JP5733103B2 - Analysis device, analysis method, and analysis method - Google Patents

Description

  The present specification relates to an analysis processing technique for a message transmitted on a network.

  Computer systems using recent IT (information and communication technology) often have large-scale and complicated configurations. For example, an increasing number of business services such as online banking payment and transfer processing are provided by a Web three-tier system including a Web server / application server / database (DB) server. Such a system has a large-scale and complicated configuration for reasons such as operational efficiency and security measures. In addition, there are many business services that require immediacy, and service stoppage and response deterioration are problems. For this reason, detailed understanding of the operation status for large-scale systems and quick resolution of performance problems are required.

  In addition, in a complex system (such as a Web three-tier system) in which multiple applications work together, in order to determine the cause of performance degradation and failure, not only the behavior of each server but also the performance of the entire system is observed and analyzed. It is necessary to. For example, in a Web three-tier system, a processing request to an application server may occur with a processing request to a Web server. The same applies to the application server / DB server. Such a process call relationship between applications is necessary to investigate the spread of performance problems into the system.

Therefore, there is the following technique as a system analysis method for analyzing the operation mode of a network to which a plurality of servers are connected by a computer.
First, the message observation means collects messages passed through the network. The message analysis means analyzes the contents of the collected message to determine the processing type requested by the message and whether it is a request message or a response message, and stores the determined information as a protocol log in the protocol log storage means . When a model generation instruction is input, the model generation unit identifies each process corresponding to the process type based on the correspondence between the request message and the response message for each process type in the protocol log stored in the protocol log storage unit. . Then, the model generation means generates a transaction model that satisfies the constraint condition regarding the call relationship between processes based on the message set selected according to the selection criteria based on the probability of the call relationship between processes. Then, the model generation unit stores the generated transaction model in the transaction model storage unit. When the analysis instruction is input, the analysis unit extracts from the protocol log storage unit a protocol log that matches the call relationship indicated by the transaction model stored in the transaction model storage unit. The analysis unit analyzes the processing state of the transaction configured by the message indicated in the extracted protocol log.

JP 2006-011683 A JP 2010-198322 A JP-A-5-327878

  When the server operating system (OS) or middleware is updated, it is necessary to perform a verification test to confirm whether the existing system works as usual. Here, as an example, a verification test of a test target system will be described below using a Web three-tier system as a test target system. The Web three-tier system includes a Web server, an application (AP) server, and a database (DB) server. The Web server, AP server, and DB server are connected to the switch. The switch is connected to a personal computer (client) and an analyzer.

  The switch has a function of mirroring data passing through the switch. Mirroring is a function for outputting the same data as data output to a certain port from other ports. The analysis apparatus can receive packets exchanged between the Web server, the AP server, and the DB server using the mirroring function of the switch.

  For example, it is assumed that a Web server, an AP server, and a DB server provide services in conjunction with a request from a client. In the verification test in this case, first, a packet (for example, an HTTP (HyperText Transfer Protocol) packet) is transmitted from the client to the Web server. At this time, a packet having the same content as the HTTP packet is input to the analyzer.

  Next, when a packet (for example, an IIOP (Internet Inter-ORB Protocol) packet, hereinafter referred to as an IIOP packet) is transmitted from the Web server to the AP server, a packet having the same content as the IIOP packet is input to the analyzer. Further, when a packet (for example, an SQL packet) is transmitted from the AP server to the DB server 4, a packet having the same content as the SQL packet is input to the analyzer.

  The analysis device analyzes the message based on the received packet, and analyzes the operating state of the Web three-tier system using the above-described system visualization technology. Here, the analysis apparatus extracts the protocol log that matches the call relationship indicated by the transaction model created in advance from the log of the received packet. The analysis device analyzes the processing state of the transaction including the message indicated in the extracted protocol log. This makes it possible to analyze a series of system (Web server, AP server, and DB server) processes (transactions) in response to a request from a client.

  However, when a plurality of transactions are executed in parallel as in the performance test, it is difficult to distinguish which transaction model the subsequent message belongs to. This will be described with reference to FIG.

  FIG. 1 is a diagram for explaining message calling relationships when a plurality of transactions are executed in parallel in a Web three-tier system. In FIG. 1, there is a Model 1 of a transaction that starts with an HTTP-a message and a Model 2 of a transaction that starts with an HTTP-b message.

  However, when transactions of Model 1 and Model 2 are executed in parallel, it is difficult to distinguish which model the message flowing between the Web server and the AP server and between the AP server and the DB server belongs.

  Therefore, it is difficult to accurately verify whether or not a problem has occurred in the system only by comparing the test results before and after updating the OS) and middleware. Also, even if it is known that a problem has occurred, it is difficult to identify where the problem has occurred.

  As described above, in the verification test after updating the OS and middleware of the test target system, it takes time to analyze the verification result, and it is difficult to obtain an accurate analysis result.

  Therefore, the present embodiment provides an analysis technique for improving the efficiency of cause analysis work when a problem occurs in a verification test after updating the OS or middleware.

The analysis device includes a collation unit, a defective model extraction unit, and a partial transaction extraction unit. The collating unit collates the model of the transaction generated using the message obtained by the first access between the computers and the message obtained by the second access. Then, the collation unit acquires a transaction that matches the model and a mismatch message other than the messages that make up the transaction. Defect model extraction unit, from the model that is executed in the second access, and extracts the defect model indicating the models except the model that matches the acquired transaction. The partial transaction extraction unit extracts a partial transaction including a message partially matching the defective model from the mismatch message.

  The analysis device includes a collection unit, a model generation unit, a correspondence information generation unit, a verification unit, a mismatch message acquisition unit, a defective model extraction unit, a temporary parent-child relationship construction unit, a partial transaction search unit, a remaining message extraction unit, and a defective transaction determination unit. Including.

The collection unit collects messages sent and received between computers connected via a network.
The model generation unit analyzes the first processing time zone by using the first message collected when the first access is made from the first computer to the second computer. The first processing time zone is indicated by the difference between the collection times of the request message and the response message that are paired for each communication protocol. The model generation unit analyzes the request message and the response message that form a pair having the second processing time zone included in the first processing time zone. The model generation unit uses the request message and response message corresponding to the first processing time zone as a caller message. The model generation unit uses a request message and a response message corresponding to the second processing time zone as a call destination message. In this case, the model generation unit analyzes a message group constituting one transaction and sets the analyzed message group as a transaction model.

  The correspondence information generation unit associates the first access log including the location information of the first access destination obtained when the first access is made and the first access time with the transaction model. Generate correspondence information.

  The collation unit collates the second message collected when the second access is made from the first computer to the second computer and the transaction model. The collation unit acquires a transaction that matches the transaction model from the second message.

  The mismatch message acquisition unit acquires a mismatch message other than a message constituting a transaction that matches the transaction model from the second message as a result of the collation.

The defective model extraction unit obtains the second access log including the location information of the second access destination obtained when the second access is made and the second access time and the correspondence information from the second access log. extracting the executed transaction model in the access. Defect model extraction unit, from the transaction model performed in the second access, to extract the failure transaction model showing the transaction model of non-transactional model that matches the acquired transaction.

  The temporary parent-child relationship construction unit analyzes the third processing time zone indicated by the difference between the request message and the response message collection time for each communication protocol, using the mismatch message. The temporary parent-child relationship construction unit analyzes the request message and the response message that form a pair having the fourth processing time zone included in the third processing time zone. The temporary parent-child relationship construction unit sets the request message and response message corresponding to the third processing time zone as parent message candidates, and sets the request message and response message corresponding to the fourth processing time zone as child message candidates. The temporary parent-child relationship constructing unit constructs a temporary parent-child relationship using the parent message candidate and the child message candidate.

  The partial transaction search unit collates the inconsistent message in which the temporary parent-child relationship is established with the bad transaction model. The partial transaction search unit searches for a partial transaction indicating a transaction including a message partially matching the bad transaction model.

  The remaining message extraction unit extracts a remaining message indicating a mismatch message other than the messages constituting the partial transaction from the mismatch message in which the temporary parent-child relationship is established.

  The bad transaction determination unit calculates a call probability represented by a reciprocal of the number of the partial transactions having the remaining message as a child message candidate. The bad transaction determination unit selects a combination of the partial transaction having the highest call probability and the remaining message, and determines a transaction indicated by the combination as a bad transaction.

  According to the analysis device described in the present specification, it is possible to improve the efficiency of cause analysis work when a problem occurs in a verification test after updating the OS or middleware.

It is a figure explaining the calling relationship of a message in case a some transaction is performed in parallel in Web 3 layer system. An example of the analyzer in this embodiment is shown. The structural example of the network in this embodiment is shown. An example of a test object system is shown. An example of the structure of the analyzer 21 in this embodiment is shown. An example of the data structure used in the present embodiment will be shown. An example of the data structure used in the present embodiment will be shown. The whole processing flow before the update of the test object system 31 in this embodiment is shown. An example of various data before the update of the test target system 31 is shown. Details of the transaction model generation process (S2) will be described. An example of test execution before the update of the test target system 31 is shown. It is an image figure of the hierarchical relationship of a transaction model. The whole processing flow after the update of the test object system 31 in this embodiment is shown. The detailed flow of a matching process (S12) is shown. An example of the various data regarding a matching process (S12) is shown. The detailed flow of a defect model extraction process (S13) is shown. An example of the various data regarding a defect model extraction process (S13) is shown. The detailed flow of a partial matching process (S14) is shown. FIG. 15 is a sequence diagram of the mismatch message in FIG. It is a figure for demonstrating the inclusion relation of a request and a response. FIG. 19 is a diagram schematically showing message parent-child relationship candidates for the mismatch message sequence of FIG. The detailed flow of S14-1 is shown. An example of a child message candidate is shown. The detailed flow of S14-2 is shown. It is a figure for demonstrating a partial model search. An example of the various data regarding the process of S14-2 is shown. It is a figure for demonstrating extraction and confirmation of a partial transaction candidate. It is a figure for demonstrating extraction of the parent-child relationship candidate of a partial transaction and the remaining mismatch message. The detailed flow of S14-3 is shown. An example of the various data regarding the process of S14-3 is shown. It is a figure for demonstrating calculation of a call probability. The detailed flow of S14-4 is shown. An example of the various data regarding the process of S14-4 is shown. It is a figure explaining selecting the combination of the partial transaction and message with the largest call probability, and confirming a bad transaction. The detailed flow of S14-5 is shown. An example of a bad transaction is shown. The output image of a correct transaction and a bad transaction is shown. An example of the hardware configuration of the analyzer 21 is shown.

  In the “system visualization technology”, a transaction (a set of messages) is extracted and output by matching a collected message with a transaction model created in advance. Messages that do not match the transaction model (mismatch messages) are output separately, but the conventional “system visualization technology” did not utilize mismatch messages.

  In this embodiment, it is possible to support the identification of the influence of the function verification test by using the mismatch message for confirming the update difference. This is because, if there is no change in the transaction model, this mismatch message can be considered as an influence of changes in the OS and middleware.

  As described above, when a plurality of transactions are executed in parallel as in the performance test, since it is not possible to distinguish which transaction model the subsequent message belongs to, it cannot be simply compared. Therefore, in this embodiment, the mismatch message and the transaction model are partially matched to extract a bad transaction.

The analysis apparatus in the present embodiment includes a collation unit, a defective model extraction unit, and a partial transaction extraction unit.
The collating unit collates the model of the transaction generated using the message obtained by the first access between the computers and the message obtained by the second access. Then, the collation unit acquires a transaction that matches the model and a mismatch message other than the messages that make up the transaction. An example of the matching unit 5 is a matching unit 55.

Defect model extraction unit, from the model that is executed in the second access, and extracts the defect model indicating the models except the model that matches the acquired transaction. As an example of the defective model extracting unit 7, a defective model extracting unit 56 is cited.

  The partial transaction extraction unit extracts a partial transaction including a message partially matching the defective model from the mismatch message. An example of the partial transaction is a partial matching unit 57.

This embodiment will be described in detail below.
FIG. 2 shows an example of the analyzer in the present embodiment. The analysis device 1 includes a collection unit 2, a model generation unit 3, a correspondence information generation unit 4, a collation unit 5, a mismatch message acquisition unit 6, a defective model extraction unit 7, a temporary parent-child relationship construction unit 8, a partial transaction search unit 9, and the rest A message extraction unit 10 and a bad transaction determination unit 11 are included.

  The collection unit 2 collects messages transmitted and received between computers connected via a network. Examples of the collecting unit 2 include a packet acquisition unit 51 and a message analysis unit 52.

  The model generation unit 3 analyzes the first processing time zone by using the first message collected when the first access is made from the first computer to the second computer. The first processing time zone is indicated by the difference between the collection times of the request message and the response message that are paired for each communication protocol. The model generation unit 3 analyzes a request message and a response message that form a pair having a second processing time zone included in the first processing time zone. The model generation unit 3 uses the request message and response message corresponding to the first processing time zone as the caller message. Further, the model generation unit 3 uses a request message and a response message corresponding to the second processing time zone as a call destination message. The model generation unit 3 analyzes a message group constituting one transaction and sets the analyzed message group as a transaction model. An example of the model generation unit 3 is a model generation unit 53.

  The correspondence information generation unit 4 generates correspondence information that associates the first access log including the location information of the first access destination obtained when there is a first access and the access time with the transaction model. To do. An example of the correspondence information generation unit 4 is a model correspondence table generation unit 54.

  The collation unit 5 collates the second message collected when the second access is made from the first computer to the second computer and the transaction model. Then, the collation unit 5 acquires a transaction that matches the transaction model from the second message. An example of the matching unit 5 is a matching unit 55.

  As a result of the collation, the mismatch message acquisition unit 6 acquires a mismatch message other than the messages constituting the transaction that matches the transaction model from the second message. An example of the mismatch message acquisition unit 6 is a matching unit 55.

Defect model extraction unit 7, and a second access log and the corresponding information including the second access destination location information and access time obtained when there is a second access, performed in the second access Extracted transaction model. Then, the defective model extraction unit 7, from the transaction model that is executed in the second access, to extract the failure transaction model showing the transaction model of non-transactional model that matches the acquired transaction. As an example of the defective model extracting unit 7, a defective model extracting unit 56 is cited.

  The temporary parent-child relationship construction unit 8 analyzes the third processing time zone indicated by the difference between the request message and the response message collection time for each communication protocol using the mismatch message. The temporary parent-child relationship building unit 8 analyzes the request message and the response message that form a pair having the fourth processing time zone included in the third processing time zone. The temporary parent-child relationship building unit 8 sets the request message and response message corresponding to the third processing time zone as parent message candidates. Further, the temporary parent-child relationship building unit 8 sets the request message and response message corresponding to the fourth processing time zone as child message candidates. The temporary parent-child relationship construction unit 8 constructs a temporary parent-child relationship using the parent message candidate and the child message candidate. An example of the temporary parent-child relationship building unit 8 is a partial matching unit 57 (S14-1).

  The partial transaction search unit 9 collates the mismatch message in which the temporary parent-child relationship is established with the bad transaction model. Then, the partial transaction search unit 9 searches for a partial transaction indicating a transaction constituted by a message partially matching the bad transaction model. An example of the partial transaction search unit 9 is a partial matching unit 57 (S14-2).

  The remaining message extraction unit 10 extracts a remaining message indicating a mismatch message other than the messages constituting the partial transaction from the mismatch message in which the temporary parent-child relationship is established. An example of the remaining message extraction unit 10 is a partial matching unit 57 (S14-3).

  The bad transaction determination unit 11 calculates a call probability represented by the reciprocal of the number of partial transactions whose remaining messages are child message candidates. The bad transaction determination unit 11 selects a combination of the partial transaction having the highest call probability and the remaining message, and determines the transaction indicated by the combination as a bad transaction. As an example of the defective transaction determination unit 11, a partial matching unit 57 (S14-4, S14-5) is cited.

With this configuration, it is possible to improve the efficiency of the cause analysis work when a problem occurs in the verification test after updating the OS and middleware.
Further, the partial transaction search unit 9 extracts a combination of partial transactions in which messages do not overlap among the messages that match the partial transaction model as partial transaction candidates. Here, the partial transaction model indicates a transaction including a message partially matching the bad transaction model. Then, the partial transaction extraction unit 9 selects a partial transaction candidate having the largest total number of messages included in the partial transaction candidates from the partial transaction candidates as a partial transaction.

  With this configuration, the partial transaction extraction unit 9 can select a partial transaction candidate having the largest total number of messages included in the partial transaction candidates from the partial transaction candidates as a partial transaction.

  The remaining message extraction unit 10 extracts a remaining message having a processing time zone included in the processing time zone of the partial transaction. By configuring in this way, the remaining message extraction unit 10 can extract the remaining messages.

  The bad transaction determination unit 11 performs the following process using a message collected every time the first computer accesses the second computer. That is, the bad transaction determination unit 11 calculates an average of call probabilities represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate for the partial transaction model and the remaining message obtained for each collected message. . The bad transaction determination unit 11 selects a combination of the partial transaction having the highest call probability and the remaining message, and determines the transaction indicated by the combination as a bad transaction.

  By configuring in this way, the bad transaction determination unit 11 can set a value obtained by averaging the reciprocal of the number of partial transactions having the remaining message as a child message candidate by the number of calls.

  FIG. 3 shows a configuration example of a network in the present embodiment. The analysis device 21 is connected to a personal computer (client) 26, a Web server 22, an application (AP) server 23, and a database (DB) server 24 via a switch 25 on the network.

  The switch 25 is one of network devices that connect networks between servers. The switch 25 can switch the communication path between the information processing apparatuses and relay the packet according to the destination information included in the header of the packet. The packet is a transmission unit at the Internet layer in the TCP / IP [Transmission Control Protocol / Internet Protocol] model which is one of communication models.

  The Web server 22, AP server 23, and DB server 24 provide services in response to requests from the client 26. The provision of services is executed in cooperation with each other by the Web server 22, the AP server 23, and the DB server 24. At this time, the analysis device 21 acquires a message transmitted / received between the Web server 22-AP server 23-DB server 24 via the network, and analyzes the operation mode of the system.

  FIG. 4 shows an example of a test target system. In the present embodiment, as an example, a Web three-tier system including the Web server 22, the AP server 23, and the DB server 24 is used as the test target system 31 that is the target of the verification test.

  Network interface cards (NICs) 35, 36, and 37 of the Web server 22, AP server 23, and DB server 24 are connected to the ports 35, 36, and 37 of the switch 25. Further, the NICs 40 and 41 of the client 26 and the analyzer 21 are connected to the ports 38 and 38 of the switch 25.

  The switch 25 has a function of mirroring data passing through the switch 25. Mirroring is a function for outputting the same data as data output to a certain port from other ports. In the example of FIG. 4, the port 39 to which the analyzer 21 is connected as a mirroring destination of the port 35 to which the Web server 32 is connected, the port 36 to which the AP server 33 is connected, and the port 37 to which the DB server 34 is connected. Is specified. Thereby, the packet addressed to each server is input to the destination server and also input to the analysis device 21.

  For example, it is assumed that the Web server 22, the AP server 23, and the DB server 24 provide services in conjunction with each other in response to a request from the client 26. In the verification test in this case, first, a packet (for example, an HTTP packet) is transmitted from the client 26 to the Web server 22. At this time, a packet having the same content as the HTTP packet is input to the analyzer 21.

  Next, when a packet (for example, an IIOP packet; hereinafter referred to as an IIOP packet) is transmitted from the Web server 22 to the AP server 23, a packet having the same content as the IIOP packet is input to the analyzer 21. Furthermore, when a packet (for example, an SQL packet) is transmitted from the AP server 23 to the DB server 24, a packet having the same content as the SQL packet is input to the analysis device 21.

  The analysis device 21 analyzes the message based on the received packet, and analyzes the operating state of the test target system 31 using the system visualization technique described above. Here, the analysis device 21 detects a difference between the transaction model created before the update of the test target system 31 and the transaction changed after the update. Note that updating the OS or middleware of at least one of the Web server 22, the AP server 23, and the DB server 24 is referred to as system update.

  FIG. 5 shows an example of the configuration of the analyzer 21 in the present embodiment. The analysis device 21 receives packets exchanged between computers constituting the network by using the mirroring function of the switch 25, and monitors and analyzes the operation status of the computers based on the received packets.

  The analysis device 21 includes a packet acquisition unit 51, a message analysis unit 52, a model generation unit 53, a model correspondence table generation unit 54, a matching unit 55, a defective model extraction unit 56, a partial matching unit 57, an output unit 58, and a storage unit 59. Including.

  The storage unit 59 stores information such as a test execution log 61, a transaction model (model) 62, a model correspondence table 63, a transaction 64, a mismatch message 65, a defective model 66, and other work information. The test execution log 61 is a log of test execution executed by the client 26, and what is acquired from the client 26 is stored in the storage unit 59.

  When the performance test of the test target system 31 is executed before the system update, processing by the packet acquisition unit 51, the message analysis unit 52, the model generation unit 53, and the model correspondence table generation unit 54 is executed.

The packet acquisition unit 51 acquires packets that the Web server 22, AP server 23, and DB server 24 exchange with each other using the mirroring function of the switch 25.
The message analysis unit 52 assembles a message from the acquired plurality of packets, and reconstructs the message.
The message analysis unit 52 analyzes the content of the collected message, generates a protocol log including the following content, and stores the protocol log (not shown) for each collected message in the storage unit 59. In the protocol log, the message collection time, the identifier indicating the message pair of the request message and the response message, the hierarchy of the server that executes the process requested by the request message, and the process requested by the request message The type is included. For example, if the protocol applied to the message is HTTP, the processing type can be determined by a URL (Uniform Resource Locator) specified in the processing request.

  The model generation unit 53 arranges the protocol logs in time series according to the time of collection, and processes the time zone from the time of collecting the request message of each message pair to the time of collecting the response message for the request pair. The processing time zone. Then, the model generation unit 53 has a processing type processed by the highest-level server within the processing time zone of the corresponding processing among the message pairs of the processing type processed by the highest-level server. A message pair in which there is no message having another identifier is detected.

  The model generation unit 53 determines the detected message pair and each message pair formed of messages in the processing time zone corresponding to the message pair as a message pair related to one transaction. The model generation unit 53, based on each message pair related to one transaction, calls that indicate the correspondence relationship between the processing type of one layer of processing and the processing type of processing of the lower layer of that one layer called from that processing Seeking a relationship. The model generation unit 53 obtains the processing time required for the processing corresponding to the processing type of the message pair from the length of the processing time zone of the processing corresponding to the message pair included in one transaction. The model generation unit 53 generates a transaction model 62 in which the obtained calling relationship and the obtained processing time for each obtained processing type are defined.

  The model generation unit 53 may generate the transaction model 62 as follows. In other words, the model generation unit 53 can call a process of one layer as a call destination and a process of a higher layer in the process time zone including the process time zone of the process as a call source. to decide. In this case, the model generation unit 53 equally determines the call probability that each process of the caller that can call one process calls that one process for each process of the caller. The model generation unit 53 calculates the average number of calls for each combination of the process type of the caller process and the process type of the callee process based on the call probability determined for each relationship between the callable processes. . The model generation unit 53 generates a transaction model 62 in which a combination of processing types whose average number of calls is equal to or greater than a predetermined value is defined as a call relationship.

  The model generation unit 53 may generate the transaction model 62 as follows. In other words, the model generation unit 53 can call a process of one layer as a call destination and a process of a higher layer in the process time zone including the process time zone of the process as a call source. to decide. In this case, the model generation unit 53 generates one or more processing set candidates indicating combinations between processes that can be called. The model generation unit 53 equally determines the reliability of each process set candidate with one process as a caller, and generates a generation pattern indicating a combination of process types according to the process types included in the process set candidates. The model generation unit 53 sets a value obtained by averaging the reliability of the processing set candidates having the same generation pattern as the reliability of the generation pattern generated from the processing set candidate. The model generation unit 53 calculates the reliability of the generated pattern by determining the reliability of each processing set candidate generated by using one process as a caller, using the reliability of each generated pattern calculated immediately before. Repeat. The model generation unit 53 generates a transaction model 62 in which a call relationship indicated by an occurrence pattern having a reliability level equal to or higher than a predetermined value is defined.

  The model correspondence table generation unit 54 associates the test execution log 61 and the generated transaction model 62 with the URL and the time, and generates a correspondence table (model correspondence table 63) of the appearance model of the transaction for the test. The model correspondence table generation unit 54 stores the generated model correspondence table 63 in the storage unit 59.

  When the performance test of the test target system 31 is executed after the system update, processing by the packet acquisition unit 51, the message analysis unit 52, the matching unit 55, the defective model extraction unit 56, the partial matching unit 57, and the output unit 58 is executed. To do.

  The matching unit 55 matches the transaction model 62 stored in the storage unit 59 with a message assembled from a packet acquired after the system update. Here, the matching unit 55 stores a protocol log (created after system update) of a message corresponding to a combination of processes that can be called between processing types matching the call relationship indicated by the transaction model 62. 59. That is, the matching unit 55 determines whether the message matches the call relationship indicated by the transaction model 62 stored in the storage unit 59. The matching unit 55 stores the matched message as a transaction 64 in the storage unit 59 as a result of the matching. Further, the matching unit 55 stores a message that does not match as a result of the matching in the storage unit 59 as a mismatch message 65.

  The defective model extraction unit 56 extracts an executed transaction model from the test execution log 61 and the model correspondence table 63 obtained after the system update. The defective model extraction unit 56 stores a transaction model that does not exist in the transaction 64 among the executed transaction models as the defective model 66 in the storage unit 59.

The partial matching unit 57 performs a partial matching process using the mismatch message 65 and the defective model 66, and analyzes the defective transaction.
The output unit 58 outputs the analysis result by partial matching to a display device, a printer, or the like.

In this embodiment, there are “message”, “object”, and “transaction” as elements to be managed.
The “message” is a minimum unit of data exchanged by a plurality of devices on a TCP (Transmission Control Protocol) session. For example, an HTTP request or a response to the request corresponds to the message. The message is divided into a plurality of segments, and each segment is stored in a packet and transmitted.

The “object” is a virtual collection of single or plural processes performed from when the server receives a message to when a response is transmitted and input data. The processing referred to here includes calculation in a CPU (Central Processing Unit), data input / output, waiting time for each, and the like.
A “transaction” is a set of object processes generated by a request to the system.

  6A and 6B show an example of the data structure used in this embodiment. (A) shows an example of the data structure of the test execution log 61. The test execution log 61 includes “date and time”, “test name”, and “URL” as data items. In “Date and time”, the date and time when the test was executed is set. In the “test name”, the name of the performance test is set. In “URL”, the URL specified in the processing request in the HTTP packet is set.

  (B) shows an example of the data structure of the transaction model 62 and the partial transaction model 82. Hereinafter, the transaction model is referred to as “model”, and the partial transaction model is referred to as “partial model”. In the model 62 and the partial model 82, object hierarchy information is set in units of models. The model 62 and the partial model 82 include “model name”, “first layer object name”, “second layer object name”, and “third layer object name” as data items. In this embodiment, since the Web three-tier system is a test target, the object has three layers, but the present invention is not limited to this. That is, the object hierarchy is changed according to the hierarchy of the server providing the service.

  (C) shows an example of the data structure of the model correspondence table. The model correspondence table includes “test name” and “model name” as data items. In the “test name”, the name of the performance test is set. In the “model name”, the name of the transaction model is set.

  (D) shows an example of the data structure of the transaction 64, the partial transaction 83, and the bad transaction 89. In the transaction 64, the partial transaction 83, and the bad transaction 89, message IDs included in these transactions are set. The transaction 64, the partial transaction 83, and the bad transaction 89 include “model name (message ID: message ID:...)” As a data item. The message ID is identification information for identifying the message.

  (E) shows an example of the data structure of the mismatch message 65 and the remaining message 84. The mismatch message and the remaining message include “time”, “message ID”, “object name”, and “response time” as data items.

  (F) shows an example of the data structure of the child message candidate information 81. In the child message candidate 81, a child message candidate for each message is set. The child message candidate 81 includes “message ID”, “child message ID”,... As data items.

  (G) shows an example of the data structure of the remaining message candidate information 85. The remaining message candidate 85 includes “model name (message ID:...)” And “object name (message ID):...” As data items.

  (H) shows an example of the data structure of the parent candidate number information 86. The parent candidate number information 86 includes “object name (message ID)” and “parent candidate number” as data items.

  (I) shows an example of the data structure of the call probability information 87. The call probability information 87 includes “partial model name (message ID:...)”, “Object name (message ID)”, and “call probability” as data items. In “partial model name (message ID:...)”, A message ID of a message included in the partial transaction model is set. In “object name (message ID)”, an object name called from the partial transaction is set. In the “call probability”, the message call probability for the partial transaction model is set.

  (J) shows an example of the data structure of the call probability table 88. In the call probability table 88, message call probabilities for partial transaction models are set. The call probability table 88 includes “object name”, “call probability of partial model name 1”, “call probability of partial model name 2”, and the like as data items.

First, the processing of the analyzer 21 before the test target system 31 is updated will be described with reference to FIGS.
FIG. 7 shows an overall processing flow before the update of the test target system 31 in the present embodiment. FIG. 8 shows an example of various data before the update of the test target system 31.

  The test is performed by accessing the test target system 31 using the client 26 (S1). Access to the test target system 31 using the client 26 may be performed automatically using a test tool, or may be performed manually by a test executor. When the test is executed, an access request is made from the client 26 to the test target system 31, and a series of transactions starts. Then, the Web server 22, the AP server 23, and the DB server 24 exchange packets with each other. The analysis device 21 collects this packet.

  Next, the analysis device 21 captures a packet from the switch 25 connected to the test target Web server 22, the AP server 23, and the DB server 24 at the time of executing the test, and generates a test transaction model 62 using the system visualization technology. (S2). The process of S2 will be described with reference to FIG.

  Then, the model correspondence table generation unit 54 associates the test execution log 61 and the transaction model 62 using the URL and time of the test execution log 61 and the URL and time of the model 62, and the model correspondence table 63 for the test. Is created (S3).

  FIG. 9 shows details of the transaction model generation process (S2). The packet acquisition unit 51 acquires a packet exchanged between the Web server 22, the AP server 23, and the DB server 24 using the mirroring function of the switch 25 (S2-1).

  The message analysis unit 52 assembles a message from the acquired plurality of packets, and analyzes the content of the message from the assembled message (S2-2). The message analysis unit 52 analyzes the contents of the collected message to determine the processing type requested by the message and whether it is a request message or a response message (message direction).

  The model generation unit 53 detects a call destination object (an object having a parent-child relationship) having a processing time zone included in the processing time zone of the call source object (S2-3). The processing of S2-3 will be described later with reference to FIG. As illustrated in FIG. 8B, the model generation unit 53 stores an object having a parent-child relationship as a transaction model 62 (S2-3).

  FIG. 10 shows an example of a test execution before the update of the test target system 31, and calls between the Web server 22, the AP server 23, and the DB server 24 when accessing URLs of HTTP-a and HTTP-b. Show the relationship. The vertical axis represents time. A right arrow indicates a request message. The left arrow indicates a response message.

  At this time, the client 26 outputs the URL accessing the test target system 31 and its time as the test execution log 61 shown in FIG. The test execution log 61 in FIG. 8A indicates that two tests, Test1 and Test2, have been executed, and URLs of HTTP-a and HTTP-b have been accessed, respectively. The test execution log 61 output from the client 26 is stored in the storage unit 59 of the analyzer 21.

  In the case of FIG. 10, the object included in the processing time zone of the object indicated by reference numeral 71 is the object indicated by reference numeral 73. An object included in the processing time zone of the object indicated by reference numeral 73 is an object indicated by reference numeral 76. In this case, since the objects denoted by reference numerals 71, 73, and 76 have a parent-child relationship, they are defined as a first hierarchy object, a second hierarchy object, and a third hierarchy object, respectively (Model 1 in FIG. 8B). .

  The objects included in the processing time zone of the object indicated by reference numeral 72 are objects indicated by reference numerals 74 and 75. Objects included in the processing time zone of the object indicated by reference numeral 74 are objects indicated by reference numerals 77 and 78. An object included in the processing time zone of the object indicated by reference numeral 75 is an object indicated by reference numeral 79. The objects indicated by reference numerals 72, 74, 75, 77, 78, and 79 have a parent-child relationship. In this case, the object indicated by reference numeral 72 is defined as a first hierarchy object. Objects indicated by reference numerals 74 and 75 are defined as second-layer objects. The objects indicated by reference numerals 77, 78, and 79 are defined as third layer objects (Model 2 in FIG. 8B).

FIG. 11 is an image diagram of the hierarchical relationship of the transaction model. FIG. 11 is an image of the transaction model (Model 1, Model 2) of FIG. 8B. FIGS. 8C and 11 show that Model 1 is executed in Test 1 and Model 2 is executed in Test 2.
The process before the update of the test target system 31 is completed.

Next, processing performed by the analysis apparatus 21 after the update of the test target system 31 will be described with reference to FIGS.
FIG. 12 shows the overall processing flow after the update of the test target system 31 in the present embodiment. Using the client 26, the same test as before the update is performed on the test target system 31, and the test execution log 61 ′ is output in the same manner (S11).

  The analysis device 21 collects packets from the switch 25 connected to each server of the test target system 31 and performs message analysis. The analysis device 21 performs matching between the analyzed message and the transaction model 62 before the update of the test target system 31 by using the system visualization technique (S12). As a result of matching, the analysis apparatus 21 outputs a transaction that matches the transaction model 62 as a transaction 64, and outputs a message that does not match as a mismatch message 65.

The analysis device 21 compares the test execution log 61 ′ and the transaction 64, and extracts a defective model 66 that did not appear in the model correspondence table 63 before the update (S13).
The analysis device 21 extracts a defective transaction by partially matching the mismatch message 65 and the defective model 66. In the partial matching process, the defective model 66 and the mismatch message 65 are partially matched, and the defective transaction is determined by associating the matched partial transaction with the remaining mismatch message (S14).

Below, each process of S12-S14 is explained in full detail.
FIG. 13 shows a detailed flow of the matching process (S12). FIG. 14 shows an example of various data related to the matching process (S12). The packet acquisition unit 51 acquires a packet that the Web server 22, the AP server 23, and the DB server 24 exchange with each other using the mirroring function of the switch 25 (S12-1).

The message analysis unit 52 assembles a message from the acquired plurality of packets, and analyzes the content of the message from the assembled message (S12-2).
The matching unit 55 matches the analyzed message with the transaction model 62, and outputs a transaction that matches the transaction model 62 as a transaction 64. On the other hand, the matching unit 55 outputs a message that does not match as a message constituting the transaction model 62 as a mismatch message 65.

  For example, it is assumed that the analyzed messages are “HTTP-c-> IIOP-c-> SQL-e, SQL-f” and “HTTP-d-> IIOP-d-> SQL-g”. In this case, as a result of matching between the analyzed message and the transaction model 62, the matching unit 55 matches the transaction model (Model 3 and Model 4) from FIG. 14A. The matching unit 55 outputs the transaction models Model 3 and Model 4 as a transaction 64 as shown in FIG. On the other hand, the matching unit 55 outputs a message that does not match as a message constituting the transaction model 62 as a mismatch message 65 as shown in FIG.

  FIG. 15 shows a detailed flow of the defect model extraction process (S13). FIG. 16 shows an example of various data related to the defect model extraction process (S13). The defect model extraction unit 56 associates the test execution log 61 shown in FIG. 16A with the model correspondence table 63 shown in FIG. 16B using “test name” as a key, and executes the executed transaction model (execution model). ) Is extracted (S13-1).

  The defective model extraction unit 56 extracts a transaction model not included in the transaction 64 from the extracted execution models as a defective model 66 (S13-2). In this embodiment, among the extracted execution models, Model 1 of Test1 and Model 2 of Test2 which are not in the transaction 64 (Model3, Model4) of FIG. 14B are defective models (FIG. 16C). Become.

  FIG. 17 shows a detailed flow of the partial matching process (S14). The partial matching unit 57 extracts the parent-child relationship candidate between the hierarchies of the mismatch message 65 from the inclusion relationship of the request and response (S14-1).

The partial matching unit 57 searches for a partial transaction that partially matches the transaction model before the update with respect to the parent-child relationship candidate (S14-2).
The partial matching unit 57 extracts a parent-child relationship candidate between the partial transaction and the remaining mismatch message (S14-3).

The partial matching unit 57 calculates the call probability of the partial transaction and the mismatch message during the entire test period (S14-4).
The partial matching unit 57 selects a combination having the highest call probability and outputs a bad transaction (S14-5).

Below, each process of S14-1-S14-5 is explained in full detail.
First, the process of S14-1 will be described in detail with reference to FIGS.
FIG. 18 is a sequence diagram of the call relationship of the mismatch message of FIG. In FIG. 18, “ID” indicates a message ID.

  In S <b> 14-1, the partial matching unit 57 extracts a parent-child relationship candidate between the hierarchies of the mismatch message 65 from the inclusion relationship of the request and response. Here, the inclusion relationship will be described with reference to FIG.

  FIG. 19 is a diagram for explaining the inclusion relationship between request and response. The time zone between the request and response times of the i-th layer message includes the time zone between the request and response times of the (i + 1) -th layer message is referred to as “inclusive”. If the time zone between the request and response times of the i-th layer message is included in the time zone between the request and response times of the i-th layer message, these messages are candidates for the parent-child relationship. .

FIG. 20 is a diagram schematically showing message parent-child relationship candidates for the mismatch message sequence of FIG. 18 using the above-described inclusion relationship.
FIG. 21 shows a detailed flow of S14-1. The partial matching unit 57 searches for messages (requests and responses) included in time in the next hierarchy from each message of the mismatch message 65. The partial matching unit 57 outputs the searched message as a child message candidate 81 as shown in FIG.

  Next, the process of S14-2 will be described in detail with reference to FIGS. In S14-2, the partial matching unit 57 searches for a partial transaction that partially matches the transaction model before the update from the parent-child relationship candidates.

  FIG. 23 shows a detailed flow of S14-2. FIG. 24 is a diagram for explaining the partial model search. FIG. 25 shows an example of various data relating to the processing of S14-2. The partial matching unit 57 searches for a partial model (S14-2-1). That is, the partial matching unit 57 matches the child message candidate 81 with the transaction model 62 for the defective model 66 and registers a partially matched message as a partial model. For example, as shown in FIG. 16C, since the defective model 66 is mode1 1 and model 2, the partial matching unit 57 uses the transaction model of mode1 1 and model 2 (FIGS. 11 and 14A). And the child message candidate 81 (FIG. 20) are matched. Then, as shown in FIG. 24, the message candidates covered with a thick line match. The partial matching unit 57 stores these matched messages in the storage unit 59 as a partial model 82 as shown in FIG.

  Next, the partial matching unit 57 extracts partial transaction candidates (S14-2-2). That is, the partial matching unit 57 extracts a combination of partial transactions in which messages do not overlap among messages that match the partial model 82.

  Then, the partial matching unit 57 determines a partial transaction from the partial transaction candidates (S14-2-3). That is, the partial matching unit 57 determines the combination having the largest number of messages as the partial transaction among the partial transaction candidate combinations. S14-2-2 and S14-2-3 will be described with reference to FIG.

  FIG. 26 is a diagram for explaining extraction / determination of partial transaction candidates. For the partial model obtained in S14-2-1 (FIG. 24), the partial transaction candidates 1 and 2 shown in FIG. Since there are a plurality of combinations as indicated by the broken lines, the partial matching unit 57 selects the partial transaction candidate of the combination having the largest number of matching messages. In FIG. 26, the number of matching messages of partial transaction candidate 1 is 6, and the number of matching messages of partial transaction candidate 2 is 5. Therefore, the partial matching unit 57 selects the partial transaction candidate 1 and stores it in the storage unit 59 as the partial transaction 83 as shown in FIG.

  Next, the partial matching unit 57 extracts remaining messages (S14-2-4). That is, the partial matching unit 57 stores a message not included in the partial transaction in the storage unit 59 as the remaining message 84. In the case of FIG. 24, messages (SQL-x, SQL-y) that have not been extracted as partial models are stored in the storage unit 59 as remaining messages 84.

  Next, the processing of S14-3 will be described in detail with reference to FIGS. In S14-3, the partial matching unit 57 extracts a parent-child relationship candidate between the partial transaction and the remaining mismatch message. This will be described with reference to FIG.

  FIG. 27 is a diagram for explaining extraction of a parent-child relationship candidate between a partial transaction and the remaining mismatch message. As shown on the left side of FIG. 27, the right side of FIG. 27 shows an abstraction of the partial transaction model (Model 1-1, Model 2-1) surrounded by a broken line. At this time, the parent of the remaining message SQL-x is one of Model 1-1. On the other hand, the parent of the remaining message SQL-y is two models 1-1 and 2-1. Therefore, in S14-3, these parent-child relationship candidates are extracted as remaining message candidates 85 as shown in FIG.

  FIG. 28 shows a detailed flow of S14-3. FIG. 29 shows an example of various data relating to the processing of S14-3. The partial matching unit 57 searches for a child message search (S14-3-1). That is, the partial matching unit 57 searches for a remaining message included in time with respect to the partial transaction, and stores it in the storage unit 59 as a remaining message candidate 85.

  Next, the process of S14-4 will be described in detail with reference to FIGS. In S14-4, the partial matching unit 57 calculates the call probability of the partial transaction and the mismatch message (probability that the message is a child of the partial transaction) in the entire test period. This will be described with reference to FIG.

  FIG. 30 is a diagram for explaining calculation of the call probability. The call probability is a value obtained by averaging the reciprocal of the number of parent partial transactions as seen from the mismatch message by the number of calls.

  For example, in the test A, the parent as viewed from the message (SQL-x) is one of the partial transactions Model 1-1. Therefore, the call probability of the message (SQL-x) for the partial transaction (Model 1-1) is 1.0 (= 1/1).

  In Test A, since there are two parents of partial transactions (Model 1-1, Model 2-1) as seen from the message (SQL-y), the call probability is 0.5 (= 1/2). . In test B, since the parent is one of partial transactions (Model 2-1) as seen from the message (SQL-y), the call probability is 1 (= 1/1). Therefore, the call probability of the message (SQL-y) for the partial transaction (Model 1-1, Model 2-1) is 0.75 (= (0.5 + 1.0) / 2).

  FIG. 31 shows a detailed flow of S14-4. FIG. 32 shows an example of various data relating to the processing of S14-4. The partial matching unit 57 uses the remaining message candidates 85 (FIG. 32A) to count the number of parent partial transactions for the remaining messages, and the number of parent candidates 86 as shown in FIG. 32B. Is stored in the storage unit 59 (S14-4-1).

  As shown in FIG. 32C, the partial matching unit 57 calculates a call probability (value obtained by averaging the reciprocal of the number of parent candidates by the number of calls) 87 for the combination of the partial transaction and the remaining message (S14-4). -2).

  As shown in FIG. 32D, the partial matching unit 57 outputs the average call probability to the call probability table 88 for the combination of the partial model and the object (S14-4-3).

  Next, the process of S14-5 will be described in detail with reference to FIGS. In S <b> 14-5, the partial matching unit 57 selects a partial transaction and a message that have the highest call probability and determines a bad transaction. This will be described with reference to FIG.

  FIG. 33 is a diagram for explaining the selection of a combination of a partial transaction and a message with the highest call probability and the determination of a bad transaction. In FIG. 33, attention is focused on a message (SQL-y) having a plurality of parent candidates. The call probability of the message (SQL-y) for the partial transaction (Model 1-1) is 0.5. The call probability of the message (SQL-y) for the partial transaction (Model 2-1) is 0.75. In this case, a combination of a message (SQL-y) and a partial transaction (Model 2-1) having a high call probability is selected. Thereby, the bad transaction is confirmed.

  FIG. 34 shows a detailed flow of S14-5. FIG. 35 shows an example of a bad transaction. When there are a plurality of combinations of partial transactions and remaining messages, the partial matching unit 57 selects a combination having a higher call probability using the remaining message candidates 85 and the call probability table (S14-5-1).

  The partial matching unit 57 stores the partial transaction with the confirmed remaining message added thereto as a bad transaction 89 (FIG. 35) in the storage unit 59 (S14-5-2).

  In this way, a defective transaction can be extracted by partially matching the mismatch message with the defective model. In the partial matching process, the defective transaction can be confirmed by partially matching the defective model and the mismatch message and associating the matched partial transaction with the remaining mismatch message.

  FIG. 36 shows an output image of a correct transaction and a bad transaction. In the case of FIG. 36, it can be confirmed that SQL-a, SQL-b, and SQL-d are lost in the bad transaction (transaction after update) compared to the correct transaction (transaction model before update). On the other hand, it can be confirmed that SQL-x and SQL-y have newly appeared in the bad transaction. The test performer can investigate the influence of the update by comparing these SQLs.

  FIG. 37 shows an example of the hardware configuration of the analyzer 21. The analysis device 21 includes a CPU (central processing unit) 91, a memory 92, a communication control unit 93, a communication device 94, a display control unit 95, a display device 96, an input interface (I / F) 97, an input device 98, and a storage device. 99, a reader 100, and a bus 101.

  To the bus 109, a CPU 91, a memory 92, a communication control unit 93, a communication device 94, a display control unit 95, an input I / F 97, an input device 98, a storage device 99, a reading device 100, and the like are connected. The CPU 91 controls the entire apparatus of the analysis device 21. The memory 92 is a storage device such as a ROM (Read Only Memory) and a RAM (Random Access Memory). The reading device 100 is a device that reads a portable recording medium. The communication control unit 93 is connected to a network accessible to the test target system 31, and controls communication with respect to the network. The communication control unit 93 is connected to the switch 25 of the test target system 31 and controls communication with the switch 25.

  The display device 96 is connected to the display control unit 95. The display control unit 95 displays an image on the screen of the display device 96 according to a command from the CPU 91. The input device 98 is connected to the input I / F 97.

  As the storage device 99, various types of storage devices such as a hard disk drive, a flash memory device, and a magnetic disk device can be used. In the storage device 99, for example, information such as S and a program according to the present embodiment is stored.

  The CPU 91 reads the program according to the present embodiment from the storage device 99, and obtains a packet acquisition unit 51, a message analysis unit 52, a model generation unit 53, a model correspondence table generation unit 54, a matching unit 55, a defective model extraction unit 56, and a part It functions as the matching unit 57.

  The memory 92 or the storage device 99 stores information such as a test execution log 61, a transaction model 62, a model correspondence table 63, a transaction 64, a mismatch message 65, a defective model 66, and other work tables. The other work information indicates, for example, a child message candidate 81, a partial model 82, a partial transaction 83, a remaining message 84, a remaining message candidate 85, a parent candidate number 86, a call probability 87, a call probability table 88, and a bad transaction 89. .

  The program that realizes the operation of the analysis device 21 described in the present embodiment may be stored, for example, in the storage device 99 from the program provider side via a communication network. In addition, a program that realizes processing described in an embodiment to be described later may be stored in a commercially available portable storage medium. In this case, the portable storage medium may be set in the reading device 100, and the program may be read and executed by the CPU 91. As the portable storage medium, various types of storage media such as a CD-ROM, a flexible disk, an optical disk, a magneto-optical disk, an IC card, and a USB memory device can be used. The program stored in such a storage medium is read by the reading device 100.

  As the input device 98, a keyboard, mouse, electronic camera, web camera, microphone, scanner, sensor, tablet, touch panel, or the like can be used. The communication network may be a communication network such as the Internet, a LAN, a WAN, a dedicated line, a wired line, and a wireless line.

  According to the present embodiment, a difference between transactions before and after an update is detected in a verification test when an OS or middleware of any server in a system that provides services by exchanging messages between a plurality of servers is updated. be able to. Therefore, when a problem occurs in the system, it becomes easy to identify the problem location, and the cause analysis work can be made more efficient.

  The present invention is not limited to the above-described embodiment, and various configurations or embodiments can be taken without departing from the gist of the present invention.

Regarding the above embodiment, the following additional notes are disclosed.
(Appendix 1)
A collection unit that collects messages sent and received between computers connected via a network;
Using the first message collected when the first access is made from the first computer to the second computer, the difference between the collection times of the request message and the response message that are paired for each communication protocol. Analyzing the indicated first processing time zone, analyzing the paired request message and response message having the second processing time zone included in the first processing time zone, and analyzing the first processing time zone The request message and response message corresponding to the call message is used as the call source message, and the request message and response message corresponding to the second processing time zone is used as the call destination message, and a message group constituting one transaction is analyzed and analyzed. A model generation unit with a message group as a transaction model;
Correspondence for generating correspondence information associating the first access log including the location information of the first access destination obtained when there is the first access and the first access time with the transaction model. An information generator,
The second message collected when there is a second access from the first computer to the second computer is matched with the transaction model, and the transaction model is matched from the second message. A collation part that retrieves the transaction;
As a result of the collation, a mismatch message acquisition unit that acquires a mismatch message other than a message that constitutes a transaction that matches the transaction model, from the second message;
And a second access log and the corresponding information including the second of the second access destination location information obtained when there is an access and a second access time, is performed in the second access It was extracted transaction model, and from the transaction model performed in the second access, the obtained defect model extraction unit for extracting a defective transaction model showing the transaction model of non-transactional model that matches the transaction,
Using the mismatch message, the third processing time zone indicated by the difference between the request message and response message collection time for each communication protocol is analyzed, and included in the third processing time zone. Analyzes the paired request message and response message having the fourth processing time zone, sets the request message and response message corresponding to the third processing time zone as parent message candidates, and supports the fourth processing time zone A request message and a response message to be a child message candidate, and using the parent message candidate and the child message candidate, a temporary parent-child relationship construction unit that constructs a temporary parent-child relationship;
A partial transaction search unit for collating the mismatch message in which the temporary parent-child relationship is constructed with the bad transaction model and searching for a partial transaction indicating a transaction constituted by a message partially matching the bad transaction model;
A remaining message extraction unit that extracts a remaining message indicating a mismatch message other than a message constituting the partial transaction from the mismatch message in which the temporary parent-child relationship is constructed;
A call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest call probability is selected and indicated by the combination A bad transaction committing part that fixes the transaction as a bad transaction;
An analysis apparatus comprising:
(Appendix 2)
The partial transaction search unit extracts, as partial transaction candidates, a combination of partial transactions that do not overlap with each other among messages that match a partial transaction model indicating a transaction composed of messages that partially match the bad transaction model. Then, from among the partial transaction candidates, the partial transaction candidate having the largest total number of messages included in the partial transaction candidates is selected as the partial transaction.
(Appendix 3)
The remaining message extraction unit
The analyzer according to claim 2, wherein a remaining message having a processing time zone included in the processing time zone of the partial transaction is extracted.
(Appendix 4)
The defective transaction confirmation unit uses the message to be collected each time access to the second computer from the first computer, obtained for each collected message, for the partial transaction and the remaining messages, An average call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest average call probability is selected, The analyzer according to appendix 1, wherein a transaction indicated by the combination is determined as a bad transaction.
(Appendix 5)
On the computer,
Collect messages sent and received between computers connected on the network,
Using the first message collected when the first access is made from the first computer to the second computer, the difference between the collection times of the request message and the response message that are paired for each communication protocol. Analyzing the indicated first processing time zone, analyzing the paired request message and response message having the second processing time zone included in the first processing time zone, and analyzing the first processing time zone The request message and response message corresponding to the call message is used as the call source message, and the request message and response message corresponding to the second processing time zone is used as the call destination message, and a message group constituting one transaction is analyzed and analyzed. The message group is a transaction model,
Generating correspondence information associating the first access log including the location information of the first access destination obtained when there is the first access and the first access time with the transaction model;
The second message collected when there is a second access from the first computer to the second computer is matched with the transaction model, and the transaction model is matched from the second message. Get the transaction,
As a result of the collation, a mismatch message other than a message constituting a transaction that matches the transaction model is obtained from the second message,
And a second access log and the corresponding information including the second of the second access destination location information obtained when there is an access and a second access time, is performed in the second access were extracted transaction model, from the transaction model performed in the second access, extract the defective transaction model showing the transaction model of non-transactional model that matches the acquired transaction,
Using the mismatch message, the third processing time zone indicated by the difference between the request message and response message collection time for each communication protocol is analyzed, and included in the third processing time zone. Analyzes the paired request message and response message having the fourth processing time zone, sets the request message and response message corresponding to the third processing time zone as parent message candidates, and supports the fourth processing time zone A request message and a response message to be a child message candidate, and using the parent message candidate and the child message candidate, a temporary parent-child relationship is constructed,
Collating the inconsistent message in which the temporary parent-child relationship is constructed with the bad transaction model, and searching for a partial transaction indicating a transaction constituted by a message that partially matches the bad transaction model;
From the mismatch message in which the temporary parent-child relationship is constructed, a remaining message indicating a mismatch message other than the messages constituting the partial transaction is extracted.
A call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest call probability is selected and indicated by the combination An analysis program that executes a process to determine a transaction as a bad transaction.
(Appendix 6)
In the partial transaction search, a combination of partial transactions in which a message does not overlap is extracted as a partial transaction candidate among messages that match a partial transaction model indicating a transaction composed of messages partially matching the bad transaction model. Then, the analysis program according to appendix 5, which causes the computer to execute a process of selecting, as the partial transaction, a partial transaction candidate having the largest total number of messages included in the partial transaction candidates.
(Appendix 7)
In extracting the remaining messages,
The analysis program according to appendix 6, which causes a computer to execute processing for extracting a remaining message having a processing time zone included in the processing time zone of the partial transaction.
(Appendix 8)
In the determination of the defective transaction, using a message that is collected each time access to the second computer from the first computer, obtained for each collected message, for the partial transaction and the remaining messages, An average call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest average call probability is selected, The analysis program according to appendix 5, which causes a computer to execute processing for determining a transaction indicated by a combination as a bad transaction.
(Appendix 9)
An analysis method performed by a computer,
The computer
Collect messages sent and received between computers connected on the network,
Using the first message collected when the first access is made from the first computer to the second computer, the difference between the collection times of the request message and the response message that are paired for each communication protocol. Analyzing the indicated first processing time zone, analyzing the paired request message and response message having the second processing time zone included in the first processing time zone, and analyzing the first processing time zone The request message and response message corresponding to the call message is used as the call source message, and the request message and response message corresponding to the second processing time zone is used as the call destination message, and a message group constituting one transaction is analyzed and analyzed. The message group is a transaction model,
Generating correspondence information associating the first access log including the location information of the first access destination obtained when there is the first access and the first access time with the transaction model;
The second message collected when there is a second access from the first computer to the second computer is matched with the transaction model, and the transaction model is matched from the second message. Get the transaction,
As a result of the collation, a mismatch message other than a message constituting a transaction that matches the transaction model is obtained from the second message,
And a second access log and the corresponding information including the second of the second access destination location information obtained when there is an access and a second access time, is performed in the second access were extracted transaction model, from the transaction model performed in the second access, extract the defective transaction model showing the transaction model of non-transactional model that matches the acquired transaction,
Using the mismatch message, the third processing time zone indicated by the difference between the request message and response message collection time for each communication protocol is analyzed, and included in the third processing time zone. Analyzes the paired request message and response message having the fourth processing time zone, sets the request message and response message corresponding to the third processing time zone as parent message candidates, and supports the fourth processing time zone A request message and a response message to be a child message candidate, and using the parent message candidate and the child message candidate, a temporary parent-child relationship is constructed,
Collating the inconsistent message in which the temporary parent-child relationship is constructed with the bad transaction model, and searching for a partial transaction indicating a transaction constituted by a message that partially matches the bad transaction model;
From the mismatch message in which the temporary parent-child relationship is constructed, a remaining message indicating a mismatch message other than the messages constituting the partial transaction is extracted.
A call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest call probability is selected and indicated by the combination An analysis method that executes a process to establish a transaction as a bad transaction.
(Appendix 10)
In the partial transaction search, a combination of partial transactions in which a message does not overlap is extracted as a partial transaction candidate among messages that match a partial transaction model indicating a transaction composed of messages partially matching the bad transaction model. The analysis method according to appendix 9, wherein the computer executes a process of selecting, from the partial transaction candidates, a partial transaction candidate having the largest total number of messages included in the partial transaction candidates as the partial transaction.
(Appendix 11)
In extracting the remaining messages,
The analysis method according to appendix 10, wherein the computer executes a process of extracting a remaining message having a processing time zone included in the processing time zone of the partial transaction.
(Appendix 12)
In the determination of the defective transaction, using a message that is collected each time access to the second computer from the first computer, obtained for each collected message, for the partial transaction and the remaining messages, An average call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest average call probability is selected, The analysis method according to appendix 9, wherein the computer executes a process of determining the transaction indicated by the combination as a bad transaction.
(Appendix 13)
The transaction model generated by using the message obtained by the first access between the computers and the message obtained by the second access are collated, and the transaction that matches the model is configured. A collation part for obtaining non-matching messages other than messages,
From the model executed in the access second, and failure model extraction unit for extracting a defect model indicating the models except the model that matches the acquired transaction,
A partial transaction extraction unit that extracts a partial transaction including a message partially matching the defect model from the mismatch message;
An analysis apparatus comprising:
(Appendix 14)
On the computer,
The transaction model generated by using the message obtained by the first access between the computers and the message obtained by the second access are collated, and the transaction that matches the model is configured. Get non-matching messages other than messages,
From the model run in the second access, it extracts the faulty model indicating the models except the model that matches the acquired transaction,
An analysis program for executing a process of extracting a partial transaction including a message partially matching the defective model from the mismatch message.
(Appendix 15)
An analysis method performed by a computer,
The computer
The transaction model generated by using the message obtained by the first access between the computers and the message obtained by the second access are collated, and the transaction that matches the model is configured. Get non-matching messages other than messages,
From the model run in the second access, it extracts the faulty model indicating the models except the model that matches the acquired transaction,
An analysis method for executing a process of extracting a partial transaction including a message that partially matches the defect model from the mismatch message.

DESCRIPTION OF SYMBOLS 1 Analyzer 2 Collection part 3 Model generation part 4 Correspondence information generation part 5 Collation part 6 Mismatch message acquisition part 7 Defective model extraction part 8 Temporary parent-child relationship construction part 9 Partial transaction search part 10 Remaining message extraction part 11 Defective transaction determination part 21 Analysis device 22 Web server 23 AP server 24 DB server 25 Switch 26 Client 51 Packet acquisition unit 52 Message analysis unit 53 Model generation unit 54 Model correspondence table generation unit 55 Matching unit 56 Defect model extraction unit 57 Partial matching unit 58 Output unit 59 Storage Part

Claims (9)

The transaction model generated by using the message obtained by the first access between the computers and the message obtained by the second access are collated, and the transaction that matches the model is configured. A collation part for obtaining non-matching messages other than messages,
From the model executed in the access second, and failure model extraction unit for extracting a defect model indicating the models except the model that matches the acquired transaction,
A partial transaction extraction unit that extracts a partial transaction including a message partially matching the defect model from the mismatch message;
An analysis apparatus comprising: A collection unit that collects messages sent and received between computers;
Using the first message collected when the first access is made from the first computer to the second computer, the difference between the collection times of the request message and the response message that are paired for each communication protocol. Analyzing the indicated first processing time zone, analyzing the paired request message and response message having the second processing time zone included in the first processing time zone, and analyzing the first processing time zone The request message and response message corresponding to the call message is used as the call source message, and the request message and response message corresponding to the second processing time zone is used as the call destination message, and a message group constituting one transaction is analyzed and analyzed. A model generation unit with a message group as a transaction model;
Correspondence for generating correspondence information associating the first access log including the location information of the first access destination obtained when there is the first access and the first access time with the transaction model. An information generator,
The second message collected when there is a second access from the first computer to the second computer is matched with the transaction model, and the transaction model is matched from the second message. A collation part that retrieves the transaction;
As a result of the collation, a mismatch message acquisition unit that acquires a mismatch message other than a message that constitutes a transaction that matches the transaction model, from the second message;
And a second access log and the corresponding information including the second of the second access destination location information obtained when there is an access and a second access time, is performed in the second access It was extracted transaction model, and from the transaction model performed in the second access, the obtained defect model extraction unit for extracting a defective transaction model showing the transaction model of non-transactional model that matches the transaction,
Using the mismatch message, the third processing time zone indicated by the difference between the request message and response message collection time for each communication protocol is analyzed, and included in the third processing time zone. Analyzes the paired request message and response message having the fourth processing time zone, sets the request message and response message corresponding to the third processing time zone as parent message candidates, and supports the fourth processing time zone A request message and a response message to be a child message candidate, and using the parent message candidate and the child message candidate, a temporary parent-child relationship construction unit that constructs a temporary parent-child relationship;
A partial transaction search unit for collating the mismatch message in which the temporary parent-child relationship is constructed with the bad transaction model and searching for a partial transaction indicating a transaction constituted by a message partially matching the bad transaction model;
A remaining message extraction unit that extracts a remaining message indicating a mismatch message other than a message constituting the partial transaction from the mismatch message in which the temporary parent-child relationship is constructed;
A call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest call probability is selected and indicated by the combination A bad transaction committing part that fixes the transaction as a bad transaction;
An analysis apparatus comprising: The partial transaction search unit extracts, as partial transaction candidates, a combination of partial transactions that do not overlap with each other among messages that match a partial transaction model indicating a transaction composed of messages that partially match the bad transaction model. The analysis apparatus according to claim 2, wherein a partial transaction candidate having the largest total number of messages included in the partial transaction candidates is selected as the partial transaction from the partial transaction candidates. The remaining message extraction unit
The analysis apparatus according to claim 3, wherein a remaining message having a processing time zone included in the processing time zone of the partial transaction is extracted. The defective transaction confirmation unit uses the message to be collected each time access to the second computer from the first computer, obtained for each collected message, for the partial transaction and the remaining messages, An average call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest average call probability is selected, The analysis device according to claim 2, wherein a transaction indicated by the combination is determined as a bad transaction. On the computer,
The transaction model generated by using the message obtained by the first access between the computers and the message obtained by the second access are collated, and the transaction that matches the model is configured. Get non-matching messages other than messages,
From the model run in the second access, it extracts the faulty model indicating the models except the model that matches the acquired transaction,
An analysis program for executing a process of extracting a partial transaction including a message partially matching the defective model from the mismatch message. On the computer,
Collect messages sent and received between computers,
Using the first message collected when the first access is made from the first computer to the second computer, the difference between the collection times of the request message and the response message that are paired for each communication protocol. Analyzing the indicated first processing time zone, analyzing the paired request message and response message having the second processing time zone included in the first processing time zone, and analyzing the first processing time zone The request message and response message corresponding to the call message is used as the call source message, and the request message and response message corresponding to the second processing time zone is used as the call destination message, and a message group constituting one transaction is analyzed and analyzed. The message group is a transaction model,
Generating correspondence information associating the first access log including the location information of the first access destination obtained when there is the first access and the first access time with the transaction model;
The second message collected when there is a second access from the first computer to the second computer is matched with the transaction model, and the transaction model is matched from the second message. Get the transaction,
As a result of the collation, a mismatch message other than a message constituting a transaction that matches the transaction model is obtained from the second message,
And a second access log and the corresponding information including the second of the second access destination location information obtained when there is an access and a second access time, is performed in the second access were extracted transaction model, from the transaction model performed in the second access, extract the defective transaction model showing the transaction model of non-transactional model that matches the acquired transaction,
Using the mismatch message, the third processing time zone indicated by the difference between the request message and response message collection time for each communication protocol is analyzed, and included in the third processing time zone. Analyzes the paired request message and response message having the fourth processing time zone, sets the request message and response message corresponding to the third processing time zone as parent message candidates, and supports the fourth processing time zone A request message and a response message to be a child message candidate, and using the parent message candidate and the child message candidate, a temporary parent-child relationship is constructed,
Collating the inconsistent message in which the temporary parent-child relationship is constructed with the bad transaction model, and searching for a partial transaction indicating a transaction constituted by a message that partially matches the bad transaction model;
From the mismatch message in which the temporary parent-child relationship is constructed, a remaining message indicating a mismatch message other than the messages constituting the partial transaction is extracted.
A call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest call probability is selected and indicated by the combination An analysis program that executes a process to determine a transaction as a bad transaction. An analysis method performed by a computer,
The computer
The transaction model generated by using the message obtained by the first access between the computers and the message obtained by the second access are collated, and the transaction that matches the model is configured. Get non-matching messages other than messages,
From the model run in the second access, it extracts the faulty model indicating the models except the model that matches the acquired transaction,
An analysis method for executing a process of extracting a partial transaction including a message that partially matches the defect model from the mismatch message. An analysis method performed by a computer,
The computer
Collect messages sent and received between computers,
Using the first message collected when the first access is made from the first computer to the second computer, the difference between the collection times of the request message and the response message that are paired for each communication protocol. Analyzing the indicated first processing time zone, analyzing the paired request message and response message having the second processing time zone included in the first processing time zone, and analyzing the first processing time zone The request message and response message corresponding to the call message is used as the call source message, and the request message and response message corresponding to the second processing time zone is used as the call destination message, and a message group constituting one transaction is analyzed and analyzed. The message group is a transaction model,
Generating correspondence information associating the first access log including the location information of the first access destination obtained when there is the first access and the first access time with the transaction model;
The second message collected when there is a second access from the first computer to the second computer is matched with the transaction model, and the transaction model is matched from the second message. Get the transaction,
As a result of the collation, a mismatch message other than a message constituting a transaction that matches the transaction model is obtained from the second message,
And a second access log and the corresponding information including the second of the second access destination location information obtained when there is an access and a second access time, is performed in the second access were extracted transaction model, from the transaction model performed in the second access, extract the defective transaction model showing the transaction model of non-transactional model that matches the acquired transaction,
Using the mismatch message, the third processing time zone indicated by the difference between the request message and response message collection time for each communication protocol is analyzed, and included in the third processing time zone. Analyzes the paired request message and response message having the fourth processing time zone, sets the request message and response message corresponding to the third processing time zone as parent message candidates, and supports the fourth processing time zone A request message and a response message to be a child message candidate, and using the parent message candidate and the child message candidate, a temporary parent-child relationship is constructed,
Collating the inconsistent message in which the temporary parent-child relationship is constructed with the bad transaction model, and searching for a partial transaction indicating a transaction constituted by a message that partially matches the bad transaction model;
From the mismatch message in which the temporary parent-child relationship is constructed, a remaining message indicating a mismatch message other than the messages constituting the partial transaction is extracted.
A call probability represented by the reciprocal of the number of partial transactions having the remaining message as a child message candidate is calculated, and a combination of the partial transaction and the remaining message having the highest call probability is selected and indicated by the combination An analysis method that executes a process to establish a transaction as a bad transaction.

Images