JP5997005B2 - Information processing apparatus, process normal end determination method, and program - Google Patents

Description

  The present invention relates to a technique for determining whether or not a process has ended normally.

  There are many processes in an information processing apparatus such as a personal computer, and they operate independently or in relation to each other. However, since each process is not a process created by the same expert, not all processes are operating according to the same rule.

  On the other hand, if a problem occurs between a plurality of processes, it may cause a serious failure in the system. Such problems are likely to occur particularly when a unique system is introduced into a personal computer. According to Patent Document 1, a process monitoring system is proposed in which an arbitrary process with a specified name is to be monitored, and when the monitoring process ends abnormally, the linked process is assigned and the process monitoring start / end period can be set flexibly. Has been. Specifically, when the monitoring process means receives a notification from the process monitoring start unit, it reads the monitoring process definition file and acquires the process name of the monitoring target process. The process ID is retrieved from the process management table of the operating system based on the process name, and set so that it can be detected when the monitored process group ends abnormally. When an abnormal end of a process is detected, the end code is acquired, and the monitoring process definition file is searched using the process name and end code as keys, and the corresponding linked process is searched and executed. Stops process monitoring in response to notification from the process monitoring end section.

JP 2000-311099 A

  Generally, when a process ends, it outputs a value called a return code. By defining the return code as normal or abnormal in advance, it is possible to determine from the return code whether the process termination processing has been performed correctly.

  However, the return code alone cannot determine whether the process stop process is an intentional stop process by a malicious user or a forced stop process from another process to reduce the process. In addition, there are many processes on a personal computer that do not output a return code and processes whose definition of the return code is unknown. Therefore, it is difficult to determine whether the process has ended normally. Patent Document 1 does not describe how to detect the abnormal end of the process.

  Therefore, an object of the present invention is to solve at least one of such problems and other problems. An object of the present invention is, for example, to determine whether or not a process has been normally terminated when a process to be monitored is terminated. Other issues can be understood throughout the specification.

  According to the present invention, for example, when a predesignated process is terminated, the predesignated process is normally terminated based on whether a related process associated with the predesignated process is operating. There is provided an information processing apparatus characterized by determining whether or not it has been performed.

Moreover, according to the present invention,
A process monitoring means for monitoring a predesignated process;
Storage means for storing a related list in which related processes related to the predesignated process are registered;
If the related process stored in the related list is activated when the pre-designated process ends, it is determined that the pre-designated process has ended normally, and is stored in the related list. An information processing apparatus is provided that includes a determination unit that determines that the previously designated process has not ended normally if the related process is not activated.

  According to the present invention, when a predesignated process is terminated, whether the predesignated process is normally terminated based on whether a related process associated with the predesignated process is operating. By determining whether or not, it is possible to more accurately determine whether or not the process has been normally completed.

It is a block diagram which shows the whole structure of a process monitoring system. It is a figure which shows an example of a related process list. It is a figure which shows an example of the mutual relationship between several processes. It is a figure which shows an example of the hardware constitutions of information processing apparatus. It is a flowchart which shows the completion | finish determination method of a process.

  FIG. 1 is a block diagram illustrating the entire process monitoring system 110 according to an embodiment of the present invention. The process monitoring system 110 operates on a personal computer (information processing apparatus). The process monitoring system 110 monitors each operation of the process 120 specified in advance as a monitoring target and the related process group 130 including related processes related to the process 120 specified in advance. The process monitoring system 110 is always activated by a personal computer and monitors the process 120 to be monitored. The process monitoring system 110 includes an end detection unit 111 that detects the end of the process 120 to be monitored, a normal end determination unit 112 that determines whether the process 120 has ended normally, and that the process 120 has not ended normally. And a notification unit 113 for notifying the user.

  The end detection unit 111 monitors the process 120 to be monitored, acquires an end event issued when the process 120 to be monitored ends, and detects the end of the process 120 to be monitored. When detecting the end of the monitoring target process 120, the end detection unit 111 notifies the normal end determination unit 112 of end information indicating that the monitoring target process 120 has ended. The end information includes identification information that can identify the process 120 to be monitored, such as the process name and process ID of the process 120 to be monitored. As described above, the end detection unit 111 functions as a process monitoring unit that monitors the process 120 specified in advance.

  When the normal end determination unit 112 receives the end information from the end detection unit 111, the normal end determination unit 112 checks the operation start status of the related process group 130. It is assumed that identification information such as process names of one or more related processes belonging to the related process group 130 is registered in the related process list 140. The related process list 140 is an example of a related list in which related processes related to the process 120 specified in advance are registered. The related process list 140 is stored in a storage unit such as a hard disk drive or a memory. On the other hand, the operating system (OS) 150 creates and holds a process list (hereinafter referred to as an OS process list 160) in which all processes operating on the personal computer are registered. The normal end determination unit 112 refers to the OS process list 160 managed by the operating system 150 to determine whether the related process group 130 is operating. The normal end determination unit 112 determines that the monitored process 120 has ended normally if the related process group 130 stored in the related process list is activated when the monitored process 120 ends. In addition, the normal end determination unit 112 determines that the process to be monitored that has been designated in advance has not ended normally unless the related process group 130 stored in the related process list is activated.

  There may be one or more processes 120 to be monitored. However, when there are a plurality of processes 120 to be monitored, a related process group 130 may be stored in the related process list for each of the plurality of processes 120 to be monitored.

  FIG. 2 is a diagram illustrating an example of the related process list 140. In the related process list 140, a process name of a process designated in advance as a monitoring target and a process name of a related process correlated with the process designated in advance are stored in association with each other. In this example, processes B, C, and D are associated with process A and registered in the related process list 140.

  FIG. 3 is a diagram illustrating an example of a mutual relationship between a plurality of processes. When the process A and the process B are in a mutual relationship, when the process A transits to the start state (S301), the process B related to each other transits to the stop state (S302). When the process A transitions to the stop state (S303), the process B transitions to the start state (S304). Thus, when the process A ends, the process B is operating. Therefore, if the process 120 to be monitored is the process A, when the process A ends, if the process B is listed in the OS process list, it is determined that the process A has ended normally. On the other hand, when the process A ends, if the process B is not listed in the OS process list, it is determined that the process A did not end normally.

  FIG. 4 is a block diagram illustrating a hardware configuration example of the computer 100 applicable as the information processing apparatus. The CPU 41 controls the entire computer using computer programs and data stored in the ROM 42 and RAM 43. In particular, the CPU 41 functions as the process monitoring system 110 by executing a computer program. The ROM 42 stores setting data of the computer 100, a boot program, and the like.

  The RAM 43 has an area for temporarily storing computer programs and data loaded from an HDD (Hard Disk Drive) 44, data received from the outside via the communication interface 47, and the like. Further, the RAM 43 has a work area used when the CPU 41 executes various processes. That is, the RAM 43 can provide various areas as appropriate.

  The HDD 44 stores a program corresponding to the operating system 150 and the process monitoring system 110, and a program corresponding to the process 120 and the related process group 130. It is also assumed that the related process list 140 and information on processes designated as monitoring targets are also stored in the HDD 44.

  Computer programs and data stored in the HDD 44 are appropriately loaded into the RAM 43 under the control of the CPU 41 and are processed by the CPU 41.

  The input device 45 includes a keyboard, a mouse, and the like. An operator of the computer can input various instructions to the CPU 41 by operating the input device 45. For example, the CPU 41 receives information on the process 120 designated as a monitoring target through the input device 45 and stores it in the HDD 44. The CPU 41 may also receive information on related processes related to the process 120 designated as the monitoring target through the input device 45, create the related process list 140, and store the related process list 140 in the HDD 44.

  The display device 46 is configured by a CRT, a liquid crystal screen, or the like, and can display a processing result by the CPU 41 using an image, text, or the like. For example, the CPU 41 may cause the display device 46 to display a message for notifying that the process 120 has not ended normally by functioning as the notification unit 113.

  The communication interface 47 is composed of various interfaces. The communication interface 47 includes, for example, a network interface for connecting the computer to a network and a device interface for connecting an external peripheral device.

  Note that the configuration of the computer 100 is not limited to such a configuration. That is, as long as the above-described functions can be achieved, the configuration of the computer 100 may be changed as appropriate.

  FIG. 5 is a flowchart showing the steps of the normal end determination method executed by the process monitoring system 110. The CPU 41 activates the operating system 150 and further activates various processes and the process monitoring system 110 according to the operating system 150. The process monitoring system 110 may be automatically started when the operating system 150 is booted as a service program, or may be started according to a user instruction.

  In S501, the CPU 41 specifies the name of the process 120 that is designated in advance as a monitoring target. The name of the process 120 designated in advance as the monitoring target is stored in the HDD 44 in advance, and the CPU 41 reads the name to identify the name of the process 120 designated in advance as the monitoring target. As a result, the CPU 41 starts monitoring the operation of the process 120.

  In S502, the CPU 41 determines whether or not the process 120 to be monitored is activated and operating. For example, the CPU 41 refers to the OS process list 160 managed by the operating system 150 to determine whether the process 120 is in operation. If the identification information of the process 120 to be monitored is not listed in the OS process list 160, the CPU 41 determines that the process 120 is not in operation. On the other hand, if the identification information of the monitoring target process 120 is listed in the OS process list 160, the CPU 41 determines that the process 120 is in operation, and proceeds to S503.

  In step S503, the CPU 41 determines whether the process 120 has ended. The CPU 41 functions as the end detection unit 111 to detect an end event of the process 120. If the end event is not detected, the CPU 41 determines that the process 120 has not ended. If the end event is detected, the CPU 41 determines that the process 120 has ended. When the process 120 ends, the CPU 41 notifies the normal end determination unit 112 that the process 120 has ended, and the process proceeds to S504.

  In step S <b> 504, the CPU 41 functions as the normal end determination unit 112, refers to the related process list 140, and acquires identification information of the related process group 130 related to the process 120.

  In step S <b> 505, the CPU 41 functions as the normal end determination unit 112 and refers to the OS process list 160 managed by the operating system 150.

  In step S <b> 506, the CPU 41 functions as the normal end determination unit 112 and determines whether the process 120 to be monitored has ended normally. For example, the CPU 41 determines whether or not the process 120 to be monitored has ended normally based on whether or not the identification information of the related process group 130 is listed in the OS process list 160 managed by the operating system 150. May be. If the identification information of the related process group 130 is listed in the OS process list 160 managed by the operating system 150, it means that the related process group 130 is operating. If the identification information of the related process group 130 is listed in the OS process list 160 managed by the operating system 150, and the related process group 130 is operating, it means that the process 120 to be monitored has ended normally. To do. Therefore, the process returns to S502 and monitoring of the process 120 is continued. On the other hand, if the identification information of the related process group 130 is not posted in the OS process list 160 managed by the operating system 150 and the related process group 130 is not operating, the process 120 to be monitored ends normally. Since it has not (abnormal end), the process proceeds to S507. The CPU 41 notifies the notification unit 113 that the process 120 to be monitored has not ended normally.

  In step S <b> 507, the CPU 41 functions as the notification unit 113 and causes the display device 46 to output a message indicating that the process 120 to be monitored has not ended normally. Note that the CPU 41 may transmit the notification to the administrator or another computer through the communication interface 47. Further, the CPU 41 may stop all functions of the computer 100.

  Note that the normal termination determination condition of the process 120 may be, for example, a condition that a predetermined number (for example, one, two, or all) of a plurality of processes belonging to the related process group 130 are not operating.

  The process 120 to be monitored basically exists in the computer 100 in which the process monitoring system 110 is installed, but the related process group 130 may exist in the computer 100 or exist on another computer. You may do it. In this case, the CPU 41 inquires of another computer whether or not the related process group 130 is operating.

  As described above, according to the present embodiment, the CPU 41 (normal end determination unit 112) determines whether the related process group 130 related to the process 120 is operating when the process 120 designated in advance is ended. Based on this, it is determined whether the process 120 has ended normally. More specifically, the CPU 41 determines that the process 120 has ended normally if the related process group 130 stored in the related process list 140 is activated when the process 120 specified in advance ends. If the related process group 130 is not activated, it is determined that the process 120 has not ended normally. This is a determination method using the interrelationship between processes that the related process group 130 is always operating when the process 120 designated in advance is normally terminated. For example, the process 120 may be forcibly stopped from the related process group 130 in order to reduce the processing of the CPU 41. That is, the related process group 130 is a process for ending the process 120 designated in advance, and the related process group 130 may be deeply involved in the end of the process 120. By utilizing such interrelationships between processes, the present invention can more accurately determine whether or not a process has been normally completed. For example, when the monitored process 120 is intentionally stopped by a malicious user, the related process group 130 may not be operating. Therefore, if the interrelationship between processes is used, whether the process 120 is stopped by a malicious user or whether the process 120 is forcibly stopped from the related process group 130 to reduce the processing of the CPU 41 is distinguished. I will be able to do it.

  Further, in the present embodiment, it is possible to determine whether or not the process 120 has ended normally without using a return code, so that erroneous determination is less than a determination method that relies on a return code. A large number of processes are operating in the computer 100, and there are processes that do not return a return code and processes that return a return code whose definition is unknown. Therefore, a determination method that relies on a return code cannot accurately determine whether or not such a process has ended normally. On the other hand, in the present embodiment, it can be determined whether or not the process 120 has ended normally without using a return code, and therefore it can be said that the determination can be made more accurately than in the past.

  The CPU 41 may perform normal termination determination using the related process list 140. The CPU 41 acquires the process name of the related process group 130 from the related process list 140 and determines whether the acquired process name is listed in the OS process list 160 managed by the operating system 150 of the computer 100. Thus, it may be determined whether or not the process 120 designated in advance has ended normally. Since the OS creates and holds an OS process list 160 in order to manage all the services and processes that are running, the CPU 41 can easily use the related process group 130 to operate. Can be determined.

  Note that the CPU 41 determines that the process 120 has ended normally if all the related processes stored in the related process list 140 are started, and starts all the related processes stored in the related process list 140. If not, it may be determined that the process 120 designated in advance has not ended normally. Alternatively, the CPU 41 determines that the process 120 designated in advance has ended normally if at least one related process of a plurality of related processes stored in the related process list 140 is activated, and the related process list 140 It may be determined that the process 120 has not ended normally unless all of the plurality of related processes stored in the process are activated. As described above, the normal termination determination condition may be stricter or gentler according to the feature of the mutual relationship between the process 120 and the related process group 130.

  If the CPU 41 determines that the process 120 designated in advance has not ended normally, the CPU 41 may cause the display device 46 and the communication interface 47 to function as notification means for notifying the abnormal end of the process. As a result, the user or the administrator can quickly grasp that the process 120 has not ended normally.

  In the present embodiment, the related process group 130 has been described as including a plurality of related processes. However, of course, the related process group 130 may include one related process. The name of the related process group 130 is merely a name for convenience of explanation.

Claims (9)

  Determining whether or not the predesignated process has terminated normally based on whether or not an associated process associated with the predesignated process is running when the predesignated process is terminated A characteristic information processing apparatus. A process monitoring means for monitoring a predesignated process;
Storage means for storing a related list in which related processes related to the predesignated process are registered;
If the related process stored in the related list is activated when the pre-designated process ends, it is determined that the pre-designated process has ended normally, and is stored in the related list. An information processing apparatus comprising: a determination unit that determines that the predetermined process has not ended normally if the related process is not activated.   The information processing apparatus according to claim 2, wherein the related process is a process for terminating the predesignated process.   The determination unit acquires a process name of the related process from the related list, and determines whether the acquired process name is listed in a process list managed by an operating system of the information processing apparatus. The information processing apparatus according to claim 2, wherein the information processing apparatus determines whether or not the predesignated process has been normally completed.   If all the related processes stored in the related list are activated, the determination unit determines that the predesignated process has ended normally, and all the related processes stored in the related list 5. The information processing apparatus according to claim 2, wherein the information processing apparatus determines that the process designated in advance is not completed normally if the process is not started. 6.   The determination means determines that the predesignated process has ended normally if at least one related process of a plurality of related processes stored in the related list is activated, and stores the process in the related list. 5. The information processing according to claim 2, wherein if all of the plurality of related processes that have been started are not activated, it is determined that the previously designated process has not ended normally. 6. apparatus.   The notification means according to any one of claims 2 to 6, further comprising a notification means for notifying the abnormal end of the process when the determination means determines that the predesignated process has not ended normally. The information processing apparatus described. A process monitoring step for monitoring a pre-designated process;
When the pre-designated process ends, the related list in which the related process related to the pre-designated process is registered is used, and the related process stored in the related list is activated. Determining that a predesignated process has ended normally, and determining that the predesignated process has not terminated normally if the related process stored in the related list is not active. A method for determining normal termination of a process, characterized in that: A process monitoring means for monitoring a predesignated process;
Storage means for storing a related list in which related processes related to the predetermined process are registered;
If the related process stored in the related list is activated when the pre-designated process ends, it is determined that the pre-designated process has ended normally, and is stored in the related list. A program that causes a computer to function as a determination unit that determines that the previously designated process has not ended normally if the related process is not activated.