JP5679354B2 - Event analysis server, event analysis method, event analysis server program - Google Patents

Description

  The present invention relates to an event analysis server, an event analysis method, and an event analysis server program.

  Many companies that manufacture products for customers not only acquire various operation logs related to breakdowns and usage histories, but also strive to increase sales and rentals by conducting customer surveys, etc. . Therefore, specifically, when a device of the same type as its own product is newly introduced into the customer's network, it is important to elucidate the reason why the customer introduced the device.

  In response to such a problem, a technique for automatically managing that the communication device itself has been replaced is disclosed.

JP 2009-244928 A

  According to Patent Document 1, the update determination information sequentially generated in the communication device management apparatus is compared, and based on the presence / absence of at least one change in the logical identification information on the network and the physical identification information on the network, A method for determining which update pattern is a change in the internal configuration of a communication device or a new introduction of a communication device is disclosed.

  However, the technique described in Patent Document 1 merely reveals which device is newly introduced, and does not exert an effect for grasping the reason why the device is newly introduced.

  By the way, it is widely performed to find meaning from the whole by statistically processing a huge number of collected data on a computer. In particular, in the computer field, since the behavior of a computer can be used as digital data as it is, information provision and inference based on statistical processing are performed in various fields.

  The present inventor applied such a statistical method, categorized the events of the devices having the same function in each network, triggered by the introduction of new devices, totaled the number of times, and compared them in units of networks We focused on providing an event analysis server that displays messages related to the reason for more accurate device introduction.

  In the present invention, in view of these problems, when a device is newly installed in a plurality of local area networks in the local area network group, the device is introduced based on an event history of a model having a common function. An object of the present invention is to provide an event analysis server that provides a message regarding the reason.

  The present invention provides the following solutions.

The invention according to the first feature is an event analysis server in which a plurality of one local network configured by one or more devices exists and is communicably connected to the plurality of local networks. ,
New device detection means for detecting that a new device is connected to the local network;
In a local network to which the new device is connected, event acquisition means for acquiring an event that occurred in the device within a predetermined period from a device having a common function other than the new device;
Event classification means for classifying the acquired event by event type;
In accordance with the classification, event counting means for counting the number of occurrences of events on a local network basis;
A message extraction means for extracting a message regarding the reason why the new device was introduced into the local network from a message database based on the total number of events for each classification;
An event analysis server is provided.

According to the invention relating to the first feature, there are a plurality of one local network configured by one or more devices, and the event analysis server connected to the plurality of local networks so as to be communicable by configuring a group includes: Detecting that a new device is connected to the local network, and within a predetermined period from a device having a common function other than the new device within the local network to which the new device is connected. Acquire events generated in the device, classify the acquired events for each type of event, and in accordance with the classification, count the number of occurrences of events in units of local networks, to the total number of events for each category based, about why the new device is introduced into the local network from the message database To extract the message.

  The invention according to the first feature is the category of the event analysis server, but the event analysis method and the program for the event analysis server have the same operations and effects.

The invention according to the second feature is
Error code acquisition means for acquiring an error code from the classified event;
An event classification means for analyzing a corresponding event from the error code and reclassifying the event for each event; and
The event aggregation means provides an event analysis server according to the first aspect of the invention, which aggregates the number of occurrences of events in units of local networks according to the classification for each event.

According to the invention relating to the second feature,
The event analysis server according to the first aspect of the invention acquires an error code from the classified event, analyzes a corresponding event from the error code, classifies the event, and classifies the event according to the classification for each event. , Count the number of event occurrences by local network .

The invention according to the third feature is the event analysis server connected to be able to communicate with a plurality of local networks by forming a group, wherein there are a plurality of one local network configured by one or more devices.
Detecting that a new device is connected to the local network;
Obtaining an event generated in the device within a predetermined period from a device having a common function other than the new device in a local network to which the new device is connected;
Classifying the acquired events by event type;
In accordance with the classification, the step of counting the number of event occurrences in units of local networks;
Extracting a message regarding the reason why the new device was introduced into the local network from a message database based on the number of events for each aggregated classification;
An event analysis method comprising:

In the invention according to the fourth aspect, there is a plurality of one local network configured by one or more devices, and an event analysis server connected to be able to communicate with the plurality of local networks by configuring a group,
Detecting that a new device is connected to the local network;
Obtaining an event generated in the device within a predetermined period from a device having a common function other than the new device in a local network to which the new device is connected;
Classifying the acquired events by event type;
A step of counting the number of occurrences of events in units of local networks according to the classification;
Extracting a message regarding the reason why the new device was introduced into the local network from a message database based on the number of events for each of the aggregated classifications;
An event analysis server program is provided.

  According to the present invention, when a device is newly installed in a plurality of local area networks in the local area network group, the message regarding the reason for introducing the device based on the event history of the models having the common function. It is possible to provide an event analysis server that provides

FIG. 1 is a schematic diagram of an event analysis system 1. FIG. 2 is an overall configuration diagram of the event analysis system 1. FIG. 3 is a functional block diagram of the event analysis server 200 and the electrical appliance 50. FIG. 4 is a flowchart showing event analysis processing executed by the event analysis server 200. FIG. 5 is a flowchart showing a new device detection process executed by the event analysis server 200 and the electrical appliance 50. FIG. 6 is a flowchart showing event acquisition processing executed by the event analysis server 200 and the electrical appliance 50. FIG. 7 is an example of a screen displaying details for each network regarding the event count result. FIG. 8 is an example of a screen that displays the overall result of the event count result. FIG. 9 shows a part of the message table in the message database 250. FIG. 10 is an example of a screen that displays a message extracted from the message database 250.

  Hereinafter, the best mode for carrying out the present invention will be described with reference to the drawings. This is merely an example, and the technical scope of the present invention is not limited to this.

[Outline of Event Analysis System 1]
FIG. 1 is a schematic diagram for explaining an overview of an event analysis system 1 configured by an event analysis server 200 and a plurality of local area networks 4 according to a preferred embodiment of the present invention. The outline of the event analysis system 1 will be described based on FIG.

  In the event analysis system 1, the event analysis server 200 is connected to a plurality of local area networks 4a, 4b, 4c, and 4d (hereinafter simply referred to as “4” unless otherwise specified). The electrical appliances 50a, 50b, 50c, and 50d constitute the local area network 4a, and the electrical appliances 50e, 50f, and 50g constitute the local area network 4b (hereinafter simply referred to as “50” unless otherwise specified).

  Here, the event is an operation record that is left when each electrical appliance 50 detects an event inside or outside the device, and an error level indicating whether the event is urgent, and what the event is It shall be represented by an error code indicating whether it is a thing. The error level and error code are defined for each product, and the error level may be uniquely determined from the error code.

  Although not shown in FIG. 1, one or more electrical appliances 50 constitute local area networks 4c and 4d. Further, the number of local area networks 4 connected to the event analysis server 200 is not limited to four, and may be any number that can be managed, such as hundreds or thousands.

  Here, since the event analysis system 1 is for extracting a message regarding the reason for the new introduction of a device, it requires a new introduction of the device for operation. Therefore, first, the event analysis server 200 detects the appliance 50 that is a newly introduced device in the local area network 4a (step S01).

  At the time of detection, in order to determine whether or not the newly introduced electrical appliance 50 is in the network, the device management server or the like of each local area network 4 may be inquired, or the event analysis server 200 may be registered in advance. By using a value that can uniquely identify the electrical appliance 50 such as a MAC address by communicating with each of the devices and detecting other devices in the local area network 4, the newly introduced electrical appliance 50 You can look for it. FIG. 1 shows a case where an electrical appliance 50a, which is a printer, is newly introduced and detected.

  Similarly, the event analysis server 200 detects the newly introduced electrical appliance 50e in the local area network 4b (step S02). Here, an example is shown in which an electrical appliance 50e, which is a copier, is newly introduced and detected.

  Similarly, the event analysis server 200 detects the appliance 50 newly introduced into the local area network 4c (step S03), and detects the appliance 50 newly introduced into the local area network 4d (step S04). It is assumed that there are no newly introduced devices in the local area networks 4c and 4d. In this way, the event analysis server 200 detects a newly introduced device for all the local area networks 4 that are communicably connected.

  Next, when a newly introduced electrical appliance 50 is detected in any of the local area networks 4, the event analysis server 200 determines the device types of the newly detected electrical appliances 50a and 50e, Identify functions. Thereafter, an event occurring within a predetermined period is acquired from the appliance 50 having the same function as at least one of the newly detected appliances 50 in the local area network 4 where the appliance 50 is newly detected. To do. Here, an event is acquired from an electrical appliance having the same function as at least one of the electrical appliance 50a as a printer and the electrical appliance 50e as a copier in the local area networks 4a and 4b.

  That is, in the local area network 4a, events that occur within a predetermined period are acquired in the electrical appliances 50b and 50c having a printing function that is a common function. On the other hand, no event is acquired for the electrical appliance 50d, which is a router and does not have a printing function (step S05).

  Similarly, the event analysis server 200 obtains an event generated within a predetermined period from the local area network 4b for the electric appliance 50a having a function common to at least one of the electric appliance 50a and the electric appliance 50e. (Step S06). The above event acquisition is not performed for the local area networks 4c and 4d in which no new device is detected.

  Next, the event analysis server 200 identifies an event category for each event type, and totals the number of occurrences for each event category. The event classification is represented by an error level such as “error”, “warn”, “info”, “debug”, etc., or an error code unique to the product. Events such as “low amount”, “printing paper shortage”, “paper jam”, “emergency stop of unknown cause” are represented by reference numbers using alphanumeric combinations such as “120” and “E2401”. Since this error code is generally different for each product, the event analysis server 200 further classifies these error codes into events such as “paper jam” by using a database prepared in advance or an API provided by each company. In addition, the total number of times that a certain event such as a paper jam has occurred in the local area network 4 configured by different devices may be calculated in addition to counting for each error code.

  After the number of event occurrences for each category is tabulated by the above processing, a message is extracted from the message database 250 provided in the event analysis server 200 based on the category and the number of event occurrences (step S07). In this extraction, those having a large total number of times are extracted in principle, but weighting may be performed so that, for example, the error level is higher and the more important one is displayed first.

  As an identifier for the event analysis server 200 to identify each local area network 4, the MAC address of a router connecting each local area network 4 and the public line network 3, or SSID when wireless communication is used. May be used. The outline of the event analysis server 200 has been described above.

[System configuration of event analysis system 1]
FIG. 2 is a system configuration diagram of an event analysis system 1 including an event analysis server 200 and a plurality of local area networks 4 according to a preferred embodiment of the present invention. The event analysis system 1 includes an event analysis server 200, a plurality of local area networks 4 configured by one or more electrical appliances 50, and a public network 3 (Internet network, third generation, fourth generation communication network, etc.). Is done. Communication in the event analysis system 1 may be wired or wireless.

  The event analysis server 200 is a server that has functions to be described later, acquires an event from the electrical appliance 50, and extracts a message. In FIG. 2, the number of local area networks 4 to which the event analysis server 200 is communicably connected is five, but may be any number in practice.

  The electrical appliance 50 is a home or business electrical appliance capable of performing data communication. For example, in addition to a personal computer 50c, a television 50b, a telephone, and a computer, a mobile phone, a portable information terminal, and a netbook terminal Slate terminals, electronic book terminals, portable music players, audio components, content playback / recording players, printers, FAX machines, copiers, scanners, MFPs (multifunctional peripheral devices, multifunction printers), etc. Including white goods such as refrigerators, washing machines, dishwashers / dryers, electric fans, air conditioners, electric heaters, rice cookers, microwave ovens, electric lighting, servers, routers 50a, gateways, NAS (Network Attached Storage), etc. .

[Description of each function]
FIG. 3 is a diagram illustrating the relationship between the function blocks of the event analysis server 200 and the electrical appliance 50 and the respective functions.

  The event analysis server 200 includes a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read Only Memory), and the like as a control unit, and a communication unit, for example, WiFi (Wireless Fidelity) compliant with IEEE 802.11. A compatible device or a wireless device conforming to the IMT-2000 standard such as a third generation mobile communication system is included (may be a wired LAN connection).

  Further, the event analysis server 200 includes a data storage unit using a hard disk or a semiconductor memory as a storage unit. The event analysis server 200 includes a message database 250 in a storage unit.

  In the event analysis server 200, the control unit reads a predetermined program, thereby realizing the event analysis module 206 in cooperation with the communication unit and the storage unit. The event analysis module 206 includes a new device detection module 201 that detects a newly introduced device in the local area network, and an event acquisition module 202 that acquires an event within a predetermined period from the same device as the newly introduced device. And an event classification module 203 that classifies the acquired events, an event totaling module 204 that totals the number of occurrences of events for each classification, and a message extraction module 205 that extracts messages based on the totaling results.

  Similarly, the electrical appliance 50 includes a CPU, a RAM, a ROM, and the like as a control unit, and an IMT-2000 standard such as a WiFi compatible device compliant with IEEE 802.11 or a third generation mobile communication system as a communication unit. A wireless device or the like conforming to the above (including a wired LAN connection). In addition, the electrical appliance 50 may include a data storage unit using a hard disk or a semiconductor memory as a storage unit.

  Furthermore, the electrical appliance 50 may include a display unit that outputs and displays data and images controlled by the control unit as an output / input unit, and includes a touch panel, a keyboard, a mouse, and the like that receive input from a user or supporter. You may prepare.

  In the electrical appliance 50, when the control unit reads a predetermined program, the other device access module 51 accesses another device according to an instruction from the event analysis server 200 in cooperation with the communication unit, the output / input unit, and the storage unit. The function information transmission module 52 that transmits the function information of the device and the event transmission module 53 that transmits the event history within a predetermined period to the event analysis server 200 are realized.

[Event analysis processing]
FIG. 4 is a flowchart of event analysis processing executed by the event analysis module 206 of the event analysis server 200. The processing performed by the module of each device described above will be described together with this processing.

  First, the new device detection module 201 of the event analysis server 200 performs a new device detection process for all local area networks 4 (step S11) (step S12). This new device detection process is a process for detecting a device newly introduced in each local area network 4. For example, each local area network 4 has a server such as a device management server, from which Information may be acquired. In the present embodiment, a configuration in which such a server is not used and only the electric appliance 50 is used will be described with reference to the flowchart of FIG.

  The event analysis server 200 is assumed to store a list of MAC addresses and IP addresses of the electrical appliances 50 when the local area network 4 was last accessed in the storage unit. The new device detection module 201 of the event analysis server 200 accesses each appliance 50 in the local area network 4 to another device in the same local area network for each local area network 4 based on this list. A request is made (step S21).

  The other device access module 51 of the electrical appliance 50 that has received the request accesses another electrical appliance 50 in the same local area network (step S22). Here, the access does not need to be performed up to so-called remote login or the like, and it is sufficient to perform communication such as a ping command and an arp command in order to detect the presence and acquire the MAC address.

  The other device access module 51 repeats access to the other device, collects the MAC addresses of the other electrical appliances 50 (step S23), and transmits the list to the event analysis server 200 (step S24). The new device detection module 201 receives the list and compares it with the previous list in the storage unit (step S25).

  As a result of the collation, the appliance 50 that is not in the previous list but is present in the current list is identified as a newly introduced device (step S26), and the function information is transmitted to the appliance 50. Request that. The function information is information related to the function of the electrical appliance 50, and may be defined and listed in advance by the event analysis server 200 such as “print function” and “call function”. Here, it is not prevented that one device has a plurality of function information, such as a telephone having a “call function”, “FAX function”, “copy function”, and “print function”. The function information transmission module 52 of the electrical appliance 50 transmits the function information, and the event analysis server 20 performs the following process of the event analysis process using the received function information (step S27). However, it should be noted that the following processing is performed after new device detection processing is performed on all connected local area networks 4 (step S11).

  Returning to the event analysis process, the event acquisition module 202 of the event analysis server 200 performs the event acquisition process for all the electrical appliances 50 except for the new device (step S13) (step S14). This event acquisition process will be described with reference to FIG.

  First, the event acquisition module 202 of the event analysis server 200 determines whether a new device has been detected in the local area network 4 to which the target electrical appliance 50 is connected (step S31). If a new device has not been detected (step S31: “NO”), the event is not acquired for the electrical appliance 50, and the process ends. If the new device is a detected network (step S31: “YES”), the following processing is continued.

  The event acquisition module 202 requests the electrical appliance 50 for an event history together with function information of all new devices detected in the new device detection process in step S12 (step S32). When receiving the request, the appliance 50 compares the received function information with the function information of the appliance 50 itself, and determines whether the appliance 50 has a function common to the new device (step S33). . If there is no common function (step S33: “NO”), the event acquisition process is terminated here. On the other hand, if there is at least one common function, the following processing is continued (step S33: “YES”).

  The event transmission module 53 of the electrical appliance 50 transmits an event history within a predetermined period (step S34). Here, it is desirable that the predetermined period is a period for judging the introduction of a new device, and it can be any appropriate period, such as one or two years, which can be said to be a lease period, starting from one month or three months. It may be a period.

  Finally, the event acquisition module 202 receives the event information (step S35), ends the event acquisition process, and returns to the event analysis process. However, it should be noted that the following processing of the event analysis processing is continuously performed after the event acquisition processing is performed on all the electrical appliances 50 except for the new device (step S13).

  Returning to the event analysis process, the event classification module 203 of the event analysis server 200 classifies each event history acquired by the event acquisition process by an error level, an error code, or the like (step S15). Here, since the error code is usually unique to the manufacturer or product, using the data in the storage unit or API provided by each company, different error codes can be assigned to the same phenomenon, such as “shortage of printing paper” You may classify | categorize according to a phenomenon, converting into "paper jam" etc.

  Next, the event totaling module 204 totalizes the number of occurrences for each classified event for each classified event for each local area network 4 (step S16). Furthermore, a combination of a plurality of predetermined events may be totaled when they occur at the same time.

  Finally, the message extraction module 205 extracts a message from the message database 250 based on the aggregation result (step S17). The extracted message may be displayed on a display unit included in the event analysis server 200 or a communicable device, or may be transmitted and transferred by e-mail or the like.

  FIG. 7 is an example of the details for each network of the aggregation results totaled for each network. Here, the printers 1, 2, 3, and 4 do not indicate unique devices but represent model names. According to FIG. 7, in the local area network 4 in which the network ID 72 is “network A” within the period of the aggregation period 71, 73 indicates that the simultaneous failure of the printer 1 and the printer 2 is generated three times. In addition, a message 74 indicating that the printer 3 and the printer 4 have recorded the number of prints of the largest doctor in the past is displayed. Although two networks and two event types are displayed here, any number may be displayed as necessary.

  FIG. 8 is an example of the total result of the totaled results totaled for each network. The number 81 of simultaneous failures of the printer 1 and the printer 2 is shown to have occurred in a total of fifteen and nine local area networks 4. Similarly, ten cases are displayed as the number 82 of records in which the maximum number of prints has been recorded by the printer 3 and the printer 4.

  FIG. 9 is a part of a message table in the message database 250. The message stored in association with the event classification having the largest number of occurrences is extracted by the message extraction module 205. However, for example, the “unknown cause emergency stop” event is generally a situation that should never be avoided, but depending on the model, the power button is not attached. May occur. Therefore, the message extraction module 205 can extract a more suitable message by not only looking at the number of occurrences but taking into account the error level of the event and weighting it accordingly.

  An example of displaying the extracted message is shown in FIG. The messages 101 and 102 extracted from the message database 250 are displayed side by side based on the priority 103 which is the order of the number of occurrences.

  The above is the processing procedure of the message analysis process.

  The means and functions described above are realized by a computer (including a CPU, an information processing apparatus, and various terminals) reading and executing a predetermined program. The program is provided in a form recorded on a computer-readable recording medium such as a flexible disk, CD (CD-ROM, etc.), DVD (DVD-ROM, DVD-RAM, etc.), for example. In this case, the computer reads the program from the recording medium, transfers it to the internal storage device or the external storage device, stores it, and executes it. The program may be recorded in advance in a storage device (recording medium) such as a magnetic disk, an optical disk, or a magneto-optical disk, and provided from the storage device to a computer via a communication line.

  As mentioned above, although embodiment of this invention was described, this invention is not limited to these embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

  1 event analysis system, 3 public network, 4 local area network, 50 electrical appliances, 200 event analysis server

Claims (4)

There are a plurality of one local network configured by one or more devices, and an event analysis server connected to a plurality of local networks by composing a group,
New device detection means for detecting that a new device is connected to the local network;
In a local network to which the new device is connected, event acquisition means for acquiring an event that occurred in the device within a predetermined period from a device having a common function other than the new device;
Event classification means for classifying the acquired event by event type;
In accordance with the classification, event counting means for counting the number of occurrences of events on a local network basis;
A message extraction means for extracting a message regarding the reason why the new device was introduced into the local network from a message database based on the total number of events for each classification;
An event analysis server comprising: Error code acquisition means for acquiring an error code from the classified event;
An event classification means for analyzing a corresponding event from the error code and reclassifying the event for each event; and
The event analysis server according to claim 1, wherein the event totaling unit totals the number of occurrences of events in units of local networks according to the classification for each event. In an event analysis server that is communicably connected to a plurality of local networks by configuring a group, there are a plurality of one local network configured by one or more devices.
Detecting that a new device is connected to the local network;
Obtaining an event generated in the device within a predetermined period from a device having a common function other than the new device in a local network to which the new device is connected;
Classifying the acquired events by event type;
In accordance with the classification, the step of counting the number of event occurrences in units of local networks;
Extracting a message regarding the reason why the new device was introduced into the local network from a message database based on the number of events for each aggregated classification;
An event analysis method comprising: There are multiple local networks that consist of one or more devices, and by configuring a group, an event analysis server that is communicably connected to multiple local networks
Detecting that a new device is connected to the local network;
Obtaining an event generated in the device within a predetermined period from a device having a common function other than the new device in a local network to which the new device is connected;
Classifying the acquired events by event type;
A step of counting the number of occurrences of events in units of local networks according to the classification;
Extracting a message regarding the reason why the new device was introduced into the local network from a message database based on the number of events for each of the aggregated classifications;
An event analysis server program comprising:

Images