JP6095489B2 - Device state determination device and program - Google Patents

Description

  The present invention relates to a device state determination apparatus and program, and more particularly, to a state determination for a device in which a disturbance can occur.

  In a maintenance service for a device on which a computer is mounted, in order to detect an abnormality in the system including the device or the device, the load information of the device (for example, CPU usage rate, memory usage, I / O access number, etc.) is monitored. Things have been done. It is known that in devices and systems centering on periodic processing such as batch processing, fluctuations in load information become periodic fluctuations following the processing.

  Conventionally, paying attention to the periodicity of the load information, the normal load information (hereinafter “model data”) of the device generated from the past load information and the same period length as the model data generated from the current load information The load information (hereinafter referred to as “load data”) is compared, and if the load data does not match the model data, it is determined that there is an abnormality.

JP 2011-034208 A JP 2009-075817 A Japanese Patent Laid-Open No. 06-175886 JP 2011-154383 A

  However, even though it is normal, if load fluctuations caused by user operations or arrival of packets when connecting to the server, that is, disturbances are included in the load data, the patterns do not match as a result of matching with the model data Therefore, there was a risk that it would be judged abnormal.

  Although it is possible to identify a load fluctuation pattern caused by a disturbance that may occur in advance and match it with model data after removing the pattern from the load data, each disturbance can be estimated by estimating all the possible disturbances. It is extremely difficult to prepare a load fluctuation pattern corresponding to the above in advance.

  An object of this invention is to determine the state of an apparatus correctly, without preparing the load fluctuation pattern corresponding to a disturbance beforehand.

  The device state determination apparatus according to the present invention cuts out information included in the device state determination target period from the load information indicating the load state applied to the state determination target device, and changes the load variation in the determination target period. Generated by load data generation means for generating load data, model data acquisition means for acquiring model data indicating that the device is in a normal state with respect to the determination target period, and generated by the load data generation means Data collating means for determining whether or not the state of the device is normal in the determination target period by collating load data with the model data, and the data collating means includes the load data generating means. As a result of collating the generated load data with the model data, if it is determined that they do not match, an event related to the device is recorded. A disturbance erasure unit that identifies a disturbance occurrence period in which an event that causes a disturbance in the determination target period is performed from log information, and erases a load variation in the disturbance occurrence period from the load data; When the load data from which the load fluctuation during the disturbance occurrence period is matched with the model data as a result of matching with the model data, the state of the device in the determination target period is determined to be normal.

  In addition, when the data collating means collates the load data from which the load fluctuation during the disturbance occurrence period has been erased by the disturbance elimination unit with the model data and determines that they do not match, the disturbance occurrence period is determined from the load data. A correction unit that performs correction for cutting out the data of the portion, and when the load data corrected by the correction unit matches with the model data, if the result matches, the state of the device in the determination target period is determined to be normal It is characterized by that.

The device state determination apparatus according to the present invention cuts out information included in the device state determination target period from the load information indicating the load state applied to the state determination target device, and changes the load variation in the determination target period. Generated by load data generation means for generating load data, model data acquisition means for acquiring model data indicating that the device is in a normal state with respect to the determination target period, and generated by the load data generation means Data collating means for determining whether or not the state of the device is normal in the determination target period by collating load data with the model data, and the data collating means includes the load data generating means result of load data generated were collated with the model data by, if it is determined that they do not match, event recording is related to the device Were identified disturbance occurrence period event the cause of the disturbance has been performed in the determination target period from the log information includes a correction unit for correcting for excision data of the disturbance occurrence period portions from the load data, When the load data corrected by the correction unit matches with the model data as a result of matching, the state of the device in the determination target period is determined to be normal.

  The program according to the present invention cuts out information included in the determination target period of the device state from load information indicating a load state applied to the device whose state is to be determined, and changes the load in the determination target period. Load data generating means for generating load data, model data acquiring means for acquiring model data indicating that the device is in a normal state with respect to the determination target period, and load data generated by the load data generating means Is collated with the model data to function as data collating means for determining whether or not the state of the device is normal in the determination target period, and the data collating means is generated by the load data generating means As a result of checking the load data against the model data, A disturbance erasure unit that identifies a disturbance occurrence period in which an event that causes a disturbance in the determination target period is performed from the recorded log information, and erases the load fluctuation in the disturbance occurrence period from the load data. When the load data from which the load fluctuation during the disturbance occurrence period has been erased by the disturbance elimination unit are matched with the model data, the state of the device in the judgment target period is judged to be normal.

  According to the present invention, it is possible to accurately determine the state of a device without preparing a load variation pattern corresponding to a disturbance in advance.

It is the block block diagram which showed one Embodiment of the apparatus state determination apparatus which concerns on this invention. It is a hardware block diagram of the computer which forms the apparatus state determination apparatus in this Embodiment. It is the flowchart which showed the apparatus state determination process in this Embodiment. (A) is a figure which shows the load data in a state determination object period, (b) is a figure which shows the model data in the state determination object period of the same period length as Fig.4 (a). It is the flowchart which showed the disturbance erasure | elimination process in this Embodiment. (A) is a figure which shows the load data in which the disturbance generate | occur | produced in the state determination object period, (b) is a figure which shows the model data in the state determination object period of the same period length as Fig.6 (a). It is a figure which shows the load data after erase | eliminating a load fluctuation | variation by the disturbance elimination process in this Embodiment. It is the flowchart which showed the data correction process in this Embodiment. (A) is a figure which shows the load data after data correction in the state determination object period, (b) is a figure which shows the model data in the state determination object period of the same period length as Fig.6 (a).

  Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block configuration diagram showing an embodiment of a device state determination apparatus according to the present invention. The device state determination apparatus 10 in the present embodiment is installed in a building such as a building, and is installed in a monitoring center that monitors a device equipped with a computer from a remote location. The monitoring center has a load information accumulation unit 1 and a log information accumulation unit 2 that accumulate load information and log information collected from a building management system installed in a building by one or a plurality of data collection devices (not shown). . Moreover, it has the model data memory | storage part 3 which stores the model data used when the determination process of whether the apparatus state which the apparatus state determination apparatus 10 implements is normal is performed. Each of the storage units 1 to 3 may be provided inside the device state determination apparatus 10 or may be provided in a place other than the monitoring center.

  The device performs a predetermined operation by operation, but the building management system constantly monitors loads such as CPU usage rate, memory usage amount, and I / O access number as an index indicating the load on the hardware resource of the device. ing. When these data are transmitted to the monitoring center in real time or periodically from the building management system, they are stored in the load information storage unit 1 as load information.

  In addition, log information including the date and time when the device operation such as user operation or network access was performed as an event related to the device, and log information including the operation content is output by the system log output by the building management system or the web server. Stored in the access log. In the log information storage unit 2, these sequentially stored log information is transmitted and stored in real time or periodically from the building management system.

  In addition, the device state determination apparatus 10 according to the present embodiment collates load information based on the operation of the device with model data indicating a case where the device is in a normal state, thereby determining whether the state of the device is normal. judge. The model data storage unit 3 stores this model data.

  Model data is prepared in advance for each device for each period. For example, in a building management system, if daily reports, weekly reports, and monthly reports are generated, model data of the length of one day (operation time or length of 24 hours) according to these cycles, Model data of length and length for one month is prepared in advance. Specifically, the model data may be generated by cutting out the load information in units of a predetermined determination target period such as one day, one week, or one month collected when the model data is operating normally from the load information. It may be calculated logically. Basically, it is desirable to prepare model data for each device installed in a building, but it may be shared by a plurality of devices depending on the usage status of the device.

  FIG. 2 is a hardware configuration diagram of a computer forming the device state determination apparatus 10 in the present embodiment. In the present embodiment, the computer forming the device state determination apparatus 10 can be realized by a general-purpose hardware configuration that has existed in the past. That is, the computer is provided as a CPU 21, ROM 22, RAM 23, HDD controller 25 connected with a hard disk drive (HDD) 24, a mouse 26 and a keyboard 27 provided as input means, and a display device as shown in FIG. An input / output controller 29 for connecting each display 28 and a network controller 30 provided as a communication means are connected to an internal bus 31.

  Returning to FIG. 1, the device state determination apparatus 10 according to the present exemplary embodiment includes a load data generation unit 11, a data collation unit 12, and a display unit 13. The load data generation unit 11 is provided as load data generation means, cuts out information included in the determination target period of the state of the device from the load information indicating the state of the load applied to the device whose state is to be determined, and performs the determination. Load data indicating load fluctuation in the target period is generated. The display unit 13 displays the determination result of whether or not the device by the data collating unit 12 is normal.

  The data collating unit 12 is provided as a data collating unit, and collates the load data generated by the load data generating unit 11 with the model data to determine whether or not the state of the device is normal in the determination target period. The data collating unit 12 is also provided as a model data obtaining unit, and obtains model data to be collated with load data from the model data storage unit 3. The data collation unit 12 includes a disturbance elimination unit 121 and a load data correction unit 122. When the disturbance elimination unit 121 collates the load data generated by the load data generation unit 11 with the model data and determines that they do not match, an event that causes a disturbance in the determination target period by referring to the log information The disturbance generation period during which the disturbance is performed is specified, and the load fluctuation in the disturbance generation period is deleted from the load data. The load data correcting unit 122 refers to the log information, identifies the disturbance occurrence period in which an event that causes the disturbance in the determination target period is performed, and removes the data of the disturbance occurrence period portion from the load data. Make corrections.

  Each component 11-13 in the apparatus state determination apparatus 10 is implement | achieved by cooperation operation | movement of the computer which forms the apparatus state determination apparatus 10, and the program which operate | moves by CPU21 mounted in the computer. In addition, when each storage means 1-3 is provided in the apparatus state determination apparatus 10, each storage means 1-3 is implement | achieved by HDD24 mounted in the apparatus state determination apparatus 10. FIG.

  Further, the program used in this embodiment can be provided not only by communication means but also by storing it in a computer-readable recording medium such as a CD-ROM or DVD-ROM. A program provided from a communication unit or a recording medium is installed in a computer, and various processes are realized by the CPU 21 of the computer sequentially executing the program.

  Next, the device state determination process in the present embodiment will be described using the flowchart shown in FIG. The device state determination process may be executed as a scheduled process by periodically executing the device state determination processing program, or is executed by a user such as an administrator starting the device state determination processing program. You may do it. In addition, the device to be a state determination target may be determined in advance or may be designated by the user each time. Here, a description will be given focusing on one device. Even when the process is performed on a plurality of devices, the same processing as described below may be performed on each device.

  The load data generation unit 11 generates load data by cutting out information included in the device state determination target period from the load information stored in the load information storage unit 1 (step 110). The state determination target period has a fixed period length such as a day, a week, or a month. The start and period length necessary to specify the state determination target period are specified by the user. Of course, the user does not have to specify the period (0 o'clock, Sunday, 1st, etc.) and the length (1 day, 1 week, 1 month, etc.) of the predetermined period for determining the state.

  Subsequently, the data collation unit 12 extracts and acquires the model data of the device having the same state determination target period length as the load data generated by the load data generation unit 11 from the model data storage unit 3 (step 120). And the load data produced | generated by the load data production | generation part 11 are collated with the acquired model data.

  If the load data matches the model data as a result of the check (Y in step 130), the data check unit 12 determines that the device was operating in a normal state during the state determination target period. (Step 190). FIG. 4 shows the relationship between load data and model data when it is determined that the device is normal.

  FIG. 4A shows load data in the state determination target period, and FIG. 4B shows model data in the state determination target period having the same period length as that in FIG. 4A. In this example, a case where memory usage is used as load information is shown as an example. When the load fluctuation pattern in each data is the same, it is determined that the load data and the model data match. Whether or not the patterns match, the load fluctuation represented by the load pattern, specifically, the slope and position of the mountain formed from the fluctuation of the memory usage value (load) that changes on the time axis, and the load data Judgment is made in consideration of an allowable range of deviation (error) of each value of model data. As a criterion for determining whether or not the patterns match, a certain criterion may be used. The same applies to the collation processing described later.

  On the other hand, if the load data does not match the model data as a result of the collation (N in step 130), the present embodiment executes the disturbance elimination process on the assumption that a disturbance has occurred as the cause of the mismatch. (Step 140).

  FIG. 5 is a flowchart showing the disturbance erasure processing in the present embodiment, and FIG. 6A is a diagram showing load data in which a disturbance occurs in the range D in the state determination target period. FIG. 6B is the same diagram as FIG. 4B and shows model data in the state determination target period. Hereinafter, the disturbance elimination process executed by the disturbance elimination unit 121 will be described with reference to FIGS.

  First, the disturbance elimination unit 121 extracts the log information included in the determination target period from the log information accumulation unit 2 (step 141), and the occurrence period (disturbance) corresponding to the disturbance from the extracted log information. (Occurrence period) is specified (step 142). If the device is used only for batch processing, that is, if the operation of the device has periodicity or regularity, the disturbance may be assumed to be user operation other than batch processing or arrival of a packet when connecting to the server, etc. By analyzing the log information within the determined determination target period, it is possible to specify the disturbance occurrence period. For example, when a user operation is specified as the cause of the occurrence of disturbance from the log information, the generation period of the load fluctuation that occurs with the user operation is specified as the disturbance generation period. Here, as illustrated in FIG. 6A, it is assumed that a disturbance has been identified in the period (disturbance occurrence period) from the start of the determination target period to the range D by analyzing the log information. In this case, the disturbance elimination unit 121 erases the load fluctuation within the disturbance occurrence period from the load data generated by the load data generation unit 11 (step 143). FIG. 7 shows the load data after eliminating the load fluctuation.

  As described above, when the load fluctuation due to the disturbance appearing in the load data is erased, the data collating unit 12 collates the load data from which the load fluctuation is erased with the model data.

  Here, if the load data matches the model data as a result of the check (Y in step 150), the data check unit 12 determines that the device was operating in a normal state during the state determination target period. (Step 190). Note that, for example, unlike FIG. 6A, when a disturbance occurs in the latter half from the middle stage where the value of the memory usage has not substantially changed, the load data after the disturbance is erased by the disturbance elimination unit 121 Since it matches the model data, at this point, it is determined that the device was operating in a normal state.

  On the other hand, if the load data does not match the model data as a result of the collation (N in step 150), in this embodiment, the load data is shifted on the time axis due to the occurrence of a disturbance as the cause of the mismatch. Assuming that this occurs, a data correction process for matching the model data with the time axis is executed (step 160).

  FIG. 8 is a flowchart showing the data correction processing in the present embodiment, and FIG. 9A is a diagram showing the load data after correction by this processing. FIG. 9B is the same diagram as FIG. 4B and shows model data in the state determination target period. Hereinafter, data correction processing executed by the load data correction unit 122 will be described with reference to FIGS. 8 and 9.

  First, the load data correction unit 122 extracts the log information included in the determination target period from the log information storage unit 2 (step 161), and the occurrence period of the event corresponding to the disturbance (from the extracted log information ( A disturbance occurrence period) is specified (step 162). The process (steps 161 and 162) for specifying the disturbance occurrence period may be the same as the process (steps 141 and 142) in the disturbance elimination process. Therefore, a means for specifying the disturbance occurrence period may be separately provided in the data collating unit 12, and the software may be configured so that the disturbance elimination period specifying process can be shared by the disturbance elimination unit 121 and the load data correction unit 122.

  Subsequently, the load data correction unit 122 performs correction for cutting out the data of the disturbance occurrence period from the load data from which the disturbance has been deleted by the disturbance deletion unit 121. More specifically, the load data in the excised disturbance generation period is simply blanked by simply excising, so that the time axis is adjusted by correcting the load data so that it can be compared with the model data. Here, the correction for cutting out the data of the disturbance occurrence period from the load data means the following.

  The disturbance occurrence period is considered to be present at the beginning of the determination target period (start period to disturbance occurrence period length), in the middle, or at the end (disturbance occurrence period length from the end).

  If it exists at the beginning, as shown in FIG. 9A, the load data at the beginning (disturbance generation period) is excised, and the entire remaining load data after excision is shifted on the time axis toward the beginning. By doing so, the beginning of the model data and load data is matched. If it exists in the middle, the load data is divided when the load data in the disturbance occurrence period is excised. Therefore, a part of the load data may be shifted and connected. That is, on the time axis, the divided right load data is shifted to the left and connected to the left load data to form one load pattern. When it exists at the end, it is only necessary to excise the load data during the disturbance occurrence period, and the load data remaining after excision does not need to be shifted.

  Although the load data may be divided into three or more due to the inclusion of a plurality of disturbances, it can be corrected to continuous load data by combining the above-described shifts. In any case, as shown in FIG. 9A, the load data after the data correction is shortened by the length of the disturbance occurrence period. Therefore, since the portion near the end of the load data cannot be compared with the model data, the portion near the end is excluded from the verification target.

  When the load data is corrected as described above, the data collation unit 12 collates the load data cut by the load data correction unit 122 for the period of occurrence of the disturbance with the model data.

  If the load data matches the model data as a result of the check (Y in step 170), the data check unit 12 determines that the device was operating in a normal state during the state determination target period. (Step 190).

  On the other hand, if the load data does not match the model data as a result of the collation (N in step 170), the data collation unit 12 determines that the device is not operating in a normal state during the state determination target period. (Step 180).

  When the operation state of the device is determined as described above, the display unit 13 displays the determination result on the display 28. Alternatively, the determination result may be printed by a printer (not shown) or stored in a file format in a storage unit.

  In this embodiment, when the load data generated by dividing the load information by the determination target period does not match the model data, correction such as deleting the disturbance from the load data or shifting on the time axis is performed. And it was made to collate with model data. Thus, it is not necessary to prepare many model data corresponding to various disturbances by eliminating the disturbance from the load data.

  In the present embodiment, both the disturbance elimination and load data shift correction processes are included in the device state determination process, but only one of them may be included.

  In the present embodiment, the case where the memory usage is used as the load information is taken as an example, but other load information such as the CPU usage rate may be used. In addition, the device state may be determined based on each of a plurality of pieces of load information instead of single load information, and may be comprehensively determined based on the determination results. Further, when determining the status of a device on a certain day, the day is determined as a determination target period, and at least one of one week or January including the day is further determined as a determination target period. A comprehensive determination may be made based on the determination result.

  Further, as information used for specifying the disturbance occurrence period, a record during operation may be used in addition to log information generated according to the operation of the device. For example, in a building management system, work performed on the spot is digitized and recorded. Also, schedule information and performance information for batch processing executed on the device is digitized. Data obtained by operation in this way may be used for specifying a disturbance occurrence period instead of log information or together with log information. Furthermore, signal information of a system in which equipment is installed may be used as information used for specifying a disturbance occurrence period. For example, in an elevator such as an elevator, signal information is changed by a user operation such as a door opening signal is changed by a user operation on an elevator car operation panel. This change may be regarded as a disturbance.

  DESCRIPTION OF SYMBOLS 1 Load information storage part, 2 Log information storage part, 3 Model data storage part, 10 Apparatus state determination apparatus, 11 Load data generation part, 12 Data collation part, 13 Display part, 21 CPU, 22 ROM, 23 RAM, 24 Hard disk Drive (HDD), 25 HDD controller, 26 mouse, 27 keyboard, 28 display, 29 I / O controller, 30 network controller, 31 internal bus, 121 disturbance eraser, 122 load data correction unit.

Claims (4)

Load data generation for generating load data indicating load variation in the determination target period by extracting information included in the determination target period of the device state from load information indicating a load state applied to the device to be determined Means,
Model data acquisition means for acquiring model data indicating a case where the device is in a normal state with respect to the determination target period;
Data collating means for determining whether or not the state of the device is normal in the determination target period by comparing the load data generated by the load data generating means with the model data;
Have
The data collating means includes
As a result of collating the load data generated by the load data generating unit with the model data, if it is determined that they do not match, the event related to the device becomes a cause of disturbance in the determination target period from the recorded log information. Including a disturbance erasure unit that identifies a disturbance occurrence period in which an event has been performed and erases load fluctuations in the disturbance occurrence period from the load data;
As a result of collating the load data from which the load fluctuation in the disturbance occurrence period is erased by the disturbance erasure unit with the model data, if they match, it is determined that the state of the device in the determination target period is normal.
An apparatus state determination device characterized by the above. The data collating means includes
As a result of collating the load data from which the load fluctuation during the disturbance occurrence period has been erased by the disturbance elimination unit with the model data, if it is determined that they do not match, a correction is made to remove the data of the disturbance occurrence period part from the load data. Including a correction unit to perform,
As a result of matching the load data corrected by the correction unit with the model data, if they match, it is determined that the state of the device in the determination target period is normal.
The apparatus state determination apparatus according to claim 1. Load data generation for generating load data indicating load variation in the determination target period by extracting information included in the determination target period of the device state from load information indicating a load state applied to the device to be determined Means,
Model data acquisition means for acquiring model data indicating a case where the device is in a normal state with respect to the determination target period;
Data collating means for determining whether or not the state of the device is normal in the determination target period by comparing the load data generated by the load data generating means and the model data;
Have
The data collating means includes
As a result of collating the load data generated by the load data generating unit with the model data, if it is determined that they do not match , the event related to the device becomes a cause of disturbance in the determination target period from the recorded log information. Including a correction unit that specifies a disturbance occurrence period in which an event has been performed, and performs correction to remove data of the disturbance generation period part from the load data;
As a result of matching the load data corrected by the correction unit with the model data, if they match, it is determined that the state of the device in the determination target period is normal.
An apparatus state determination device characterized by the above. Computer
Load data generation for generating load data indicating load variation in the determination target period by extracting information included in the determination target period of the device state from load information indicating a load state applied to the device to be determined means,
Model data acquisition means for acquiring model data indicating a case where the device is in a normal state with respect to the determination target period;
Data collating means for determining whether or not the state of the device is normal in the determination target period by comparing the load data generated by the load data generating means with the model data;
Function as
The data collating means includes
As a result of collating the load data generated by the load data generating unit with the model data, if it is determined that they do not match, the event related to the device becomes a cause of disturbance in the determination target period from the recorded log information. Including a disturbance erasure unit that identifies a disturbance occurrence period in which an event has been performed and erases load fluctuations in the disturbance occurrence period from the load data;
As a result of collating the load data from which the load fluctuation in the disturbance occurrence period is erased by the disturbance erasure unit with the model data, if they match, it is determined that the state of the device in the determination target period is normal.
program.

Images