JP6317074B2 - Failure notification device, failure notification program, and failure notification method - Google Patents

Description

  The present invention relates to a technique for notifying a computer (information processing apparatus) of a failure that occurs.

  A distributed computer network system is a system in which individual parts constituting a program are executed by a plurality of computers in parallel and communicate with each other via a network. Therefore, when the distributed computer network system is used, the throughput is improved as compared with the case where the calculation is performed by one computer. Since monitoring of such a distributed computer network system must be performed on distributed computers at the office, command control by remote operation is required.

  Patent Document 1 discloses a system that performs maintenance operation using an integrated network monitoring system regarding management and monitoring of a plurality of devices in a large-scale distributed computer network system. In this network monitoring system, as a means for remotely monitoring a server, an information collection agent (program) for collecting information on the monitored device is incorporated in the monitored device. This network monitoring system incorporates a network monitoring manager (program) in the monitoring device. FIG. 2 is a diagram showing the overall configuration of such a network monitoring system. The network monitoring system includes a network monitoring manager function 131 incorporated in the maintenance network monitoring apparatus 130 and monitoring agent functions 102, 112, 122 incorporated in the monitoring target apparatuses 100, 110, 120. Application programs 101, 111, and 121 are incorporated in the monitoring target devices 100, 110, and 120, respectively. The failure information of the monitoring target devices 100, 110, 120 detected by the monitoring agent functions 102, 112, 122 is notified to the network monitoring manager function 131. This failure information is displayed on a unique GUI screen 131a implemented by the network monitoring manager function 131. The failure notification destination is limited to the GUI screen 131a (GUI: Graphic User Interface).

  If this method is to be introduced into a network system such as a large-scale distributed computer network system that is already in operation, it is necessary to newly incorporate an integrated network monitoring system and server management software as described above into the existing system. is there.

  On the other hand, a network system that is generally in operation is equipped with an integrated monitoring function that can be managed centrally. For example, as shown in FIG. 3a, an integrated distributed monitoring function 171 for managing a plurality of devices to be monitored is already installed in the existing distributed computer system from the maintenance work GUI screen 171a of the maintenance network monitoring device 170. This is the current situation. The integrated monitoring function 171 centrally confirms the operating state and failure occurrence status of the monitoring target devices 140 and 150 from the maintenance work GUI screen 171a. The integrated monitoring function 171 also performs various maintenance operations from the maintenance work GUI screen 171a. Here, application programs 141 and 151 having fault monitoring and notification functions are incorporated in the monitoring target devices 140 and 150, respectively. For this reason, when a monitoring target device 160 is newly added to the system of FIG. 3a and an integrated network monitoring system and server management software are incorporated along with this addition, the existing monitoring devices are configured to overlap. FIG. 3B shows a configuration in which the monitoring target device 160 monitored by the network monitoring manager function 172 is added to the network monitoring device 170 in operation, and the network monitoring manager function 172 is installed in the maintenance network monitoring device 170. The maintenance person must perform a confirmation operation and a maintenance operation from two screens of the existing GUI screen 171a and the GUI screen 172a provided by the network monitoring manager function 172. As a result, there is a problem that the maintenance worker's work becomes complicated and the work efficiency decreases.

  In addition, adding a new program or installing software to a device that is operating in a stable system may affect the operation of the application during operation, and cannot be easily implemented. There is.

  On the other hand, information obtained by monitoring can also be obtained by using a logging function of a UNIX (registered trademark) OS (Operation System). The UNIX-based OS has a logging function called a system log (syslog) that records operation logs such as various events and state changes occurring in the system in a file. This logging function records various system-related events in the system log file, from the user's login date and time to the situation when an abnormality such as a kernel panic occurs. For this reason, the system log is an important information source for system management, such as pursuing the cause of a failure and searching for traces of unauthorized access. Therefore, this logging function can replace the information collection agent and the network monitoring manager. With this alternative, even when an integrated network monitoring system or the like is incorporated into an existing distributed computer network, it is not necessary to install the network monitoring manager function, and a reduction in user work efficiency is avoided.

  However, the contents of the system log are generally complex. This content includes not only fault information but also all predetermined operation histories. If the goal is simply to obtain fault information, the system log can be said to be information overload. It is necessary to check each applicable message one by one to determine whether the content is urgent or the level of the failure. The problem of taking time arises.

  Patent Document 2 discloses a system that detects a failure occurring in a UNIX server, records the content of the failure in a plurality of different log files, and notifies a system maintenance person. However, since this system notifies all faults, it is indispensable for the maintenance person to isolate the cause. A wide variety of logs are notified from messages such as state changes and login information that do not require urgent information, to messages that accompany the occurrence of a failure that requires urgent action through the system administrator. Therefore, there is a problem that the system maintainer is busy with organizing the information.

  Patent Document 3 discloses a log information management device and a log information management program for managing data related to a system log that contributes to system management. This log information management program enables a keyword search for messages in a system log file, and provides a technique by which a system administrator can appropriately extract log information optimal for pursuing the cause of a failure. However, this system generates man-hours necessary for the search.

By reducing the burden on maintenance personnel by selecting and notifying log information,
A technique disclosed in Patent Document 4 may be mentioned. Patent Document 4 discloses that a log management application monitors log data output from a driver application, determines an error level, and then records an error of a predetermined level or higher in a log database.

  Further, Patent Document 5 centrally monitors a failure during system operation, collects log information stored in the activation processing unit when a failure is detected, and notifies an external remote maintenance management system together with an alarm message. It is disclosed that.

JP 2004-021549 A JP 2000-148541 A JP 2003-141075 A JP 2009-151680 A JP 2001-325124 A

  The problem of the technique of Patent Document 1 is that the confirmation work and the maintenance operation are performed using two screens, and the complexity of the search work in the technique of Patent Document 2 makes it difficult to monitor the distributed computer system. It is a cause.

  Since the technique of Patent Document 4 determines an error level based on log data output from an application, even if a more serious error level occurs in the operation system, this cannot be detected. In addition, when a plurality of applications are activated at the same time, a duplicate error message may occur, preventing efficient countermeasures. Further, even if the error is caused by the same cause, it may appear as a different phenomenon depending on the application. Therefore, the means of Patent Document 4 does not lead to a fundamental solution.

  The technology of Patent Document 5 reports all log data stored in the activation processing unit to the remote maintenance management system for errors that occur in the application activation stage, but reports general errors that occur in the OS. is not. In addition, since all log data is reported at the time of failure, a burden of determination is imposed on the system maintainer. Furthermore, in this technique, when the data is normally started, log data output from the application is used. Therefore, as in Patent Document 4, it is not a fundamental solution.

  An object of the present invention is to provide a failure notification device or the like that notifies an error message so that a maintenance person can efficiently perform maintenance.

According to the present invention,
Monitoring means for acquiring a log relating to a failure from an operation system provided in the monitoring target device, analysis means for determining the importance of the log acquired from the operation system, and contents of the log having the importance equal to or higher than a threshold among the logs A failure notification device having notification means for notifying failure notification information representing

  According to the present invention, the monitoring process for acquiring a log relating to a failure from the operation system provided in the monitoring target device, the analysis process for determining the importance level of the log acquired from the operation system, and the importance level among the logs is A notification process for notifying the failure notification information indicating the log content equal to or greater than the threshold and a failure notification program to be executed by the computer are obtained.

  According to the present invention, a log relating to a failure is acquired from an operation system included in a monitoring target device, the importance of the log acquired from the operation system is determined, and the content of the log having the importance greater than or equal to a threshold among the logs A failure notification method for notifying failure notification information that represents

  According to the present invention, a failure notification device or the like that notifies failure information can be obtained so that a maintenance person can efficiently perform maintenance response.

  Next, the basic configuration content of the embodiment of the present invention will be described.

  The configuration of the embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a functional block diagram of a distributed computer network including a failure notification device according to an embodiment of the present invention.

  The failure notification device 301 according to the present invention is provided in the monitoring target UNIX device 1 as an example. The failure notification device 301 includes a monitoring agent function 11, a system log function 12, a failure log file 12c, and a failure notification function 15. The monitored UNIX device 1 includes a failure notification device 301, a system log 12a, various logs 12b, a failure monitoring function 13, a failure management function 14, a failure notification information management table 14a, and a failure notification function 15.

  This monitored UNIX device 1 operates in a distributed computer network system. In addition, a monitoring target device A3, a monitoring target device B4, a monitoring target device C5, a monitoring target device D6, a monitoring target device E7, and a monitoring target device F8 are connected to the distributed computer network system.

  The monitoring agent function 11 monitors the operation status of the operation system of the monitoring target UNIX device 1, acquires a log representing the operation status, and notifies the acquired log to the system log function 12. The monitoring agent function 11 is also called a monitoring unit 310.

  The system log function 12 is provided by, for example, a UNIX-based OS. The system log function 12 records various messages such as operation and operation of the software (kernel) that implements the basic functions of the UNIX OS and programs (daemons) that operate in the background, fault information, and the like as the system log 12a. To do. The monitoring agent function 11 is also called a monitoring unit 310. The system log function 12 records various logs as various logs 12b. Various logs are mail server software built into the UNIX OS as a standard function, scheduled automatic execution program for jobs, etc. The OS standard functions send messages such as operation logs and failure information as files for each function. Recorded. Here, the mail server software is sendmail or the like. The scheduled automatic execution program for jobs is cron or the like. The various logs 12b are file groups.

  Further, the system log function 12 records a message notifying a failure that has occurred in the hardware of the monitored UNIX device 1 detected by the monitoring agent function 11 in the failure log file 12c.

  Further, the system log function 12 selects a message having a high “importance” indicating a failure level from the messages recorded in the system log 12a and various logs 12b, and stores the selected message in the failure log file 12c. The system log function 12 is also called an analysis unit 320.

  FIG. 4 is a diagram illustrating an example of the description content of the failure log file 12c. The “significance” of the message recorded in the failure log file 12c is 4: emerg (an error that the system cannot be used), 3: alert (an error to be dealt with urgently), 2: crit (a fatal error) , 1: err (general error). The “importance” of the message to be recorded is defined in the system log setting file 12d. As an example, the system log setting file 12d defines the importance to be recorded according to the rules of “record only importance 4”, “record importance 3 and 4”, and “record all importance 1 to 4”. FIG. 4 shows a case where “record importance 3 and 4” is defined in the system log setting file 12d, as will be described later. In other words, FIG. 4 is an example of the failure log file 12c when the importance level threshold is 3. The system log setting file 12d is a setting file held by the system log function 12, and defines the “record destination file name” of the message in addition to the above “importance”. The file name of the failure log file 12c or the like is used as the message recording destination file name. The failure log file 12c is also called a storage unit 330. The system log setting file 12d is stored in a storage unit (not shown) of the system log function 12.

  Next, the outline of the operation of the present embodiment will be described with reference to FIG. The system log function 12 determines the importance of the system log 12a and various logs 12b, and registers a log having an importance exceeding a certain standard in the failure log file 12c. This determination is performed based on the importance for each message defined in the system log setting file 12d. In the example shown in FIG. 4, the importance level 3 is set as a threshold value, and fault logs greater than this value (alert, emerge) are registered. The failure log may be registered according to other criteria. For example, when the importance is 4 or more, only the failure log in the kernel program that occurred at 9:51:27 on December 2 is recorded.

  The failure monitoring function 13 constantly monitors the failure log file 12c, and when a new failure log record is detected, the failure monitoring function 13 notifies the maintenance person of the failure log as a failure notification message. Convert to Thereafter, the failure monitoring function 13 transmits a failure message to the failure management function 14. Based on the failure notification message received from the failure monitoring function 13, the failure management function 14 identifies the occurrence location such as the failure occurrence time, the name of the hardware in which the failure has occurred, and the application process name in the failure notification information management table 14a. The information and details of the failure contents are registered in a state of being associated with each other. Note that the content recorded in the failure notification information management table 14a is the same as the corresponding content in FIG. 4 except that the content is converted into a data format for the failure notification message and recorded. The failure notification function 15 monitors the failure notification information management table 14a at a constant time period. When the failure notification function 15 detects that a failure notification message has been newly registered, the failure notification function 15 acquires the failure notification message from the failure notification information management table 14a and transmits it to the maintenance network monitoring device 2. The maintenance person performs maintenance management of the distributed computer network in an integrated manner through the GUI screen 21 connected to the maintenance network monitoring apparatus 2. The failure notification function 15 is also referred to as a notification unit 340.

  Next, the operation of the failure monitoring function 13 in this embodiment will be described in detail based on the processing outline flowchart of FIG.

  The failure monitoring function 13 always reads the failure log file 12c based on a fixed second period or a specific schedule, and checks whether a new log has been written (steps S052 to S059). If there is a new log (YES in step S054), the data is converted into a failure notification message format for notification to the maintenance person (step S055), and the failure notification message is transmitted to the failure management function 14 (step S056). . The period of the predetermined second is set to, for example, about 10 to 30 seconds in consideration of the failure occurrence frequency, the immediateness of failure detection, and the system load condition. FIG. 4 is an example of the contents described in the failure log file 12c as described above. The records stored in the failure log file 12c are “failure occurrence date”, “failure occurrence device host name”, “failure occurrence program”, “failure content details”, and “failure importance”. These are stored in association with each other. FIG. 4 is an example in which records of failures with importance levels 3 and 4 are stored. As described above, since the “failure occurrence date / time” is recorded in the failure log file 12c, in the read processing of the failure log file 12c, only a new log can be read based on the record of the failure occurrence date / time. It is efficient. Therefore, this “failure occurrence date and time” information is used as read start position information in the failure log file of data that has been read in the previous cycle. That is, a marker is attached to data associated with “date and time of data when reading of the failure log file 12c has been completed” (hereinafter referred to as “date and time DP” (DP: Data Position)). In the next cycle, the failure monitoring function 13 reads the log after “date and time DP” up to the last line of the file based on this position information (step S053).

  The information of “date and time DP” is initialized when the failure monitoring function 13 is activated (step S051). The failure monitoring function 13 reads the failure log file 12c from the log written after “date and time DP” to the last line of the file (step S053). The fault monitoring function 13 determines whether there is a new log (step S054). If there is a new log (YES in step S054), the failure monitoring function 13 converts the acquired new log into a failure notification message format for notifying the maintenance person (step S055). Thereafter, the failure monitoring function 13 transmits this failure notification message to the failure management function 14 (step S056). The failure monitoring function 13 sets the “failure occurrence date / time” of the last read failure message as “date / time DP” and completes the update (step S057). After the processing is stopped for a fixed time (step S058), the failure monitoring function 13 resumes the processing from S052.

  If there is no new log (NO in step S054), the failure monitoring function 13 resumes the processing from S052 after the processing is stopped for a fixed second (step S058).

  Next, the operation of the failure management function 14 in the present embodiment will be described in detail based on a part of FIG. 5 and a processing outline flowchart of FIG.

  The failure management function 14 receives the failure notification message (step S056 in FIG. 5) notified from the failure monitoring function 13 (step S061). The failure management function 14 registers this in the failure notification information management table 14a (step S062).

  Next, the operation of the failure notification function 15 in this embodiment will be described in detail based on the process outline flowchart of FIG. In the reading process of the failure notification information management table 14a, it is efficient to read only new failure notification information. Therefore, a marker is added to the data that has been read from the failure notification information management table 14a. By attaching this marker, the information of “position of data for which reading of the failure notification information management table has been completed” (hereinafter referred to as “management table DP (DP: Data Position)”) is initialized (step S071). The failure notification function 15 performs the loop processing of S072 to S07a following this initialization. In this loop process, first, the failure notification function 15 reads the failure notification information management table 14a from the position of the marker, and reads the failure notification messages registered after the data up to the last line (step S073). This reading may be performed at a constant second cycle or may be performed according to a specific schedule.

  The failure notification function 15 checks whether a new failure notification message has been written (step S074). If there is a new failure notification message (YES in step S074), failure notification function 15 repeats the processes of S075 to S07b. That is, the failure notification function 15 transmits a failure notification message to the maintenance network monitoring device 2 (step S076). The fault notification function 15 uses a trap message of SNMP (Simple Network Management Protocol), which is a UDP (User Datagram Protocol) -based network monitoring / management protocol, as means for notifying the maintenance network monitoring apparatus 2.

  The failure notification function 15 updates the information in the “management table DP” (step S077). Failure notification function 15 repeats S075 to S07b when the number of SNMP trap transmissions is equal to or less than the prescribed number (YES in step S078). If the number of SNMP trap transmissions is greater than the specified number (NO in step S078), failure notification function 15 returns to step S072 and repeats the process.

  Note that when the failure log file is read at a constant second cycle, the cycle (step S079) is set to a short cycle of, for example, about 1 second in order to take into account the immediateness of the failure notification.

In the present embodiment, the failure notification function 15 can be configured to combine the functions of the failure monitoring function 13, the failure management function 14, and the failure notification information management table 14a. Further, the failure monitoring function 13 can be configured to have the failure management function 14.
Such a configuration having the failure monitoring function 13 and the failure management function 14 or the failure management function 14 is also simply referred to as a management unit. The failure notification management table 14a is also called a management table.

  In addition, when the data is stored in the failure log file 12c, the failure notification function 205 can be configured to issue a failure notification message as needed. In this case, the failure monitoring function 13, the failure management function 14, and the failure notification management table 14a are unnecessary.

  In the present embodiment, failure management is performed using the system log function of the OS, so that maintenance management is possible using an existing GUI monitor. In addition, since the transmission of the failure notification message is limited to a failure having a high importance level, the maintenance person can efficiently perform maintenance.

  The monitoring agent function 11, the system log function 12, the fault monitoring function 13, the fault management function 14, and the fault notification function 15 may be realized by hardware such as a logic circuit or a program stored in a memory (not shown) It may be realized by executing.

In the present embodiment, UNIX is used as the OS, but other OS may be used. For example, LINUX (registered trademark) can be used.
(Second Embodiment)
Next, a second embodiment based on the above-described first embodiment will be described. In the following description, the same components as those of the first embodiment are denoted by the same reference numerals as those shown in FIG. 1 according to the first embodiment, and redundant description is omitted. To do.

  FIG. 8 is a schematic block diagram showing the configuration of the second exemplary embodiment of the present invention.

  In the present embodiment, an application program 206 and an application program 207 that operate on the monitored UNIX device 200 are provided in addition to the configuration of FIG.

  The monitoring target UNIX device 200 is connected to the distributed computer network system in the same manner as the monitoring target UNIX device 1. In addition, a monitoring target device A220, a monitoring target device B230, a monitoring target device C240, a monitoring target device D250, a monitoring target device E260, and a monitoring target device F270 are communicably connected to the distributed computer network system via the wide area LAN 9. ing.

  The system log 202a, various logs 202b, and the failure log file 202c in the monitoring target UNIX device 200 have the same functions as the system log 12a, various logs 12b, and the failure log file 12c of the first embodiment, respectively.

  When the application program 206 and the application program 207 detect any processing error during the execution of the application, the application program 206 and the application program 207 convert the failure information into data in a failure information message format for notifying the maintenance person. In addition, the application program 206 and the application program 207 transmit a failure notification message to the failure management function 204.

  The failure management function 204 receives the failure notification message notified from the application 206 or 207, and registers the failure notification information in the failure notification information management table 204a in the same manner as when the failure information message is received from the failure monitoring function 203. The application 206 and the application 207 are also called execution monitoring units.

  A failure notification message notified from the failure management function 204, the application program 206, and the application program 207 is registered in the failure notification information management table 204a. The failure notification function 205 included in the failure notification device 302 transmits these failure notification messages to the maintenance network monitoring device 210. As with the failure notification function 15 of the first embodiment, the failure notification function 205 reads the failure notification message read from the failure log function 202C from the failure log file 202C and sent to the failure management function 204, as well as maintenance network monitoring. To device 210. The maintenance person performs maintenance management of the distributed computer network in an integrated manner using the GUI screen 211 connected to the maintenance network monitoring apparatus 210.

According to the second embodiment of the present invention, not only the hardware failure and OS error that occurred in the monitored UNIX device 1, but also error information detected by various application programs is stored in the failure notification information management table 204a. Centralized management. For this reason, when a new application program is added, the failure management function 204 and the failure notification interface of the application program are combined to enable failure notification from the failure information management to the maintenance network monitoring device 210. Therefore, it is not necessary to create a failure management function 204 and a failure notification function 205 specific to the application program.
(Third embodiment)
Next, a second embodiment based on the above-described first embodiment will be described. In the following description, the same components as those of the first embodiment are denoted by the same reference numerals as those shown in FIG. 1 according to the first embodiment, and redundant description is omitted. To do.

  In the first embodiment, the failure notification is recorded in the failure log file 12c according to the importance. In the third embodiment, an importance level is set for each application, and a failure notification corresponding to the importance level is recorded. The fault monitoring function 13 is configured to notify the fault management function 14 only of fault messages that have a great influence on the application in use. Based on the failure information message received from the failure monitoring function 13, the failure notification function 15 identifies the occurrence location such as the failure occurrence time, the name of the hardware where the failure occurred, the application process name, etc., in the failure notification information management table 14a. Register information and details of failure. The failure notification function 15 monitors the failure notification information management table 14a at regular intervals, as in the first embodiment. When the failure notification function 15 detects that the failure notification information is newly registered, the failure notification function 15 acquires the failure information from the failure notification information management table 14a, and transmits a failure notification message to the maintenance network management device 2.

  In this embodiment, a failure message that does not directly affect the application in use is not notified, so that the user can perform maintenance response more efficiently than the first embodiment without being interrupted by maintenance work. can do.

  As an example, an environment in which an application A that directly affects the operation of the system X and an application B that does not affect the operation of the system X are operating in the system X will be described. In the system X, when the process of the application A stops, it becomes an important failure, but when the process of the application B stops, it does not become a serious problem. By defining the failure importance level of “process stop” individually for the applications A and B, only useful failure information can be notified to the maintainer. That is, in this embodiment, it is possible for the application A to set the failure that causes the process to stop at a higher importance level than the application B.

  As in the second embodiment, the present embodiment can be configured such that the execution monitoring unit such as the application programs 206 and 207 identifies an application program being executed.

In the present embodiment, a configuration may be employed in which an application program specifying unit that specifies a running application program determines the running application program.
(Fourth embodiment)
A fourth embodiment will be described with reference to FIG. The fourth embodiment of the present invention includes a monitoring unit 310 that acquires a log from the operation system, an analysis unit 320 that determines the importance of the log acquired from the operation system, and the importance of the logs is equal to or greater than a threshold value. And a notification unit 340 that notifies the maintenance device of the log as a failure notification.

  The effect of this embodiment is that an efficient maintenance response is possible even in an existing computer network by using the log of the operation system.

  The present invention described with reference to the first to fourth embodiments described above is the function of the flowchart (FIGS. 5, 6, and 7) referred to in the description of the embodiment, or FIGS. In the block diagram shown in FIG. 10, a program capable of realizing each unit shown in the apparatus is supplied to the information processing apparatus 1000 shown in FIG. 10, and then the program is executed on a CPU 1100 (CPU: Central Processing Unit). Is achieved. The program supplied in the information processing apparatus 1000 may be stored in a readable / writable temporary storage memory 1200 or a nonvolatile storage device 1300 such as a hard disk drive.

1 is a block diagram of a distributed computer network including a failure notification device according to a first embodiment of the present invention. It is a block diagram which shows an example of the whole network monitoring system structure using server management software. It is a block diagram which shows an example of the whole existing network monitoring system structure before adding a monitoring object apparatus. It is a block diagram which shows an example of the whole existing network monitoring system structure after adding a monitoring object apparatus. It is a figure which shows an example of the content of the failure log file by the 1st Embodiment of this invention. It is a flowchart showing the process of the failure monitoring function by the 1st Embodiment of this invention. It is a flowchart showing the process of the failure management function by the 1st Embodiment of this invention. It is a flowchart showing the process of the failure notification function by the 1st Embodiment of this invention. It is a block diagram which shows the structure of the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the 4th Embodiment of this invention. It is a block diagram which shows the information processing apparatus which performs this invention by a computer program.

1 Monitored UNIX device 2 Maintenance network monitoring device 3 Monitored device A
4 Monitoring target device B
5 Monitoring target device C
6 Monitored device D
7 Monitoring target device E
8 Device F to be monitored
9 Wide area LAN
11 Monitoring Agent Function 12 System Log Function 12a System Log 12b Various Logs 12c Fault Log 12d System Log Setting File 13 Fault Monitoring Function 14 Fault Management Function 14a Fault Notification Information Management Table 15 Fault Notification Function 21 GUI Screen 100 Monitored Device 101 Application Program 102 Monitoring Agent Function 110 Monitoring Target Device 111 Application Program 112 Monitoring Agent Function 120 Monitoring Target Device 121 Application Program 122 Monitoring Agent Function 130 Maintenance Network Monitoring Device 131 Network Monitoring Manager Function 131a GUI Screen 140 Monitoring Target Device 150 Monitoring Target Device 160 Monitoring Target device 141 Application program 151 Application Application program 162 Monitoring agent function 170 Maintenance network monitoring device 171 Integrated monitoring function 171a Maintenance work GUI screen 172 Network monitoring manager function 172a GUI screen 200 Monitored UNUX device 202a System log 202b Various logs 202c Fault log 203 Fault monitoring function 204 Failure Management Function 204a Failure Notification Information Management Table 205 Failure Notification Function 206 Application Program 207 Application Program 210 Maintenance Network Monitoring Device 211 GUI Screen
220 Device A to be monitored
230 Device B to be monitored
240 Monitoring target device C
250 Monitoring target device D
260 Monitoring target device E
270 Monitoring target device F
300 Failure Notification Device 301 Failure Notification Device 302 Failure Notification Device 310 Monitoring Unit 320 Analysis Unit 340 Notification Unit 1000 Information Processing Device 1100 CPU
1200 Temporary storage memory 1300 Storage device

Claims (9)

A monitoring unit for acquiring a log relating to a failure from an operation system included in the monitoring target device;
An analysis unit for determining the importance of the log acquired from the operation system;
Among the logs, a notification unit for notifying failure notification information indicating the content of the log whose importance is equal to or higher than a threshold value;
A storage unit for storing the log equal to or higher than the threshold;
A management unit that monitors the storage unit and registers the new log as the failure notification information in a management table included in the monitoring target device when the new log is registered;
The notification unit monitors the management table and, when new failure notification information is registered, reads and notifies the new failure notification information from the management table, and the reading is completed in the management table A failure notification device comprising a function of attaching a marker to the new failure notification information . An execution monitoring unit for monitoring the application program;
The failure notification apparatus according to claim 1, wherein the management unit registers a failure message regarding the application program acquired by the execution monitoring unit as the failure notification information in the management table.   The analysis unit determines importance of the log for each of a plurality of application programs that can be executed by the monitoring target device, and the notification unit corresponds to an application program executed by the monitoring target device. The failure notification device according to claim 1, wherein the content of the log is notified as failure notification information. A monitoring process for acquiring a log relating to a failure from an operation system included in the monitoring target device;
An analysis process for determining the importance of the log acquired from the operation system;
Among the logs, a notification process for notifying failure notification information indicating the content of the log having the importance level equal to or higher than a threshold value;
A process of storing the log of the threshold value or more in a storage unit;
When the storage unit is monitored and a new log is registered, the computer executes a management process for registering the new log as the failure notification information in a management table provided in the monitoring target device, and
The notification process monitors the management table and, when new failure notification information is registered, reads and notifies the new failure notification information from the management table, and the reading is completed in the management table A failure notification program comprising a process of adding a marker to the new failure notification information . An execution monitoring process for monitoring the application program;
5. The fault notification program according to claim 4, wherein the management process includes a process of registering a fault message related to the application program acquired in the execution monitoring process as the fault notification information in the management table.   The analysis process includes a process of determining the importance of the log for each of a plurality of application programs that can be executed by the monitoring target device, and the notification process is an application executed by the monitoring target device 6. The failure notification program according to claim 4, further comprising a process of notifying the contents of the log corresponding to the program as failure notification information. Obtain a log related to the failure from the operation system of the monitored device,
Determining the importance of the log obtained from the operation system;
Notifying the failure notification information indicating the content of the log having the importance level equal to or higher than the threshold among the logs
Save the log above the threshold in the storage unit,
When the storage unit is monitored and the new log is registered, the new log is registered as the failure notification information in the management table included in the monitoring target device,
The management table is monitored, and when the new failure notification information is registered, the new failure notification information is read out from the management table and notified, and the new failure that has been read out in the management table A failure notification method characterized by attaching a marker to notification information . Monitor application programs
The failure notification method according to claim 7, wherein a failure message related to the application program acquired by monitoring the application program is registered in the management table as the failure notification information.   The degree of importance of the log is determined for each of a plurality of application programs that can be executed by the monitoring target device, and the content of the log corresponding to the application program being executed by the monitoring target device is the failure notification information. The failure notification method according to claim 7 or 8, which is notified as follows.

Images