] Figure 1

Description

  The present invention relates to an event response support apparatus, an event response support method, and a program.

  Some devices that constitute a network system, such as devices such as servers, routers, and switches, can detect an event such as a failure or trouble that has occurred in its own device and record it as log information. These devices can also transmit the recorded log information to an external monitoring terminal or the like. For example, the monitoring terminal can display received log information or notify a user of the network system. For example, the user can determine a response method (which may be referred to as a “response method”) such as a solution to the event that has occurred by confirming log information or the like displayed on the monitoring terminal.

  For example, Patent Document 1 describes a system for managing a failure using SNMP (Simple Network Management Protocol) or MIB (Management Information Base).

JP 2000-115168 A

  By the way, when a user determines a response method for an event that has occurred as described above, the determined response method is influenced by, for example, the technical ability and experience of the user. Therefore, an inappropriate response method is determined, and it may not be possible to appropriately respond to the event. Also, determination of the response method may require analysis of log information, investigation of product manuals, etc., and the problem may not be resolved quickly. In addition, when the event is complicated, the accuracy of the response may be reduced, and the solution of the problem may be prolonged.

  Therefore, an object of the present invention is to assist a user so that a response to an event occurring in a device or the like can be executed more quickly and accurately.

  The present application includes a plurality of means for solving at least a part of the above-described problems. Examples of such means are as follows.

A first aspect of the present invention for solving the above-mentioned problem is an event response support apparatus that supports a response to an event that has occurred in a monitored device, and includes information for specifying log information, and the log information A support information storage unit that stores support information including a method for responding to related events, a history of outputting the support method of the support information for each support information, and the correspondence of the support information in the history Related to history information storage unit that associates and stores history information including supplementary information for a method, a monitoring unit that monitors log information of the monitoring target device, and log information of the monitoring target device received by the monitoring unit Identifying the support information to be performed from the support information storage unit, obtaining the handling method from the identified support information, and storing history information associated with the identified support information in the history information storage The acquiring the supplementary information from the identified history information, and an output unit for outputting a corresponding method and supplemental information and the acquired, each support information stored in the support information storage unit, the support information with identifying from A reliability information storage unit that associates and stores reliability information indicating reliability, and calculates the reliability of the support information based on the number of the history information associated with the support information, and the reliability information A reliability calculation unit that sets the reliability information stored in the storage unit, and the output unit acquires reliability information associated with the identified support information from the reliability information storage unit. The obtained reliability information is output together with the handling method .

Here, in the event response support apparatus, the reliability calculation unit calculates a ratio of the number of history information in which the supplementary information is not set out of a total number of history information associated with the support information, The reliability of the support information may be calculated .

Further, in the event response support apparatus, the history information includes an event factor related to the response method of the support information in the history, and the reliability calculation unit is associated with the support information. The ratio of the number of history information in which the supplementary information is not set out of the total number of history information (however, the same factor of the history information is counted as one) is calculated as the reliability of the support information. It may be characterized by that.

The event response support apparatus further includes an input unit that receives approval for the history information stored in the history information storage unit, and the reliability calculation unit includes history information associated with the support information. The reliability of the support information may be calculated based on the approved history information .

In addition, the event response support apparatus includes an input unit that receives approval for support information stored in the support information storage unit, and the reliability calculation unit has approved the support information. The elapsed time from the date and time may be measured, and the longer the elapsed time, the lower the reliability of the support information may be.

In addition, the event response support apparatus includes an input unit that receives approval for support information stored in the support information storage unit, and the reliability calculation unit has approved the support information. The number of times may be counted, and the reliability of the support information may be increased as the number of times increases .

Further, the event response support apparatus includes an input unit that receives approval for support information stored in the support information storage unit, and the reliability calculation unit is configured to handle an event of an approver of the support information The higher the capability level, the higher the reliability of the support information may be.

Further, in the event response support apparatus, the reliability calculation unit obtains an official response method regarding log information included in the support information, and a character string included in the official response method and the support information May be characterized in that the reliability of the support information is increased as the difference is smaller .

Further, in the event response support apparatus, the output unit determines whether or not the reliability of the support information is equal to or less than a predetermined threshold, and the support information whose reliability is equal to or less than the predetermined threshold It may be characterized by outputting a message for prompting review .

A second aspect of the present invention for solving the above problem is an event response support method in an event response support device that supports response to an event that has occurred in a monitored device, wherein the event response support device includes: A support information storage unit that stores support information including information for identifying log information and a method for responding to an event related to the log information, and the support method for the support information is output for each support information. For each piece of support information stored in the support information storage unit, and a history information storage unit that associates and stores history information including supplementary information for the corresponding method of the support information in the history anda reliability information storing unit that associates and stores reliability information indicating the reliability of the information, said event corresponding support method includes a monitoring step of monitoring the log information of the monitored device, the monitoring The support information related to the log information of the monitored device received at the step is identified from the support information storage unit, the handling method is acquired from the identified support information, and the history associated with the identified support information An output step for identifying the information from the history information storage unit, acquiring the supplementary information from the identified history information, and outputting the acquired handling method and supplementary information, and determining the reliability of the support information. A reliability calculation step that calculates the reliability information stored in the reliability information storage unit and sets the reliability information based on the number of history information associated with the history information. acquires reliability information associated with the support information from the reliability information storage unit, and outputs the acquired reliability information together with the corresponding process, And wherein the door.

A third aspect of the present invention for solving the above-described problem is a program that causes a computer to function as an event response support apparatus that supports a response to an event that has occurred in a monitored device, and specifies log information Information and a support information storage unit that stores support information including a method for responding to an event related to the log information, a history of outputting the support method of the support information for each of the support information, and the history A history information storage unit that associates and stores history information including supplemental information for the support method of the support information in the device, a monitoring unit that monitors log information of the monitoring target device, and the monitoring received by the monitoring unit The support information related to the log information of the target device is specified from the support information storage unit, the response method is acquired from the specified support information, and the specified support information is acquired. It acquires the supplementary information from the identified history information with the history information associated with identifying from the history information storage unit to an output unit for outputting a corresponding method and supplemental information and the acquired, the support information storage unit A reliability information storage unit that associates and stores reliability information indicating the reliability of the support information for each stored support information, and the history information associated with the support information with the reliability of the support information. The computer is made to function as a reliability calculation unit that is calculated based on the number of and is set to the reliability information stored in the reliability information storage unit, and the output unit is associated with the identified support information The reliability information is acquired from the reliability information storage unit, and the acquired reliability information is output together with the handling method .

It is a figure which shows an example of schematic structure of the network system 10 which concerns on 1st embodiment of this invention. It is a figure which shows an example of a function structure of the event response assistance apparatus. It is a figure which shows an example of a structure of the assistance information table. It is a figure which shows an example of a structure of the log | history information table. 2 is a diagram illustrating an example of a schematic configuration of a computer 40. FIG. It is a flowchart which shows an example of a support information output process. It is a figure which shows an example of UI screen 50 which outputs assistance information. It is a flowchart which shows an example of a support information registration process. It is a flowchart which shows an example of a support information approval process. It is a flowchart which shows an example of a support information search process and a support information edit process. It is a figure which shows an example of UI screen 60 which inputs operation with respect to support information. It is a figure which shows an example of a function structure of 1 A of event response assistance apparatuses which concern on a 1st modification. 4 is a diagram illustrating an example of a configuration of a reliability information table 113. FIG. It is a figure which shows an example of UI screen 50A which outputs reliability. It is a flowchart which shows an example of a reliability calculation process. It is a figure which shows an example of a function structure of the event response assistance apparatus 1B which concerns on a 2nd modification. It is a figure which shows an example of a structure of the difficulty level information table. It is a figure which shows an example of a structure of the user level information table. It is a figure which shows an example of UI screen 50B which outputs a difficulty level. It is a figure which shows an example of a function structure of 1 C of event response assistance apparatuses which concern on a 3rd modification. It is a figure which shows an example of a structure of the urgency information table. It is a figure which shows an example of UI screen 50C which outputs an urgent degree.

<First embodiment>
A first embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing an example of a schematic configuration of a network system 10 according to the first embodiment of the present invention. The network system 10 includes an event response support apparatus 1 and one or more monitoring target devices 2. The event response support apparatus 1 and the monitoring target device 2 are connected via a network 3 such as a LAN (Local Area Network) or the Internet.

  The event response support apparatus 1 monitors and receives log information transmitted from the monitoring target device 2 and displays a response method related to an event such as a failure or trouble identified from the log information. You may call a network monitoring device, a network monitoring server, a network monitoring system, etc. The event response support apparatus 1 will be described in detail later.

  The monitoring target device 2 is a device such as a server device, a router, a switch, or a user terminal. The monitoring target device 2 has a function of recording log information related to an event or the like that has occurred in its own device or another device. The monitored device 2 has a function of transmitting the recorded log information to an external device. In the present embodiment, the monitored device 2 is set to transmit log information to the event response support apparatus 1.

  The log information includes, for example, an OS (Operating System), a system event log, and an error log. For example, recording and transmission / reception of log information can be realized by using existing technologies such as MIB (Management Information Base) and SNMP (Simple Network Management Protocol).

  The configuration of the network system 10 in FIG. 1 described above is the main configuration in describing the features of the present invention, and is not limited to the above configuration. Further, the configuration of a general network system is not excluded. For example, a user terminal may be connected to the event response support apparatus 1, and the event response support apparatus 1 may output a response method or the like to the user terminal for display. Further, for example, the event response support apparatus 1 is not limited to a single device, and may be realized by a system using a plurality of devices.

  FIG. 2 is a diagram illustrating an example of a functional configuration of the event response support apparatus 1. The event response support apparatus 1 includes a control unit 100, a storage unit 110, an output unit 120, an input unit 130, and a communication unit 140.

  The output unit 120 displays a user interface (hereinafter also referred to as “UI”) screen or the like.

  The input unit 130 receives user input operations.

  The communication unit 140 transmits and receives information via the network 3.

  The storage unit 110 stores information necessary for controlling the event response support apparatus 1. The storage unit 110 stores a support information table 111 and a history information table 112.

  In the support information table 111, support information indicating a response method related to an event identified from the log information transmitted from the monitoring target device 2 is stored. Specifically, for example, as shown in FIG. 3 (a diagram illustrating an example of the configuration of the support information table 111), the support information table 111 includes a support information ID 111a, a system name 111b, and an address 111c for each support information. And a support information record in which items of time zone 111d, character string 111e, description 111f, handling method 111g, registrant ID 111h, and status 111i are associated with each other.

The support information ID 111a is identification information of the support information.
The system name 111b is the name of the system that outputs log information related to the support information.
The address 111c is an address of a system that outputs log information related to the support information, for example, an IP address or a MAC address.
The time zone 111d is information indicating a time zone including the time when the log information related to the support information is output.
The character string 111e is a character string included in log information related to the support information.
The description 111f is information explaining the meaning of the character string 111e.
The handling method 111g is information indicating a handling method related to an event identified from log information related to the support information.
The registrant ID 111h is identification information of the user who registered the support information.
The status 111i is the status of the support information. The status includes “temporary registration” indicating a state before the support information is registered by the user, “waiting for approval” indicating a request for approval of the support information to the approver, and the approval. “Approved” indicating that the support information has been approved by the person.

  The history information table 112 stores history information indicating a history of use of the support information by displaying the support information on the output unit 120 or the user terminal. Specifically, for example, as shown in FIG. 4 (a diagram showing an example of the configuration of the history information table 112), the history information table 112 includes, for each history information, a history information ID 112a, a corresponding date 112b, A history information record in which items of ID 112c, support information ID 112d, factor 112e, supplement 112f, and status 112g are associated is stored. Each history information record is associated with a support information record.

The history information ID 112a is identification information of the history information.
The response date and time 112b is the date and time when the event was handled using the support information associated with the history information.
The responder ID 112c is identification information of a user who has dealt with an event using the support information associated with the history information.
The support information ID 112d is identification information of support information associated with the history information.
The factor 112e is information indicating the factor of the event identified from the log information related to the support information associated with the history information.
The supplement 112f is information indicating a supplement to the support method 111g of the support information associated with the history information.
The status 112g is the status of the history information. The status includes “temporary registration” indicating the state before the user performs the registration operation of the history information, “waiting for approval” indicating the request for approval of the history information to the approver, and the approval. “Approved” indicating that the history information has been approved by a person.

  Returning to FIG. The control unit 100 controls the entire event response support apparatus 1. The control unit 100 includes a monitoring unit 101, a search unit 102, an output control unit 103, an input control unit 104, an information generation unit 105, and a notification unit 106.

  The monitoring unit 101 monitors whether log information has been received from the monitoring target device 2 via the communication unit 140. The monitoring unit 101 stores the received log information in the storage unit 110, for example. For example, the monitoring unit 101 may request log information from the monitoring target device 2 by polling or the like, and receive the log information as a response to the request. Further, for example, the monitoring target device 2 may autonomously transmit log information to the event response support apparatus 1.

  The search unit 102 searches the support information table 111 for a support information record that meets the set conditions and outputs it. In addition, the search unit 102 searches the history information table 112 for history information records that meet the set conditions and outputs them.

  Based on the support information record and the history information record, the output control unit 103 outputs, that is, displays a UI screen or the like for supporting the response to the event via the output unit 120. Of course, the output control unit 103 may output a UI screen or the like to a user terminal (not shown) or the like via the communication unit 140 and display it.

  The input control unit 104 receives an operation on the UI screen or the like for supporting the response to the event output via the output unit 120 via the input unit 130. Of course, the input control unit 104 may accept an operation from a user terminal (not shown) or the like via the communication unit 140.

  The information generation unit 105 adds a support information record related to the received log information to the support information table 111. In addition, the information generation unit 105 adds a history information record of the used support information record to the history information table 112. In addition, each item included in the support information record and the history information record is updated.

  The notification unit 106 transmits a registration request notification, an approval request notification, an approval result notification, and the like regarding the support information record and the history information record to the notification destination user via the communication unit 140.

  The event response support apparatus 1 described above includes, for example, a CPU (Central Processing Unit) 41, a memory 42, and an external storage device 43 such as an HDD, as shown in FIG. 5 (an example of a schematic configuration of the computer 40). A communication interface (I / F) 44 for connecting to a communication network by radio or wire, an input device 45 such as a mouse or a keyboard, an output device 46 such as a liquid crystal display, and a recording such as a DVD (Digital Versatile Disk) This can be realized by a computer 40 including a media I / F 47 that reads and writes information on the medium.

  For example, the control unit 100 can be realized by loading a predetermined program stored in the external storage device 43 into the memory 42 and executing it by the CPU 41. The storage unit 110 can be realized by the CPU 41 using the memory 42 or the external storage device 43. The output unit 120 can be realized by the CPU 41 using the output device 46. The input unit 130 can be realized by the CPU 41 using the input device 45. The communication unit 140 can be realized by the CPU 41 using the communication I / F 44.

  The predetermined program may be downloaded from the network to the external storage device 43 via the communication I / F 44, and then loaded onto the memory 42 and executed by the CPU 41. Alternatively, it may be loaded directly from the network onto the memory 42 via the communication I / F 44 and executed by the CPU 41. Further, the computer 40 may load the predetermined program into the external storage device 43 or the memory 42 from the storage medium set in the media I / F 47.

  The functional configuration of the event response support apparatus 1 in FIG. 2 is classified according to main processing contents for easy understanding. The present invention is not limited by the way of classification and names of the constituent elements. The configuration of the event response support apparatus 1 can be classified into more components depending on the processing content. Moreover, it can also classify | categorize so that one component may perform more processes. Further, the processing of each component may be executed by one hardware or may be executed by a plurality of hardware. Further, the processing of each component may be realized by one program or may be realized by a plurality of programs. For example, the storage unit 110 is constructed on a storage device connected to the event response support device 1 via a network, and the event response support device 1 acquires support information and history information from the storage device, The support information and history information of the device may be updated. Moreover, the structure of the table of said FIG.3 and FIG.4 is an example, and is not restricted to the illustrated example. Further, the support information and the history information are not limited to the table structure, and may have other data structures.

  Next, processing realized by the event response support apparatus 1 will be described.

  In the present embodiment, the event response support apparatus 1 controls login for each user (for example, an administrator of the network system 10, a responder who responds to an event, an approver who approves support information, etc.). In addition, it is assumed that a service as shown in the following flow can be provided to each user. The event response support apparatus 1 can acquire the user ID of the logged-in user, the contact information of the user (for example, an e-mail address, etc.), and the like.

  FIG. 6 is a flowchart illustrating an example of the support information output process.

  The monitoring unit 101 determines whether log information has been received from the monitoring target device 2 via the communication unit 140 (step S101). If the log information has not been received (step S101: N), the determination is continued.

  When log information is received (step S101: Y), the search unit 102 extracts key information, which is a search key used for searching for support information records, from the log information received in step S101 (step S103). Specifically, the log information includes, for example, the IP address of the monitored device 2 that is the transmission source of the log information, a code indicating the content of the event that has occurred, an output message that describes the content of the event that has occurred, It is assumed that the output time indicating the occurrence time is included. The search unit 102 extracts the transmission source IP address, the output time, and the output message as key information from the received log information.

  Then, the search unit 102 searches the support information table 111 for an approved support information record that matches the key information extracted in step S103 (step S105). Specifically, the search unit 102 matches the address indicated by the address 111c and the transmission source IP address of the key information among the support information records whose status 111i is “approved” and the time indicated by the time zone 111d. A support information record in which the output time of the key information is included in the band and the character string indicated by the character string 111e is included in the output message of the key information is searched. Of course, which information is used as key information is not limited to the above example. Further, the input control unit 104 may accept a setting of which information is used as key information from the user.

  Then, the search unit 102 determines whether or not the support information record has been identified as a result of Step S105 (Step S107).

  When the support information record can be specified (step S107: Y), the search unit 102 searches the history information table 112 for the approved history information record associated with the support information record specified in step S105 (step S107). S105). Specifically, the search unit 102 searches for history information records having a support information ID 112d that matches the support information ID 111a of the support information record among the history information records whose status 112g is “approved”.

  Then, the search unit 102 determines whether or not the history information record has been identified as a result of Step S109 (Step S111).

  When the history information record is specified (step S111: Y), the output control unit 103 determines the support information and history based on the support information record specified in step S105 and the history information record specified in step S109. Information is output via the output unit 120 or the communication unit 140 (step S113).

  Specifically, the output control unit 103 outputs a UI screen 50 as illustrated in FIG. 7 (an example of a UI screen 50 that outputs support information), for example. As shown in the figure, the UI screen 50 includes a log information area 51 for displaying the contents of log information, a support information area 52 for displaying the contents of support information, and a history information area 53 for displaying the contents of history information. , And a close button 54 for ending the display of the UI screen 50.

  The output control unit 103 acquires the transmission source IP address and the output message from the log information received in step S101, and outputs them to the log information area 51 as the address 51a and the output message 51b. Further, the output control unit 103 acquires the description 111f and the handling method 111g from the support information record specified in step S105, and outputs them to the support information area 52 as the description 52a and the handling method 52b. Further, the output control unit 103 acquires the factor 112e and the supplement 112f from the history information record specified in step S109, and outputs the factor 112e and the supplement 112f to the history information area 53 as the factor 53a and the supplement 53b. When a plurality of history information records are specified, a list of the factors 53a and supplements 53b of each record may be displayed.

  Of course, the configuration of the UI screen 50 is not limited to the illustrated one. For example, the output control unit 103 may output any one or more items included in the log information, may output any one or more items included in the support information record, or the history information record Any one or more items included in may be output.

  When no history information record is specified (step S111: N), the output control unit 103 outputs support information via the output unit 120 or the communication unit 140 based on the support information record specified in step S105. (Step S115). Specifically, the output control unit 103 outputs a UI screen 50 as shown in FIG. 7, for example, omitting the history information area 53.

  Then, the information generation unit 105 registers the history information record in the history information table 112 (step S117). Specifically, the information generation unit 105 adds a new history information record to the history information table 112. Further, the information generation unit 105 sets the newly generated ID for the added history information record as the history information ID 112a, and sets the support information ID 111a of the support information record specified in step S105 as the support information ID 112d. In addition, the output time of the log information received in step S101 is set to the corresponding date 112b. Also, the user ID of the user who has logged in to the event response support apparatus 1 is acquired and set as the responder ID 112c. In addition, “provisional registration” is set in the status 112g. The factor 112e and the supplement 112f are not set.

  Then, the notification unit 106 transmits a notification requesting registration of the temporarily registered history information record to the user who has logged in the event response support apparatus 1 or another user via the output unit 120 or the communication unit 140. (Step S119). As a notification method, for example, an e-mail may be transmitted to the user's e-mail address, or a pop-up screen may be displayed on the output device 46 or the user's terminal. After the end of step S119, the control unit 100 returns the process to step S101.

  On the other hand, when the support information record is not specified (step S107: N), the output control unit 103 outputs a message indicating that support information is unregistered via the output unit 120 or the communication unit 140 (step S107). S121).

  Then, the information generation unit 105 registers the support information record in the support information table 111 (step S123). Specifically, the information generation unit 105 adds a new support information record to the support information table 111. Further, the information generation unit 105 sets the newly generated ID for the added support information record as the support information ID 111a. In addition, the transmission source IP address, output time, and output message of the log information received in step S101 are set in the address 111c, the time zone 111d, and the character string 111e. Also, the user ID of the user who has logged in to the event response support apparatus 1 is acquired and set as the registrant ID 111h. In addition, “provisional registration” is set in the status 111i. The system name 111b, the description 111f, and the handling method 111g are not set.

  Then, the notification unit 106 transmits a notification requesting registration of the temporarily registered support information record to the user who has logged into the event response support apparatus 1 or another user via the output unit 120 or the communication unit 140. (Step S125). As a notification method, for example, an e-mail may be transmitted to the user's e-mail address, or a pop-up screen may be displayed on the output device 46 or the user's terminal. After the end of step S125, the control unit 100 returns the process to step S101.

  As described above, the support information related to the log information and the history information related to the support information are output. The user can determine not only the output support information but also history information related to the support information, and determine a method for responding to an event identified from the log information.

  FIG. 8 is a flowchart showing an example of the support information registration process.

  This flow is started, for example, when the event response support apparatus 1 receives an instruction to start support information registration processing from a user or the like who has received the above registration request notification. Specifically, after the user logs in, the output control unit 103 displays the UI screen 60 as shown in FIG. 11 (an example of the UI screen 60 for inputting an operation for support information), as the output unit 120 or The data is output via the communication unit 140. As shown in the figure, the UI screen 60 includes a support information registration button 61 for starting the support information registration process (see FIG. 8) and a support information approval for starting the support information approval process (see FIG. 9). A button 62, a support information search button 63 for starting the support information search process (see FIG. 10), and a support information edit button for starting the support information editing process (see FIG. 10 as in the support information search process) 64 and a close button 65 for ending the display of the UI screen 60.

  The input control unit 104 receives an input operation on the UI screen 60 via the input unit 130 or the communication unit 140. When the support information registration button 61 is clicked or the like, the control unit 100 starts this flow.

  The search unit 102 searches the support information table 111 for a support information record whose status 111i is “provisional registration” (step S201). Further, the search unit 102 searches the history information table 112 for a history information record whose status 112g is “provisional registration” (step S201).

  Then, the search unit 102 determines whether or not the temporary registration record has been identified as a result of step S201 (step S203). When the provisional registration record is not specified (S203: N), the control unit 100 ends the process of this flow.

  When the temporary registration record is specified (step S203: Y), the control unit 100 accepts editing of the temporary registration record (step S205). Specifically, the output control unit 103 acquires from the support information table 111 and the history information table 112 the temporary registration support information record specified in step S201 and the history information record related to the support information record. Each item of the recorded record is displayed in a list on the UI screen. Further, the input control unit 104 receives an editing operation for each item of each record on the UI screen. You may make it receive deletion of a record. Further, the input control unit 104 receives an operation for ending editing on the UI screen.

  In the UI screen as described above, for the support information record, for example, the user sets the items that were not set in step S123 (see FIG. 6), the system name 111b, the description 111f, and the handling method 111g. Can do. Of course, the items set in step S123 (see FIG. 6) can also be edited. In addition, for the history information record, the user can set, for example, items, factors 112e, and supplements 112f that were not set in step S117 (see FIG. 6). Of course, the items set in step S117 (see FIG. 6) can also be edited.

  Here, the user can change the content of each item so that each item of the support information record functions well as a search key. For example, the output time set in the time zone 111d can be changed to a time zone including the output time. For example, the output message set in the character string 111e can be changed to a part of the character string included in the output message. The same applies to other items.

  In addition, after the user responds to the event based on the support information record output in step S115 or step S113 (see FIG. 6), the user analyzes the cause of the event and records history information related to the support information record. It can be set as the record factor 112e. In addition, after the user responds to the event based on the support information record output in step S115 or step S113 (see FIG. 6), the user analyzes an error or lack of the support information and relates to the support information record. It can be set as a supplement 112f of the history information record to be performed.

  The control unit 100 determines whether or not there has been an operation to end editing of the temporarily registered record (step S207). If there is no operation to end editing (step S207: N), the process returns to step S205 to continue accepting edits.

  When there is an operation to end editing (step S207: Y), the information generation unit 105 uses the contents of each item of each temporarily registered record edited in step S205 to store the support information table 111 or the history information table 112. The corresponding record is updated (step S209). Further, “waiting for approval” is set in the status 111i or the status 112g of the updated record (step S209).

  Then, the notification unit 106 transmits a notification for requesting approval of the support information record and the history information record waiting for approval to the user or other users designated in advance as the approver via the output unit 120 or the communication unit 140. (Step S211). As a notification method, for example, an e-mail may be transmitted to the user's e-mail address, or a pop-up screen may be displayed on the output device 46 or the user's terminal. After step S211, the control unit 100 ends the process of this flow.

  As described above, it is possible to add insufficient information or correct inappropriate contents to provisionally registered support information and provisionally registered history information. Therefore, the quality of support information and history information can be improved so that the response to the event can be performed quickly and accurately.

  FIG. 9 is a flowchart illustrating an example of the support information approval process.

  This flow is started, for example, when the event response support apparatus 1 receives an instruction to start support information approval processing from a user such as an approver who has received an approval request notification. Specifically, the output control unit 103 outputs a UI screen 60 as shown in FIG. 11, for example. When the support information approval button 62 is clicked, the control unit 100 starts this flow.

  The search unit 102 searches the support information table 111 for a support information record whose status 111i is “waiting for approval” (step S301). Further, the search unit 102 searches the history information table 112 for a history information record whose status 112g is “waiting for approval” (step S301).

  Then, the search unit 102 determines whether or not a record waiting for approval has been identified as a result of step S301 (step S303). When the record waiting for approval is not specified (S303: N), the control unit 100 ends the process of this flow.

  When the record waiting for approval is specified (step S303: Y), the control unit 100 accepts the approval of the record waiting for approval (step S305). Specifically, the output control unit 103 acquires, from the support information table 111 and the history information table 112, the support information record waiting for approval specified in step S301 and the history information record related to the support information record. The contents of each item of the recorded record are displayed in a list on the UI screen. In addition, the input control unit 104 receives an approval operation for each record on the UI screen. In addition, the input control unit 104 receives an operation for ending approval on the UI screen. Note that the input control unit 104 may accept an editing operation of the contents of each item of each record on the UI screen.

  In the UI screen as described above, for example, the approver can review the contents of each record updated in step S209 (see FIG. 8) and set approved or not approved. Each record can be edited.

  The control unit 100 determines whether or not there has been an operation to end the approval of the record awaiting approval (step S307). If there is no operation to end the approval (step S307: N), the process returns to step S305 and the acceptance of the approval is continued.

  When there is an operation to end the approval (step S307: Y), the information generation unit 105 uses the contents of each item of each record waiting for approval edited in step S305, in the support information table 111 or the history information table 112. The corresponding record is updated (step S309). Also, “approved” is set in the status 111i or the status 112g of the record for which approval is set in step S305 (step S309). In addition, “temporary registration” is set in the status 111i or the status 112g of the record for which the approval is impossible in step S305 (step S309).

  Then, the notification unit 106 notifies the user or other user indicated by the registrant ID 111h of the notification of the approval result (approved or unapproved) for each support information record that has been waiting for approval. It transmits via the part 140 (step S311). For each history information record waiting for approval, a notification of an approval result (approved or not approved) is transmitted to the user indicated by the correspondent ID 112c or another user via the output unit 120 or the communication unit 140. (Step S311). As a notification method, for example, an e-mail may be transmitted to the user's e-mail address, or a pop-up screen may be displayed on the output device 46 or the user's terminal. After step S311, the control unit 100 ends the process of this flow.

  As described above, the approver can add insufficient information or correct inappropriate contents to the support information waiting for approval and the history information waiting for approval. It is also possible to notify the registrant that the approval is impossible and to review the contents of the support information and history information. Therefore, the quality of support information and history information can be improved so that the response to the event can be performed quickly and accurately. For example, if the approver is a person with higher ability and experience than the registrant or the like, the quality of support information and history information can be improved easily.

  FIG. 10 is a flowchart illustrating an example of the support information search process and the support information edit process.

  This flow is started, for example, when the event response support apparatus 1 receives an instruction to start support information search processing or support information editing processing from a user. Specifically, the output control unit 103 outputs a UI screen 60 as shown in FIG. 11, for example. When the support information search button 63 or the support information edit button 64 is clicked, the control unit 100 starts this flow.

  The control unit 100 accepts a search condition (step S401). Specifically, the output control unit 103 outputs a UI screen for receiving search conditions for the support information record and the history information record. As a search condition for the support information record, for example, a support information ID, a system name, an address, a time zone, a character string, a description, a handling method, a registrant ID, and a value related to at least one item of status, a range of values, Accept keywords. As a search condition for the history information record, for example, a value, a range of values, a keyword, etc. regarding at least one item of history information ID, corresponding date / time, responder ID, support information ID, factor, supplement, and status are accepted. The input control unit 104 accepts a search condition setting operation on the UI screen. Further, the input control unit 104 accepts an operation for starting a search on the UI screen.

  The control unit 100 determines whether or not there is an operation for starting a search (step S403). If there is no operation to start the search (step S403: N), the process returns to step S401, and the search condition reception is continued.

  When there is an operation for starting the search (step S403: Y), the search unit 102 acquires the search condition set in step S401, and acquires a support information record that matches the search condition for the support information record from the support information table 111. The history information record that matches the search condition for the history information record is searched from the history information table 112 (step S405).

  Then, the search unit 102 determines whether or not a record that meets the search condition has been identified as a result of step S405 (step S407).

  When a record that meets the search condition is identified (step S407: Y), the control unit 100 outputs a search result (step S409). Specifically, the output control unit 103 acquires the records specified in step S407 from the support information table 111 and the history information table 112, and displays the contents of the acquired records in a list on the UI screen. Further, the input control unit 104 accepts an operation for starting record editing on the UI screen. Further, the input control unit 104 accepts an operation for terminating the output of the search result on the UI screen.

  The control unit 100 determines whether or not there has been an operation for starting record editing (step S411).

  If there is an operation to start editing the record (step S411: Y), the control unit 100 accepts the editing of the record output in step S409 (step S413). Specifically, the input control unit 104 accepts an editing operation for the contents of each record on the UI screen output in step S409. Further, the input control unit 104 receives an operation for ending editing on the UI screen.

  In the UI screen as described above, for example, the user can review and correct the contents of the support information record and the history information record.

  The control unit 100 determines whether or not there has been an operation for finishing editing the record (step S415). If there is no operation to end editing (step S415: N), the process returns to step S413, and the acceptance of editing is continued.

  When there is an operation to end editing (step S415: Y), the information generation unit 105 uses the contents of each item of each record edited in step S413, and the corresponding record in the support information table 111 or the history information table 112 Is updated (step S417). Further, “waiting for approval” is set in the status 111i or the status 112g of the updated record (step S417).

  Then, the notification unit 106 transmits a notification for requesting approval of the support information record and the history information record waiting for approval to the user or other users designated in advance as the approver via the output unit 120 or the communication unit 140. (Step S419). As a notification method, for example, an e-mail may be transmitted to the user's e-mail address, or a pop-up screen may be displayed on the output device 46 or the user's terminal. After the end of step S419, the control unit 100 ends the process of this flow.

  On the other hand, when there is no operation to start editing the record (step S411: N), the control unit 100 determines whether there is an operation to end the output of the search result (step S421). If there is no operation to end the output of the search result (step S421: N), the process returns to step S409, and the output of the search result is continued. When there is no operation to end the output of the search result (step S421: N), the control unit 100 ends the process of this flow.

  On the other hand, when a record that meets the search condition is not identified (step 407: N), the output control unit 103 sends a message indicating that a record that meets the search condition is unregistered via the output unit 120 or the communication unit 140. And output (step S423). After step S423 ends, the control unit 100 ends the process of this flow.

  As described above, it is possible to search for arbitrary support information and history information, and to add necessary information to the searched support information and history information or to correct inappropriate contents as necessary. it can. Therefore, the quality of support information and history information can be improved so that the response to the event can be performed quickly and accurately. For example, if the person who reviews the support information and the history information is a person who has higher ability and experience than the approver or the like, the quality of the support information and the history information can be easily improved.

  The processing units of the flows in FIGS. 6 and 8 to 10 are divided according to main processing contents in order to make the processing of the event handling support apparatus 1 easy to understand. The present invention is not limited by the way of dividing the processing unit or the name. The processing of the event response support apparatus 1 can be divided into more processing units according to the processing contents. Moreover, it can also divide | segment so that one process unit may contain many processes. Further, the processing order of the above flow is not limited to the illustrated example. In addition, the configuration of the UI screen described above with reference to FIGS. 7 and 11 is not limited to the illustrated example.

  The first embodiment of the present invention has been described above. According to the present embodiment, it is possible to assist the user so that the response to the event occurring in the device or the like can be executed more quickly and accurately.

<First modification>
A first modification of the first embodiment will be described with reference to the drawings. In this modification, the thing support apparatus 1 associates the reliability with the support information, and outputs the reliability together with the support information. The reliability is a measure of how much support information is believed when responding to an event such as a device trouble. Hereinafter, the same components as those in the first embodiment are denoted by the same reference numerals, description thereof will be omitted, and differences from the first embodiment will be mainly described.

  FIG. 12 is a diagram illustrating an example of a functional configuration of the event handling support apparatus 1A according to the first modification.

  A reliability information table 113 is stored in the storage unit 110A.

  In the reliability information table 113, the reliability information of the support information record stored in the support information table 111 is stored. Specifically, for example, as illustrated in FIG. 13 (a diagram illustrating an example of the configuration of the reliability information table 113), the support information ID 113a and the reliability 113b are associated with each support information in the reliability information table 113. A reliability information record is stored. The support information ID 113a is identification information of support information associated with the reliability information. The reliability 113b is the reliability of the support information associated with the reliability information.

  Returning to FIG. The control unit 100A includes a reliability calculation unit 107.

  The reliability calculation unit 107 calculates and updates the reliability 113b of the reliability information record stored in the reliability information table 113 according to a predetermined method at a predetermined timing. The reliability calculation unit 107 will be described in detail later.

  The search unit 102A searches the support information table 111 to identify a support information record that meets the set conditions, and searches the reliability information table 113 for a reliability information record associated with the specified support information record. Identify.

  When the output control unit 103A outputs the content of the support information record, for example, in step S113 and step S115 (see FIG. 6), the reliability associated with the support information record and the support information specified by the search unit 102A is identified. Based on the information record, the support information and its reliability are output.

  Specifically, the output control unit 103A outputs a UI screen 50A as illustrated in FIG. 14 (an example of a UI screen 50A that outputs reliability), for example. The output control unit 103A acquires the reliability 113b specified by the search unit 102A, and outputs it to the support information area 52A as the reliability 52c.

  Returning to FIG. When registering the support information record in the support information table 111, the information generation unit 105A registers the reliability information record associated with the registered support information record in the reliability information table 113, for example, in step S123 (see FIG. 6). Specifically, the information generation unit 105A adds a new reliability information record to the reliability information table 113. Further, the support information ID 111a of the registered support information record is set to the support information ID 113a. No setting is made for the reliability 113b.

  FIG. 15 is a flowchart illustrating an example of the reliability calculation process. This flow is started at regular timing, for example.

  The search unit 102A refers to the support information table 111, and selects one unselected record among the support information records whose status 111i is “approved” (step S501). Note that if there is no approved support information record, the control unit 100 may end the processing of this flow.

  Then, the reliability calculation unit 107 calculates the reliability of the support information record selected in step S501 (step S503).

  Specifically, the reliability calculation unit 107 acquires, from the history information table 112, a history information record associated with the support information record selected in step S501 and whose status 112g is “approved”. Then, for example, the reliability is calculated by the following method (1) or (2). In the present modification, for example, the range that the reliability can take is 0 (low reliability) to 1 (high reliability).

(1) Of the total number of acquired history information records, the ratio of the number of history information records for which nothing is set in the supplement 112f is calculated as the reliability. The reliability increases as the ratio increases.
(2) Of the total number of acquired history information records, the ratio of the number of history information records for which nothing is set in the supplement 112f, and the reliability are calculated. However, the records having the same factor 112e are counted as one. The reliability increases as the ratio increases.

  Of course, the above-described reliability calculation method is an example, and other methods may be used as long as objective reliability can be calculated as much as possible.

  For example, the average number of history information records associated with the support information record per unit period is calculated as the usage frequency of the support information record, and the reliability decreases as the usage frequency decreases. It may be a value. Further, for example, the elapsed time from the date and time when the support information record is approved may be measured, and the reliability may be set to a value such that the reliability decreases as the elapsed time increases. Further, for example, the total number of history information records associated with the support information record may be acquired, and the reliability may be set to a value that increases the reliability as the total number increases.

  Also, for example, based on the character string of the support information record handling method 111g and the official handling method for log information related to the support information record (for example, the log information and the model name of the system that output the log information) Then, a correspondence method related to the log information may be obtained from a manual published on the web.) And a difference is calculated, and the reliability becomes higher as the difference becomes smaller. It is good also as such a value.

  In addition, for example, the number of times that the status of the support information record has changed from “Waiting for approval” to “Approved” is counted as the number of reviews, and the reliability can be set to a value that increases as the number of reviews increases. Good. Further, for example, the level of the approver who approved the support information record is specified using the user level information table 115 described later, and the reliability becomes higher as the level of the approver becomes higher. It may be a value.

  Further, for example, any two or more of the reliability levels as described above may be combined, and the sum or product of the reliability levels may be calculated as the reliability level. In calculating the sum or product of each reliability, each reliability may be multiplied by a weighting factor set for each reliability.

  The reliability may be set and changed by the input control unit 104 receiving it from a user such as a registrant, an approver, or a responder via the input unit 130 or the communication unit 140.

  Then, the information generation unit 105A sets the reliability information calculated in step S503 to the reliability 113b of the reliability information record associated with the support information record selected in step S501. Update (step S505).

  Then, the output control unit 103A determines whether or not the reliability calculated in step S503 is equal to or less than a predetermined threshold (step S507). Note that the input control unit 104 may accept the setting change of the predetermined threshold value via the input unit 130 or the communication unit 140.

  When the reliability is equal to or lower than the predetermined threshold (step S507: Y), the output control unit 103A sends a message prompting the review of the content of the support information record selected in step S501 via the output unit 120 or the communication unit 140. Output (step S509). The user who has confirmed the message can review and correct the content of the support information by, for example, the support information search process and the support information edit process (see FIG. 10).

  When the reliability exceeds a predetermined threshold (step S507: N), or after the end of step S509, the search unit 102A determines whether all the support information records whose status 111i is “approved” have been selected. (Step S511). When all the records have not been selected (step S511: N), the search unit 102A returns the process to step S501. When all the records are selected (step S511: Y), the control unit 100A ends the process of this flow.

  The first modification has been described above. According to this modification, the reliability of the support information is calculated and displayed together with the support information. Therefore, the user can respond to the event in consideration of the reliability of the support information. If the reliability is low, the user can determine, for example, whether various factors should be assumed. In addition, since the user can determine whether to review the support information based on the reliability and the message, the quality of the support information can be maintained or improved as much as possible.

<Second modification>
A second modification of the first embodiment will be described with reference to the drawings. In the second modified example, the event handling support apparatus 1 associates the difficulty level of handling an event related to the support information with the support information, and outputs the difficulty level together with the support information. The difficulty level is a guideline for determining whether the responder should seek help from another person when dealing with an event such as equipment trouble. Moreover, in this modification, the event response support apparatus 1 outputs advice or the like when responding to an event based on the user's level. Hereinafter, the same components as those in the first embodiment are denoted by the same reference numerals, description thereof will be omitted, and differences from the first embodiment will be mainly described.

  FIG. 16 is a diagram illustrating an example of a functional configuration of the event response support apparatus 1B according to the second modification.

  The storage unit 110B stores a difficulty level information table 114 and a user level information table 115.

  The difficulty level information table 114 stores difficulty level information of the support information record stored in the support information table 111. Specifically, as shown in FIG. 17 (an example of the configuration of the difficulty level information table 114), for example, the difficulty level information table 114 includes a support information ID 114a and a difficulty level 114b for each support information. The associated difficulty level information record is stored. The support information ID 114a is identification information of support information associated with the difficulty level information. The difficulty level 114b is a difficulty level of handling an event related to support information associated with the difficulty level information.

  The user level information table 115 stores capability levels corresponding to user events. Specifically, for example, as shown in FIG. 18 (a diagram showing an example of the configuration of the user level information table 115), the user level information table 115 includes a user ID 115a and a user associated with the level 115b for each user. Stores level information records. The level 115b is information indicating a capability level corresponding to the user event.

  Returning to FIG. The search unit 102B searches the support information table 111 for a support information record that meets the set conditions and specifies the difficulty information record associated with the specified support information record from the difficulty information table 114. Identify. In addition, the search unit 102B searches the user level information table 115 to identify a user level information record that meets the set conditions.

  When the output control unit 103B outputs the content of the support information record, for example, in step S113 and step S115 (see FIG. 6), the difficulty associated with the support information record and the support information identified by the search unit 102B, for example. Based on the information record, the support information and its difficulty level are output. Further, the output control unit 103B outputs advice or the like when responding to the event based on the difficulty level specified by the search unit 102B and the level of the user who has logged in the event response support apparatus 1.

  Specifically, the output control unit 103B outputs a UI screen 50B as shown in FIG. 19 (an example of a UI screen 50B that outputs the difficulty level), for example. The output control unit 103B acquires the difficulty level 114b specified by the search unit 102B, and outputs it to the support information area 52B as the difficulty level 52d. Further, the output control unit 103B determines the advice content by the following method, for example, and outputs the advice content to the support information area 52B as the advice 52e. Of course, either difficulty level or advice may be output.

  For each difficulty level (for example, a natural number of 1 to 3), a determination table in which a user level (for example, a natural number of 1 to 6) that can handle the event of the difficulty level is prepared in advance (for example, the difficulty level) 1: user level 1-2, difficulty level 2: user level 3-4, difficulty level 3: user level 5-6). The output control unit 103B acquires the level 115b of the user from the user level information table 115 based on the user ID of the user who has logged into the event response support apparatus 1. And using the said determination table, the user level linked | related with the acquired difficulty 114b is referred, and it is determined whether the acquired level 115b is less than the referred user level.

  When the acquired level 115b is lower than the referred user level, the output control unit 103B determines, for example, a character string such as “There is a possibility that it is difficult to deal with your skill level” as the advice content. When the acquired level 115b is equal to or higher than the referenced user level, the output control unit 103B may not determine the advice content in particular, or may determine some character string as the advice content.

  Returning to FIG. When the output control unit 103B accepts editing of the content of the support information record, for example, in step S205 (see FIG. 8), step S305 (see FIG. 9), and step S413 (see FIG. 10), the output control unit 103B Based on the difficulty level information record associated with the support information, the support information and the difficulty level are output. The input control unit 104B accepts editing of the difficulty level.

  When registering the support information record in the support information table 111, for example, in step S123 (see FIG. 6), the information generation unit 105B registers the difficulty level information record associated with the registered support information record in the difficulty level information table 114. Specifically, the information generation unit 105 </ b> B adds a new difficulty level information record to the difficulty level information table 114. Further, the support information ID 111a of the registered support information record is set to the support information ID 114a. The difficulty level 114b is not set. Further, when the difficulty level is edited, the information generation unit 105B updates the difficulty level information record by setting the edited difficulty level in the difficulty level 114b of the difficulty level information record.

  The second modification has been described above. According to this modification, the difficulty level of the support information is displayed together with the support information. Therefore, the user can respond to the event in consideration of the difficulty level of the support information. If the degree of difficulty is high, the user can determine, for example, whether or not to help another user. Further, since the advice is displayed, the user can easily make a determination.

<Third modification>
A third modification of the first embodiment will be described with reference to the drawings. In the third modification, the event response support apparatus 1 associates the support information with the emergency level of response to the event related to the support information, and outputs the emergency level together with the support information. For example, the urgency level is a measure for determining how much the responder should hurry when dealing with an event such as equipment trouble. Hereinafter, the same components as those in the first embodiment are denoted by the same reference numerals, description thereof will be omitted, and differences from the first embodiment will be mainly described.

  FIG. 20 is a diagram illustrating an example of a functional configuration of the event handling support apparatus 1C according to the third modification.

  The urgency information table 116 is stored in the storage unit 110C.

  The emergency level information table 116 stores the emergency level information of the support information record stored in the support information table 111. Specifically, for example, as shown in FIG. 21 (a diagram showing an example of the configuration of the emergency level information table 116), the emergency level information table 116 includes a support information ID 116a and an emergency level 116b for each support information. Stores the associated urgency information record. The support information ID 116a is identification information of support information associated with the urgency information. The urgency level 116b is an urgency level for handling an event related to support information associated with the urgency level information. The possible range of the urgency 116b is, for example, 0 (low urgency) to 1 (high urgency). The urgency level 116b may be set to a value indicating that no response to an event is necessary.

  Returning to FIG. The search unit 102C searches the support information table 111 for a support information record that meets the set conditions and specifies the urgency information record associated with the specified support information record from the urgency information table 116. Identify.

  When the output control unit 103C outputs the content of the support information record, for example, in step S113 and step S115 (see FIG. 6), the urgency level associated with the support information record and the support information identified by the search unit 102C Based on the information record, the support information and its urgency are output.

  Specifically, the output control unit 103C outputs a UI screen 50C as shown in FIG. 22 (a diagram illustrating an example of a UI screen 50C that outputs the degree of urgency), for example. The output control unit 103C acquires the urgency level 116b specified by the search unit 102C and outputs the urgency level 116b to the support information area 52C. When the value indicating that the response to the event is unnecessary is set in the urgency level 116b, the output control unit 103C sends a message indicating that the response to the event is unnecessary to the output unit 120 or the communication unit. 140 may be output.

  Returning to FIG. When the output control unit 103C receives editing of the content of the support information record, for example, in step S205 (see FIG. 8), step S305 (see FIG. 9), and step S413 (see FIG. 10), the output control unit 103C Based on the urgency information record associated with the support information, the support information and the urgency level are output. The input control unit 104B accepts editing of the urgency level.

  When registering the support information record in the support information table 111, for example, in step S123 (see FIG. 6), the information generation unit 105C registers the urgency information record associated with the registered support information record in the urgency information table 116. Specifically, the information generation unit 105C adds a new urgency information record to the urgency information table 116. Further, the support information ID 111a of the registered support information record is set to the support information ID 116a. No setting is made for the urgency level 116b. Further, when the urgency level is edited, the information generation unit 105C updates the urgency level information record by setting the edited urgency level in the urgency level 116b of the urgency level information record.

  The third modification has been described above. According to this modification, since the urgency level of the support information is displayed together with the support information, the user can deal with the event in consideration of the urgency level of the support information. If the degree of urgency is high, the user can determine, for example, whether to increase the priority of handling the event.

  In addition, the above 1st embodiment of this invention and each modification may combine any two or more. Moreover, the above 1st embodiment of this invention and each modification are intended to illustrate the summary and scope of this invention, and do not limit it. Many alternatives, modifications, and variations will be apparent to those skilled in the art.

  For example, for each user, the control unit 100 counts the number of times that the user has registered the support information record, or the number of times the support information record registered by the user has been used (for example, the number of times output by the search process or the output process). And the number of times counted may be output to the personnel evaluation system. In this way, the personnel evaluation system evaluates the user's contribution regarding the support information based on the number of times output from the event response support apparatus 1, or uses the evaluation for the comprehensive personnel evaluation of the user. I can do it. In addition, reflecting the user's contribution regarding the support information in the user's evaluation is an incentive to increase the number of support information or improve the quality of the support information. Of course, the control unit 100 may evaluate the contribution of the user regarding the support information, or may use the evaluation for the comprehensive personnel evaluation of the user.

  Further, for example, the control unit 100 calculates, for each user, an average value, maximum value, minimum value, or the like of the reliability of the support information record registered by the user, and uses the calculated reliability for the personnel evaluation system. You may make it output. In this way, the personnel evaluation system evaluates the user's contribution related to the support information based on the reliability output from the event response support apparatus 1, or converts the evaluation into a comprehensive personnel evaluation of the user. Can be used. In addition, reflecting the user's contribution regarding the support information in the user's evaluation is an incentive to increase the number of support information or improve the quality of the support information. Of course, the control unit 100 may evaluate the contribution of the user regarding the support information, or may use the evaluation for the comprehensive personnel evaluation of the user.

  For example, a link or a command for executing the handling method or supplement may be set in the handling method 111g or the supplement 112f. In this way, the user can more easily respond to the event by an operation such as clicking.

1: event response support device, 2: monitored device, 3: network, 10: network system,
40: Computer, 41: CPU, 42: Memory, 43: External storage device, 44: Communication I / F, 45: Input device, 46: Output device, 47: Media I / F,
50: UI screen, 51: Log information area, 51a: Address, 51b: Output message, 52: Support information area, 52a: Description, 52b: Response method, 52c: Reliability, 52d: Difficulty, 52e: Advice, 52f : Urgency, 53: History information area, 53a: Factor, 53b: Supplement, 54: Close button, 60: UI screen, 61: Support information registration button, 62: Support information approval button, 63: Support information search button, 64 : Support information edit button, 65: Close button,
100: control unit, 101: monitoring unit, 102: search unit, 103: output control unit, 104: input control unit, 105: information generation unit, 106: notification unit, 107: reliability calculation unit, 110: storage unit, 111: Support information table, 111a: Support information ID, 111b: System name, 111c: Address, 111d: Time zone, 111e: Character string, 111f: Description, 111g: Response method, 111h: Registrant ID, 111i: Status 112: History information table, 112a: History information ID, 112b: Corresponding date and time, 112c: Corresponding person ID, 112d: Support information ID, 112e: Factor, 112f: Supplement, 112g: Status, 113: Reliability information table, 113a: Support information ID, 113b: reliability, 114: difficulty information table, 114a: support information ID, 1 4b: difficulty, 115: user level information table, 115a: user ID, 115b: level, 116: emergency information table, 116a: support information ID, 116b: emergency, 120: output unit, 130: input unit, 140 : Communication Department

Claims (11)

An event response support device that supports the response to an event that occurred in a monitored device,
A support information storage unit for storing support information including information for identifying log information and a method for responding to an event related to the log information;
For each support information, a history information storage unit that stores history information including the history of outputting the support method of the support information, and history information including supplementary information for the support method of the support information in the history,
A monitoring unit for monitoring log information of the monitored device;
The support information related to the log information of the monitored device received by the monitoring unit is specified from the support information storage unit, and the handling method is acquired from the specified support information, and is associated with the specified support information. The history information is specified from the history information storage unit and the supplementary information is acquired from the specified history information, and the acquired handling method and the output unit for outputting the supplementary information;
For each support information stored in the support information storage unit, a reliability information storage unit that stores the reliability information indicating the reliability of the support information in association with each other,
A reliability calculation unit that calculates the reliability of the support information based on the number of the history information associated with the support information, and sets the reliability information stored in the reliability information storage unit;
Have
The output unit acquires reliability information associated with the identified support information from the reliability information storage unit, and outputs the acquired reliability information together with the handling method.
An event response support apparatus characterized by that.   The event response support apparatus according to claim 1,
  The reliability calculation unit calculates, as the reliability of the support information, a ratio of the number of history information in which the supplementary information is not set out of the total number of history information associated with the support information.
An event response support apparatus characterized by that.   The event response support apparatus according to claim 2,
  The history information includes an event factor related to the handling method of the support information in the history,
  The reliability calculation unit is a ratio of the number of history information in which the supplementary information is not set out of the total number of history information associated with the support information (provided that the factors of the history information are the same) Counting)) as the reliability of the support information,
An event response support apparatus characterized by that.   The event response support apparatus according to any one of claims 1 to 3,
  An input unit that accepts approval for history information stored in the history information storage unit;
  The reliability calculation unit calculates the reliability of the support information based on the approved history information among the history information associated with the support information;
  An event response support apparatus characterized by that.   The event response support apparatus according to any one of claims 1 to 3,
  An input unit for receiving approval for support information stored in the support information storage unit;
  The reliability calculation unit measures an elapsed time from the date and time when the support information is approved, and lowers the reliability of the support information as the elapsed time is longer.
An event response support apparatus characterized by that.   The event response support apparatus according to any one of claims 1 to 3,
  An input unit for receiving approval for support information stored in the support information storage unit;
  The reliability calculation unit counts the number of times the support information has been approved, and increases the reliability of the support information as the number of times increases.
An event response support apparatus characterized by that.   The event response support apparatus according to any one of claims 1 to 3,
  An input unit for receiving approval for support information stored in the support information storage unit;
  The reliability calculation unit increases the reliability of the support information as the event response capability level of the approver of the support information is higher.
An event response support apparatus characterized by that.   The event response support apparatus according to any one of claims 1 to 3,
  The reliability calculation unit obtains an official correspondence method related to log information included in the support information, and includes a character string included in the official correspondence method and a character string included in the correspondence method included in the support information. In comparison, the smaller the difference, the higher the reliability of the support information.
An event response support apparatus characterized by that. The event response support apparatus according to any one of claims 1 to 8 ,
The output unit determines whether or not the reliability of the support information is equal to or lower than a predetermined threshold, and outputs a message that prompts the review of the support information whose reliability is equal to or lower than the predetermined threshold.
An event response support apparatus characterized by that. An event response support method in an event response support device that supports the response to an event occurring in a monitored device,
The event response support apparatus includes:
A support information storage unit for storing support information including information for identifying log information and a method for responding to an event related to the log information;
For each support information, a history information storage unit that stores history information including the history of outputting the support method of the support information, and history information including supplementary information for the support method of the support information in the history,
For each support information stored in the support information storage unit, a reliability information storage unit that stores the reliability information indicating the reliability of the support information in association with each other,
Have
The event response support method includes:
A monitoring step of monitoring log information of the monitored device;
The support information related to the log information of the monitoring target device received in the monitoring step is specified from the support information storage unit, the handling method is acquired from the specified support information, and is associated with the specified support information. Outputting the supplementary information from the identified history information and specifying the acquired history information from the history information storage unit, and outputting the acquired handling method and supplementary information;
A reliability calculation step of calculating the reliability of the support information based on the number of the history information associated with the support information, and setting the reliability information stored in the reliability information storage unit;
Have
In the output step, the reliability information associated with the identified support information is acquired from the reliability information storage unit, and the acquired reliability information is output together with the handling method.
An event response support method characterized by that. A program that causes a computer to function as an event response support device that supports the response to an event occurring in a monitored device,
A support information storage unit for storing support information including information for identifying log information and a method for responding to an event related to the log information;
For each support information, a history information storage unit that stores history information including the history of outputting the support method of the support information, and history information including supplementary information for the support method of the support information in the history,
A monitoring unit for monitoring log information of the monitored device;
The support information related to the log information of the monitored device received by the monitoring unit is specified from the support information storage unit, and the handling method is acquired from the specified support information, and is associated with the specified support information. The history information is specified from the history information storage unit and the supplementary information is acquired from the specified history information, and the acquired handling method and the output unit for outputting the supplementary information ;
For each support information stored in the support information storage unit, a reliability information storage unit that stores the reliability information indicating the reliability of the support information in association with each other,
As a reliability calculation unit that calculates the reliability of the support information based on the number of the history information associated with the support information, and sets the reliability information stored in the reliability information storage unit,
Make the computer work,
The output unit acquires reliability information associated with the identified support information from the reliability information storage unit, and outputs the acquired reliability information together with the handling method.
A program characterized by that.

Images