JP6816891B2 - Failure content identification device, system, method, and program - Google Patents

Description

The present invention relates to a failure content identifying device, a system, a method, and a program for identifying a failure content of software installed in an information processing device.

Identifying the details of a failure in software installed on an information processing device (server, etc.) Normally, when a log information or message is acquired, the acquired log is used in a database that stores the failure information. Identify the details of the software failure by extracting the details of the failure corresponding to the information. There is a technique that makes it possible to identify software failure details by using information on system and component configurations even if there is no failure content corresponding to the acquired log information or message in the database (for example, Patent Document 1, 2).

International Publication No. 2014/196129 International Publication No. 2015/079564

The following analysis is provided by the inventor of the present application.

However, in the techniques described in Patent Documents 1 and 2, when there is a failure content corresponding to the acquired log information or message in the database, the failure content is uniformly specified, and the correct failure content is specified. May not be possible.

A main subject of the present invention is a failure content identification device, system, method, and a failure content identification device, a system, a method, which can contribute to identifying the correct failure content even if there is a failure content corresponding to the acquired log information or message in the database. To provide a program.

The failure content identifying device according to the first viewpoint includes a storage unit that stores data and a control unit that controls the storage unit and performs predetermined information processing. The storage unit includes a first database acquired from the information processing device, which is organized by associating and organizing the failure occurrence date and time and the information related to the failure occurrence software, the information related to the software, and the name of the log information. Stores the running message and the second database in which the startup completion message is associated and organized. The control unit performs a process of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failure occurrence software in the first database from the second database, and the information processing apparatus. In the process of acquiring the log information corresponding to the name of the extracted log information and the acquired log information, there is the same message as the running message of the second database, and the message of the first database is described. The difference between the failure occurrence date and time and the output date and time of the activated message included in the acquired log information is within the first predetermined time, and in the acquired log information, the activation of the second database is performed. There is the same message as the completion message, and the difference between the failure occurrence date and time of the first database and the output date and time of the startup completion message included in the acquired log information is the second predetermined time or more. At times, a process of transmitting a first notification notifying that a software start delay failure has occurred to the information processing apparatus is performed.

The failure content identification system according to the second viewpoint includes a failure content identification device according to the first viewpoint and an information processing device communicably connected to the failure content identification device.

The method for identifying the failure content according to the third viewpoint includes a step of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failure occurrence software in the first database from the second database and information processing. In the step of acquiring the log information corresponding to the name of the extracted log information from the apparatus and the acquired log information, there is the same message as the message during the startup of the second database, and the first database The difference between the failure occurrence date and time of the above and the output date and time of the activated message included in the acquired log information is within the first predetermined time, and the second database is started in the acquired log information. There is the same message as the completion message, and the difference between the failure occurrence date and time of the first database and the output date and time of the startup completion message included in the acquired log information is the second predetermined time or more. Includes, sometimes, a step of transmitting a first notification to the information processing apparatus notifying that a software startup delay failure has occurred. Each said step is performed by hardware resources. The first database is a database obtained by associating and organizing information on a failure occurrence date and time and failure occurrence software related to the information processing device acquired from the information processing device. The second database is a database in which information related to software, names of log information, messages during startup, and messages of completion of startup are associated and organized.

The program according to the fourth viewpoint is a process of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failure occurrence software in the first database from the second database, and from the information processing apparatus. , The process of acquiring the log information corresponding to the name of the extracted log information, and the acquired log information have the same message as the message during the startup of the second database, and the failure of the first database. The difference between the occurrence date and time and the output date and time of the activated message included in the acquired log information is within the first predetermined time, and in the acquired log information, the startup of the second database is completed. When there is the same message as the message, and the difference between the failure occurrence date and time of the first database and the output date and time of the startup completion message included in the acquired log information is greater than or equal to the second predetermined time. The hardware resource is made to execute the process of transmitting the first notification notifying that the software start delay failure has occurred to the information processing apparatus. The first database is a database obtained by associating and organizing information on a failure occurrence date and time and failure occurrence software related to the information processing device acquired from the information processing device. The second database is a database in which information related to software, names of log information, messages during startup, and messages of completion of startup are associated and organized. The program according to the fourth viewpoint can be recorded on a non-transient recording medium.

According to the first to fourth viewpoints, it is possible to contribute to identifying the correct content of the failure.

It is a block diagram which shows typically the structure of the failure content identification system which concerns on Embodiment 1. It is a table which shows typically the structure of the example of the failure situation information database used in the failure content identification system which concerns on Embodiment 1. It is a table which shows typically the structure of the example of the failure information database used in the failure content identification system which concerns on Embodiment 1. It is a table which shows typically the structure of the example of the start confirmation database used in the failure content identification system which concerns on Embodiment 1. It is a table which shows typically the structure of the example of the failure occurrence confirmation database used in the failure content identification system which concerns on Embodiment 1. It is a table which shows typically the structure of the example of the update confirmation database used in the failure content identification system which concerns on Embodiment 1. This is an example of a message during startup used in the failure content identification system according to the first embodiment. This is an example of a start-up completion message used in the failure content identification system according to the first embodiment. It is a flowchart which schematically shows the operation of the control part of the failure content identification device in the failure content identification system which concerns on Embodiment 1. FIG. FIG. 5 is a flowchart following FIG. 9 schematically showing the operation of the control unit of the failure content identification device in the failure content identification system according to the first embodiment. FIG. 5 is a flowchart following FIG. 10 schematically showing the operation of the control unit of the failure content identification device in the failure content identification system according to the first embodiment. FIG. 5 is a flowchart following FIG. 11 schematically showing the operation of the control unit of the failure content identification device in the failure content identification system according to the first embodiment. FIG. 5 is a flowchart following FIG. 12, which schematically shows the operation of the control unit of the failure content identification device in the failure content identification system according to the first embodiment. FIG. 5 is a flowchart following FIG. 13 schematically showing the operation of the control unit of the failure content identification device in the failure content identification system according to the first embodiment. It is a flowchart following FIG. 14 which schematically shows the operation of the control part of the failure content identification apparatus in the failure content identification system which concerns on Embodiment 1. FIG. FIG. 5 is a flowchart following FIG. 15 schematically showing the operation of the control unit of the failure content identification device in the failure content identification system according to the first embodiment. FIG. 5 is a flowchart following FIG. 16 schematically showing the operation of the control unit of the failure content identification device in the failure content identification system according to the first embodiment. It is a block diagram which shows typically the structure of the failure content identification system which concerns on Embodiment 2. It is the flowchart which showed typically the operation of the control part of the fault content identification apparatus in the fault content identification system which concerns on Embodiment 2.

Hereinafter, embodiments will be described with reference to the drawings. In addition, when the drawing reference reference numerals are attached in this application, they are for the purpose of assisting understanding only, and are not intended to be limited to the illustrated embodiment. Further, the following embodiments are merely examples, and do not limit the present invention. Further, the connecting lines between blocks such as drawings referred to in the following description include both bidirectional and unidirectional. The one-way arrow schematically shows the flow of the main signal (data), and does not exclude interactivity.

[Embodiment 1]
The failure content identification system according to the first embodiment will be described with reference to the drawings. FIG. 1 is a block diagram schematically showing the configuration of the failure content identification system according to the first embodiment. FIG. 2 is a table schematically showing the configuration of an example of the failure status information database used in the failure content identification system according to the first embodiment. FIG. 3 is a table schematically showing the configuration of an example of the failure information database used in the failure content identification system according to the first embodiment. FIG. 4 is a table schematically showing the configuration of an example of the start confirmation database used in the failure content identification system according to the first embodiment. FIG. 5 is a table schematically showing the configuration of an example of the failure occurrence confirmation database used in the failure content identification system according to the first embodiment. FIG. 6 is a table schematically showing the configuration of an example of the update confirmation database used in the failure content identification system according to the first embodiment. FIG. 7 is an example of a message during activation used in the failure content identification system according to the first embodiment. FIG. 8 is an example of a start-up completion message used in the failure content identification system according to the first embodiment.

The failure content identification system 1 is a system that identifies the failure content of the software installed in the customer device 100 with the failure content identification device 300 (see FIG. 1). The failure content identification system 1 includes a customer device 100, a network 200, and a failure content identification device 300.

The customer device 100 is an information processing device used (owned or rented) by the customer. The customer device 100 includes not only a single device but also a system in which a plurality of devices cooperate with each other. The customer device 100 has a control unit 110, an input unit 120, an output unit 130, a communication unit 140, and a storage unit 150 as main components.

The control unit 110 is a functional unit that controls the input unit 120, the output unit 130, the communication unit 140, and the storage unit 150 (see FIG. 1). The control unit 110 controls the input unit 120 to take in the information input from the input unit 120. The control unit 110 controls the output unit 130 to cause the output unit 130 to output information. The control unit 110 controls the communication unit 140 to send and receive information to the failure content identification device 300. The control unit 110 inputs / outputs data to / from the storage unit 150, and writes / reads data to / from the storage unit 150. The control unit 110 performs predetermined information processing by executing software (including operating system software).

When a software failure occurs, the control unit 110 identifies the failure by the operating system or the failed software. The control unit 110 outputs log information 151 corresponding to the failure identified by the operating system or the software that caused the failure. The control unit 110 stores the output log information 151 in the storage unit 150. The control unit 110 causes the failure content identification device 300 to transmit the log information 151 stored in the storage unit 150 through the communication unit 140. The control unit 110 acquires the failure status information input from the input unit 120 by the operation of the user of the customer device 100. The control unit 110 causes the failure content identification device 300 to transmit the acquired failure status information through the communication unit 140. When the control unit 110 receives the failure information from the failure content identification device 300 through the communication unit 140, the control unit 110 outputs the received failure information from the output unit 130. Other details of the control unit 110 will be described later.

Here, the failure status information is information including the failure occurrence date and time, the failure occurrence software, the failure occurrence message, and the operation immediately before the failure occurrence, which are input by the user from the input unit 120 when the failure occurs. The failure status information is information necessary for determining the occurrence of a failure. The failure status information may be input by the user of the customer device 100 or may be generated by the control unit 110. It is preferable that the failure status information can be input by selecting from a plurality of predetermined information (for example, a character string) (for example, selecting with a pull-down menu or selecting with a radio button). The failure status information does not have to be input for all items, and may be input only for the items necessary for performing the operation to be performed. The failure status information may be stored in the storage unit 150 together with the log information 151 so that it can be acquired when necessary.

The failure occurrence date and time is the date and time when the failure occurrence message is output (for example, displayed) from the output unit 130 by the operating system or the failure software. The failure occurrence date and time may be the date and time when the user of the customer device 100 recognizes the failure occurrence message, and it is not necessary to accurately input the date and time at the moment when the message is output.

The failure occurrence software is information (for example, the name of the software) that identifies the software that has been recognized as having a failure by the user of the customer device 100. The name of the failure occurrence software can be the information included in the failure occurrence message.

The failure occurrence message is a message output (for example, displayed) from the output unit 130 by the operating system or the failure software at the time of failure occurrence (hereinafter, the same applies). The failure occurrence message can be assumed to have been read by the user of the customer device 100. The failure message contains information that can identify the software that output the message. The message when a failure occurs is not essential information.

The operation immediately before the occurrence of a failure is the content of the operation performed by the user of the customer device 100 immediately before the occurrence of the failure (between the time points prior to the time when the event presumed to be the failure occurs and a predetermined time). The event presumed to be a failure includes, for example, a case where a message at the time of failure is not output, but the software is started after a predetermined ratio of time required for starting the software, or a case where the software is not started.

The input unit 120 is a functional unit for inputting information (see FIG. 1). For the input unit 120, for example, a keyboard, mouse, touch panel, microphone, button, or other input means can be used, and an information terminal or the like having an input unit communicably connected via a communication unit (not shown) is used. You may.

The output unit 130 is a functional unit for outputting information (display, audio output, printing, etc.) (see FIG. 1). As the output unit 130, for example, a display for displaying, a printer for printing, or other output means can be used, and an information terminal or the like having an output unit communicably connected via a communication unit (not shown) is used. May be good. Further, instead of using the output unit 130, information is output by using another information terminal or the like (not shown; for example, a terminal used by the user) connected through the communication unit 140 and the network 200. May be good.

The communication unit 140 is a functional unit (for example, an interface or the like) for communicating (transmitting and receiving) information (see FIG. 1). The communication unit 140 is communicably connected to the network 200.

The storage unit 150 is a functional unit that stores information such as various data, programs, and files (see FIG. 1). As the storage unit 150, for example, a hard disk device, an externally connected RAID (Redundant Arrays of Independent Disks) device, or the like can be used, and any non-volatile storage device may be used. The storage unit 150 stores the installed software. The storage unit 150 stores the log information 151.

Here, the log information 151 is information related to the execution results of various commands required for software failure analysis (fault investigation) output by the operating system or the software in which the failure has occurred. The log information 151 includes the name of the log information (file name used by the software) and the message (message in the log information). Since the log information 151 includes information on the types of operating systems and software, and information indicating their versions, the log information 151 can be used when specifying such information. If the log information 151 is output by the operating system, it may not be necessary because it is used only in a predetermined process. The log information 151 is stored in the storage unit 150 and can be acquired when necessary.

The network 200 is an information communication network that connects the customer device 100 and the failure content identification device 300 so as to be able to communicate by wire or wirelessly (see FIG. 1).

The failure content identification device 300 is an information processing device (hardware resource) that identifies the failure content of the software installed in the customer device 100 (see FIG. 1). The failure content identification device 300 includes a control unit 310, an input unit 320, an output unit 330, a communication unit 340, and a storage unit 350.

The control unit 310 is a functional unit that controls an input unit 320, an output unit 330, a communication unit 340, and a storage unit 350 (see FIG. 1). The control unit 310 controls the input unit 320 to take in the information input from the input unit 320. The control unit 310 controls the output unit 330 to cause the output unit 330 to output information. The control unit 310 controls the communication unit 340 to send and receive information to and from the customer device 100. The control unit 310 inputs / outputs data to / from the storage unit 350, and writes / reads data to / from various databases 351 to 355 stored in the storage unit 350. By executing software, the control unit 310 performs predetermined information processing by appropriately using various databases 351 to 355 and the like.

When the control unit 310 receives the failure status information from the customer device 100 through the communication unit 340, the control unit 310 registers the received failure status information in the failure status information database 351. When the control unit 310 receives the log information 151 from the customer device 100 through the communication unit 340, the control unit 310 determines whether or not a message corresponding to the message in the received log information 151 exists in the failure information database 352. When the corresponding message exists, the control unit 310 extracts the failure information associated with the corresponding message from the failure information database 352. The control unit 310 transmits the extracted failure information to the customer device 100 through the communication unit 340 and the network 200. The details of other operations of the control unit 310 will be described later.

The input unit 320 is a functional unit for inputting information (see FIG. 1). For the input unit 320, for example, a keyboard, mouse, touch panel, microphone, button, or other input means can be used, and an information terminal or the like having an input unit communicably connected via a communication unit (not shown) is used. You may.

The output unit 330 is a functional unit for outputting information (display, audio output, printing, etc.) (see FIG. 1). As the output unit 330, for example, a display for displaying, a printer for printing, or other output means can be used, and an information terminal or the like having an output unit communicably connected via a communication unit (not shown) is used. May be good. Further, instead of using the output unit 330, information is output by using another information terminal or the like (not shown; for example, a terminal used by the user) connected through the communication unit 340 and the network 200. May be good.

The communication unit 340 is a functional unit (for example, an interface or the like) for communicating (transmitting and receiving) information (see FIG. 1). The communication unit 340 is communicably connected to the network 200.

The storage unit 350 is a functional unit that stores information such as various data, programs, and files (see FIG. 1). As the storage unit 350, for example, a hard disk device, an externally connected RAID (Redundant Arrays of Independent Disks) device, or the like can be used, and any non-volatile storage device may be used. The storage unit 350 stores a program for identifying the content of a failure that has occurred in the software. The storage unit 350 stores the failure information database 352, the failure status information database 351, the start confirmation database 353, the failure occurrence confirmation database 354, and the update confirmation database 355.

The failure status information database 351 is a database (first database) that stores past failure status information of the customer device 100 in which a failure has occurred (see FIG. 1). The failure status information database 351 organizes and associates the failure occurrence date and time, the failure occurrence software, the failure occurrence message, and the operation immediately before the failure occurrence, which are elements of the failure status information (see FIG. 2).

The failure information database 352 is a database (third database) that stores past failure information and related information prepared in advance for each software (see FIG. 1). The failure information database 352 organizes and associates log information (name of log information, message in log information), failure information, cause, and operations required for failure recovery, which are elements of failure information (see FIG. 3). ). The name of the log information can be a file name (hereinafter, the same applies). The failure information includes only the case where a failure has occurred. The cause and the operation required for failure recovery are optional information and may not be included in the failure information database 352.

Here, two or more log information may be output from the same software. Since the log information file is output separately for each function of the software that output the log information file, the file name of each log information indicates that it is the log information of the software function. For example, when a software function has a communication function, the log information related to the communication function is output with a file name meaning the log information of the function, and the log information related to the screen display function is the log information of the function. It is output with a file name that means log information.

The startup confirmation database 353 is a database (second database) prepared in advance for each software and accumulating information for confirming startup and startup completion (see FIG. 1). The startup confirmation database 353 is associated with the names of software, startup messages, startup completion messages, and log information in an organized manner (see FIG. 4). Software is information that identifies software (hereinafter, the same applies). The booting message is a message in the log information output from the software or the operating system during booting (a message that can be confirmed to be booting). The boot completion message is a message in the log information output from the software or the operating system when the boot is completed (a message confirming that the boot is completed). The message during startup is different from the message when startup is completed. Further, the message during startup and the message of completion of startup are different from the messages (not shown) in the log information output at the start of startup (at the time of the latest startup command) for each software. The message in the log information output at the start of each software startup is stored separately from the startup message and the startup completion message. Here, the time at which the message in the log information output at the start of startup of each software is output is the time output at the location of the message in the log information, which is the activation disclosure time.

(Example of running message)
The file name of the log information output by the software instructed to start is "webotx_agent.log". The information indicating the running message output to the file name is the content shown in FIG. In the example of the message during startup in FIG. 7, the software instructed to start is the file name "webotx_agent.log" of the log information output by the software. In the example of the running message in Fig. 7, the message in the log information that means that the software is running, which is output when the software is started, is "OTX02050031 WEB0302: The web container is started. ".

(Example of startup completion message)
The file name of the log information output by the software instructed to start is "webotx_agent.log". The information indicating the start-up completion message output to the file name is the content shown in FIG. In the example of the start completion message of FIG. 8, the software instructed to start is the file name "webotx_agent.log" of the log information output by the software. In the example of the startup completion message in FIG. 8, the message in the log information indicating that the software has been started, which is output when the software has been started, is "OTX01205135: When the application server [domain1] is started. It was successful. " The time when the startup completion message is output is defined as the startup completion time. Since the message in the log information is output even during startup, the message at the time of completion of startup is detected and set as the startup completion time.

The failure occurrence confirmation database 354 is a database (fourth database) that stores information for confirming the failure occurrence due to the operation of each software (see FIG. 1). In the failure occurrence confirmation database 354, the names of the software, the failure occurrence message, the operation immediately before the failure occurrence, the operation output message, and the log information are organized and associated (see FIG. 5). The operation output message is a message output from the software or the operating system when the user performs an operation.

Here, the reason why the failure occurrence confirmation database 354 is set is as follows. When storing (backing up) the stored information in an external storage device, if the initial settings are made to a new tape device, I / O (Input) depends on the type of software (for example, Networker manufactured by DELL EMC). / Output) An error may be output. The I / O error is usually a message indicating that a failure has occurred, but in order to format a new tape for data storage used by software and separate and manage each data area, label information is provided for each data area. This is a message that occurs when the initial setting is different from the normal operation, not a failure, when the labeling operation to be added is performed when formatting. Therefore, the problem of the I / O error disappears once the initial setting is completed, and as a result, it can be determined that the failure has not occurred. It is determined whether the output content (or output message) of the log information does not cause an obstacle due to other operation contents, that is, whether it matches the data of the contents of a plurality of log information registered in advance. That is, by preparing in advance a failure occurrence confirmation database 354 associated with the presence / absence of an operation that matches the operation in which the judgment of the content of the log information changes for each log information, a search is performed when a failure occurs, and if there is matching information, Acquire the conditions (number of log information outputs, operation details before log occurrence) in that case, and if the combination of the operation details acquired together with the log information does not mean a failure, determine that a failure has occurred. Absent. The failure occurrence confirmation database 354 is a database necessary for realizing the above. As for the operation content before the log generation, it is necessary to register the operation content before the log generation in the failure content identification device 300 in order to correctly determine the presence or absence of a failure based on the log information.

The update confirmation database 355 is a database (fifth database) that stores information for confirming updates for each software (see FIG. 1). The update confirmation database 355 is organized and associated with software and update software application confirmation commands (see FIG. 6). The update software application confirmation command is a command for confirming the application of the updated software.

Here, the update software generally executes the update after confirming in advance the influence of the operation on the operating system and the application software installed in the information processing apparatus. Therefore, the update software is not automatically applied to the operating system and application software installed in the information processing device. Since the update software is not applied to the failed software, enter a different update software application confirmation command for each software to check whether the failure has occurred, and the latest update software will be updated. Check if it is applied. This confirmation includes the type of correction software applied to the file output after entering the update software application confirmation command.

Next, the operation of the control unit of the failure content identification device in the failure content identification system according to the first embodiment will be described with reference to the drawings. 9 to 17 are flowcharts schematically showing the operation of the control unit of the failure content identification device in the failure content identification system according to the first embodiment.

First, the control unit 310 of the failure content identification device 300 determines the software startup delay failure, so that the failure status information (failure occurrence date and time, failure occurrence software, failure occurrence message, and failure occurrence immediately before) from the customer device 100 Acquire (step A1; see FIG. 9) including any of the operations; as described above.

Here, when a failure occurs in the customer device 100, the failure status information is input to the customer device 100 by the user of the customer device 100 (it may be automatically generated by the customer device 100), and the failure content identification device 300 is input from the customer device 100. Is transmitted to the control unit 310 of the failure content identification device 300. The details of the failure status information are as described above.

Next, the control unit 310 stores the failure status information acquired in step A1 in the failure status information database 351 of the storage unit 350 (step A2; see FIG. 9).

Next, the control unit 310 extracts information related to the failure occurrence software corresponding to the failure status information acquired in step A1 from the failure status information database 351 (step A3; see FIG. 9).

Next, the control unit 310 extracts the name of the log information associated with the software corresponding to the information related to the failure occurrence software extracted in step A3 from the start confirmation database 353 (step A4; see FIG. 9).

Next, the control unit 310 remotely connects to the customer device 100, acquires the log information corresponding to the name of the log information extracted in step A4 from the customer device 100, and temporarily stores it (step A5; see FIG. 9). ..

Next, the control unit 310 extracts a running message associated with the software corresponding to the information related to the failure occurrence software extracted in step A3 from the start confirmation database 353 (step A6; see FIG. 9).

Next, the control unit 310 confirms whether or not there is the same starting message as the starting message extracted in step A6 in the log information temporarily stored in step A5 (step A7; see FIG. 9). If there is no same booting message (NO in step A7), it is determined that no software startup delay failure has occurred, and the process proceeds to step B1 for determining the hardware failure.

Here, the software startup delay failure refers to a failure in which it takes time (delay) to start the software due to the accumulation of temporary files accompanying the startup of the software. As a software startup delay failure, for example, when the software is started, the software creates a temporary file (temporary file) every time the software is started, and the operation is accumulated without being erased until the software is terminated. Due to these factors, the software startup time may become longer. This temporary file is created each time the software is started, and as a result, it takes a long time for the operating system software to acquire a list of a large number of accumulated temporary files, and as a result, the software is started and completed. Become slow. When a software startup delay failure occurs, the cause of the failure may be output (displayed, etc.). In addition, instructions for failure recovery such as deleting the created temporary file may be output.

If there is the same active message (YES in step A7), the control unit 310 extracts the output date and time of the activated message from the log information temporarily stored in step A5 (step A8; see FIG. 9).

Next, the control unit 310 extracts the failure occurrence date and time of the failure status information acquired in step A1 from the failure status information database 351 (step A9; see FIG. 10).

Next, the control unit 310 has a difference between the output date and time of the activated message extracted in step A8 and the failure occurrence date and time extracted in step A9 within a preset first predetermined time (for example, 1 hour). It is confirmed whether or not (step A10; see FIG. 10). If the difference between the output date and time of the message being started and the failure occurrence date and time is not within the first predetermined time (NO in step A10), it is determined that a software startup delay failure has not occurred, and a hardware failure judgment is made. Step B1 of.

When the difference between the output date and time of the message being started and the failure occurrence date and time is within the first predetermined time (YES in step A10), the control unit 310 extracts the failure occurrence software from the startup confirmation database 353 in step A3. Extract the startup completion message associated with the software corresponding to the information related to (step A11; see FIG. 10).

Next, the control unit 310 confirms whether or not the log information temporarily stored in step A5 has the same start-up completion message as the start-up completion message extracted in step A11 (step A12; see FIG. 10). If there is no same startup completion message (NO in step A12), it is determined that no software startup delay failure has occurred, and the process proceeds to step B1 for determining the hardware failure.

When there is the same activation completion message (YES in step A12), the control unit 310 extracts the output date and time of the activation completion message from the log information temporarily stored in step A5 (step A13; see FIG. 10).

Next, the control unit 310 sets a time difference between the output date and time of the activation message extracted in step A8 and the output date and time of the activation completion message extracted in step A13 as a preset second predetermined time (2). For example, it is confirmed whether or not it is 3 minutes or more (step A14; see FIG. 10). If the time difference between the output date and time of the message during startup and the output date and time of the message of startup completion is not greater than or equal to the second predetermined time (NO in step A14), it is determined that no software startup delay failure has occurred, and a hardware failure occurs. Proceed to step B1 for making a judgment.

When the time difference between the output date and time of the message being started and the output date and time of the message of starting completion is equal to or longer than the second predetermined time (YES in step A14), the control unit 310 determines that a software startup delay failure has occurred. A software startup delay failure occurrence notification (first notification) for determining and notifying the occurrence of the software startup delay failure is transmitted to the customer device 100 (step A15; see FIG. 10). After step A15, the process proceeds to step B1 for determining the hardware failure.

In step A15, the customer device 100 receives the software startup delay failure occurrence notification, the customer device 100 outputs (displays, etc.) the software startup delay failure occurrence notification, and the user of the customer device 100 is notified of the software startup delay in the customer device 100. It can notify the occurrence of a failure.

In the case of NO in step A7, in the case of NO in step A10, in the case of NO in step A12, in the case of NO in step A14, or after step A15, the control unit 310 fails to determine the hardware failure. Information related to the failure occurrence software corresponding to the failure status information acquired in step A1 is extracted from the status information database 351 (step B1; see FIG. 11).

Next, the control unit 310 selects a failure information database 352 including software corresponding to the information related to the failure occurrence software extracted in step B1 (step B2; see FIG. 11).

Next, the control unit 310 extracts a failure occurrence message corresponding to the failure status information acquired in step A1 from the failure status information database 351 (step B3; see FIG. 11).

Next, the control unit 310 extracts the failure information associated with the message in the log information including the same message as the failure occurrence message extracted in step B3 from the failure information database 352 selected in step B2 (step B4). See FIG. 11).

Next, the control unit 310 extracts the name of the log information associated with the failure information extracted in step B4 from the failure information database 352 selected in step B2 (step B5; see FIG. 11).

Next, the control unit 310 remotely connects to the customer device 100, acquires the log information corresponding to the name of the log information extracted in step B5 from the customer device 100, and temporarily stores the log information (step B6; see FIG. 11). ..

Next, the control unit 310 extracts a message from the log information temporarily stored in step B6 (step B7; see FIG. 11).

Next, the control unit 310 confirms in the failure information database 352 selected in step B2 whether or not there is failure information associated with the message in the same log information as the message extracted in step B7 (step B8; See FIG. 12). If there is no failure information (NO in step B8), the process proceeds to step B14.

When there is failure information (YES in step B8), the control unit 310 confirms whether the failure information extracted in step B4 is an operation indicating automatic recovery of hardware (step B9; see FIG. 12). If the operation does not indicate automatic hardware recovery (NO in step B9), it is determined that the failure information in the failure information database 352 has not been improved, and the process proceeds to step B14.

Here, in the log information temporarily stored in step B6, even though there is the same message (message indicating that a failure has occurred) in the log information corresponding to the failure information, the failure does not occur immediately. This is to confirm the exact occurrence of the failure. In addition, it is confirmed whether the failure information is an operation indicating automatic hardware recovery because the failure information includes an operation indicating automatic hardware recovery even though the failure has been recovered. This is to confirm whether or not it is, or whether or not it is mistaken for some other wording.

When the operation indicates automatic hardware recovery (YES in step B9), the control unit 310 uses the log information temporarily stored in step B6 to output the output date and time of the hardware failure message and the hardware automatic operation. The output date and time of the recovery message is extracted (step B10; see FIG. 12).

Here, the hardware failure occurrence message is a message output (for example, displayed) from the output unit 130 by the operating system or software recovered from the failure when a hardware failure occurs. The hardware automatic recovery message is a message output (for example, displayed) from the output unit 130 by the operating system or software recovered from the failure at the time of automatic hardware recovery (failure recovery).

Next, the control unit 310 confirms whether or not the output date and time of the hardware automatic recovery message extracted in step B10 is after the output date and time of the hardware failure occurrence message extracted in step B10 (step B11). See FIG. 12). If the output date and time of the hardware automatic recovery message is not after the output date and time of the hardware failure message (NO in step B11), the hardware failure message is output at the time after the hardware automatic recovery message. It is determined that the hardware failure is continuing, and the process proceeds to step B14.

Here, checking whether the output date and time of the hardware automatic recovery message is after the output date and time of the hardware failure message is checking whether the hardware is automatically recovered in the correct order. To do.

If the output date and time of the hardware automatic recovery message is after the output date and time of the hardware failure message (YES in step B11), the control unit 310 causes a hardware failure in the log information temporarily stored in step B6. It is confirmed whether or not the hour message and the hardware failure recovery message have been recorded a predetermined number of times or more within a predetermined time (step B12; see FIG. 12). If it has been recorded more than a predetermined number of times (YES in step B12), it is determined that there is an intermittent hardware failure, and the process proceeds to step B14.

Here, the intermittent hardware failure refers to a case where the output of a normal message and a failure message is repeated, although it is not a continuous failure. For example, in the case of a disk device, it is completely complete. It is not broken, but corresponds to the pre-breaking stage that needs to be replaced.

If it has not been recorded more than a predetermined number of times (NO in step B12), the control unit 310 determines that a hardware failure (fault corresponding to the failure information) has not occurred, and determines that no hardware failure has occurred. A hardware failure non-occurrence notification (second notification) is transmitted to the customer device 100 (step B13; see FIG. 12). After step B13, the process proceeds to step C1 for determining the failure by the operation immediately before the failure occurs.

In step B13, the customer device 100 receives the hardware failure non-occurrence notification, the customer device 100 outputs (displays, etc.) the hardware failure non-occurrence notification, and the user of the customer device 100 receives a hardware failure in the customer device 100. It is possible to notify that it has not occurred.

If there is no failure information (NO in step B8), or if the operation does not indicate automatic hardware recovery (NO in step B9), the output date and time of the failure recovery message is not after the output date and time of the failure occurrence message. If (NO in step B11) or if it has been recorded more than a predetermined number of times (YES in step B12), the control unit 310 determines that a failure (fault corresponding to failure information, hardware failure) has occurred. After determining, from the failure information database 352 selected in step B2, information related to the cause associated with the message in the same log information as the message extracted in step B7 and the operation required for failure recovery is extracted (step B14; FIG. 12).

Next, the control unit 310 transmits the failure information extracted in step B4 and the information related to the cause extracted in step B14 and the operation required for failure recovery to the customer device 100 (step B15; see FIG. 12). After step B15, the process proceeds to step C1 for determining the failure by the operation immediately before the failure occurs.

In step B15, the customer device 100 receives the failure information and the operation required for the cause and the failure recovery, outputs (displays, etc.) the failure information and the operation required for the cause and the failure recovery, and the customer device 100. It is possible to inform the user of the failure information in the customer device 100, the cause, and the operation necessary for the failure recovery. In the operation necessary for the cause and failure recovery, for example, it may be an instruction to replace the hard disk device.

After step B13 or step B15, the control unit 310 extracts information related to the failure occurrence software corresponding to the failure status information acquired in step A1 from the failure status information database 351 (step C1; see FIG. 13).

Next, the control unit 310 selects a failure occurrence confirmation database 354 including software corresponding to the information related to the failure occurrence software extracted in step C1 (step C2; see FIG. 13).

Next, the control unit 310 extracts a failure occurrence message corresponding to the failure status information acquired in step A1 from the failure status information database 351 (step C3; see FIG. 13).

Next, the control unit 310 extracts from the failure occurrence confirmation database 354 selected in step C2 the name of the log information corresponding to the same failure occurrence message as the failure occurrence message extracted in step C3 (step C4; FIG. See 13).

Next, the control unit 310 remotely connects to the customer device 100, acquires the log information corresponding to the name of the log information extracted in step C4 from the customer device 100, and temporarily stores the log information (step C5; see FIG. 13). ..

Next, the control unit 310 extracts information related to the operation immediately before the failure occurrence corresponding to the failure status information acquired in step A1 from the failure status information database 351 (step C6; see FIG. 13).

Next, the control unit 310 confirms whether or not there is the same information related to the operation immediately before the failure occurrence extracted in step C6 in the failure occurrence confirmation database 354 selected in step C2 ( Step C7; see FIG. 14). If there is no information related to the same operation immediately before the failure (NO in step C7), the output message at the time of failure occurs, but it is not necessary to judge whether or not the failure has occurred together with the operation details at this time. Proceed to step D1 for determining and determining a failure due to the application of the latest update software.

If there is information related to the same operation immediately before the occurrence of a failure (YES in step C7), the control unit 310 has the same log information temporarily stored in step C5 as the operation output message of the failure occurrence confirmation database 354 selected in step C2. Check if there is a message (step C8; see FIG. 14). If the operation output message is not included (NO in step C8), it is considered that the operation entered in the failure status information database 351 by the operator has not been performed, and the output message content is a failure occurrence, but the operation content at this time At the same time, it is determined that it is not necessary to determine whether or not a failure has occurred, and the process proceeds to step D1 for determining a failure due to the non-application of the latest update software.

Here, the operation output message of the failure occurrence confirmation database 354 is a failure message itself, but it is a message that is always generated by the operation of performing the initial setting, and only when this initial setting is performed, there is no problem in the specifications. It is a message, and once the initial settings are completed, the problem disappears. As a result, it is a message that may not have caused a failure.

When the operation output message is included (YES in step C8), the control unit 310 extracts the output date and time of the failure occurrence message and the output date and time of the operation output message from the log information temporarily stored in step C5. (Step C9; see FIG. 14).

Next, the control unit 310 sets the time difference between the output date and time of the failure occurrence message extracted in step C9 and the output date and time of the operation output message extracted in step C9 within a preset third predetermined time. It is confirmed whether or not there is (step C10; see FIG. 14). If it is not within the specified time (NO in step C10), the output message content is a failure, but it is judged that it is not necessary to judge whether or not a failure has occurred together with the operation content at this time, and the latest update software has not been released. Proceed to step D1 for determining the failure by application.

If it is within a predetermined time (YES in step C10), the control unit 310 determines that no failure due to the operation has occurred, and notifies that no failure has occurred due to the operation (third notification). Is transmitted to the customer device 100 (step C11; see FIG. 14). After step C11, the process proceeds to step D1 for determining a failure due to non-application of the latest update software.

The determination that the failure has not occurred in step C11 is when the failure formats the data storage used by the software on the tape and formats the label information in each data area in order to separate and manage each data area. , Indicates that it is an I / O error when the labeling operation to be added is performed, and indicates that the initial setting has been performed normally.

In step C11, the customer device 100 receives the failure non-occurrence notification, the customer device 100 outputs (displays, etc.) the failure non-occurrence notification, and the user of the customer device 100 is informed that the customer device 100 has not failed. I can inform you.

In the case of NO in step C7, in the case of NO in step C8, in the case of NO in step C10, or after step C11, the control unit 310 has acquired the failure in step A1 from the failure status information database 351 of the storage unit 350. Information related to the failure occurrence software corresponding to the status information is extracted (step D1; see FIG. 15).

Next, the control unit 310 selects the update confirmation database 355 including the software corresponding to the information related to the failure occurrence software extracted in step D1 (step D2; see FIG. 15).

Next, the control unit 310 extracts the update software application confirmation command associated with the software corresponding to the information related to the failure occurrence software extracted in step D2 from the update confirmation database 355 selected in step D2 (step D3; (See FIG. 15).

Next, the control unit 310 remotely connects to the customer device 100, acquires the execution log information from the customer device 100 by executing the update software application confirmation command extracted in step D3 on the customer device 100, and temporarily stores the execution log information ( Step D4; see FIG. 15).

Next, the control unit 310 confirms whether or not the execution log information temporarily stored in step D4 includes all the information related to the latest update software of the software published on the Internet (step D5; (See FIG. 15). If all the information related to the latest update software is included (YES in step D5), the process proceeds to step E1 for performing a normal failure determination.

Here, the information relating to the latest update software of the software published on the Internet may be collected in advance, or may be collected immediately before the step D5 is performed.

If all the information related to the latest update software is not included (NO in step D5), the control unit 310 remotely connects to the customer device 100 and connects the customer device 100 with the latest update software (patch program, patch program, patch program). (Also possible) is applied (step D6; see FIG. 15).

As a case of performing step D6, for example, when opening a PDF file on a WEB (World Wide Web) site with IE8 (Microsoft, Internet Explorer 8) or IE11 (Microsoft, Internet Explorer 11), it is being read. When the operation is stopped and the display is not performed, the update software may be applied to the customer device 100 based on the information that the latest update software is not applied.

By performing step D6, the customer apparatus 100 generates and stores log information in a state where all the latest update software is applied.

Next, the control unit 310 remotely connects to the customer device 100, acquires log information from the customer device 100 in a state in which all the latest update software has been applied, and temporarily stores the log information (step D7; see FIG. 15).

Next, the control unit 310 confirms whether or not the log information temporarily stored in step D7 includes a new message that is not included in the execution log information acquired in step D4 (step D8; see FIG. 15). If a new message is included (YES in step D8), it is determined that a failure other than the failure caused by not applying the update program has occurred (the failure is not recovered even if the update program is applied), and it is normal. Proceed to step E1 for determining the failure.

If no new message is included (NO in step D8), the control unit 310 recovers by applying the latest update software to the customer device 100, determines that no failure has occurred at this time, and notifies that fact. The update software application recovery failure non-occurrence notification (fourth notification) is transmitted to the customer device 100 (step D9; see FIG. 15). After step D9, the process proceeds to step E1 for making a normal failure determination.

In step D9, the customer device 100 receives the update software application recovery failure non-occurrence notification, the customer device 100 outputs (displays, etc.) the update software application recovery failure non-occurrence notification, and the customer device 100 users of the customer device 100 receive the update software application recovery failure non-occurrence notification. It can be recovered by applying the update software and can notify that no failure has occurred.

After YES in step D5, YES in step D8, or step D9, the control unit 310 extracts information related to the failure occurrence software corresponding to the failure status information acquired in step A1 from the failure status information database 351 (step). E1; see FIG. 16).

Next, the control unit 310 selects the failure information database 352 including the software corresponding to the information related to the failure occurrence software extracted in step E1 (step E2; see FIG. 16).

Next, the control unit 310 extracts a failure occurrence message corresponding to the failure status information acquired in step A1 from the failure status information database 351 (step E3; see FIG. 16).

Next, the control unit 310 extracts the failure information associated with the message in the log information including the same message as the failure occurrence message extracted in step E3 from the failure information database 352 selected in step E2 (step E4). See FIG. 16).

Next, the control unit 310 extracts the name of the log information associated with the failure information extracted in step E4 from the failure information database 352 selected in step E2 (step E5; see FIG. 16).

Next, the control unit 310 remotely connects to the customer device 100, acquires the log information (log information of the failure occurrence software) corresponding to the name of the log information extracted in step E5 from the customer device 100, and temporarily stores it. (Step E6; see FIG. 16).

Next, the control unit 310 extracts a message in the log information associated with the failure information extracted in step E4 from the failure information database 352 selected in step E2 (step E7; see FIG. 16).

Next, the control unit 310 confirms whether or not the log information temporarily stored in step E6 has the same message as the message in the log information extracted in step E7 (step E8; see FIG. 16). If there is the same message (YES in step E8), it is considered that there is no problem even if the normal failure determination is performed, and the process proceeds to step F1 for performing the normal failure determination.

If there is no same message (NO in step E8), the control unit 310 does not say that the software startup failure cannot be confirmed, connects remotely to the customer device 100, and acquires the log information output by the operating system from the customer device 100. And temporarily store it (step E9; see FIG. 16).

Here, if a certain software cannot be started, the log information output by the software that does not start does not output the log information or the message indicating the failure, but the log information output by the operating system indicates the failure related to the software. There is log information. Based on the content of the log information output by the operating system (content indicating a failure related to the software), it can be determined that the software is defective. The log information output by the software is log information that is output even in a normal state and information on starting and stopping the software is output.

Next, the control unit 310 confirms whether or not the log information output by the operating system temporarily stored in step E9 has the same message as the message in the log information extracted in step E7 (step E10; FIG. 16). reference). If there is no same message (NO in step E10), it is not regarded as a failure, and the process proceeds to step F1 for performing a normal failure determination.

If there is the same message (YES in step E10), the control unit 310 considers that a failure has occurred and is associated with the message in the log information extracted in step E7 from the failure information database 352 selected in step E2. The cause and the operation required for disaster recovery are extracted (step E11; see FIG. 16).

Next, the control unit 310 transmits the failure information extracted in step E4, the cause extracted in step E11, and the operation required for failure recovery to the customer device 100 (step E12; see FIG. 16). After step E12, the process proceeds to step F1.

In step E12, the customer device 100 receives the failure information and the operation required for the cause and failure recovery, outputs (displays, etc.) the failure information and the operation required for the cause and failure recovery, and the customer device 100. It is possible to inform the user of the failure information in the customer device 100, the cause, and the operation necessary for the failure recovery.

After YES in step E8, NO in step E10, or step E12, the control unit 310 notifies the customer device 100 of the presence or absence of a failure (software startup delay failure notification in step A15, failure not occurring in step B13). It is confirmed whether or not the notification, the failure non-occurrence notification in step C11, and the update software application recovery failure non-occurrence notification in step D9 have been transmitted (step F1; see FIG. 17). When the notification regarding the presence or absence of a failure has not been transmitted (NO in step F1), the control unit 310 considers that a failure that cannot be determined by the normal failure information has not occurred, and is a step for performing a normal failure determination. Proceed to F3.

When the notification regarding the presence / absence of a failure has been transmitted (YES in step F1), the control unit 310 considers that a failure that cannot be determined from the normal failure information has occurred, and the investigation of the presence / absence of the failure has been completed. A survey completion notification is transmitted to the customer device 100 (step F2; see FIG. 17), and then the process ends.

When the notification regarding the presence / absence of a failure has not been transmitted (NO in step F1), the control unit 310 obtains information related to the failure occurrence software corresponding to the failure status information acquired in step A1 from the failure status information database 351. Extract (step F3; see FIG. 17).

Next, the control unit 310 selects a failure information database 352 including software corresponding to the information related to the failure occurrence software extracted in step F3 (step F4; see FIG. 17).

Next, the control unit 310 extracts a failure occurrence message corresponding to the failure status information acquired in step A1 from the failure status information database 351 (step F5; see FIG. 17).

Next, the control unit 310 extracts the failure information associated with the message in the log information including the same message as the failure occurrence message extracted in step F5 from the failure information database 352 selected in step F4 (step F6). See FIG. 17).

Next, the control unit 310 extracts the name of the log information associated with the failure information extracted in step F6 from the failure information database 352 selected in step F4 (step F7; see FIG. 17).

Next, the control unit 310 remotely connects to the customer device 100, acquires the log information (log information of the failure occurrence software) corresponding to the name of the log information extracted in step F7 from the customer device 100, and temporarily stores it. (Step F8; see FIG. 17).

Next, the control unit 310 extracts a message in the log information associated with the failure information extracted in step F6 from the failure information database 352 selected in step F4 (step F9; see FIG. 17).

Next, the control unit 310 confirms whether or not the log information temporarily stored in step F8 has the same message as the message in the log information extracted in step F9 (step F10; see FIG. 17). If there is no same message (NO in step F10), the process proceeds to step F13.

If there is the same message (YES in step F10), the control unit 310 considers that a failure has occurred and is associated with the message in the log information extracted in step F9 from the failure information database 352 selected in step E2. The cause and the operation required for failure recovery are extracted (step F11; see FIG. 17).

Next, the control unit 310 transmits the failure information extracted in step F6, the cause extracted in step F11, and the operation required for failure recovery to the customer device 100 (step F12; see FIG. 17), and then ends. To do.

In step F12, the customer device 100 receives the failure information and the operation required for the cause and failure recovery, outputs (displays, etc.) the failure information and the operation required for the cause and failure recovery, and the customer device 100. It is possible to inform the user of the failure information in the customer device 100, the cause, and the operation necessary for the failure recovery.

If there is no same message (NO in step F10), the control unit 310 determines that the cause of the failure is unknown, and issues an unknown cause notification (fifth notification) notifying that the cause of the failure is unknown. It is transmitted to the device 100 (step F13; see FIG. 17), and then ends.

In step F13, the customer device 100 receives the unknown cause notification, outputs (displays, etc.) the unknown cause notification, and notifies the user of the customer device 100 that the cause of the failure in the customer device 100 is unknown. it can.

The operation of the control unit 310 of the failure content identification device 300 is as described above. Only one of step C1 to C11), failure determination due to non-application of the latest update software (steps D1 to D9), and normal failure determination (steps E1 to E12) may be performed.

According to the first embodiment, the message in the log information is not a failure, but the message in the log information is not a failure, but the correct failure content is obtained even if a failure actually occurs. Can contribute to the identification of.

[Embodiment 2]
The fault content identifying device according to the second embodiment will be described with reference to the drawings. FIG. 18 is a block diagram schematically showing the configuration of the failure content identification system according to the second embodiment.

The failure content identification system 1 is a system that identifies the failure content of the software installed in the information processing device 100 by the failure content identification device 300. The failure content identification system 1 includes an information processing device 100 and a failure content identification device 300.

The information processing device 100 is a device having information processing that is communicably connected to the failure content identification device.
..

The failure content identification device 300 includes a storage unit 350 that stores data, and a control unit 310 that controls the storage unit 350 and performs predetermined information processing.

The storage unit 350 stores the first database 351 and the second database 353. The first database 351 is a database acquired from the information processing device 100 and organized by associating information on the failure occurrence date and time and the failure occurrence software related to the information processing device 100. The second database 353 is a database in which information related to software, names of log information, starting messages, and starting completion messages are associated and organized.

The control unit 310 performs a process of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failure occurrence software of the first database 351 from the second database 353. The control unit 310 performs a process of acquiring log information corresponding to the name of the extracted log information from the information processing device 100. The control unit 310 performs a process of confirming that the acquired log information has the same message as the message during the startup of the second database 353. The control unit 310 performs a process of confirming that the difference between the failure occurrence date and time of the first database 351 and the output date and time of the activation message included in the acquired log information is within the first predetermined time. The control unit 310 performs a process of confirming that the acquired log information has the same message as the message of the completion of starting the second database 353. The control unit 310 performs a process of confirming that the difference between the failure occurrence date and time of the first database 351 and the output date and time of the activation completion message included in the acquired log information is equal to or longer than the second predetermined time. After confirming these, the control unit 310 performs a process of transmitting the first notification notifying that the software start delay failure has occurred to the information processing apparatus 100.

Next, the operation of the control unit of the failure content identification device in the failure content identification system according to the second embodiment will be described with reference to the drawings. FIG. 19 is a flowchart schematically showing the operation of the control unit of the failure content identification device in the failure content identification system according to the second embodiment. See FIG. 18 for the configuration of the failure content identification system.

First, the control unit 310 of the failure content identification device 300 extracts from the second database 353 the name of the log information associated with the information related to the software corresponding to the information related to the failure occurrence software in the first database 351 (step). G1).

Next, the control unit 310 acquires the log information corresponding to the name of the extracted log information from the information processing device 100 (step G2).

Next, the control unit 310 confirms that the acquired log information has the same message as the message during the startup of the second database 353 (step G3).

Next, the control unit 310 confirms that the difference between the failure occurrence date and time of the first database 351 and the output date and time of the active message included in the acquired log information is within the first predetermined time (1st predetermined time or less). Step G4).

Next, the control unit 310 confirms that the acquired log information has the same message as the message of the completion of starting the second database 353 (step G5).

Next, the control unit 310 confirms that the difference between the failure occurrence date and time of the first database 351 and the output date and time of the activation completion message included in the acquired log information is equal to or more than the second predetermined time. (Step G6).

Finally, after confirming steps G3 to G6, the control unit 310 performs a process of transmitting a first notification notifying that a software start delay failure has occurred to the information processing device 100 (step G7), and then ends. To do.

According to the second embodiment, it is possible to contribute to the identification of the correct fault content.

Some or all of the above embodiments may also be described, but not limited to:

(Additional note)
In the present invention, the form of the failure content specifying device according to the first viewpoint is possible.

In the failure content identification device according to the first viewpoint, the first database is organized by associating the failure occurrence date and time, the information related to the failure occurrence software, and the failure occurrence message regarding the information processing device. The storage unit further stores the information related to the software, the name of the log information, the message in the log information, and the third database organized by associating the failure information, and the control unit further stores the acquired log information. There is no message that is the same as the running message of the second database, or the difference between the failure occurrence date and time of the first database and the output date and time of the running message included in the acquired log information. Is not within the first predetermined time, or in the acquired log information, there is no same message as the message of the completion of the startup of the second database, or the failure occurrence date and time and the log information of the first database. When the difference from the output date and time of the startup completion message included in is not equal to or greater than the second predetermined time, the software corresponding to the information related to the failure occurrence software in the first database from the third database is involved. In the process of extracting the name of the log information associated with the information, the process of acquiring the log information corresponding to the name of the extracted log information from the information processing apparatus, and the acquired log information, the third There is the same message as the message in the log information of the database, the failure information of the third database is an operation indicating automatic recovery of hardware, and the hardware included in the acquired log information. The output date and time of the hardware automatic recovery message is later than the output date and time of the hardware failure occurrence message included in the acquired log information, and in the acquired log information, the hardware automatic recovery message And the process of transmitting the second notification to the information processing apparatus when the message at the time of the occurrence of the hardware failure has not been recorded more than a predetermined number of times within the predetermined time, and when the message indicating that the hardware failure has not occurred. Do more.

In the failure content identification device according to the first viewpoint, the third database is necessary for the information related to the software, the name of the log information, the message in the log information, the failure information, and the cause and failure recovery. It is a database organized by associating various operations, and the control unit does not have the same message as the message in the log information of the third database in the acquired log information, or the failure information of the third database. Does not operate to indicate automatic hardware recovery, or when the output date and time of the hardware automatic recovery message included in the acquired log information is the occurrence of a hardware failure included in the acquired log information. When the message at the time of automatic recovery of hardware and the message at the time of occurrence of a hardware failure are recorded a predetermined number of times or more within a predetermined time in the log information acquired, which is not later than the output date and time of the message, the above. From the third database, the process of extracting the cause associated with the message in the log information and the operation required for failure recovery, and the extracted failure information and the cause and the operation required for failure recovery are transmitted to the information processing apparatus. The process of transmitting is further performed.

In the failure content identification device according to the first viewpoint, the first database associates the failure occurrence date and time, the information related to the failure occurrence software, and the information related to the operation immediately before the failure occurrence with respect to the information processing device. The storage unit further stores the fourth database organized by associating the names of the information related to the software, the message at the time of failure, the information related to the operation immediately before the failure, the output message at the time of operation, and the log information. Then, the control unit does not have the same message as the running message of the second database in the acquired log information, or includes the failure occurrence date and time of the first database and the acquired log information. The difference from the output date and time of the message being started is not within the first predetermined time, or the acquired log information does not have the same message as the message of the start completion of the second database, or the above. When the difference between the failure occurrence date and time of the first database and the output date and time of the start completion message included in the log information is not equal to or more than the second predetermined time, the fourth database is referred to as the first database. A process of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failure occurrence software, and a process of acquiring the log information corresponding to the name of the extracted log information from the information processing apparatus. And, in the fourth database, there is the same information related to the operation immediately before the failure occurrence as the information related to the operation immediately before the failure occurrence of the first database, and in the acquired log information, at the time of the operation of the fourth database. There is the same message as the output message, and the time difference between the output date and time of the failure occurrence message included in the log information and the output date and time of the operation output message included in the log information is within the third predetermined time. Further, a process of transmitting a third notification to the information processing apparatus, which informs that a failure due to the operation has not occurred, is further performed.

In the failure content identification device according to the first viewpoint, the storage unit further stores a fifth database organized by associating information related to software and an update software application confirmation command, and the control unit has acquired the fifth database. In the log information, there is no same message as the running message of the second database, or the failure occurrence date and time of the first database and the output date and time of the starting message included in the acquired log information. There is no difference from the first predetermined time, or the acquired log information does not have the same message as the start completion message of the second database, or the failure occurrence date and time of the first database. When the difference from the output date and time of the startup completion message included in the log information is not equal to or more than the second predetermined time, the information related to the failure-generating software in the first database corresponds to the information from the fifth database. A process of extracting an update software application confirmation command associated with information related to software, and a process of acquiring execution log information from the information processing device by executing the extracted update software application confirmation command in the information processing device. When the acquired execution log information does not include all the information related to the latest update software of the software published on the Internet, all the latest update software is applied and the information processing device is used. , The process of acquiring the log information in the state where all the latest update software is applied, and when there is no new message in the acquired execution log information in the acquired log information, the said to the information processing apparatus. It recovers by applying the latest update software, and further performs a process of transmitting a fourth notification to the information processing apparatus notifying that a failure has not occurred at the present time.

In the failure content identification device according to the first viewpoint, the first database is organized by associating the failure occurrence date and time, the information related to the failure occurrence software, and the failure occurrence message regarding the information processing device. The storage unit further stores a third database that organizes information related to software, names of log information, messages in log information, failure information, and causes and operations necessary for failure recovery. In the acquired log information, the control unit does not have the same message as the active message of the second database, or the failure occurrence date and time of the first database and the activation included in the acquired log information. There is no difference between the output date and time of the message in the message within the first predetermined time, or the acquired log information does not have the same message as the start completion message of the second database, or the first database When the difference between the failure occurrence date and time and the output date and time of the startup completion message included in the log information is not equal to or more than the second predetermined time, it corresponds to the information related to the failure occurrence software in the first database. A process of selecting the third database of information related to software, and a process of extracting failure information containing the same message as the message at the time of failure occurrence of the first database from the selected third database. A process of extracting the name of the log information associated with the extracted failure information from the third database, and a process of acquiring the log information corresponding to the name of the extracted log information from the information processing apparatus. In the process of extracting a message in the log information associated with the failure information including the same message as the failure occurrence message of the first database from the selected third database, and in the acquired log information. , When the same message as the message in the extracted log information does not exist, the process of acquiring the log information output by the operating system from the information processing apparatus and the acquired log information output by the operating system are extracted. When there is the same message as the message in the log information, the process and extraction of the cause associated with the extracted message in the log information and the operation required for failure recovery are extracted from the selected third database. The above-mentioned failure information, the cause, and the operation required for failure recovery are described above. Further, the process of transmitting to the information processing device is performed.

In the failure content identification device according to the first viewpoint, when the acquired log information has the same message as the message in the extracted log information, the control unit extracts it from the selected third database. A process of extracting the cause associated with the message in the log information and an operation required for failure recovery, and a process of transmitting the extracted failure information and the cause and an operation required for failure recovery to the information processing apparatus. , And when the acquired log information output by the operating system does not have the same message as the extracted message in the log information, a fifth notification is sent to notify that the cause of the failure is unknown. The process of transmitting to the information processing device is further performed.

In the present invention, it is possible to form a failure content identification system according to the second viewpoint.

In the present invention, it is possible to form a method for identifying the content of a failure according to the third viewpoint.

In the present invention, the form of the program according to the fourth viewpoint is possible.

The disclosures of the above patent documents shall be incorporated into this document by citation. Within the framework of the entire disclosure of the present invention (including the scope of claims and drawings), the embodiments or examples can be changed or adjusted based on the basic technical idea thereof. Further, various combinations or selections (necessary) of various disclosure elements (including each element of each claim, each element of each embodiment or embodiment, each element of each drawing, etc.) within the framework of all disclosure of the present invention. (Not selected) is possible. That is, it goes without saying that the present invention includes all disclosures including claims and drawings, and various modifications and modifications that can be made by those skilled in the art in accordance with technical ideas. In addition, regarding the numerical values and numerical ranges described in the present application, it is considered that arbitrary intermediate values, lower numerical values, and small ranges are described even if not specified.

1 Failure content identification system 100 Customer device (information processing device)
110 Control unit 120 Input unit 130 Output unit 140 Communication unit 150 Storage unit 151 Log information 200 Network 300 Failure content identification device 310 Control unit 320 Input unit 330 Output unit 340 Communication unit 350 Storage unit 351 Failure status information database (first database)
352 Failure information database (third database)
353 Start confirmation database (second database)
354 Failure occurrence confirmation database (4th database)
355 update confirmation database (5th database)

Claims (10)

A storage unit that stores data and
A control unit that controls the storage unit and performs predetermined information processing,
With
The storage unit
The first database acquired from the information processing device and organized by associating the failure occurrence date and time and the information related to the failure occurrence software related to the information processing device.
A second database that organizes software-related information, log information names, startup messages, and startup completion messages in association with each other.
Remember,
The control unit
A process of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failed software in the first database from the second database, and
A process of acquiring log information corresponding to the name of the extracted log information from the information processing device, and
In the acquired log information, there is the same message as the running message of the second database, and
The difference between the failure occurrence date and time of the first database and the output date and time of the activated message included in the acquired log information is within the first predetermined time, and
In the acquired log information, there is the same message as the message of the completion of the startup of the second database, and
The difference between the failure occurrence date and time of the first database and the output date and time of the activation completion message included in the acquired log information is equal to or greater than the second predetermined time.
sometimes,
A process of transmitting a first notification notifying that a software start delay failure has occurred to the information processing device, and
I do,
Failure content identification device. The first database is organized by associating the failure occurrence date and time, the information related to the failure occurrence software, and the failure occurrence message regarding the information processing device.
The storage unit further stores a third database in which information related to software, names of log information, messages in log information, and failure information are associated and organized.
The control unit
In the acquired log information, the same message as the running message of the second database does not exist, or
The difference between the failure occurrence date and time of the first database and the output date and time of the activated message included in the acquired log information is not within the first predetermined time, or
In the acquired log information, there is no message that is the same as the message that the startup of the second database is completed, or
The difference between the failure occurrence date and time of the first database and the output date and time of the startup completion message included in the log information is not greater than or equal to the second predetermined time.
sometimes,
A process of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failed software in the first database from the third database, and
A process of acquiring log information corresponding to the name of the extracted log information from the information processing device, and
In the third database, there is failure information associated with the message in the same log information as the acquired message of the log information, and
The failure information in the third database is an operation indicating automatic hardware recovery, and
The output date and time of the hardware automatic recovery message included in the acquired log information is later than the output date and time of the hardware failure occurrence message included in the acquired log information, and
In the acquired log information, the hardware automatic recovery message and the hardware failure occurrence message are not recorded more than a predetermined number of times within a predetermined time.
sometimes,
A process of transmitting a second notification to the information processing device notifying that a hardware failure has not occurred, and
Do more,
The device for identifying the content of a failure according to claim 1. The third database is a database in which information related to the software, names of the log information, messages in the log information, the failure information, and causes and operations necessary for failure recovery are associated and organized.
The control unit
In the third database, there is no failure information associated with the message in the same log information as the acquired message of the log information, or
The failure information in the third database does not indicate the automatic recovery of hardware, or
The output date and time of the hardware automatic recovery message included in the acquired log information is not later than the output date and time of the hardware failure occurrence message included in the acquired log information, or
In the acquired log information, the hardware automatic recovery message and the hardware failure occurrence message are recorded a predetermined number of times or more within a predetermined time.
sometimes,
The process of extracting the cause associated with the message in the log information and the operation required for disaster recovery from the third database, and
A process of transmitting the extracted failure information, the cause, and an operation required for failure recovery to the information processing apparatus, and
To do more,
The device for identifying the content of a failure according to claim 2. The first database is organized by associating the information processing apparatus with the date and time when the failure occurred, the information related to the failure occurrence software, and the information related to the operation immediately before the failure occurrence.
The storage unit further stores a fourth database in which information related to software, a message at the time of failure occurrence, information related to an operation immediately before the occurrence of a failure, an output message at the time of operation, and a log information are associated and organized.
The control unit
In the acquired log information, the same message as the running message of the second database does not exist, or
The difference between the failure occurrence date and time of the first database and the output date and time of the activated message included in the acquired log information is not within the first predetermined time, or
In the acquired log information, there is no message that is the same as the message that the startup of the second database is completed, or
The difference between the failure occurrence date and time of the first database and the output date and time of the startup completion message included in the log information is not greater than or equal to the second predetermined time.
sometimes,
A process of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failure-occurring software in the first database from the fourth database, and
A process of acquiring log information corresponding to the name of the extracted log information from the information processing device, and
In the fourth database, there is information related to the operation immediately before the failure occurrence, which is the same as the information related to the operation immediately before the failure occurrence in the first database, and
In the acquired log information, there is the same message as the operation output message of the fourth database, and
The time difference between the output date and time of the failure occurrence message included in the log information and the output date and time of the operation output message included in the log information is within the third predetermined time.
sometimes,
A process of transmitting a third notification to the information processing device notifying that an operation failure has not occurred, and
Do more,
The device for identifying the content of a failure according to claim 1. The storage unit further stores the information related to the software and the fifth database organized by associating the update software application confirmation command.
The control unit
In the acquired log information, the same message as the running message of the second database does not exist, or
The difference between the failure occurrence date and time of the first database and the output date and time of the activated message included in the acquired log information is not within the first predetermined time, or
In the acquired log information, there is no message that is the same as the message that the startup of the second database is completed, or
The difference between the failure occurrence date and time of the first database and the output date and time of the startup completion message included in the log information is not greater than or equal to the second predetermined time.
sometimes,
The process of extracting the update software application confirmation command associated with the information related to the software corresponding to the information related to the failed software in the first database from the fifth database, and
A process of acquiring execution log information from the information processing device by executing the extracted update software application confirmation command on the information processing device, and
When the acquired execution log information does not include all the information related to the latest update software of the software published on the Internet, all the latest update software is applied, and the information processing apparatus is used to perform the above. The process of acquiring log information with all the latest update software applied, and
When there is no new message in the acquired log information that is not in the acquired execution log information, the information processing device is restored by applying the latest update software to notify that no failure has occurred at this time. 4 Processing to send the notification to the information processing device and
Do more,
The device for identifying the content of a failure according to claim 1. The first database is organized by associating the failure occurrence date and time, the information related to the failure occurrence software, and the failure occurrence message regarding the information processing device.
The storage unit further stores a third database in which information related to software, names of log information, messages in log information, failure information, and causes and operations necessary for failure recovery are associated and organized.
The control unit
In the acquired log information, the same message as the running message of the second database does not exist, or
The difference between the failure occurrence date and time of the first database and the output date and time of the activated message included in the acquired log information is not within the first predetermined time, or
In the acquired log information, there is no message that is the same as the message that the startup of the second database is completed, or
The difference between the failure occurrence date and time of the first database and the output date and time of the startup completion message included in the log information is not greater than or equal to the second predetermined time.
sometimes,
The process of selecting the third database of the information related to the software corresponding to the information related to the failed software in the first database, and
A process of extracting failure information containing the same message as the failure occurrence message of the first database from the selected third database, and
A process of extracting the name of the log information associated with the extracted failure information from the selected third database, and
A process of acquiring log information corresponding to the name of the extracted log information from the information processing device, and
From the selected third database, a process of extracting a message in the log information associated with the failure information including the same message as the failure occurrence message of the first database, and
When the acquired log information does not have the same message as the message in the extracted log information, the process of acquiring the log information output by the operating system from the information processing device
When the acquired log information output by the operating system has the same message as the extracted message in the log information, the cause associated with the message in the extracted log information extracted from the selected third database. And the process of extracting the operations required for disaster recovery,
A process of transmitting the extracted failure information, the cause, and an operation required for failure recovery to the information processing apparatus, and
Do more,
The device for identifying the content of a failure according to claim 1. The control unit
When the acquired log information has the same message as the message in the extracted log information,
From the selected third database, the process of extracting the cause associated with the message in the extracted log information and the operation required for failure recovery, and
A process of transmitting the extracted failure information, the cause, and an operation required for failure recovery to the information processing apparatus, and
And
When the acquired log information output by the operating system does not have the same message as the extracted message in the log information.
A process of transmitting a fifth notification to the information processing apparatus notifying that the cause of the failure is unknown, and
Do more,
The device for identifying the content of a failure according to claim 6. The fault content identification device according to any one of claims 1 to 7.
An information processing device that is communicatively connected to the failure content identification device,
To prepare
Failure content identification system. A step of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failure occurrence software of the first database from the second database, and
A step of acquiring log information corresponding to the name of the extracted log information from the information processing device, and
In the acquired log information, there is the same message as the message during the startup of the second database, and
The difference between the failure occurrence date and time of the first database and the output date and time of the activated message included in the acquired log information is within the first predetermined time, and
In the acquired log information, there is the same message as the message of the completion of starting the second database, and
The difference between the failure occurrence date and time of the first database and the output date and time of the activation completion message included in the acquired log information is equal to or greater than the second predetermined time.
sometimes,
A step of transmitting a first notification notifying that a software start delay failure has occurred to the information processing apparatus, and
Including
Each of these steps is done by hardware resources
The first database is a database obtained by associating and organizing information on a failure occurrence date and time and failure occurrence software related to the information processing device, which is acquired from the information processing device.
The second database is a database in which information related to software, names of log information, starting messages, and starting completion messages are associated and organized.
How to identify the nature of the failure. The process of extracting the name of the log information associated with the information related to the software corresponding to the information related to the failure occurrence software in the first database from the second database, and
Processing to acquire log information corresponding to the name of the extracted log information from the information processing device, and
In the acquired log information, there is the same message as the message during the startup of the second database, and
The difference between the failure occurrence date and time of the first database and the output date and time of the activated message included in the acquired log information is within the first predetermined time, and
In the acquired log information, there is the same message as the message of the completion of starting the second database, and
The difference between the failure occurrence date and time of the first database and the output date and time of the activation completion message included in the acquired log information is equal to or greater than the second predetermined time.
sometimes,
A process of transmitting a first notification notifying that a software start delay failure has occurred to the information processing device, and
Let the hardware resources execute
The first database is a database obtained by associating and organizing information on a failure occurrence date and time and failure occurrence software related to the information processing device, which is acquired from the information processing device.
The second database is a database in which information related to software, names of log information, starting messages, and starting completion messages are associated and organized.
program.

Images