JP6207078B2 - Monitoring device, monitoring method and program - Google Patents

Description

  The present invention relates to a monitoring device, a monitoring method, and a program.

  In recent social infrastructure systems, a form in which various components exhibit various functions by coordinating while transmitting and receiving information to each other is generalized, and the sophistication of the functions and the configuration of the system as a whole are progressing. . Along with this, the number of inspection items and the sophistication / complexity of the maintenance and repair work for the system are also increasing, increasing the burden on the operator. Furthermore, an increase in the time required for maintenance and repair work is a factor that reduces the operating rate of the entire system.

  On the other hand, the predetermined device has a function of recording and accumulating the contents of the processing performed by itself and the date and time thereof as log information. For example, when a failure occurs in the processing of the device, the maintenance worker of the device identifies the cause and countermeasure of the failure by referring to the log information and analyzing it.

In addition, the fluctuation tendency of a specific numerical value indicating the operating status of a certain device (for example, the number of communications per unit time or the number of communications retries, etc.) and a failure (failure) that occurred in the past are stored in association with each other. In addition, a technique has been devised in which a failure sign is detected by monitoring a change in the numerical value recorded as log information during operation to predict the occurrence of the failure (see, for example, Patent Document 1).
According to such a monitoring method, the occurrence of a failure can be predicted in advance, and measures can be taken before the failure occurs, so the burden on maintenance workers and the like can be reduced and the operating rate of equipment can be improved. .

JP 2012-147049 A

However, as described above, in social infrastructure systems where the functional configuration has become more sophisticated and complicated, failures that can occur in the system are also diversified. Therefore, by tracking only specific numerical values in log information, It is difficult to accurately grasp the actual situation of disability.
On the other hand, the number of components constituting the system and the amount of information transmitted / received between them have increased, and along with this, the log information recorded in each component has become enormous. It is not realistic to analyze a failure while individually extracting numerical values necessary for accurately grasping the actual state of the failure from such a large amount of log information.

  The present invention has been made in view of the above problems, and provides a monitoring device, a monitoring method, and a program capable of accurately predicting a failure occurring in the system even in a system with complicated processing and configuration. For the purpose.

  In order to solve the above problem, an aspect according to the present invention is a monitoring device that monitors a system having at least one component device, and a log information acquisition unit that acquires log information output by the component device; A feature vector extraction unit that extracts feature vectors composed of a plurality of types based on the log information, a failure information input unit that receives input of failure information about a failure that has occurred in the system, and the failure among the feature vectors A failure information processing unit that stores a failure feature vector extracted based on log information acquired from a predetermined time before occurrence of the failure until the occurrence of the failure and failure information about the failure in association with each other; The normal feature vector extracted based on the log information obtained during normal operation of the system among the feature vectors is the fault vector. Based on the determination of whether similar to any of the symptoms vector, a monitoring device comprising: a failure prediction unit, a to predict failures in the system.

  Further, according to one aspect of the present invention, in the monitoring device described above, the failure prediction unit calculates a difference degree calculated from a difference between each of the normal feature vector and the numerical value included in the failure feature vector. Based on the degree of difference, it is determined which of the failure time feature vectors is similar to the normal time feature vector.

  In addition, according to an aspect of the present invention, in the monitoring device described above, the failure prediction unit includes the normal-time feature based on a comparison of the center of gravity position uniquely determined by a numerical value included in the feature vector in a virtual space. It is characterized by determining which of the failure feature vectors the vector is similar to.

  Further, according to an aspect of the present invention, in the monitoring device described above, the failure prediction unit is configured to perform the normal operation based on a comparison between feature values that are highly related to a specific failure among the numerical values included in the feature vector. It is determined which of the failure time feature vectors is similar to the time feature vector.

  According to another aspect of the present invention, in the above-described monitoring apparatus, the failure prediction unit includes an average feature vector calculation unit that calculates an average feature vector including an average value for each numerical value included in a plurality of normal time feature vectors. Is characterized in that when it is determined that the normal feature vector is more similar to the average feature vector than the fault feature vector, the system is determined to be operating soundly.

  Further, according to an aspect of the present invention, in the above monitoring device, when the failure prediction unit determines that the normal feature vector is not similar to either the failure feature vector or the average feature vector, It is determined that there is a sign of an unknown failure in the system.

  Further, according to one aspect of the present invention, in the monitoring device described above, the system includes two or more of the component devices, and the feature vector extraction unit is a process performed between the two or more component devices. The feature vector is extracted based on log information indicating.

  According to another aspect of the present invention, the monitoring apparatus includes a numerical value specification receiving unit that receives specification of a type of numerical values constituting the feature vector, and the feature vector extracting unit receives the specification. A feature vector including a numerical value of the designated type is re-extracted from the log information.

  Further, one aspect according to the present invention is a method for monitoring a system having at least one component device, wherein the log information acquisition unit accepts input of log information output by the component device, and the feature vector extraction unit includes: A feature vector composed of a plurality of types of numerical values is extracted based on the log information, a failure information input unit accepts input of failure information regarding a failure that has occurred in the system, and a failure information processing unit includes Predicting a failure by storing the failure feature vector extracted based on log information acquired from a predetermined time before the occurrence of the failure until the occurrence of the failure and the failure information about the failure in association with each other. The normal feature vector extracted from the feature vector based on log information acquired during normal operation of the system is the feature vector at the time of failure. Based on the determination of whether similar to any Torr, a monitoring method characterized by predicting failures in the system.

  Further, according to one aspect of the present invention, a computer of a monitoring apparatus that monitors a system having at least one component device is provided based on log information input means for receiving input of log information output by the component device, and the log information. Feature vector extraction means for extracting a feature vector consisting of a plurality of types of numerical values, fault information input means for receiving fault information regarding faults occurring in the system, and a predetermined time before occurrence of the fault among the feature vectors Fault information processing means for associating and storing the fault feature vector extracted based on the log information acquired up to the time of the fault and fault information about the fault, of the feature vectors of the system The normal feature vector extracted based on the log information acquired during normal operation is the fault feature. Based on the determination of whether similar to any of the vector, disorders predicting means for predicting a fault occurring in the system, a program to function as a.

  According to the monitoring apparatus, the monitoring method, and the program described above, it is possible to accurately predict a failure that occurs in the system even in a system with complicated processing and configuration.

It is a figure which shows the function structure of the monitoring apparatus which concerns on 1st Embodiment. It is a figure explaining the example of the process of the feature vector extraction part which concerns on 1st Embodiment. It is a figure explaining the function of the failure information processing part concerning a 1st embodiment. It is a figure explaining the function of the failure prediction part concerning a 1st embodiment. It is a figure explaining the example of the similarity determination in the failure prediction part which concerns on 1st Embodiment. It is a flowchart figure which shows the processing flow of the failure prediction part which concerns on 1st Embodiment. It is a figure which shows the structure of the fee collection system made into the monitoring object by the monitoring apparatus which concerns on 2nd Embodiment. It is a figure explaining the example of the process of the feature vector extraction part which concerns on 2nd Embodiment. It is a figure which shows the example of the failure information accumulate | stored in the failure information database which concerns on 2nd Embodiment. It is a figure which shows the example of the feature vector accumulate | stored in the log information database which concerns on 2nd Embodiment. It is a figure explaining the example of the similarity determination in the failure prediction part which concerns on 2nd Embodiment. It is a figure explaining the example of the similarity determination in the failure prediction part which concerns on the modification of 2nd Embodiment. It is a figure explaining the example of the notification process in the failure prediction part which concerns on the modification of 2nd Embodiment.

<First Embodiment>
The monitoring device according to the first embodiment will be described below with reference to the drawings.
FIG. 1 is a diagram illustrating a functional configuration of the monitoring apparatus according to the first embodiment.
As an example, the monitoring apparatus 1 according to the present embodiment will be described in the case of monitoring a toll collection system provided on a toll road or the like.

As shown in FIG. 1, the fee collection system 2 has a plurality of component devices 2A, 2B, 2C,. The plurality of component devices 2A, 2B,... Are, for example, a toll collection machine, a vehicle separator, a start controller, or a wireless communication device that constitutes an electronic toll collection system (ETC: Electronic Toll Collection (registered trademark)) Or a lane server. The component devices 2A, 2B,... Operate in cooperation with each other while exchanging information with each other.
For example, when the entry of the vehicle is detected by the vehicle separator, the toll collection machine issues a pass ticket based on the detection information. Further, when it is detected that the toll collection machine has acquired the passing ticket, the opening / closing bar of the start controller is opened based on the detection information. In this way, the fee collection system links various processing operations while various devices perform information communication in real time. Further, each of the component devices 2A, 2B,... Regularly records and accumulates the processing performed by each of them and the date and time of information transmission / reception and the contents thereof as log information.
As will be described later, the monitoring device 1 according to the present embodiment targets the fee collection system 2 and acquires log information recorded by each component device 2A, 2B,. Note that the monitoring device 1 according to the present embodiment is provided in a toll gate where a plurality of fee collection systems 2 including the same component devices are installed, acquires log information from each of them, and collects the plurality of fee collection systems. A monitoring process based on log information is performed every two.

  The monitoring apparatus 1 according to the present embodiment includes a log information acquisition unit 10, a feature vector extraction unit 11, a log information database (DB) 12, a failure information input unit 13, a failure information processing unit 14, a failure information database (DB) 15, and A failure prediction unit 16 is provided.

As illustrated in FIG. 1, the log information acquisition unit 10 acquires log information output from each component device 2A, 2B,. Here, the log information output from each of the component devices 2A, 2B,... Specifically includes the processing of the component devices 2A, 2B,... And communication with other component devices. It is character information (text data) or numerical information (binary data) whose contents and date / time are encoded each time. The log information acquisition unit 10 sequentially receives log information output as such character information from the constituent devices 2A, 2B,.
When there are a plurality of fee collection systems 2, a process of associating the acquired log information with identification information for identifying each fee collection system 2 may be performed. By identifying the log information to be acquired for each toll collection system 2, the monitoring device 1 can perform monitoring processing on each of the plurality of toll collection systems 2 simultaneously and in parallel.

Based on the log information acquired by the log information acquisition unit 10, the feature vector extraction unit 11 extracts a feature vector composed of a combination of a plurality of types of numerical values (feature amounts) representing the operating status of the fee collection system 2.
For example, the feature vector extraction unit 11 extracts a record of a specific communication process c performed between certain component devices from the log information, and the specific occurrence that occurred during a predetermined period (for example, the most recent week). The number of communication retries and the amount of communication data in the communication process c are acquired as numerical values. Furthermore, the feature vector extraction unit 11 performs a process of normalizing each numerical value based on an average value, a standard deviation, or the like determined for each numerical value. By doing in this way, the magnitude and increase / decrease of different types of numerical values can be expressed on the same scale. The feature vector extraction unit 11 stores and accumulates log information and a feature vector extracted from the log information in the log information database 12.
The feature vector extraction unit 11 according to the present embodiment includes an average feature vector calculation unit 110 that calculates an average feature vector from a plurality of pieces of log information during normal operation of the fee collection system 2. The average feature vector calculation unit 110 will be described later.
As a modification described above, the feature vector extraction unit 11 may accept information other than the information recorded in the log information, such as weather, temperature, humidity, and the like. And the feature vector extraction part 11 may be provided with the correction | amendment part which corrects a numerical value about the numerical value with the said high dependence of temperature and humidity in the case of extraction of the feature vector based on log information.

  For example, when a failure occurs in the fee collection system 2, the failure information input unit 13 receives input of information regarding a failure identified in maintenance / repair work by a maintenance worker. For example, the failure information input unit 13 accepts input of information necessary for classifying the failure that has occurred, such as the name of the constituent device of the failure that has occurred, the serial number, the date and time, and the cause of the failure.

The failure information processing unit 14 stores the feature vector (feature vector at the time of failure) extracted by the feature vector extraction unit 11 when a failure occurs in association with the failure information about the failure in the failure information database 15. ,accumulate. Specifically, the failure information processing unit 14 refers to the failure occurrence date and time input by a maintenance worker or the like, and starts from a predetermined time immediately before the failure occurrence (for example, one week before) until the failure occurrence. The failure feature vector extracted based on the acquired log information is associated with the failure information about the failure.
The failure information processing unit 14 stores and accumulates the associated failure feature vector and failure information in the failure database 15. At this time, the failure information processing unit 14 stores the classified failure information in a specific failure category (category) based on information such as the name of the component device in which the failure has occurred, the model number, and the cause of the failure among the input failure information. To do. In this way, when it is determined that the newly generated failure in the toll collection system 2 is the same as the failure that occurred in the past, the failure associated with the new failure in the failure information database 15 The time feature vectors are accumulated while being classified into the same fault category.

  The failure prediction unit 16 determines whether the feature vector extracted based on log information acquired during normal operation of the toll collection system 2 among the feature vectors (normal feature vector) is similar to the failure feature vector. Based on the determination, a failure occurring in the fee collection system 2 is predicted. Specific processing contents of the failure prediction unit 16 will be described later.

FIG. 2 is a diagram illustrating an example of processing of the feature vector extraction unit according to the first embodiment.
As an example, the feature vector extraction unit 11 uses, as a feature vector of the toll collection system 2, based on log information output from “relay communication device (router)” that is one of the component devices (referred to as component device 2 A). A feature vector composed of twelve numerical values (feature amounts) as shown in FIG. Here, the numerical values P1, P2,..., P12 are numerical values (communications) selected as indicating the characteristics and trends of the communication status between the relay communication device (component device 2A) and each of the other component devices. Frequency, communication retry count, communication data amount, etc.). The numerical value P4 is, for example, the number of communication retries of the predetermined communication process c performed with the component device B, and the numerical value P10 is the communication data amount of the communication process c.

The frequency of communication, the number of communication retries, the amount of communication data, etc. have different units and scales as numerical values. For example, even with the same “communication frequency”, there are communication processes that are performed several tens of times a day during normal operation, and there are communication processes that are performed only once in several days. For this reason, the feature vector extraction unit 11 (an average feature vector calculation unit 110 described later) acquires, in the past, an average value μ, a standard deviation σ, and the like for each of twelve numerical values selected as constituting the feature vector. The normalization processing is performed based on the average value μ, the standard deviation σ, and the like. Thereby, as shown in FIG. 2, in the extracted feature vector, the magnitude or increase / decrease for each numerical value constituting the feature vector can be compared on the same scale.
For example, the feature vector extraction unit 11 assumes that the numerical value P4 (the number of communication retries for the communication processing c) and the numerical value P10 (the amount of communication data for the communication processing c) both follow a normal distribution, and “50” in FIG. The scale is set so that μ, “0”, and “100” correspond to −3σ, + 3σ, and the like, respectively.
Note that the normalization process described above is an example, and depending on the selected numerical value, there may be another statistical distribution. In this case, the feature vector extraction unit 11 performs a normalization process based on an appropriate statistical distribution for each numerical value.

In the above-described processing, specifically, the feature vector extraction unit 11 according to the present embodiment includes an average feature vector calculation unit 110. The average feature vector calculation unit 110 includes numerical values P1, P2, and a plurality of normal feature vectors extracted from the log information of the plurality of toll collection systems 2 in normal operation periodically or irregularly from the past to the present. ... The average value μ for each is calculated. That is, in the present embodiment, the average value μ and the standard deviation σ for each of the numerical values P1, P2,... Are not fixed values set in advance, but are based on log information in a plurality of toll collection systems 2 in normal operation. Dynamically calculated and constantly updated. The average feature vector calculation unit 110 performs processing for storing and updating the average feature vector Va including the average value μ for each of the numerical values P1, P2,.
It should be noted that the average feature vector calculation unit 110 performs rejection determination for obvious abnormal values among the numerical values P1, P2,... Of the plurality of normal time feature vectors referred to when calculating the average value μ, and calculates the average value. It is good also as what is not included in calculation processing, such as μ.

FIG. 3 is a diagram illustrating the function of the failure information processing unit according to the first embodiment.
As described above, the failure information processing unit 14 stores and accumulates the failure feature vector in the failure information database 15 while associating the failure feature vector with the failure information about the failure.
Specifically, when a failure occurs during the operation of the toll collection system 2 and repair work is performed, or when the toll collection system 2 is regularly inspected or specially checked (non-periodic upon request from the toll gate) When a failure is recognized through the inspection performed in (1), the maintenance worker inputs failure information indicating the content of the failure through the failure information input unit 13. At this time, the failure information processing unit 14 stores the generated failures while classifying them into predetermined categories based on the input failure information. Specifically, as shown in FIG. 3, the failure that has occurred is classified as failure A, failure B, failure C,. As an example, as shown in FIG. 3, the failure information processing unit 14 indicates that a failure has occurred in a processor component that controls the entire component device 2A (relay communication device) as “failure A”, and a communication connector. The case where the communication line quality caused by the deterioration of the cable has occurred is classified as “failure B”, and the case where a failure has occurred in the communication control IC component is classified as “failure C”.

Further, the failure information processing unit 14 refers to the failure occurrence date and time in the input failure information, and extracts feature vectors (based on log information acquired during a predetermined period (for example, one week) immediately before the failure occurrence) Failure feature vector). Here, the failure information processing unit 14 continuously acquires log information and log information acquired within a corresponding period from the log information database 12 in which log information and feature vectors extracted from the log information are accumulated. The feature vector extracted from is referred to. By doing in this way, the failure information processing unit 14 indicates, for each failure classification (failure A, failure B, failure C,...), The status of the toll collection system 2 immediately before the failure occurrence. Feature vectors Vs1, Vs2, Vs3,... (See FIG. 3) can be associated with each other.
As described above, the failure information database 15 stores information groups in which failure information and failure feature vectors are associated with each other as shown in FIG.

Here, an example of the failure that has occurred (failure A, failure B, failure C) and feature vectors Vs1, Vs2, and Vs3 at the time of failure (FIG. 3) will be described.
The failure feature vector Vs1 indicating the state immediately before the occurrence of the failure A is a small chart as a whole. Here, in failure A, a failure has occurred in the processor component that controls the entire component device 2A (relay communication device). Therefore, the frequency with which communication processing is performed in the component device 2A is reduced, and other communication-related numerical values such as the communication retry count (numerical value P4) and the communication data amount (numerical value P10) are also decreased.

  The failure feature vector Vs2 indicating the state immediately before the occurrence of the failure B is a large chart as a whole. In the failure B, the communication line quality deteriorated due to the deterioration of the communication connector cable in the corresponding component 2A. As a result, the number of communication retries (numerical value P4) increases, and accordingly, the communication data amount (numerical value P10) also increases.

  The failure feature vector Vs3 indicating the state immediately before the occurrence of the failure C is a chart on the right side as a whole. In failure C, a failure occurred in the communication control IC component in the component device 2A concerned. As a result, the number of communication retries (numerical value P4) has increased, but the frequency of communication transmission / reception itself has increased, so the amount of communication data (numerical value P10) has decreased.

FIG. 4 is a diagram illustrating the function of the failure prediction unit according to the first embodiment.
As described above, the failure prediction unit 16 uses any of the failure time feature vectors stored in the failure information database 15 as the normal time feature vector extracted based on the log information acquired during the normal operation of the toll collection system 2. Judge whether it is similar to. Specifically, the failure prediction unit 16 accesses the log information database 12 periodically (for example, every week) during normal operation of the toll collection system 2, and logs accumulated within the regular period during normal operation. A feature vector based on information (normal feature vector) is referred to.
For example, the failure prediction unit 16 refers to the log information database 12 and based on each of the plurality of fee collection systems 2 installed for each traveling lane of the toll gate (traveling lanes X1, X2, X3,...). The normal feature vectors V1, V2, V3,... Extracted (see FIG. 4) are acquired.

Further, the failure predicting unit 16 compares the normal feature vectors V1, V2, V3,... Acquired here with the failure feature vectors stored in the failure information database 15 to obtain normal feature vectors. Based on the determination of whether V1 or the like is similar to any of the failure feature vectors, a failure occurring thereafter in the toll collection system 2 is predicted.
For example, the normal feature vector V1 is in a state where all of the numerical values P1 to P12 are substantially close to the average value μ, and the failure predicting unit 16 is similar to the failure feature vectors Vs1, Vs2, and Vs3 (FIG. 3). Judge not to. Therefore, it is presumed that the toll collection system 2 from which the normal time feature vector V1 has been acquired has no sign of failure at present and is in a healthy state.

  On the other hand, the normal feature vector V2 tends to have a slightly widened chart as a whole. Therefore, the failure predicting unit 16 determines that the normal feature vector V2 is similar to the failure feature vector Vs2 (fault B chart). Then, the failure predicting unit 16 predicts that a failure B will occur in the future operation for the fee collection system 2 from which the normal feature vector V2 has been acquired. From this prediction, the maintenance worker or the like can determine that it is necessary to inspect the communication connector cable of the component device 2A (relay communication device) with respect to the toll collection system 2.

  The normal feature vector V3 is a chart slightly to the right of the average as a whole. Therefore, the failure predicting unit 16 determines that the normal feature vector V3 is similar to the failure feature vector Vs3 (fault C chart). Then, the failure prediction unit 16 predicts that the fee collection system 2 from which the normal feature vector V3 is acquired may cause a failure C in the future. A maintenance worker or the like can determine that it is necessary to check the communication control IC component of the fee collection system 2 based on the prediction result.

FIG. 5 is a diagram illustrating an example of similarity determination in the failure prediction unit according to the first embodiment.
The failure prediction unit 16 is calculated from the difference between the normal feature vectors V1, V2,... And the failure feature vectors Vs1, Vs2,... (Numerical values P1, P2,...). The difference degree D is calculated, and based on the difference degree D, the normal feature vectors V1, V2,... Are compared with the failure feature vectors Vs1, Vs2,.
Here, the degree of difference D is, for example, an average value of absolute values of differences for each of the numerical values P1, P2,. Specifically, if the absolute value of the difference between the numerical values Pn of the two feature vectors is expressed by | ΔPn |, the difference degree D = (| ΔP1 | + | ΔP2 | +... || ΔP12 |) / 12 Become. Note that the method of calculating the degree of difference D is not limited to this, and may be a value obtained by, for example, the square root of the sum of squares of differences for each numerical value included in each feature vector.
The failure prediction unit 16 determines that the two feature vectors are more similar as the dissimilarity D is lower.

As an example, as shown in the upper part of FIG. 5, as a result of the comparison based on the above-mentioned difference D, the normal feature vector V1 of the toll collection system 2 installed in the toll lane X1 is the average feature vector at the current stage. Suppose that it was most similar to Va (it was RANK1). Here, the average feature vector Va is a feature vector calculated by the average feature vector calculation unit 110, and all the numerical values (numerical values P1 to P12) included in the feature vector are average vectors μ.
In the case of the above example, the failure prediction unit 16 determines that the average feature vector Va is higher than any of the failure feature vectors Vs1, Vs2,..., In which the normal feature vectors V1, V2,. Thus, the failure predicting unit 16 determines that the operation status of the toll collection system 2 installed in the travel lane X1 is healthy.
On the other hand, for example, when the degree of difference D in the failure feature vector Vs1 of “failure A” is RANK1, the failure prediction unit 16 determines that there is a sign of failure A in the toll collection system 2 in the travel lane X1. Then, an alarm signal for notifying that is output.

Further, as shown in the lower part of FIG. 5, the normal feature vector V2 of the toll collection system 2 installed in the toll gate lane X2 is most similar to the average feature vector Va at this stage, but the fault C Assume that the degree of difference D from the failure feature vector Vs3 is also low. In this case, although RANK1 is the average feature vector Va, the degree of difference D between the failure C and the failure feature vector Vs3 is equally low.
In this case, the failure prediction unit 16 determines that the difference between the difference D between the failure feature vector Vs3 and the difference D from the average feature vector Va is a predetermined determination threshold ΔDth (for example, ΔDth = 1). Therefore, it may be determined that there is a sign of failure C in the toll collection system 2 of the travel lane X2, and a warning signal for notifying that may be output.
Further, the failure predicting unit 16 has the degree of difference between two different failures (for example, failure A and failure C) as RANK1 and RANK2, respectively, and these differences D are close (below ΔDth). In such a case, the constituent devices 2A, 2B,... May be notified that two failures A and C may occur simultaneously.

FIG. 6 is a flowchart illustrating a processing flow of the failure prediction unit according to the first embodiment.
An example of a specific processing flow of the processing of the failure prediction unit 16 described with reference to FIG. 5 will be described with reference to FIG.
The failure prediction unit 16 starts a processing flow as shown in FIG. 6 each time new normal feature vectors V1, V2,.

First, the failure prediction unit 16 refers to the log information database 12 and refers to a normal feature vector (for example, a normal feature vector V1 (FIG. 4)) for a certain fee collection system 2 (step S10).
Next, the failure predicting unit 16 refers to the failure information database 15 to obtain the current average value feature vector Va and the failure feature vectors Vs1, Vs2,... (FIG. 3) stored at the current time. Obtain (step S11).
Then, the failure predicting unit 16 determines whether the acquired normal time feature vector V1, the average feature vector Va, and each of the failure time feature vectors Vs1, Vs2,. (Step S12). Specifically, this determination process is a process of creating a ranking based on the degree of difference D as shown in FIG.

Next, the failure predictor 16 determines whether or not the most similar (RANK1) to the normal feature vector V1 is the average feature vector Va (step S13).
When the average feature vector Va is RANK1 (step S13: YES), the failure prediction unit 16 further determines whether there is a failure feature vector close to the difference D of the average feature vector Va (step S14). .
If there is nothing close to the difference degree D of the average feature vector Va (step S14: NO), the failure predicting unit 16 determines that the operating status of the fee collection system 2 is healthy and ends the process.

  On the other hand, if the average feature vector Va is not RANK1 (step S13: NO), or if it is not RANK1 but there is something close to the difference D of RANK1 (average feature vector Va) (step S14: YES), monitoring The device 1 performs a predetermined notification process to notify that. For example, when the failure feature vector Vs3 of the failure C is close to the average feature vector Va in step S14, the failure prediction unit 16 indicates that there is a possibility of proceeding to the failure C in the toll collection system 2. Perform notification processing to call attention. For example, when the difference D of the failure feature vector Vs1 of the failure A is less than the difference D of the average feature vector Va in step S13 and the failure A is RANK1, the failure prediction unit 16 In the fee collection system 2, a warning process is performed to notify that the risk of the occurrence of the failure A is increasing.

  In this way, the failure predicting unit 16 determines that the normal feature vectors V1, V2,... Are based on the dissimilarity D calculated from the differences between the numerical values P1 to P12. It is determined which of the feature vectors Va) is similar, and if it is determined that there is a sign of failure, a predetermined warning process is performed to indicate that.

As described above, according to the monitoring device 1 according to the present embodiment, a plurality of numerical values (numerical values P1, P2, P2) selected from a large amount of log information acquired from a system (fee collecting system 2) including a plurality of component devices. ..., P12) are acquired (data mining), and feature vectors based on the plurality of numerical values are extracted. Then, the occurrence of a failure is predicted by determining whether or not the feature vector is similar to the feature vector at the time of failure. In this way, it is possible to accurately detect a sign of the occurrence of a failure based on the feature vector that comprehensively indicates the operation tendency of the entire system.
Moreover, according to the monitoring apparatus 1, since the kind of failure in which the sign of occurrence is recognized can be specified, preparations (emergency dispatch dynamics) according to the failure can be prepared. As a result, it is possible to cope with the occurrence of a failure in advance, and even if it occurs, the recovery time can be shortened, so that the operating rate of the system can be improved.

  In the present embodiment, the system to be monitored (fee collection system 2) originally has a function of outputting log information according to the operation status. Therefore, according to the monitoring device 1 according to the present embodiment, it is not necessary to install a new function for monitoring by the monitoring device 1 in the system to be monitored. Therefore, monitoring by the monitoring apparatus 1 of this embodiment can be easily applied to a system having a function of outputting log information.

Also, the log information output by the system to be monitored is generally character information (text data) or numerical information (binary data), so the information is made in accordance with the log information recording method based on the character information. Is easy to extract. Therefore, according to the monitoring device 1 according to the present embodiment, for each system to be monitored, by customizing the system so that a plurality of desired numerical values can be extracted from the log information output by the system, any system can be obtained. Is also applicable.
Moreover, by doing in this way, a component apparatus and the some system from which the aspect differs can also be made into the monitoring object simultaneously.

  Furthermore, according to the monitoring device 1 according to the present embodiment, as described above, every time a new failure occurs, failure information is input by a maintenance worker, and a feature vector at the time of failure (feature vector at the time of failure) Accumulated while being associated. Therefore, every time a failure occurs during the operation of the system to be monitored, the number of predictable failure patterns increases. Thereby, the effect that the operation rate is improved as the operation of the system is continued.

In the present embodiment, the average feature vector Va is used to determine whether or not the system operating status is healthy (for example, step S13 in FIG. 6). As described above, the average feature vector Va is an average value of each numerical value P1, P2,... Obtained from the log information of another system in the past or the present, and dynamically changes. That is, the monitoring device 1 according to the present embodiment determines whether or not the sound device is healthy by comparison with an average feature vector that dynamically changes according to the operating state, instead of a predetermined fixed value.
Here, if the operational status soundness is determined according to a predetermined fixed value, if the numerical value that inherently fluctuates according to the system operating time is included, the system is healthy. In spite of the fact, it is assumed that it is determined that “there is a sign of failure” based on the comparison between the changed numerical value and the fixed value. According to the monitoring device 1 according to the present embodiment, the determination is performed based on the comparison with the average feature vector that is dynamically calculated. Therefore, the element of sound numerical fluctuation is excluded, and the failure is predicted more accurately. be able to.

Note that the feature vector extraction unit 11 according to the present embodiment extracts a plurality of preselected numerical values (numerical values P1, P2,...) From the log information collected by the log information acquisition unit 10, Explained as what to do. Specifically, the feature vector extraction unit 11 may include a numerical value specification receiving unit that receives specification of a numerical value type by a maintenance worker. Accordingly, the maintenance worker can arbitrarily specify the number and type of the numerical values P1, P2,... Constituting the feature vector via the numerical value specification receiving unit.
Here, when the failure information processing unit 14 accumulates a plurality of failure feature vectors for the same failure (for example, “failure A”), the failure information processing unit 14 is classified into the same “failure A”, but at the time of the multiple failures. It is assumed that the uniformity of the feature vector tendency cannot be found, or the failure tendency itself cannot be grasped. In this case, the maintenance worker reselects the characteristic vector values P1, P2,... Via the numerical value designation receiving unit so that the tendency as “failure A” can be found. The failure information processing unit 14 that has received the designation by the maintenance worker refers to the log information stored in the log information database 12 and re-extracts various feature vectors. The maintenance worker can examine a combination of numerical values necessary for failure prediction while confirming the re-extracted feature vector.

  As described above, according to the monitoring device 1 according to the first embodiment, it is possible to accurately predict a failure occurring in the system even in a complex system including a plurality of component devices, and improve the operating rate of the system. Can be made.

<Second Embodiment>
Next, the monitoring device 1 according to the second embodiment will be described.
The monitoring device 1 according to the second embodiment is different from the first embodiment in the point of failure prediction processing in the failure prediction unit 16. Hereinafter, an example of the prediction process will be described in order.
FIG. 7 is a diagram illustrating a configuration of a toll collection system to be monitored by the monitoring apparatus according to the second embodiment.
The monitoring device 1 according to the second embodiment acquires log information of the fee collection system 2 as shown in FIG. 7 and predicts the occurrence of a failure.
The fee collection system 2 to be monitored is an electronic fee collection system as an example, and is configured in such a manner that the component device 2M individually communicates with each of the component devices 2A, 2B, and 2C as shown in FIG. Has been. For example, the component device 2M is an IC card reader, the component devices 2A, 2B, and 2C are each an IC card, a data processing device that performs data processing on the IC card, and charging based on the read IC card data. It is a payment processing apparatus that performs toll collection processing.

FIG. 8 is a diagram illustrating an example of processing of the feature vector extraction unit according to the second embodiment.
In the present embodiment, the feature vector extraction unit 11 has selected 12 numerical values as the feature vectors of the fee collection system 2 shown in FIG. Here, the numerical value M is a numerical value related to the machine operation (IC card insertion / removal) of the component device 2M itself. Numerical values A1 to A7 are numerical values related to processing entrusted to the constituent device 2A from the constituent device 2M, numerical values B1 to B3 are numerical values related to processing consigned from the constituent device 2M to the constituent device 2B, and numerical value C1 is It is a numerical value related to the processing entrusted from the component device 2M to the component device 2C.

The feature vector extraction unit 11 is based on a statistical distribution (average value μ, standard deviation σ, etc.) for each numerical value (numerical values M, A1 to A7, B1 to B3, C1), as in the first embodiment. Normalization processing is performed so that the magnitude of each numerical value and the variation in increase / decrease can be compared on the same scale. As for the average value μ, standard deviation σ, and the like of each numerical value, the average feature vector calculation unit 110 periodically determines the plurality of operating toll collection systems 2 from the past to the present as in the first embodiment. It is dynamically calculated based on log information acquired periodically or irregularly.
In the present embodiment, as shown in FIG. 8, among the numerical values constituting the feature vector, numerical values that are highly related are set so as to be biased in a specific direction in the chart. For example, the numerical values A1 to A7 relating to communication with the component device 2A are set adjacently so as to be biased toward the lower right side of the chart as a whole.

FIG. 9 is a diagram illustrating an example of failure information stored in the failure information database according to the second embodiment.
The processing of the failure information processing unit 14 according to this embodiment is the same as that of the first embodiment. That is, the failure information database in which the failure information about the failure that has occurred in the toll collection system 2 according to the present embodiment and the failure feature vector extracted based on the log information acquired immediately before the failure is associated with each other 15 accumulated.

Here, an example of failure information and failure feature vectors stored in the failure information database 15 according to the present embodiment will be described with reference to FIG.
As an example, it is assumed that the failure A is a failure in which the software runs away due to the deterioration of the electronic component α of the component device 2C and the operation of the toll collection system 2 is stopped. In this case, the failure characteristic vector Vs1 indicating the state immediately before the occurrence of the failure A increases with only the numerical value C relating to the component device 2C protruding, and the other numerical values are in the vicinity of the average value.
In addition, the failure B is caused by frequent communication processing in the operation of the toll collection system 2 as a result of frequent communication abnormalities due to deterioration (dirt, wear) of the signal contact fittings of the component device 2M used for communication with the component device 2A. This indicates a failure that has been retried and cannot be operated smoothly. The failure characteristic vector Vs2 immediately before the occurrence of the failure B is a chart in which some of the numerical values A1 to A7 are larger than the average value μ.
The failure C represents a failure in which the operation of the toll collection system 2 is temporarily stopped because the function is stopped due to thermal damage of the main control IC which is a main electronic component of the component device 2B. In relation to this, the failure characteristic vector Vs3 immediately before the occurrence of the failure C increases with the numerical values B2 and B3 protruding.

FIG. 10 is a diagram illustrating an example of feature vectors stored in the log information database according to the second embodiment.
As in the first embodiment, the failure prediction unit 16 according to the present embodiment refers to the log information database 12 and extracts from each log information of the plurality of fee collection systems 2 (FIG. 7) during normal operation. Obtained normal feature vectors V1, V2, V3,... As an example, the failure prediction unit 16 extracts, for each of the three toll collection systems 2 installed in the travel lanes X1 to X3, the normal-time feature vector based on the log information within the most recent predetermined period during normal operation. Consider a case where V1 to V3 (FIG. 10) are acquired.

FIG. 11 is a diagram illustrating an example of similarity determination in the failure prediction unit according to the second embodiment.
FIG. 11 shows failure characteristic vectors Vs1, Vs2, and Vs3 (FIG. 9) for the obstacles A, B, and C, and normal feature vectors V1 to V3 for the toll collection system 2 installed in the traveling lanes X1 to X3. The center of gravity position is shown. Here, the centroid position is an average value of the numerical values of the feature vectors on the chart plane (xy plane) which is a virtual space. The barycentric position is uniquely determined by the numerical value included in the feature vector on the chart plane.
The failure prediction unit 16 according to the present embodiment determines whether or not they are similar based on the distance between the gravity center positions of the feature vectors.

For example, the failure feature vector Vs1 of the failure A is increased only by the numerical value C1 because the component device 2C has a failure (see FIG. 9). Therefore, in FIG. 11, the failure feature vector Vs1 of the failure A is shifted to the + y direction side, which is the direction in which the axis of the numerical value C1 is set. On the other hand, the normal time feature vector V1 of the toll collection system 2 (travel lane X1) is similarly shifted to the + y direction side, and the distance between the positions of the center of gravity is approaching.
Here, for example, the failure prediction unit 16 according to the present embodiment has a predetermined distance d between the centroid position (x1, y1) of the normal feature vector V1 and the centroid position (x2, y2) of the failure feature vector Vs1. When it is equal to or less than the determination threshold dth, it is determined that the normal feature vector V1 is similar to the fault feature vector Vs1, and processing to notify that is performed. Thereby, the maintenance worker can recognize that the repair work of the component equipment 2C is required for the fee collection system 2 of the travel lane X1.
The distance d is obtained by d = {(x1-x2) ² + (y1-y2) ² } ^1/2 .

  Similarly, in the failure feature vector Vs2 of the failure B, some of the numerical values A1 to A7 are increased due to the failure in the communication path with the component device 2A (see FIG. 9). . Therefore, in FIG. 11, the position of the center of gravity of the failure feature vector Vs2 changes in the lower right direction of the chart. On the other hand, the barycentric position of the normal time feature vector V2 of the toll collection system 2 (travel lane X2) similarly shifts to the lower right side, and is approaching the barycentric position of the obstacle B. Therefore, the failure prediction unit 16 performs processing for predicting the occurrence of an abnormality equivalent to that of the failure B according to the determination result based on the determination threshold dth and notifying that effect.

  Further, in the failure feature vector Vs3 of the failure C, the numerical values B2 and B3 are particularly increased because the operation is stopped due to the failure inside the component device 2B (see FIG. 9). On the other hand, the normal feature vector V3 of the toll collection system 2 (travel lane X3) is not clearly similar to the obstacles A, B, and C in the overall shape of the chart. However, in the normal time feature vector V3, B1, which is one of the numerical values related to the communication processing with the component device 2B, protrudes, and the position of the center of gravity is approaching the direction of the center of gravity of the obstacle C. As a result, the failure prediction unit 16 predicts the occurrence of a failure based on the component device 2B in the same manner as the failure C according to the determination result based on the determination threshold dth, and notifies that fact.

  As described above, the failure prediction unit 16 according to the present embodiment compares the center-of-gravity position in the chart plane between the normal feature vectors V1, V2,... And the failure feature vectors Vs1, Vs2,. Similarity determination is performed based on this. Then, by setting the numerical value axes constituting the feature vector in association with the predetermined commonality that the numerical values have, it is possible to accurately estimate the progress point of the abnormality from the direction of the transition of the center of gravity position. For example, the numerical values A1 to A7 are collectively set in the lower right direction of the chart plane while having a common “numerical value related to communication with the component device 2A”. Therefore, it can be estimated from the tendency that the center of gravity position of the normal time feature vectors V1, V2,...

In the above description, the toll collection system 2 according to the present embodiment notifies the possibility of the occurrence of a failure when the distance between each other is equal to or less than the predetermined determination threshold dth based on the distance of the center of gravity. However, the modification of the present embodiment is not limited to this mode. For example, in the modification, the failure prediction unit 16 predicts the occurrence of a failure based on whether or not the azimuth θ (θ = 0 ° to 360 °) in which the position of the center of gravity has changed from the origin 0 matches. May be.
Specifically, in FIG. 11, for example, the distance d between the center of gravity of the failure feature vector Vs3 and the center of gravity of the normal feature vector V3 is relatively distant, and depending on the distance determination threshold dth, The sign of C is not detected. However, as shown in FIG. 11, the azimuths in which the gravity center positions of the two feature vectors have changed substantially coincide on the left side of the chart plane. In this case, the failure predicting unit 16 determines whether the orientation θ of the center of gravity of the normal feature vector V3 falls within the range of θs ± Δθ with respect to the orientation θs of the center of gravity of the failure feature vector Vs3. The occurrence of the failure C in the toll collection system 2 may be predicted based on the determination result.
As described above, by comparing the transition direction θ, the failure prediction unit 16 can identify a failure that may occur before the center of gravity position falls within a predetermined distance range, The cause can be detected early.

FIG. 12 is a diagram for explaining an example of similarity determination in the failure prediction unit according to the modification of the second embodiment.
As a modification of the second embodiment, the failure prediction unit 16 further includes a numerical value that is highly related to a specific failure among the numerical values (numerical values M, A1 to A7, B1 to B3, and C1) included in the feature vector. Based on the comparison of feature values, the similarity determination between the normal feature vectors V1, V2,... And the failure feature vectors Vs1, Vs2,.

  As a specific example, the failure information processing unit 14 according to the modification includes a feature value setting unit. The feature value setting unit sets one feature value having a tendency common to failure feature vectors related to a plurality of pieces of failure information classified into the same failure category. For example, as a tendency common to the failure feature vector Vs2 (center of FIG. 9) for the failure B and a plurality of other failure feature vectors classified as the same failure B, “the numerical value C1 is decreasing”. , The feature value setting unit of the failure information processing unit 14 sets and stores this numerical value C1 as a “feature value” that is highly related to the failure B. At the same time, the failure information processing unit 14 stores information indicating that the tendency of the failure B becomes stronger when the numerical value C1 that is the “feature value” decreases to a predetermined value. Specifically, the feature value setting unit stores, for example, an information group such as “failure B, feature value: C1, numerical value: OO” in the failure information database 15.

On the other hand, it is assumed that the normal feature vector V4 as shown in FIG. 12 is acquired in the toll collection system 2 installed in the travel lane X4.
In this case, the failure prediction unit 16 according to the modification first determines which failure feature vector the normal feature vector is similar to, based on the comparison of the center of gravity position, as in the second embodiment. Judging. However, in this case, the center of gravity position of the normal feature vector V4 is close to the average value (origin 0) as a whole, and the commonality with the failure feature vectors Vs1, Vs2, and Vs3 is also from the transition direction. It cannot be seen (see FIG. 11). Therefore, the failure prediction unit 16 determines that the fee collection system 2 is in a healthy operating state based on similarity determination based on the position of the center of gravity.

However, the failure prediction unit 16 according to the modification further determines the similarity of each feature vector based on the comparison between the feature values (numerical value C1) stored by the failure information processing unit 14. That is, the failure predicting unit 16 reads the tendency (see FIG. 12) in which the numerical value C1 of the normal feature vector V4 is decreasing, and the failure information processing unit 14 associates with the “decreasing tendency of the feature value (numerical value C1)”. It is judged that it is similar to the attached “Fault B”.
By doing in this way, the failure prediction unit 16 according to the modification can predict the occurrence of a failure with higher accuracy based on the commonality that has been overlooked only by the comparison of the center of gravity position.

In the above-described modification, the failure information processing unit 14 automatically associates the failure B with the numerical value C1 highly related to the failure B by analyzing the accumulated failure information and the failure feature vector. Described as a setting. However, in another embodiment, for example, a feature value that is determined to be highly related to a failure by a maintenance worker by visually observing chart diagrams of a plurality of failure feature vectors classified into the same failure category. The failure information processing unit 14 may accept and store input of information (failure classification and its feature value) based on the determination.
In this case, the failure information processing unit 14 displays a chart of the accumulated feature vector at the time of maintenance via a display unit (monitor) included in the monitoring device 1 and a displayed chart. It is assumed that a feature value designation receiving unit that receives a feature value designation based on the judgment of the maintenance worker based on the figure is provided.

  In the above-described modification, the failure prediction unit 16 has been described as performing similarity determination based on the “center of gravity position” of each feature vector and similarity determination based on a previously set “feature value”. The failure prediction unit 16 may further perform similarity determination based on the “difference degree D” described in the first embodiment.

FIG. 13 is a diagram illustrating an example of notification processing in a failure prediction unit according to a modification of the second embodiment.
In the case of the above-described modification, the determination result may differ depending on the similarity determination method.
In this case, as shown in FIG. 13, the failure prediction unit 16 may display a failure predicted for each determination method as failure prediction notification processing. For example, the failure prediction unit 16 displays the result of comparison between the normal feature vector V4 and each of the failure feature vectors Vs1, Vs2,..., And the average feature vector Va for each determination method. In FIG. 13, for example, determination method m1 is determination based on “difference degree D”, determination method m2 is determination based on “center of gravity position”, and determination method m3 is determination based on “feature value”.
The failure predicting unit 16 notifies the determination result for each determination method, so that the maintenance worker can grasp the signs of the failure in detail and in various ways. For example, according to the determination result as shown in FIG. 13, although the operation status at the present stage is close to sound, it may be determined that there is a possibility of progressing to the occurrence of the failure B in the future and it is necessary to pay attention. it can.

In addition, the failure prediction unit 16 according to the first and second embodiments described above has the failure time feature vectors Vs1, Vs2, and the normal time feature vectors extracted from the monitoring target (charge collection system 2). .. Or the average feature vector Va is relatively judged to be similar to predicting the occurrence of a failure. However, if the failure prediction unit 16 according to another embodiment determines that the normal feature vector is not similar to any of the failure feature vectors Vs1, Vs2,... Or the average feature vector Va, the monitoring target (Toll collection system 2) may determine that there is a sign of an unknown failure, and perform notification processing to that effect. In this case, the failure prediction unit 16 provides a fixed determination threshold for the similarity determination criterion, and the fixed determination threshold for each of the failure feature vectors Vs1, Vs2,... And the average feature vector Va. Similarity determination based on the above shall be performed.
In this way, when a new phenomenon that does not correspond to any of the failure feature vectors that have been accumulated so far is occurring, the maintenance worker can Recognize that and take measures.

  As described above, according to the monitoring device 1 according to the second embodiment and the modification thereof, only independent monitoring is performed for each component device by extracting a numerical value group related to a plurality of different component devices as one feature vector. In addition, it is possible to comprehensively understand the cooperative operation of the entire components in the system.

  The monitoring device 1 described above has a computer system inside. Each process of the monitoring apparatus 1 described above is stored in a computer-readable recording medium in the form of a program, and the above process is performed by the computer reading and executing the program. Here, the computer-readable recording medium refers to a magnetic disk, a magneto-optical disk, a CD-ROM (Compact Disk Read Only Memory), a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

  As mentioned above, although some embodiment of this invention was described, these embodiment is shown as an example and is not intending limiting the range of invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the invention described in the claims and equivalents thereof, as long as they are included in the scope and gist of the invention.

DESCRIPTION OF SYMBOLS 1 ... Monitoring apparatus 10 ... Log information acquisition part 11 ... Feature vector extraction part 12 ... Log information database 13 ... Fault information input part 14 ... Fault information processing part 15 ... Fault Information database 16 ... failure prediction unit 2 ... toll collection system 2A, 2B, 2C, ... components

Claims (10)

A monitoring device for monitoring a system having at least one component device,
A log information acquisition unit for acquiring log information output by the component device;
A feature vector extraction unit for extracting a feature vector composed of a plurality of types of numerical values based on the log information;
A failure information input unit that receives input of failure information about a failure that has occurred in the system;
Of the feature vectors, a failure time feature vector extracted based on log information acquired from a predetermined time before the occurrence of the failure to the time of the occurrence of the failure is associated with the failure information about the failure A fault information processing unit for storing;
Generated in the system based on a determination as to which of the failure feature vectors is similar to a normal feature vector extracted based on log information acquired during normal operation of the system among the feature vectors A failure prediction unit for predicting a failure;
A monitoring device comprising: The failure prediction unit
A dissimilarity calculated from a difference between numerical values included in the normal feature vector and the failure feature vector is calculated, and based on the dissimilarity, the normal feature vector is any of the fault feature vectors. It is judged whether it is similar. The monitoring apparatus of Claim 1 characterized by the above-mentioned. The failure prediction unit
In the virtual space, based on the comparison of the center of gravity position uniquely determined by the numerical value included in the feature vector, it is determined which of the failure feature vectors is similar to the normal feature vector. Item 3. The monitoring device according to item 1 or item 2. The failure prediction unit
Determining whether the normal feature vector is similar to the fault feature vector based on a comparison of feature values that are highly related to a specific fault among the numerical values included in the feature vector. The monitoring device according to any one of claims 1 to 3. An average feature vector calculation unit that calculates an average feature vector composed of an average value for each numerical value included in a plurality of normal feature vectors,
The failure prediction unit
The system according to any one of claims 1 to 4, wherein when the normal feature vector is determined to be more similar to the average feature vector than the fault feature vector, the system is determined to be operating soundly. The monitoring apparatus as described in any one. The failure prediction unit
6. The method according to claim 5, wherein when it is determined that the normal feature vector is not similar to either the fault feature vector or the average feature vector, it is determined that there is a sign of an unknown fault in the system. The monitoring device described. The system has two or more of the component devices,
The said feature vector extraction part extracts the said feature vector based on the log information which shows the process performed between two or more said component apparatuses. The one of the Claims 1-6 characterized by the above-mentioned. The monitoring device described in 1. A numerical value designation receiving unit for accepting designation of the type of numerical values constituting the feature vector;
The feature vector extraction unit re-extracts, from the log information, a feature vector including a numerical value of the specified type when the specification is accepted. The monitoring device according to one item. A method of monitoring a system having at least one component device,
The log information acquisition unit accepts input of log information output by the component device,
A feature vector extraction unit extracts a feature vector composed of a plurality of types of numerical values based on the log information,
The failure information input unit accepts input of failure information about a failure that has occurred in the system,
The failure information processing unit extracts a feature vector at the time of failure extracted based on log information acquired from a predetermined time before the occurrence of the failure to the time of occurrence of the failure, and the failure for the failure Information in association with each other,
Based on the judgment that the failure prediction unit is similar to the failure feature vector, the normal feature vector extracted based on the log information acquired during normal operation of the system among the feature vectors, A monitoring method characterized by predicting a failure occurring in the system. A monitoring device computer for monitoring a system having at least one component;
Log information input means for receiving input of log information output by the component device;
Feature vector extraction means for extracting a feature vector composed of a plurality of types of numerical values based on the log information;
Fault information input means for receiving input of fault information regarding a fault that has occurred in the system;
Of the feature vectors, a failure time feature vector extracted based on log information acquired from a predetermined time before the occurrence of the failure to the time of the occurrence of the failure is associated with the failure information about the failure Fault information processing means for storing,
Generated in the system based on a determination as to which of the failure feature vectors is similar to a normal feature vector extracted based on log information acquired during normal operation of the system among the feature vectors Failure prediction means for predicting failure,
Program to function as.

Images