JP6078391B2 - Incident management system, incident operation management method, and program - Google Patents

Description

  The present invention relates to an operation management technology for incidents, and more particularly to a technology effective for reducing failure recovery work time in incident management operations in an environment of different languages.

  In the data center, there is a so-called incident management operation business in which an information system is entrusted to a customer and an operation service including failure handling is provided. Operational service providers must monitor the occurrence of incidents in the customer's system, quickly restore service, and minimize the impact on customer operations.

  For example, Patent Document 1 is known as a mechanism for quickly recovering a service from an incident that has occurred (see Patent Document 1). This technology realizes an efficient response according to the characteristics and situation of the target system.

JP 2011-76161 A

  Patent Document 1 described above searches and presents applicable failure cases (actions and procedures for incidents that occurred in the past) from messages of incidents that have occurred, and enables appropriate and quick recovery work. In order to make use of this mechanism, it is necessary to increase the satisfaction rate of failure determination conditions for determining failure cases to be applied to incidents and failure response procedure manuals used for service restoration.

  When a new incident management operation is started in a different language environment due to overseas expansion, etc., there are no failure cases that can be used in that language environment. It will take. As a result, there is a problem that more time is required for service restoration than in the operation environment of the native language.

  In order to reduce the service recovery time of incident management operations introduced in a different language environment, a mechanism that promotes the fulfillment of failure cases that can be used in the language environment of the introduction destination is indispensable. However, the above-described technology does not include a mechanism for satisfying failure cases after introduction in a different language environment.

  The objective of this invention is providing the technique which can provide the satisfaction of the troubleshooting procedure manual in a different language environment efficiently in a short time.

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in the present application, the outline of typical ones will be briefly described as follows.

  In order to achieve the above-described object, the present invention realizes a mechanism for extracting failure handling procedure candidates to be translated from a handling case corresponding to an incident and promoting failure case satisfaction.

  The incident management system of the present invention has a failure information input unit. The failure information input unit determines whether the determination information included in the failure information generated from the monitoring target device matches the determination information included in the foreign language failure case information stored in the foreign language failure case information table.

  Then, when it is determined to be compatible, the failure information and the case ID of the compatible foreign language failure case information are stored in the incident information table as the first incident information. It has a failure information input unit for storing in the incident information table as second incident information without an ID.

  Further, the present invention can be applied to a method using a system for collecting and managing incidents, and a program for causing a computer system to function as the system.

  Among the inventions disclosed in the present application, effects obtained by typical ones will be briefly described as follows.

  Incident resolution time in a different language environment can be reduced.

It is explanatory drawing which shows an example of a structure in the incident management business application system by one embodiment of this invention. It is explanatory drawing which showed the item example of the incident information table stored in the incident database of FIG. It is explanatory drawing which showed an example of the item of the Chinese obstacle case information table stored in the Chinese case database of FIG. It is explanatory drawing which showed an example of the item of the Japanese fault case information table stored in the Japanese case database of FIG. It is explanatory drawing which shows an example of the incident list screen displayed on the operation terminal of FIG. It is explanatory drawing which shows an example of the failure example display screen displayed on the operation terminal of FIG. It is a flowchart which shows the process example of the determination condition automatic generation process by the failure case update process part provided in the incident management system of FIG. 1, and the translation object procedure automatic extraction process.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

<Summary of invention>
The first outline of the present invention is an incident management system (incident management system 10). This incident management system has a failure information input unit (failure information input unit 11).

  The failure information input unit includes determination information included in failure information generated from the monitored device (monitored device 2) and foreign language failure case information stored in the foreign language failure case information table (Chinese failure case information table 31). It is determined whether or not the determination information included in is compatible.

  Then, when it is determined to be compatible, the failure information and the case ID of the compatible foreign language failure case information are stored in the incident information table (incident information table 21) as the first incident information. Moreover, when it determines with not matching, it has a failure information input part which stores failure information in an incident information table as 2nd incident information without case ID.

  The second outline of the present invention is an incident operation management method for operating and managing incidents by a computer system. The computer system includes a monitoring target device (monitoring target device 2) connected to a communication line, a fault monitoring device (fault monitoring device 3) that acquires fault information generated from the monitoring target device, and a fault acquired by the fault monitoring device. Fault information input unit (fault information input unit 11) for registering information, fault information output unit (list display processing unit 12) for outputting fault information registered by the fault information input unit, and faults registered by the fault information output unit A failure case update processing unit (failure case update processing unit 13) for updating information.

  The failure information input unit has the following steps.

  (1) Whether the determination information included in the failure information generated from the monitored device matches the determination information included in the foreign language failure case information stored in the foreign language failure case information table (Chinese failure case information table 31) Determining.

  (2) When it is determined to be compatible in the step, the failure information and the case ID of the applicable foreign language failure case information are stored in the incident information table (incident information table 21) as the first incident information (incident information table). This is a step of storing the failure information in the incident information table as the second incident information without the case ID when it is determined that they do not match.

  Furthermore, a third outline of the present invention is a program to be executed by a computer system. The computer system includes a monitoring target device (monitoring target device 2) connected to a communication line, a fault monitoring device (fault monitoring device 3) that acquires fault information generated from the monitoring target device, and a fault acquired by the fault monitoring device. Fault information input unit for registering information, fault information output unit (list display processing unit 12) for outputting fault information registered by the fault information input unit, and fault case update for updating fault information registered by the fault information output unit And a processing unit (failure case update processing unit 13).

  Then, the failure information input unit is caused to execute the following steps.

  (1) Whether the determination information included in the failure information generated by the monitored device matches the determination information included in the foreign language failure case information stored in the foreign language failure case information table (Chinese failure case information table 31) Determining.

  (2) When it is determined to be compatible in the above step, the failure information and the case ID of the applicable foreign language failure case information are stored in the incident information table (incident information table 21) as first incident information (incident information table). In this case, the failure information is stored in the incident information table as the second incident information without the case ID when it is determined that it does not match.

  Hereinafter, the embodiment will be described in detail based on the above-described outline.

<Configuration example of incident management business application system>
FIG. 1 is an explanatory diagram showing an example of a configuration in an incident management business application system according to an embodiment of the present invention.

  This incident management business application system relates to the application of incident management operation business to a different language environment. As shown in FIG. 1, the incident management business application system includes a monitoring target device 2, a failure monitoring device 3, an operation terminal 4, and an incident management system 10 that are provided in a data center 1 that is an overseas expansion destination. Here, an example is shown in which the overseas expansion destination is China, and the data center 1 is located in China.

  The incident management system 10 includes a failure information input unit 11, a list display processing unit 12, a failure case update processing unit 13, a failure case display processing unit 14, an incident database 20, a Chinese case database 30, and a Japanese case database 40. Have

  The incident database 20 stores an incident information table 21, and the Chinese case database 30 stores a Chinese failure case information table 31. The Japanese case database 40 stores a Japanese failure case information table 41.

  As described above, as an example of the different language environment, the case where the data center 1 is in China and Chinese is used for dealing with troubles is described. However, if the overseas expansion destination is other than China, the overseas expansion destination The native language will be used for disability.

  For example, if the overseas expansion destination is France, the data center is located in France, and French is used as the language for dealing with failures. In addition, when the overseas expansion destination is Germany, the data center is located in Germany, and the language for handling failures is German. Therefore, the language for dealing with disabilities varies depending on the native language of the country of entry.

  The monitored device 2 and the failure monitoring device 3 are connected by a communication line or the like. The fault monitoring apparatus 3 automatically collects faults that have occurred in the monitoring target device 2 that is the fault monitoring target, and transmits the faults to the incident management system 10. In FIG. 1, there are three monitored devices 2, but the number of monitored devices 2 is not limited to this.

  The failure information input unit 11 in the incident management system 10 receives the failure information transmitted from the failure monitoring device 3. The failure information input unit 11 compares the message included in the received failure information with the failure case information in the Chinese failure case information table 31 stored in the Chinese case database 30, and the device name, AP (application) name Is determined to match. At this time, if ErrorID is specified in the failure case information, the ErrorID also matches, and it is determined whether the message includes a match determination message.

  When the failure case information matches, the failure information input unit 11 adds the failure case information to the incident information table 21 stored in the incident database 20 with the matched case ID. If they do not match, they are registered in the incident information table 21 with no case ID.

  The processing function of the failure information input unit 11 described above is, for example, a program-format software stored in a program storage memory (not shown) provided in the incident management system 10 or the like. This is realized by execution of a CPU (Central Processing Unit) not shown.

  The list display processing unit 12 outputs an incident list screen shown in FIG. The person in charge of operation manages from incident occurrence to completion on the incident list screen of FIG.

  The failure case update processing unit 13 generates a failure case determination condition from an incident that does not match the failure case in the incident information table 21 stored in the incident database 20.

  Then, a failure handling procedure that can be translated and diverted from the Japanese failure case information table 41 stored in the Japanese case database 40 is extracted, and the Chinese failure case information table 31 stored in the Chinese case database 30 is extracted. Register with.

  The failure case display processing unit 14 outputs the failure case display registered in the Chinese failure case information table 31 to the operation terminal 4 and displays it on the operation terminal 4 as a failure case display screen of FIG.

<Example of incident information table 21>
FIG. 2 is an explanatory diagram showing an example of items in the incident information table 21 stored in the incident database 20 of FIG.

  The incident information table 21 is a table in which incident information is stored. As shown in FIG. 2, each of incident ID, occurrence time, host name, device name, AP name, Error ID, matching case ID, status, and message Have items.

  The incident ID is a character string that uniquely identifies the incident. The occurrence time indicates the occurrence time of the incident. The host name indicates the name of the host that generated the failure information. The device name indicates the name of the device.

  The AP name indicates the application name. The Error ID is a character string that identifies the phenomenon that has occurred. The matched case ID is the ID of the matched case. The status indicates the incident response status. A message is an item of a message.

<Examples of Chinese Disability Case Information Table Items>
FIG. 3 is an explanatory diagram showing an example of items in the Chinese failure case information table 31 stored in the Chinese case database 30 of FIG.

  The Chinese fault case information table 31 stores Chinese fault case information. As shown in FIG. 3, the case ID, device name, AP name, Error ID, original case ID, valid, Msg common rate , A match determination message (Msg common part), and a corresponding procedure manual name.

  The case ID is a character string that uniquely identifies a failure case. The device name indicates a device name used for matching determination. The AP name indicates the application name, and the Error ID is a character string that identifies the phenomenon that has occurred.

  The original case ID indicates a case including a procedure that is translated and used as a diversion source. Valid indicates whether the response case is applied to the incident. In FIG. 3, for example, “◯” indicates that the registration is valid at the same time, “●” indicates that the registration is enabled manually, and “x” indicates that it is invalid.

  The Msg common rate indicates the ratio of the character string matching portion among a plurality of messages that are the origins of the generation of the match determination message (Msg common portion). The match determination message (Msg common part) indicates the generated match determination message. The response procedure document name indicates the document name after translation used for the recovery work from the incident.

<Examples of Japanese Disability Case Information Table>
FIG. 4 is an explanatory diagram showing an example of items in the Japanese language trouble case information table 41 stored in the Japanese case database 40 of FIG.

  The Japanese fault case information table 41 is a table storing Japanese fault case information, and each item is the same as the Chinese fault case information table 31 of FIG. 3 as shown in FIG. . This Japanese-language failure case information table 41 is a part of correspondence cases accumulated in the Japanese operating environment, and is referred to as a translation diversion source.

<Example of incident list screen>
FIG. 5 is an explanatory diagram illustrating an example of an incident list screen.

  The incident list screen displays a list of incidents registered by the failure information input unit 11 in the incident management system 10 of FIG. 1 and is output to the operation terminal 4 by the list display processing unit 12.

  The person in charge of the operation can confirm the details of the incident by selecting a line from the list of incidents shown in FIG. 5 and pressing the “open detail screen” button B1. Then, the response procedure included in the details is opened and the service is restored to complete the incident response.

<Display example of failure case display screen>
FIG. 6 is an explanatory diagram illustrating an example of a failure case display screen.

  As shown in FIG. 6A, the failure case display screen displays a list of Chinese failure case information registered by the failure case update processing unit 13 of FIG. When a line is selected in the failure handling case list of FIG. 6, an applicable failure handling procedure candidate list is displayed.

  Also, if the diversion source handling procedure is not uniquely determined in the failure case update process by the failure case update processing unit 13 shown in FIG. 7 to be described later, the person in charge of the operation confirms the procedure contents and adopts the application target. Then, as shown in FIG. 6B, a button B2 of “Upload Procedure” is pressed to upload the failure handling procedure translated into Chinese as the language of the operating environment.

<Processing example of failure case update processing unit>
FIG. 7 is a flowchart showing a processing example of determination condition automatic generation processing and translation target procedure automatic extraction processing by the failure case update processing unit 13 of the incident management system 10 of FIG. The failure case update processing unit 13 generates a response case including a response procedure to be diverted from the incident according to the process shown in the flowchart of FIG.

  Various functions for performing the processing shown below include, for example, software in a program format stored in a program storage memory (not shown) provided in the incident management system 10 or the like, and a CPU (not shown) of the incident management system 10 (Central Processing Unit) etc. are executed by each execution.

  In the following, an example of Chinese failure handling case generation processing using a Japanese handling case as a source is shown.

  First, the failure case update processing unit 13 reads an incident that does not match the case on the day before this processing from the incident information table 21 of the incident database 20 (step S701). Subsequently, a two-dimensional array IncArray (x) (y) for storing incident information is prepared (step S702).

  Thereafter, the process between steps S703 to S709 is repeatedly executed for the number of incidents searched in the process of step S701 (steps S703 and S709).

  The failure case update processing unit 13 determines whether the Error ID included in the incident information is empty (step S704).

  If ErrorID is empty in the process of step S704, out of the incidents searched in the process of step S701, the incidents that match the three items of device name, AP name, and ErrorID are extracted and stored in the matching incident array (z). (Step S705).

  If the ErrorID is not empty in the process of step S704, the incidents with the matching device name and AP name and the empty ErrorID are extracted from the incidents searched in the process of step S701, and the matching incident array (z) (Step S706).

  When either the process of step S705 or the process of step S706 ends, it is determined whether or not the number of elements in the matching incident array (z) is greater than 2 (step S707).

  If the number of elements in the matched incident array (z) is greater than 2 in the process of step S707, the matched incident array (z) is added to the end of the two-dimensional array IncArray (step S708).

  If the number of elements in the matched incident array (z) is not greater than 2 in the process of step S707, or when the process of step S708 ends, steps S710 to S719 are performed for the number of elements in the two-dimensional array IncArray (x). Repeat the process.

  First, a common part between messages included in the matched incident array (z) of the two-dimensional array IncArray (x) is extracted (step S711), and a common ratio of the common part extracted in the process of step S711 is calculated (step S712). ).

  Then, it is determined whether the Error ID of the head incident in the two-dimensional array IncArray (x) is empty (step S713).

  As a result, if the Error ID is empty, the Japanese fault case information is searched to obtain a case ID that matches the three items of the device name, the AP name, and the Error ID, and if not, obtain the empty (step S714). ). In the process of step S714, a plurality of case IDs may match.

  In the process of step S713, if the Error ID is not empty, the Japanese fault case information is searched, and the case ID that matches the two items of the device name and AP name (Error ID is empty) is acquired. Obtain (step S715). In the process of step S715, a plurality of case IDs may match.

  Subsequently, information to be registered as a failure case is stored in the array (step S716). Here, the original case ID searched in steps S714 and S715 described above, the common part (validity determination message) between the valid (×) and the message acquired in step S711 described above, and the Japanese diversion source Includes the corresponding procedure manual name.

  Then, the original case ID is uniquely determined, and the item validity of the information with the common rate calculated in the process of step S712 described above is, for example, 80% or more is updated to (◯) (step S717). After the update, information to be registered as a failure case is registered in the Chinese failure case information table 31 (step S718).

  As described above, even when a new incident management operation is started in an environment other than Japanese, incidents that can be handled can be increased, so that the incident resolution time can be shortened.

  As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

  The present invention is suitable for incident management in a different language environment.

DESCRIPTION OF SYMBOLS 1 Data center 2 Monitoring object apparatus 3 Fault monitoring apparatus 4 Operation terminal 10 Incident management system 11 Fault information input part 12 List display process part 13 Fault case update process part 14 Fault case display process part 20 Incident database 21 Incident information table 30 Chinese Case database 31 Chinese failure case information table 40 Japanese case database 41 Japanese failure case information table B1 button B2 button

Claims (12)

  When determining whether or not the determination information included in the failure information generated from the monitoring target device is compatible with the determination information included in the foreign language failure case information stored in the foreign language failure case information table, The failure information and the case ID of the applicable foreign language failure case information are stored in the incident information table as the first incident information, and when it is determined that the failure does not match, the failure information is stored in the second without the case ID. An incident management system comprising a failure information input unit for storing in the incident information table as incident information. The incident management system according to claim 1,
The determination information that the failure information has, and the determination information that the foreign language failure case information has are a device name, an application name, an error ID, and a failure message.
The failure information input unit is configured such that the device name, application name, and error ID of the failure information match the device name, application name, and error ID of the foreign language failure case information, and the failure of the foreign language failure case information An incident management system that determines that a message is suitable when the message includes a failure message of the failure information. The incident management system according to claim 1,
Furthermore, a foreign language case database storing the foreign language disorder case information table;
An incident database for storing the incident information table;
Having an incident management system. In the incident management system according to claim 2,
Further, the second incident information stored in the incident information table is searched, and three or more pieces of the second incident information with common matching item information included in the second incident information are associated with each other by matching item. An incident group is generated, and information on three items including the device name, application name, and error ID in the incident group classified by matching item, or information on two items including the device name and application name is searched from Japanese fault case information. In the case where the common rate of the common part included in the failure message included in the incident group according to the matching item is a threshold value or more, and the case ID of the Japanese language failure case information is 1, the foreign language failure case information The failure message of the common part is used as a match determination message, and before the Japanese failure case information. Having a fault case update processing unit that updates the foreign language disorder incident information table so as to add the case ID as the original case ID, incident management system. A monitoring target device connected to a communication line, a fault monitoring device that acquires fault information generated from the monitoring target device, a fault information input unit that registers fault information acquired by the fault monitoring device, and the fault information input An incident operation management method by a computer system having a failure information output unit that outputs the failure information registered by the unit and a failure case update processing unit that updates the failure information registered by the failure information output unit,
Determining whether the determination information included in the failure information generated from the monitored device matches the determination information included in the foreign language failure case information stored in the foreign language failure case information table in the failure information input unit; ,
When it is determined to be compatible in the step, the failure information and the case ID of the compatible foreign language failure case information are stored as first incident information in an incident information table. Storing information in the incident information table as second incident information without the case ID;
An incident operation management method. In the incident operation management method according to claim 5,
The determination information that the failure information has, and the determination information that the foreign language failure case information has are a device name, an application name, an error ID, and a failure message.
The step of determining the fit includes
The device name, application name, and error ID of the failure information match the device name, application name, and error ID of the foreign language failure case information, and the failure information in the failure message of the foreign language failure case information Incident operation management method that determines conformity when a message is included. In the incident operation management method according to claim 5,
The incident operation management method further comprising the step of outputting the first incident information and the second incident information stored in the incident information table in the failure information output unit. In the incident operation management method according to claim 6,
Further, in the failure case update processing unit, the second incident information stored in the incident information table is searched, and three or more second items of common item information included in the second incident information are shared. Generating incident groups by matching items by associating incident information;
Search for information on three items consisting of device name, application name, and error ID in the matching item-specific incident group, or two items consisting of device name and application name from Japanese fault case information, and the matching item-specific incident group Extracting a common rate of common parts included in the failure message of:
When the extracted common rate is greater than or equal to a threshold value and the Japanese language failure case information has one case ID, the failure message of the common part is used as a match determination message in the foreign language failure case information, and the Japan Updating the foreign language disorder case information table to add the case ID of the language disorder case information as an original case ID;
An incident operation management method. A monitoring target device connected to a communication line, a fault monitoring device that acquires fault information generated from the monitoring target device, a fault information input unit that registers fault information acquired by the fault monitoring device, and the fault information input A fault information output unit that outputs fault information registered by a fault unit, and a program that is executed by a computer system having a fault case update processing unit that updates fault information registered by the fault information output unit,
Determining whether the determination information included in the failure information generated from the monitored device matches the determination information included in the foreign language failure case information stored in the foreign language failure case information table in the failure information input unit; ,
When it is determined to be compatible in the step, the failure information and the case ID of the compatible foreign language failure case information are stored as first incident information in an incident information table. Storing information in the incident information table as second incident information without the case ID;
Having a program. The program according to claim 9, wherein
The step of determining the fit includes
The device name, application name, and error ID of the failure information match the device name, application name, and error ID of the foreign language failure case information, and the failure information in the failure message of the foreign language failure case information A program that lets you decide when a message is included that it fits. The program according to claim 9, wherein
Furthermore, the program which makes the said fault information output part perform the step which outputs the said 1st incident information stored in the said incident information table, and the said 2nd incident information. The program according to claim 10, wherein
Further, the second incident information stored in the incident information table is searched, and three or more pieces of the second incident information with common matching item information included in the second incident information are associated with each other by matching item. Generating a group of incidents;
Search for information on three items consisting of device name, application name, and error ID in the matching item-specific incident group, or two items consisting of device name and application name from Japanese fault case information, and the matching item-specific incident group Extracting a common rate of common parts included in the failure message of:
When the extracted common rate is greater than or equal to a threshold value and the Japanese language failure case information has one case ID, the failure message of the common part is used as a match determination message in the foreign language failure case information, and the Japan Updating the foreign language disorder case information table to add the case ID of the language disorder case information as an original case ID;
Is executed by the failure case update processing unit.

Images