JP5638400B2 - Incident management information system, its elapsed time collection method, and elapsed time collection program - Google Patents

Description

  The present invention relates to a technique for collecting incident response elapsed time in an incident management operation business of an information processing system, and in particular, when collecting values that are the heart of SLA (Service Level Agreement). The present invention relates to an incident management information system for preliminarily defining a combination of an incident and a workflow step and automatically collecting elapsed time based on the definition information, an elapsed time collection method, and an elapsed time collection program.

  In incident management operations, the service desk handles related incidents and provides primary responses to daily incidents from monitored devices, etc., in order to minimize the impact on the operations.

  Since the response status of the service desk with respect to the incident that has occurred can be grasped by measuring the time of contact with the customer and the time of the primary response, there are cases where this time is defined as an SLA and is a matter of agreement with the customer.

  Response time, which is an agreement with customers, can be measured by, for example, processing incident response in a workflow, measuring the dwell time for each workflow processing step, and issuing a warning when an SLA violation occurs. .

  As means for efficiently performing this, for example, in JP 2010-66807 A, when an incident is notified, the corresponding IT system is specified, and the person responsible for the system is further specified. Describes a technique for confirming whether or not the conditions defined in the SLA are satisfied in incident response when receiving a notification of completion of incident response from.

  With such conventional technology, it is possible to efficiently grasp the SLA compliance status for each incident and issue an alert as necessary.

JP 2010-66807 A

  However, with the conventional technology, it is possible to grasp the operational quality for each incident. However, if you want to grasp the operational quality for a certain period of time for each customer or the entire operational service, the incidents that caused SLA violations are manually counted. Therefore, there has been a problem that a lot of man-hours are required to grasp the quality status of the entire incident management operation work.

  In addition, it is not possible to distinguish incidents that only report or incidents that take primary actions only by measuring the residence time of workflow processing steps, so it is necessary to understand what kind of response is taking a long time. There was also a problem that it was not possible.

  As described above, in the prior art, a large amount of man-hours is required for collecting and counting the reporting time and countermeasure time, which are the liver of the SLA in the incident management operation.

  Therefore, an object of the present invention is to solve the problems of the quality status grasping method using these conventional technologies, and automatically measure the elapsed time of the handling status by using an incident management system equipped with a workflow and a template for aggregation. It is to provide an incident management information system, an elapsed time collection method thereof, and an elapsed time collection program for collecting and reporting on the Internet.

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in the present application, the outline of typical ones will be briefly described as follows.

  In other words, an outline of a typical one is that an incident management information system is used to input incident information, store the workflow history for incident information together with the incident information in a database, and between each processing step in the workflow history. It has an aggregation template in which the classification of the incident information subject to the elapsed time aggregation range and the elapsed time aggregation range is defined. Based on the workflow history information and the aggregation template, the elapsed time of workflow processing steps is aggregated, And an elapsed time totaling system that outputs an elapsed time totaling report.

  Also, in the incident management information system elapsed time collection method, workflow history information and workflow for incident information stored in the incident management system database in the incident management information system by the elapsed time aggregation system in the incident management information system Elapsed time aggregation report that aggregates the elapsed time of the processing steps of the workflow based on the aggregation template that defines the elapsed time aggregation range between each processing step in the history and the classification of the incident information subject to the elapsed time aggregation range Is output.

  In the elapsed time collection program, the information processing device defines the workflow history information for incident information, the elapsed time aggregation range between each processing step in the workflow history, and the classification of the incident information subject to the elapsed time aggregation range. Based on the tabulated template, the elapsed time of the processing steps of the workflow is totaled, and the elapsed time totaling means for outputting the elapsed time totaling report is made to function.

  The effects obtained by typical ones of the inventions disclosed in the present application will be briefly described as follows.

  In other words, the effect obtained by a typical one is to prepare a total range for calculating elapsed time as a template, and also define the total template to define the response cases associated with incidents, By automatically collecting and reporting the elapsed time based on this, it becomes possible to realize the SLA compliance status without requiring man-hours.

It is a block diagram which shows the whole structure of the incident management information system which concerns on one embodiment of this invention. It is a flowchart which shows the workflow process of the incident management system of the incident management information system which concerns on one embodiment of this invention. It is a figure which shows the item example of the incident information used in the incident management information system which concerns on one embodiment of this invention. It is a figure which shows the item example of the workflow history used in the incident management information system which concerns on one embodiment of this invention. It is a figure which shows the item example of response example DB used in the incident management information system which concerns on one embodiment of this invention. It is a figure which shows the item example of the total template used in the incident management information system which concerns on one embodiment of this invention. It is a figure which shows the example of an item of the correspondence case classification table used in the incident management information system which concerns on one embodiment of this invention. It is a flowchart which shows the process of the incident management information system of the incident management information system which concerns on one embodiment of this invention. It is a figure which shows the implementation example of the report preparation of the total report output by the elapsed time collection system of the incident management information system which concerns on one embodiment of this invention. It is a figure which shows an example of the total report output with the elapsed time collection system of the incident management information system which concerns on one embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

  With reference to FIG. 1, the overall configuration of an incident management information system according to an embodiment of the present invention will be described. FIG. 1 is a block diagram showing the overall configuration of an incident management information system according to an embodiment of the present invention.

  In FIG. 1, the incident management information system includes a data center 1, a monitoring target device 2, a failure monitoring device 3, and a monitoring center 5, which are connected via an inter-center network 4.

  The monitoring center 5 includes a case addition system 6, a response case DB 7, an operation terminal 8, an incident management system 10, an incident database 20, an elapsed time totaling system 30 that is an elapsed time totaling means, a totaling template 31, and a corresponding case classification table 32. It is composed of

  In addition, each process by the case addition system 6, the incident management system 10, and the elapsed time totaling system 30 of the monitoring center 5 is realized by executing a processing program stored in each of them by the CPU.

  The failure monitoring device 3 of the data center 1 transmits a message of a failure that has occurred in the monitored device 2 to the case addition system 6 of the monitoring center 5. The case addition system 6 extracts a response case associated with the failure message from the response case DB 7 based on the content of the failure message and the source information, and the failure message and the response case No. Is transmitted to the failure information input unit 11 of the incident management system 10.

  The failure information input unit 11 registers the message as incident information in the incident information 21 of the incident database 20.

  The service desk personnel of the monitoring center 5 uses the operation terminal 8 to perform the work step processing of the registered incident information workflow by the workflow control unit 12 of the incident management system 10.

  The elapsed time tabulation system 30 reads the tabulation template 31 and the corresponding case classification table 32, searches the incident information 21 and the workflow history 22 in the incident database 20 based on the conditions defined in the tabulation template 31, and totals the elapsed time. A report 33 is generated.

  Next, the overall processing of the incident management information system according to the embodiment of the present invention will be described with reference to FIGS. FIG. 2 is a flowchart showing workflow processing of the incident management system of the incident management information system according to the embodiment of the present invention, and FIGS. 3 to 7 are used in the incident management information system according to the embodiment of the present invention. FIG. 3 shows incident information, FIG. 4 shows a workflow history, FIG. 5 shows a corresponding case DB, FIG. 6 shows a summary template, and FIG. 7 shows an example of items in a corresponding case classification table.

  First, in the incident management system 10, when a failure message generated in the monitored device 2 is transmitted to the failure information input unit 11 of the incident management system 10, the “accept” step (S100) of the failure message is executed.

  Thereafter, when the service desk personnel of the monitoring center 5 operate with the operation terminal 8, the workflow steps transition.

  The “customer contact” step (S101) is a step of notifying the relevant person that a failure has occurred, and the “measure content recording” step (S102) is a step of performing recovery work and confirmation work based on the response case. The “content record approval” step (S103) is a step for approving the senior manager etc. for the content implemented in the “measure content recording”, and when the supervisor approves, the process proceeds to the “completion” step (S104).

  Through these processes, the incident information 21 and the workflow history 22 information are stored in the incident database 20.

  Here, information used in the information processing system according to the embodiment of the present invention will be described.

  First, as an example of the incident information 21 stored in the incident database 20, as shown in FIG. 3, the incident ID for uniquely identifying the registered incident, the occurrence date and time of the failure detected by the failure monitoring apparatus , The customer name, current workflow step name, urgency level, and importance level associated with the monitoring target device. In addition, the corresponding case No. Is for searching for a response procedure for each incident added by the case addition system 6 of FIG.

  The workflow history 22 stored in the incident database 20 is a history that is automatically stored when the service desk staff of the monitoring center 5 operates the incident management system 10 with the operation terminal 8. 4 has an incident ID for identifying an incident and an execution date and time when each workflow step transitions to the next step.

  In addition, as an example of items in the correspondence case DB 7 referred to by the case addition system 6 of FIG. 1, as shown in FIG. And a response procedure to be referred to when an incident occurs.

  Further, as an example of an aggregation template 31 input by the elapsed time aggregation system 30, as shown in FIG. 6, the name of the template for uniquely identifying the template definition, and the elapsed time for each template are aggregated. It has an elapsed time count range that defines the range of the workflow step, a target incident, and a threshold value.

  The elapsed time totaling range is calculated, for example, when the template name is “one report contact time”, the time from reception to customer contact is calculated as the elapsed time, and the template name “measure time” is from customer contact to input of countermeasure content Is calculated as the elapsed time.

  The target incident defines incidents to be counted. In the example illustrated in FIG. 6, the information is classified into three types of “report”, “confirmation”, and “WA”.

  “Notification” includes incidents associated with procedures for reporting only. “Confirmation” includes incidents associated with a procedure for performing only a typical response confirmation operation when an incident occurs, as an aggregation target. “WA” has a meaning of collecting incidents associated with workarounds, that is, procedures for performing recovery.

  If all are marked with ○, all incidents are counted.

  The classification of the target incident matches the classification defined in “Category” of the corresponding case table in FIG. By referring to the correspondence case classification table of FIG. 7, it is determined whether or not the incident is a target of aggregation.

  In addition, the threshold value defines an SLA value for the processing time of the workflow step defined in the “elapsed time totaling range”. For example, “1 report contact time” has a threshold value of “8” for the time from reception to customer contact. Note that an item defining “−1” as a threshold value means that a report of exceeding the threshold value is not output.

  In addition, as an example of items in the corresponding case classification table 32 input by the elapsed time counting system 30 in FIG. 1, as shown in FIG. Has the same ID as “Correspondence Case No.” in the correspondence case of FIG. Each corresponding case No. Each column has a “category” column for classifying the incidents to be tabulated.

  Next, processing of the incident management information system of the incident management information system according to the embodiment of the present invention will be described with reference to FIGS. FIG. 8 is a flowchart showing the process of the incident management information system of the incident management information system according to the embodiment of the present invention, and FIG. 9 is output by the elapsed time collection system of the incident management information system according to the embodiment of the present invention. FIG. 10 is a diagram showing an example of a summary report output by the elapsed time collection system of the incident management information system according to the embodiment of the present invention.

  First, the elapsed time totaling system 30 starts processing, and then reads and inputs a totaling template in S801 (S801). Next, in S802, the total period is input in the format yyyy / mm / dd.

  In step S803, the processing from step S804 onward is repeated for the number of templates defined in the aggregation template, and the processing ends when the processing for the number of templates defined in the aggregation template is completed.

  In step S804, an incident search condition is determined. The incident date and time of incident information shown in FIG. 3 is set to the period input in S802. In addition, conditions for the incidents to be aggregated are set by XX in the “target incident” field of the aggregation template. Incidents to be counted are calculated by referring to the corresponding case classification table in FIG. 7 from the “response case No.” in the incident information in FIG. 3 and extracting “category” in FIG. Identify whether it is out of scope.

  Based on the search condition of S804, an incident is searched for in S805. Depending on the search result, in S806, S807 to S815 are repeatedly executed for the number of incidents.

  In S807, the workflow history of the From-To processing step in the elapsed time counting range defined in the counting template 31 for each incident is extracted, and the completion date of the From processing step is subtracted from the completion date of the To processing step. Calculate time.

  In step S <b> 808, it is confirmed whether a threshold is set for the aggregation template 31. If it is set in S808, it is compared with the value calculated in S807 in S809. If the threshold is exceeded, the number of incidents exceeding the threshold is incremented in S811.

  If the threshold is not exceeded in S809, the number of incidents below the threshold is incremented in S810.

  In S812, the average elapsed time is calculated based on the elapsed time calculated in S807. Further, in S813, the maximum time is determined. If the incident processing time is the maximum, the maximum time is determined in S814. Update.

  The above-described count of the number of incidents, average elapsed time, and maximum time calculation are performed by setting an area for each customer name.

  Finally, in S816, the value calculated by the processing of the one-item aggregation template is added to the report.

  The above processing is repeatedly executed for the total number of templates in S817.

  As shown in FIG. 9, in the example of the report creation by S816 in FIG. 8, in 901, one report contact time is defined in the total template. Since the threshold is 8 minutes, the number of incidents within 8 minutes and the number of incidents exceeding 8 minutes are generated. Further, the average time and the maximum time are also set based on the calculation result of FIG.

  In 902, the target incident values defined in the aggregation template are narrowed down, and the number and percentage of incidents that only carry out “reporting” and the average time and maximum time for handling this type of incident are extracted. It is.

  Further, as shown in FIG. 10, the aggregation report created in S816 of FIG. 8 outputs the aggregation period on the table, and the X axis indicates the customer. The Y-axis extracts the SLA compliance status and the average time for each incident response classification according to the conditions defined in the aggregation template.

  As described above, in the present embodiment, a totaling range for calculating the elapsed time is prepared as the totaling template 31, and the definition for classifying the corresponding cases corresponding to the incidents is also defined in the totalizing template 31. Since the elapsed time is automatically collected and reported based on this, it becomes possible to realize the SLA compliance status without requiring man-hours.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  The present invention relates to a technique for collecting an incident response elapsed time in an incident management operation business of an information processing system, and is widely applicable to an incident management operation business of a failure monitoring operation service in an outsourcing service.

  DESCRIPTION OF SYMBOLS 1 ... Data center, 2 ... Monitored apparatus, 3 ... Fault monitoring apparatus, 4 ... Network between centers, 5 ... Monitoring center, 6 ... Case addition system, 7 ... Corresponding case DB, 8 ... Operation terminal, 10 ... Incident management system , 11 ... Fault information input unit, 12 ... Workflow control unit, 20 ... Incident database, 21 ... Incident information, 22 ... Workflow history, 30 ... Elapsed time totaling system, 31 ... Total template, 32 ... Corresponding case classification table, 33 ... Elapsed time summary report.

Claims (6)

An incident management information system for managing incident information related to failures in monitored devices,
An incident management system that inputs the incident information and stores a history of a workflow for the incident information in a database together with the incident information;
An aggregation template in which an elapsed time aggregation range between each processing step in the workflow history and a classification of incident information targeted in the elapsed time aggregation range are defined, and based on the workflow history information and the aggregation template Elapsed time aggregation that includes incidents corresponding to the incident information classification, totals the elapsed time of the workflow processing step in the elapsed time aggregation range of the incidents to be aggregated, and outputs an elapsed time aggregation report Incident management information system characterized by comprising a system. In the incident management information system according to claim 1,
The aggregation template has threshold information on the elapsed time,
The elapsed time totaling system, when the threshold information is set in the total template, totals the elapsed time based on the threshold information, and includes the threshold information An incident management information system for outputting the elapsed time totaling report. A method for collecting elapsed time in an incident management information system for managing incident information related to a failure of a monitored device,
By means of an elapsed time counting system in the incident management information system, information on the workflow history for the incident information stored in the incident management system database in the incident management information system, and between each processing step in the workflow history Based on the elapsed time aggregation range and the aggregation template in which the classification of the incident information targeted in the elapsed time aggregation range is defined, the incident corresponding to the incident information classification is the aggregation target, and the incident of the incident to be aggregated An elapsed time collecting method comprising: totaling elapsed times of the processing steps of the workflow in an elapsed time totaling range and outputting an elapsed time totaling report. In the elapsed time collection method according to claim 3,
The aggregation template has threshold information on the elapsed time,
When the threshold information is set in the total template by the elapsed time totaling system, the elapsed time is totaled based on the threshold information and includes the threshold information. The elapsed time collecting method, wherein the elapsed time totaling report is output. In order to manage the incident information related to the failure of the monitored device and to total the elapsed time between each processing step of the workflow for the incident information,
Based on the workflow history information for the incident information, an elapsed time total range between each processing step in the workflow history, and a total template defining a classification of target incident information in the elapsed time total range, As an elapsed time totaling means for counting incidents corresponding to the incident information classification, totaling the elapsed time of the processing steps of the workflow in the elapsed time totaling range of the incidents to be totaled, and outputting an elapsed time totaling report Elapsed time collection program characterized by functioning. In the elapsed time collection program according to claim 5,
The aggregation template has threshold information on the elapsed time,
The elapsed time counting means, when the threshold information is set in the total template, performs the total of the elapsed time based on the threshold information, and includes the threshold information An elapsed time collecting program for outputting the elapsed time totaling report.

Images