JP5862403B2 - Failure importance processing server device, network management system, failure importance estimation method and program - Google Patents

Description

  The present invention relates to a failure importance level processing server device, a network management system, a failure importance level estimation method, and a program.

  As the number of network devices and servers increases, the use of network management systems that monitor the status of network devices and servers and perform operations on network devices and servers is increasing. When managing the status of network devices and servers as failures, it is necessary to define the failure status. As one of the occurrence states of a failure, an importance level indicating the level of a problem caused by the failure is often used, and the importance level of the failure is generally defined in advance. In other words, the design of what kind of importance is assigned to what kind of failure is performed.

In addition, several techniques have been proposed in relation to the importance of failures. For example, in the network monitoring method described in Patent Document 1, a failure detection unit that detects a failure of a packet switch and a network, and a failure information generation unit that generates failure information related to the failure are provided, and the failure information is previously provided for the failure information. According to the definition of severity, a failure classification table that registers conditions to be classified as major alarms and minor alarms, and failure information is classified according to the failure classification table, and failure information is divided into summary information and detailed information. An information classification control unit is provided, and a major / alarm summary log file, a minor / alarm summary log file, and a detailed information log file for storing each failure information are provided.
As a result, in the monitoring of the packet switching network and the packet switching equipment that constitutes it, it is easy to understand important failure information and global failure status, and to efficiently isolate and analyze the cause of failure. Has been.

JP-A-7-162420

The design for assigning importance to a failure is generally performed at the construction stage before system operation. However, it may not be possible to define the importance of some faults at the design stage. For example, in the design stage, it is conceivable that the actual failure occurrence state in the operation stage cannot be assumed and the importance of the failure cannot be defined. Further, when the failure itself is not assumed in advance, it is possible that the failure is not registered including the importance level registration.
A failure whose severity is not defined may be overlooked as an unmanaged failure because the level of the failure problem cannot be grasped in the operation stage.

  Moreover, in the network monitoring system described in Patent Document 1, it is necessary to define in advance in the failure information classification table according to the importance of failure information, and it is not possible to deal with failures for which importance is not defined.

  It is an object of the present invention to provide a failure importance level processing server device, a network management system, a failure importance level estimation method, and a program that can solve the above-described problems.

  The present invention has been made to solve the above-described problems, and the failure importance processing server apparatus according to one aspect of the present invention associates the importance for each failure with the failure occurrence frequency and the variation in the failure occurrence interval. If the failure degree storage unit and the failure notification of the failure whose degree of importance is not registered are acquired, the failure degree is referred to based on the occurrence frequency of the failure and the variation in the occurrence interval. And an importance degree processing unit for estimating the importance degree.

  The network management system according to one aspect of the present invention includes a first importance storage unit that stores importance for each failure as the importance for notification, and an importance for each failure as the importance for estimation. When acquiring a failure notification of a failure whose importance is not registered in the first importance storage unit, a second importance storage unit that stores the failure occurrence frequency and the failure occurrence interval in association with each other, Based on the occurrence frequency and the variation in the occurrence interval, the second importance level storage unit is referred to, an importance level processing unit for estimating the importance level of the failure, and the importance level is registered in the first importance level storage unit. If the failure notification of the failure that has been acquired is acquired, the importance registered in the first importance storage unit is output, and the failure notification of the failure whose importance is not registered in the first importance storage unit is acquired Then, before the importance processing unit estimated Characterized by comprising a failure handling unit outputting the importance, the.

  Also, the failure importance level estimation method according to an aspect of the present invention includes a failure importance level processing server including an importance level storage unit that stores the importance level for each failure in association with the failure occurrence frequency and the variation in the failure occurrence interval. In the importance level estimation method of the apparatus, when acquiring a fault notification of a fault whose priority level is not registered, the importance level storage unit is referred to based on the occurrence frequency of the fault and the variation in the occurrence interval. An importance level estimation step for estimating the importance level of the failure is provided.

  In addition, the program according to one aspect of the present invention is important for the failure importance degree processing server apparatus including the importance degree storage unit that stores the importance degree for each failure in association with the failure occurrence frequency and the variation in the failure occurrence interval. Importance level estimation step of obtaining the fault notification of the fault whose degree is not registered, and estimating the importance level of the fault by referring to the importance level storage unit based on the occurrence frequency of the fault and the variation in the occurrence interval Is a program for executing

  According to the present invention, it is possible to estimate the problem level of a failure for which the importance is not defined.

It is a schematic block diagram which shows the structure of the network management system in one Embodiment of this invention. It is a figure which shows the example of the failure management table which the failure management database 11 in the same embodiment memorize | stores. It is a figure which shows the example of the failure occurrence history table which the failure occurrence history database 21 in the embodiment memorize | stores. It is a figure which shows the example of the failure classification score table which the failure classification score database 23 in the embodiment memorize | stores. 4 is a flowchart illustrating a procedure of processing performed by the network management system 100 when a failure occurs in the embodiment. 4 is a flowchart illustrating a procedure of table update processing performed by an importance processing unit 22 in the embodiment. It is a schematic block diagram which shows the minimum structure of this invention in a failure importance processing server apparatus.

Next, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a schematic block diagram showing a configuration of a network management system according to an embodiment of the present invention.
In this figure, the network management system 100 includes a failure management server device 1, a failure importance level processing server device 2, and an operator terminal 4. The failure management server device 1 is connected to the monitoring network 3 via a communication network. Further, the failure management server device 1 is connected to the failure importance level processing server device 2 and the operator terminal 4.

  The failure management server device 1 includes a failure management database (DB) 11, a failure processing unit 12, a terminal control unit 13, and a network communication unit 14. The failure importance level processing server apparatus 2 includes a failure occurrence history database 21, an importance level processing unit 22, and a failure classification score database 23. The monitoring network 3 includes a plurality of network devices 31 and a server device 32 that are fault monitoring targets.

  Then, the failure management server device 1 receives a failure notification for notifying a failure that has occurred in the network device 31 or the server device 32 in the monitoring network 3 at the network communication unit 14, and the received failure history is stored in the failure management database 11. Remember. The failure processing unit 12 notifies the failure notification received by the network communication unit 14 to the importance processing unit 22 of the failure importance processing server device 2. The failure importance processing server device 2 notifies the failure processing unit 12 of the failure management server device 1 of the importance of the failure estimated by the importance processing unit 22. The failure management server apparatus 1 notifies the operator terminal 4 of the importance of the failure estimated by the importance processing unit 22 through the terminal control unit 13.

Here, the failure management database 11 is an example of a first importance storage unit in the present invention, and stores the importance for each failure as the importance for notification.
Further, the failure occurrence history database 21 is an example of an importance storage unit (second importance storage unit) in the present invention. The failure occurrence history database 21 associates the importance for each failure with the failure occurrence frequency and the variation in the failure occurrence interval so that the importance processing unit 22 estimates the importance of the failure whose importance is not registered. Remember.

  Here, it is considered that failures that occur on an irregular basis, such as failures that occur frequently and hardware failures, are set (defined) as important failures that need to be addressed. . For example, a failure that occurs many times in a short period needs to be dealt with preferentially, and the degree of importance may be set high. Moreover, it is conceivable that a failure that has a fatal effect on the system is also set to a high importance for a failure that hardly occurs such as a CPU failure or a failure that occurs irregularly such as a network failure.

  On the other hand, although the number of occurrences of failures is large, failures that occur with a fixed behavior such as the occurrence interval once a day may have a low priority for handling and may be set low in importance. For example, in a router located at a bottleneck, it is conceivable that communication data is temporarily concentrated and buffer overflow occurs relatively frequently and relatively regularly. The buffer overflow caused by the concentration of communication data is expected to be immediately resolved by data retransmission, and the importance may be set low.

  Thus, it is considered that there is a certain correlation between the occurrence frequency of failures and the degree of variation in occurrence of failures (degree of regularity) and the importance. Therefore, the network management system 100 associates the failure occurrence frequency and the degree of variation of the failure occurrence with the level of the importance of the failure according to the occurrence state of the failure occurring in the monitoring network 3.

  FIG. 2 is a diagram illustrating an example of a failure management table stored in the failure management database 11. The failure management table is a table provided for the failure management server device 1 to manage a failure that has occurred in the network device 31 or the server device 32 in the monitoring network 3. In addition, the failure processing unit 12 uses, as information for notifying the operator terminal 4, information on the failure (particularly importance) in which the importance is registered among the information stored in the failure management table by the failure management database 11. Use.

  The failure management table shown in FIG. 2 stores information on failures in the network device 31 or the server device 32 in the monitoring network 3, and one row corresponds to one failure. In the example shown in the figure, each row of the failure management table holds a failure identifier, a failure type, a failure occurrence location, a failure occurrence time, an importance level, and a failure resolution time. For example, in row L11, the failure identifier XXXalm1YY, the failure type alm1, the failure occurrence location is router A, the failure occurrence time is 2011/12/05 13:00:00, the severity is 2, and the failure resolution time is 2011/12 / The failure of 05 14:00:05 is registered.

The failure identifier is an identifier used by the network management system 100 to identify a failure. In particular, when a failure occurs, the monitoring network 3 transmits a failure notification including the failure identifier of the failure that has occurred to the failure management server device 1, and the failure management server device 1 uses the failure identifier as a search key to store a failure management table. Retrieve fault information by searching.
The failure type indicates the type of failure. Various types of failures can be used. For example, it may be common to the same type of device such as “CPU failure” in the server device 32, or may be defined for each device.

The failure location indicates the device where the failure occurred.
The failure occurrence time indicates the latest failure occurrence time, that is, the last failure occurrence time.
The importance is the importance of the failure. For example, the operation manager of the network management system 100 defines (sets) and registers the failure in the failure management database 11 based on the seriousness of the influence of the failure and the necessity of handling the failure. To do.
The failure resolution time indicates the time when the failure that has occurred is resolved. In a state where the failure has not been resolved, a value indicating unsolved, such as a blank, is stored as the failure resolution time.

  Here, as a general rule, the failure management database 11 stores in advance the values of each item of the failure identifier, the failure type, the location of the failure, and the importance for each row of the failure management table. The failure management table is a table for the network management system 100 to identify a failure. For example, an initial setting person of the network management system 100 such as an operation manager of the network management system 100 registers these items. The initial setting person of the network management system 100 sets each of the above items for a failure expected to occur in the monitoring network 3 (stores it in the failure management database 11).

However, the initial setter does not always know all the failures that may occur in the monitoring network 3. In addition, after initial setting of the network management system 100, a device may be added to the monitoring network 3 and a failure that is not expected at the time of initial setting may occur. In this way, a failure other than that registered in the failure management table may occur.
In addition, when the initial setter registers a failure, it is possible that the importance of the failure cannot be determined because each device of the monitoring network 3 is before operation. In this case, the initial setter sets the importance value to be a value indicating that it has not been registered, such as setting the importance to blank.
Thus, there may be a case where the importance of the failure is not registered.

Further, the failure processing unit 12 stores the failure occurrence time and the failure resolution time in the failure management database 11 based on information from the monitoring network 3.
For example, the failure processing unit 12 reads the failure occurrence time from the failure notification transmitted from the monitoring network 3 and stores the failure occurrence time in the failure management database 11. Further, the failure processing unit 12 reads out the failure resolution time from the failure resolution notification transmitted from the monitoring network 3 and stores it in the failure management database 11.

FIG. 3 is a diagram illustrating an example of a failure occurrence history table stored in the failure occurrence history database 21. The importance processing unit 22 uses the importance stored in the failure occurrence history table in the failure occurrence history database 21 for estimating the importance of a failure whose importance is not registered.
The failure occurrence history table shown in the figure stores a history of failures that have occurred in the network device 31 or the server device 32 in the monitoring network 3, and one row corresponds to one failure history. In the example of the figure, each line of the failure occurrence history table includes a failure identifier, a failure type, a failure occurrence location, an importance level, a failure occurrence initial time, a failure occurrence last time, the number of occurrences, an interval from the previous occurrence and an average. Holds the occurrence interval. For example, in the row L21, the failure identifier is ZZZalm4AA, the failure type is alm4, the failure location is router B, the severity is 1, the failure occurrence initial time is 2011/12/0212: 00: 00, and the failure occurrence last time is 2011. / 12/0213: 00: 00, 121 times of occurrences, 30 seconds of the interval with the previous occurrence time, and 30 seconds of average occurrence intervals are stored.

The failure occurrence initial time indicates a failure occurrence time when the network management system 100 (network communication unit 14) first receives a failure notification of the corresponding failure. The failure occurrence last time indicates the failure occurrence time (that is, the latest failure occurrence time) when the network management system 100 (network communication unit 14) has finally received the failure notification of the corresponding failure.
The number of occurrences indicates the number of occurrences of the corresponding failure. For example, every time the failure processing unit 22 receives a failure notification, the importance processing unit 22 counts up the number of occurrences of the failure by counting up the number of occurrences of the corresponding failure.

The interval from the previous occurrence is the difference between the time of the most recent failure and the time of the previous failure, that is, the time between the occurrence of the previous failure and the occurrence of the latest failure. Indicates elapsed time. When the importance processing unit 22 receives the latest failure notification, the failure occurrence history database 21 stores the previous failure occurrence time as the latest failure occurrence time. Therefore, the importance processing unit 22 calculates the interval between the previous occurrence based on the latest failure occurrence time read from the failure notification and the previous failure occurrence time stored in the failure occurrence history database 21. And stored in the failure occurrence history database 21.
The average occurrence interval is a value obtained by dividing the time from the first occurrence time of failure to the last failure occurrence time by the number obtained by subtracting 1 from the occurrence count.

FIG. 4 is a diagram showing an example of a failure classification score table stored in the failure classification score database 23. The importance processing unit 22 uses the failure classification score stored in the failure classification score table by the failure classification score database 23 in order to update the importance of the failure occurrence history table.
The failure classification score table shown in the figure is an interval difference defined as an absolute value of a difference between “average occurrence interval” and “interval between previous occurrence times” in the failure occurrence history table described with reference to FIG. (Hereinafter, simply referred to as “interval difference”) and the number of occurrences (the number of occurrences per unit time, that is, the occurrence frequency) are associated with a combination of failure classification scores. As will be described later, the failure classification score is used as a coefficient for updating the importance of the failure stored in the failure occurrence history database 21. The importance level processing unit 22 performs clustering of the importance level of the failure by repeatedly calculating the importance level of the failure and the failure classification score.

  In the example of FIG. 4, the failure classification score database 23 indicates that the failure classification score is 0.5 when the interval difference is 0 and the occurrence count is 1, 0.1 when the occurrence interval is 10, and 100 when the occurrence count is 100. Has a score of 0.05. Then, the importance processing unit 22 recalculates the failure classification score from the importance of the failure that has occurred and the score currently stored in the failure classification score database 23. In this embodiment, the importance indicates that the larger the numerical value, the more serious the failure.

Here, the importance processing unit 22 updates the importance of the failure and updates the failure classification score (hereinafter referred to as “table update processing”) as follows.
At a certain time n (when the number of occurrences of the failure is n), the importance of the failure alm stored in the failure occurrence history database 21 is sv (n) _alm . Also, let c (n) i, j be the failure classification score stored in the failure classification score database 23 in association with the interval difference i and occurrence frequency j in the failure alm. When a failure alm occurs in the (n + 1) th failure occurrence, the importance level processing unit 22 calculates the importance level sv (n + 1) _alm of the failure alm at time n + 1 based on the equation (1).

  If there is no combination of the interval difference and the number of occurrences in the failure classification score table that is the same as the interval difference i and the number of occurrences j in the failure alm, the combination most similar to the interval difference i and the number of occurrences j in the failure alm Use. For example, the importance level processing unit 22 firstly calculates the Euclidean distance (√ (square of the difference between interval differences + the difference between the interval difference i and the occurrence number j) for each combination of the interval difference and the occurrence number in the failure classification score table. The square of the difference in the number of occurrences)) is calculated. The importance processing unit 22 uses the failure classification score associated with the one having the smallest Euclidean distance.

Further, the importance level processing unit 22 updates the failure classification score c (n + 1) _{i, k} of the interval difference i and the occurrence count k based on the equation (2).

  Further, the importance level processing unit 22 normalizes the failure classification score c (n + 1) i, k based on Expression (3).

  In order not to exceed the importance domain of the network management system 100, when the importance calculated based on the formula (1) exceeds the system domain, the importance processing unit 22 Use the maximum value in the domain. When the calculated importance is below the domain, the importance processing unit 22 uses the minimum value in the system domain.

In general, since the behavior of a fault generated from a management target cannot be estimated, a random value is registered as an initial value of a score held in the fault classification score table in the fault classification score database 23, for example.
In addition, if an event such as a failure that occurs regularly but every minute, such as every minute in advance, is known, the score can be held fixed by the operation manager's design policy. Good. The score specified by the design policy may be set so as not to be included in the calculation.

FIG. 5 is a flowchart showing a procedure of processing performed by the network management system 100 when a failure occurs. When the network communication unit 14 receives a failure notification from the monitoring network 3, the network management system 100 starts the process of FIG.
In the process of FIG. 6, first, the network communication unit 14 outputs the received failure notification to the failure processing unit 12 (step S101).

  Then, the failure processing unit 12 determines whether the failure corresponding to the failure notification received by the network communication unit 14 is a failure whose importance is not registered (step S102). Specifically, the failure processing unit 12 has a degree of importance when the failure indicated by the failure notification is not registered (defined) in the failure management table stored in the failure management database 11 or when a failure is registered. If it is not registered, it is determined that the importance is an unregistered failure.

When it is determined that the importance is an unregistered failure (step S102: YES), the failure processing unit 12 outputs a failure notification to the failure importance level processing server device 2 together with information indicating that it is not registered (step S102). S111).
In the failure importance level processing server apparatus 2, the importance level processing unit 22 acquires a failure notification, and updates the failure occurrence history table based on the acquired out-of-field notification (step S112).

Specifically, when the failure indicated by the failure notification is not registered in the failure occurrence history table, the importance level processing unit 22 reads the failure identifier and the failure occurrence time from the failure notification. Also, the importance level processing unit 22 adds one line to the failure occurrence history table. Then, the importance level processing unit 22 writes the failure identifier read from the failure notification in the failure identifier item of the added row. Further, the importance level processing unit 22 writes the failure occurrence time read from the failure notification in the failure occurrence initial time item and the failure occurrence last time item of the added row. Furthermore, the importance level processing unit 22 writes “1” in the item of the number of occurrences of the added row, “0” in the item of the interval from the previous occurrence, and “0” in the item of the average occurrence interval. Further, the importance level processing unit 22 writes information indicating that the importance level is not registered, such as blank, for the importance level item.
If the failure notification includes information on the failure type and the location where the failure has occurred, the importance level processing unit 22 also writes these information in the added line.

On the other hand, when the failure indicated by the failure notification is already registered in the failure occurrence history table, the importance level processing unit 22 reads the failure occurrence time from the failure notification, and the failure occurrence last time of the corresponding row of the failure occurrence history table Write (update) the item. At that time, the importance level processing unit 22 stores the last failure occurrence time before update as the previous failure occurrence time.
Further, the importance level processing unit 22 increases the value of the item of the number of occurrences of the corresponding line by one. Then, the importance level processing unit 22 calculates the average occurrence interval by dividing the time from the initial failure occurrence time to the final failure occurrence time by the number of occurrences, and writes the average occurrence interval in the item of the average occurrence interval of the corresponding row. Also, the importance level processing unit 22 calculates the time from the previous failure occurrence time to the last failure occurrence time, and writes it in the item of the interval from the previous occurrence of the corresponding row.

Next, the importance level processing unit 22 refers to the failure occurrence history table on the basis of the failure occurrence frequency and occurrence interval indicated by the failure notification, and estimates the importance level of the failure (step S113).
Specifically, the importance level processing unit 22 reads out the occurrence frequency from the failure occurrence history table as the occurrence frequency of the failure indicated by the failure notification. In addition, the importance level processing unit 22 calculates the difference between the occurrence intervals indicated by the failure notification as an interval difference (interval with the previous occurrence (time from the previous failure occurrence to the current failure occurrence) and the average occurrence interval. The absolute value of the difference is calculated.
In addition, the importance level processing unit 22 calculates an interval difference for each failure whose importance is registered in the failure occurrence history.
Then, the importance level processing unit 22 selects, from among the failures whose importance levels are registered in the failure occurrence history, the most similar failure in the combination of the failure indicated by the failure notification, the number of occurrences, and the interval difference. For example, the importance level processing unit 22 calculates the Euclidean distance between each failure occurrence number and interval difference and the failure occurrence number and interval difference indicated by the failure notification for each failure registered in the failure occurrence history. (√ (square of difference in occurrence count + square of difference in interval difference)) is obtained. Then, the importance level processing unit 22 selects a fault having the closest Euclidean distance.
Then, the importance level processing unit 22 reads the importance level of the selected failure from the failure occurrence history table as an estimated value of the importance level of the failure indicated by the failure notification.

Then, the importance processing unit 22 transmits the estimated importance to the failure management server apparatus 1 (failure processing unit 12) (step S114). The failure processing unit 12 transmits the failure information including the importance level from the importance level processing unit 22 to the operator terminal 4 via the terminal control unit 13 for display (step S115).
Thereafter, the process of FIG.

On the other hand, when it is determined in step S102 that the severity is a registered failure (step S102: NO), the failure processing unit 12 reads the importance of the failure from the failure management database 11, and the terminal control unit 13 Is sent to the operator terminal 4 to display fault information including the importance (step S121).
In addition, the failure processing unit 12 outputs a failure notification to the failure importance level processing server apparatus 2 together with information indicating that the importance level has been registered (step S122).
In the failure importance level processing server apparatus 2, the importance level processing unit 22 acquires a failure notification, and performs a table update process described below based on the acquired out-of-field notification (step S123).
Thereafter, the process of FIG.

FIG. 6 is a flowchart illustrating a procedure of table update processing performed by the importance processing unit 22. The importance level processing unit 22 performs the process of FIG. 6 in step S113 of FIG. That is, the importance level processing unit 22 performs the process of FIG. 6 every time an unregistered failure occurs.
In the process of FIG. 6, the importance processing unit 22 first uses the failure classification score stored in the failure classification score database 23 to determine the importance in the failure occurrence history table indicated by the failure notification as described above. Updating is performed according to equation (1) (step S201).

Next, the importance processing unit 22 updates the failure classification score according to the above-described equation (2) for the next use based on the failure classification score and the importance (step S202). Then, the importance level processing unit 22 performs normalization of the failure classification score table according to the above-described equation (3) (step S203).
Thereafter, the processing of FIG. 5 ends and the processing returns to the processing of FIG.

  As described above, the importance processing unit 22 refers to the failure occurrence history database 21 (failure occurrence history table) based on the occurrence frequency of the failure and the variation in the occurrence interval for the failure whose importance is not registered. Thus, the importance of the obstacle is estimated. As a result, the importance level processing unit 22 determines the importance level (problem level) of a failure for which the importance level is not defined, the importance level of the failure, the frequency of occurrence of the failure, and the variation in the occurrence interval. It is possible to estimate more appropriately on the basis of the correlation.

Further, the failure importance level processing server apparatus 2 (importance level processing unit 22) determines the absolute difference between the average occurrence interval of the failure and the interval from the occurrence of the failure to the current occurrence as the variation in the failure occurrence interval. Use the value.
As a result, the importance processing unit 22 obtains the variation in the failure occurrence interval by a simple calculation of obtaining the absolute value of the difference between the average failure occurrence interval and the interval from the occurrence of the failure to the current occurrence. Can do. Therefore, the load on the importance processing unit 22 can be suppressed, and an increase in processing time for the importance processing unit 22 to estimate the importance can be suppressed. Further, the failure occurrence history database 21 only needs to store the average failure occurrence interval and the interval from the previous occurrence of the failure to the current occurrence, and does not need to store the failure occurrence times for all times. . Therefore, the storage capacity of the failure occurrence history database 21 can be suppressed.

In addition, when the importance processing unit 22 obtains a failure notification of a failure whose importance, failure occurrence frequency, and variation in failure occurrence interval are known, the importance processing unit 22 stores the importance stored in the failure occurrence history database 21 based on the failure notification. Update. At that time, the importance level processing unit 22 reads the score from the same position in the failure classification score table and updates the importance level for failures having similar failure occurrence frequencies and failure occurrence interval variations. .
As a result, the importance level processing unit 22 performs the same update for failures having similar failure occurrence frequencies and failure occurrence interval variations, and the importance values are similar (the difference is small). Can be considered). That is, the importance level processing unit 22 performs the clustering of the importance level of the failure by updating the importance level.
Therefore, the importance level processing unit 22 can estimate the importance level in a more stable manner (so as to estimate the same importance level for failures having similar failure occurrence frequencies and failure occurrence intervals).

  In this way, the importance level processing unit 22 can automatically classify the importance level of a failure. In particular, it may be possible to classify failures that occurred from servers and network devices that were not taken into consideration at the stage of construction of the network operation management system. In addition, by classifying faults under certain conditions, it will be possible to examine the visualization of faults that could not be recognized and how to deal with them.

  In addition, the importance processing unit 22 updates the importance stored in the failure occurrence history database 21 to update the importance so that the failure occurrence frequency and the failure occurrence interval are also changed. The importance of the fault can be estimated more appropriately.

Further, the failure management database 11 stores the importance for each failure as the importance for notification, and the failure occurrence history database 21 stores the importance for each failure as the importance for estimation.
Thereby, even if the importance level processing unit 22 performs the clustering described above, the failure processing unit 12 determines the importance level that is defined and registered for the failure level (ie, the fixed importance level). Can be notified to the operator terminal.

Next, a minimum configuration of the present invention in the failure importance degree processing server apparatus will be described with reference to FIG.
FIG. 7 is a schematic block diagram showing the minimum configuration of the present invention in the failure importance degree processing server apparatus. In the figure, the failure importance level processing server apparatus 102 includes an importance level storage unit 121 and an importance level processing unit 122.

Similar to the failure occurrence history database 21 (FIG. 1), the importance storage unit 121 stores the importance for each failure in association with the failure occurrence frequency and the failure occurrence interval variation. Similarly to the importance level processing unit 22 (FIG. 1), the importance level processing unit 122 obtains a fault notification for a fault whose level of importance is not registered, based on the occurrence frequency of the fault and the variation in the occurrence interval. With reference to the importance degree storage unit 121, the importance degree of the failure is estimated.
As a result, the importance processing unit 122, like the importance processing unit 22 (FIG. 1), sets the importance (problem level) of the failure for the failure for which the importance is not defined, It can be estimated more appropriately based on the correlation between the occurrence frequency of the failure and the variation in the occurrence interval.

A program for realizing all or part of the functions of the network management system 100 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed. You may perform the process of each part. Here, the “computer system” includes an OS and hardware such as peripheral devices.
Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design changes and the like without departing from the gist of the present invention.

DESCRIPTION OF SYMBOLS 100 Network management system 1 Failure management server apparatus 11 Failure management database 12 Failure processing part 13 Terminal control part 14 Network communication part 2 Failure importance processing server apparatus 21 Failure occurrence history database 22 Importance processing part 23 Failure classification score database 3 Monitoring network 31 Network equipment 32 Server device 4 Operator terminal

Claims (6)

An importance storage unit for storing the importance for each failure in association with the frequency of failure occurrence and variations in failure occurrence intervals;
When a failure notification of a failure whose severity is not registered is obtained, importance processing for estimating the importance of the failure by referring to the importance storage unit based on the occurrence frequency of the failure and the variation in the occurrence interval And
A failure importance degree processing server device comprising:   2. The failure importance degree according to claim 1, wherein as the variation in the failure occurrence interval, an absolute value of a difference between an average occurrence interval of the failure and an interval from the occurrence of the failure to the occurrence of the failure is used. Processing server device.   When the importance processing unit obtains a failure notification of a failure whose importance, failure occurrence frequency, and variation in failure occurrence interval are known, the importance processing unit updates the importance stored in the importance storage unit based on the failure notification The failure importance degree processing server apparatus according to claim 1 or 2, wherein A first importance storage unit for storing importance for each failure as the importance for notification;
As the importance for estimation, a second importance storage unit that stores the importance for each failure in association with the failure occurrence frequency and the variation in the failure occurrence interval;
When the failure notification of the failure whose importance is not registered in the first importance storage unit is acquired, the second importance storage unit is referred to based on the occurrence frequency of the failure and the variation in the occurrence interval. An importance processing unit for estimating the importance of the fault,
When a failure notification of a failure whose importance is registered in the first importance storage unit is acquired, the importance registered in the first importance storage unit is output, and the first importance storage unit stores the importance When acquiring a failure notification of a failure whose importance is not registered, a failure processing unit that outputs the importance estimated by the importance processing unit;
A network management system comprising: A method for estimating the importance of a failure importance processing server device comprising an importance storage unit for storing the importance for each failure in association with a failure occurrence frequency and a variation in failure occurrence interval,
When a failure notification of a failure whose severity is not registered is obtained, importance estimation for estimating the importance of the failure by referring to the importance storage unit based on the occurrence frequency of the failure and the variation in the occurrence interval A failure importance estimation method comprising the steps of: In the failure importance degree processing server device having an importance degree storage unit for storing the importance degree for each failure in association with the failure occurrence frequency and the variation in the failure occurrence interval,
When a failure notification of a failure whose severity is not registered is obtained, importance estimation for estimating the importance of the failure by referring to the importance storage unit based on the occurrence frequency of the failure and the variation in the occurrence interval A program for executing steps.

Images