JP6868416B2 - Failure response support system - Google Patents

Description

The present invention relates to a failure handling technique in an information processing system or the like, and is particularly effective in applying to a failure handling support system that presents a method of dealing with a detected failure to a person in charge.

For example, in the operation management work related to an information processing system having various servers and the like, it is included to monitor the presence or absence of a failure by a monitoring system or the like and promptly respond to the detection of the failure. Here, for example, when a failure detected by a monitoring system or the like cannot be resolved by a primary response by an operator or the like, or depending on the content of the failure, the person in charge who is not present at the site such as a developer or an engineer is immediately contacted. Will be done and the person in charge will take action. Such communication to the person in charge may be made at night depending on the information processing system to be operated. In this case, the person in charge who is not located at the site may have to deal with the failure by himself / herself from a remote location. In addition, if it is determined that it is necessary to contact the customer, the customer must also be contacted.

As a technology related to automation and speeding up of failure response, for example, Japanese Patent Application Laid-Open No. 2005-202446 (Patent Document 1) detects the occurrence of a failure in an environment where a business server, a network device, and a business application exist. , It is stated that by extracting the details of the failure from the log information and searching for the failure countermeasure information, it is possible to implement early countermeasures in the event of a failure and shorten the recovery time. In addition, if it is not included in the failure countermeasure information, it is stated that the failure information can be extracted without specialized knowledge by editing and providing the log information and resource information necessary for the investigation.

Further, in Japanese Patent Application Laid-Open No. 2009-276929 (Patent Document 2), the monitored server is periodically monitored, and when a failure is detected, operation logs before and after the failure are collected to trigger the occurrence of the failure. Search the error log to extract keywords such as error codes, extract similar cases from the case DB using the keywords, acquire failure avoidance information, generate a failure avoidance file based on this, and use it as the monitored server. It is stated that it applies.

Japanese Unexamined Patent Publication No. 2005-202446 Japanese Unexamined Patent Publication No. 2009-276929

When a failure is detected as in the conventional technology, the corresponding or similar one is searched from the past failure response history, failure countermeasure information, etc. based on the content of the failure message, and the response method is obtained from the search results. And it is presented to the person in charge.

On the other hand, when extracting a countermeasure method, it is being studied to improve the accuracy of extraction by using AI (Artificial Intelligence) / machine learning, which has been widely applied in recent years. At this time, the issue is how to link the machine learning engine and the machine learning service (hereinafter collectively referred to as "machine learning engine") with the monitoring system including the existing one. For example, when a failure is detected, the problem is how to automatically input and link the contents to the machine learning engine to obtain the output of the calculation result based on the trained model. Another issue is how to reflect the results of actual troubleshooting as learning data in the machine learning engine at what timing and how to update (re-learn) the learning model.

Therefore, an object of the present invention is to apply a failure response support system that efficiently cooperates with a machine learning engine and can present and recommend a highly accurate response method for a failure detected by a monitoring system or the like. There is.

The above and other objects and novel features of the present invention will become apparent from the description and accompanying drawings herein.

A brief description of typical inventions disclosed in the present application is as follows.

The failure response support system according to a typical embodiment of the present invention is a failure response support system that outputs the response content recommended to the user for a failure that has occurred in the monitored object, and outputs a failure message related to the failure. The failure notification device for transmitting the failure notification including the failure message, the failure response support device for acquiring the response content based on the failure message, and transmitting the response content notification including the response content to the user, and the failure message. On the other hand, it has a machine learning device that acquires the corresponding contents by using an analysis model constructed in advance by machine learning based on the accumulated information of past failure correspondence.

Then, the failure notification device transmits the failure notification to the user and the failure response support device, and the failure response support device extracts the failure message from the received failure notification and extracts the failure. Regarding the message, the machine learning device is requested to acquire the corresponding content, and the machine learning device classifies the necessity of contacting the customer from the user regarding the failure with respect to the acquired failure message. The correspondence content is acquired by the analysis model 1 and / or the second analysis model that extracts the candidate of the correspondence content from the past failure correspondence similar to the failure.

Among the inventions disclosed in the present application, the effects obtained by representative ones will be briefly described as follows.

That is, according to a typical embodiment of the present invention, it is possible to efficiently cooperate with a machine learning engine and present / recommend a highly accurate response method for a failure detected by a monitoring system or the like. Become.

It is a figure which showed the outline about the structural example of the trouble response support system which is one Embodiment of this invention. It is a figure which showed an example about the content of the trouble mail. It is a figure which showed the example about the content of correspondence content mail in one Embodiment of this invention. It is a figure which showed the outline about the example of the process flow which constructs the analysis model in advance in one Embodiment of this invention. It is a figure which showed the outline about the example which creates the BoW corpus in one Embodiment of this invention. It is a figure which showed the outline of the example of the flow of the online analysis processing in one Embodiment of this invention. FIGS. (A) to (C) are diagrams showing an outline of an example of feedback of the contents of correspondence by the person in charge in one embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In addition, in all the drawings for explaining the embodiment, in principle, the same reference numerals are given to the same parts, and the repeated description thereof will be omitted. On the other hand, the parts described with reference numerals in one figure may be referred to with the same reference numerals in the explanation of other figures, although they are not shown again.

<System configuration>
FIG. 1 is a diagram showing an outline of a configuration example of a failure response support system according to an embodiment of the present invention. The failure response support system 1 of the present embodiment is in charge of the developer or the like when, for example, the occurrence of a failure in the monitored server 10 including a plurality of Web servers operated by a company or the like is detected by the monitoring system 20. It is a server system that supports the person 2 by recommending and recommending the contents to be dealt with.

The failure response support system 1 is composed of, for example, a failure mail server 30, a failure response support server 40, and a machine learning server 50. The failure mail server 30 is a server system having a function of transmitting an e-mail notifying the occurrence of a failure in the monitoring target server 10 when the monitoring system 20 detects the occurrence of the failure. The failure response support server 40 is a server system having a function of recommending / recommending the response contents for the occurrence of a failure to the person in charge 2. The machine learning server 50 is a server system having a function of creating an analysis model for extracting and determining a correspondence content based on the accumulation of past correspondence contents by machine learning and performing analysis.

Each server is composed of, for example, a server device or a virtual server built on a cloud computing service, and is connected to a network such as the Internet, VPN (Virtual Private Network), or LAN (Local Area Network) (not shown). ing. Then, by using a CPU (Central Processing Unit) (not shown), middleware such as OS (Operating System), DBMS (DataBase Management System), and Web server program developed on the memory from a recording device such as HDD (Hard Disk Drive). By executing the software that runs on it, various functions related to troubleshooting support are realized. In the example of FIG. 1, each is described as an independent server system, but one or more servers may be constructed on the same server system. Further, if possible, an information processing device such as a PC (Personal Computer) may be used instead of the server.

The failure mail server 30 is a mail server that receives a failure occurrence notification from the monitoring system 20 that monitors the occurrence of a failure in the monitoring target server 10 and issues a failure mail 31 that is an e-mail for notifying the failure occurrence. For example, a failure email 31 in which the failure content such as a failure message is described is created to the email address of the person in charge 2 registered in advance according to the monitored server 10 and the application in which the failure occurred, the content of the failure, and the like. And send. Normally, the person in charge 2 receives the failure mail 31 and makes a judgment on various matters such as the content and degree of the failure, the content of the response, and the necessity of contacting the customer 3 based on the content of the failure mail 31.

In the present embodiment, e-mail is used as a specific means for giving a notification, but if it is a means for giving a notification, in addition to or instead of this, another specific means. May be used. For example, SMS (Short Message Service), which has already become widespread, may be used, or a message protocol unique to the present embodiment may be implemented instead of notification by SMTP (Simple Mail Transfer Protocol).

In the present embodiment, the failure mail server 30 further transmits the failure mail 31 having the same contents to the failure response support server 40 (that is, an email address that can be received by the failure response support server 40). For example, the failure mail server 30 sets the destination for sending the failure mail 31 as an email address for broadcast communication (mailing list), and the failure response support server 40 adds an email address that can be received to this, which is easily realized. can do. If it is possible to send the failure mail 31, it is not essential to have a mail server function, and it is a mail client that sends the failure mail 31 using another mail server or e-mail service (not shown). You may.

The failure response support server 40 has a function of receiving the failure mail 31 from the failure mail server 30 and transmitting the response content mail 44 that recommends / recommends the response content to the person in charge 2 based on the content thereof. It is a server system. When recommending the response content to the person in charge 2, for example, the response content mail 44, which is an e-mail containing the response content, is transmitted to the person in charge 2. The failure response support server 40 includes, for example, a failure message extraction unit 41 implemented as software, a response content acquisition unit 42, a response content reflection unit 43, and the like.

The failure message extraction unit 41 performs a process of extracting only the part of the failure message necessary for analyzing the correspondence contents with respect to the failure mail 31 received from the failure mail server 30. FIG. 2 is a diagram showing an example of the contents of a general failure mail 31. The failure mail 31 addressed to the person in charge 2 contains a lot of unnecessary or meaningless information for analyzing the failure, such as a header and a footer composed of a fixed phrase, a greeting sentence, and the like. In the example of FIG. 2, only the part inside the broken line frame, that is, the part in which the information for identifying the monitored server 10 and the information such as the failure message are described is necessary information, and the other parts are unnecessary for analysis. Information. In the present embodiment, the failure message extraction unit 41 extracts only these failure messages as necessary parts. As a result, unnecessary analysis by the machine learning server 50 is eliminated to reduce the analysis load, and noise is eliminated to improve the accuracy of analysis.

The method of extracting the necessary portion from the failure mail 31 is not particularly limited, and an appropriate method can be taken according to the specifications of the failure mail 31. For example, specify a predetermined area such as a standard header or footer by the line number or the number of characters, or specify these areas by a character string or a tag as a mark and delete the area uniformly. Can be done. On the contrary, the necessary part may be specified and extracted by these methods.

Returning to FIG. 1, the response content acquisition unit 42 responds to the information obtained by extracting only the necessary part of the failure mail 31 by the failure message extraction unit 41 by using the analysis model learned by the machine learning server 50. It has a function to analyze the contents and obtain candidates for the corresponding contents to be recommended / recommended. As a method for requesting analysis to the machine learning server 50, an appropriate method can be used according to the specifications of the external interface provided by the machine learning server 50. For example, an API (Application Programming Interface) may be called, or an execution instruction e-mail may be sent. There may be a plurality of candidates for the corresponding contents acquired by the analysis on the machine learning server 50. The correspondence content acquisition unit 42 also has a function of shaping the acquired correspondence content candidates and notifying the person in charge 2 of the correspondence content mail 44 to the mail address of the person in charge 2.

FIG. 3 is a diagram showing an example of the content of the correspondence content mail 44 in the present embodiment. In the example of FIG. 3, the recommended correspondence content is described in the area surrounded by the symbol “◆”. As will be described later, the response includes two items: (A) necessity of customer contact and (B) workaround (first aid) candidates.

The necessity of customer contact includes a value (for example, a percentage) calculated by the machine learning server 50, which indicates the possibility or certainty that contact is necessary. In addition, the workaround includes a value calculated by the machine learning server 50 that indicates the degree and certainty of similarity with a similar failure case in the past, and information on the content of the response taken in the case. The person in charge 2 receives the correspondence content mail 44 by the person in charge terminal 60, which is an information processing terminal such as a PC, a tablet terminal, or a smartphone, and refers to the content as useful reference information when dealing with a failure. be able to.

Returning to FIG. 1, the response content reflection unit 43 acquires feedback information from the person in charge 2 (person in charge terminal 60) regarding the result of the implementation of the response content by the person in charge 2, and uses the content as new learning data. It has a function of re-learning by the machine learning server 50 and updating the trained analysis model. At this time, in order to reduce the workload of the person in charge 2, the person in charge 2 easily returns the response reply mail 45 to the response content mail 44 previously received from the failure response support server 40, so that the result can be easily obtained. We shall be able to notify you of feedback. The method of feedback by the corresponding reply mail 45 will be described later.

The machine learning server 50 is a server system having a function of creating an analysis model 53 for extracting and determining the correspondence contents by machine learning and performing analysis by using the accumulation of the past correspondence contents as teacher data. For example, software. It has each part such as a pretreatment part 51 and an analysis part 52 implemented as.

The preprocessing unit 51 has a cleansing function as a preprocessing for analysis by a machine learning engine, which normalizes a failure message composed of text data including a failure content into a format capable of analyzing the failure content by performing natural language processing. For the function of performing natural language processing such as morphological analysis, a known and generally available natural language processing engine, library, or the like can be appropriately used. The contents of the cleansing function will be described later.

The analysis unit 52 has a function of performing machine learning in advance based on the contents of the past correspondence history (the failure message is cleansed by the preprocessing unit 51) to create the learned analysis model 53. In addition, regarding the content of the failure message related to the newly generated failure (cleansed by the preprocessing unit 51), a function of acquiring a response content candidate based on the analysis model 53 and responding to the failure response support server 40 is provided. Have. As for the machine learning function, a known and generally available machine learning engine, machine learning service, or the like can be appropriately used.

<Processing flow>
FIG. 4 is a diagram showing an outline of an example of a process flow for constructing an analysis model in advance in the present embodiment. Here, the machine learning server 50 constructs an analysis model 53 for extracting and determining the corresponding contents based on the accumulation of the past corresponding contents by machine learning, or updates the latest one. The process is executed at any time, for example, by a monthly batch process or based on an instruction from the person in charge 2.

First, the machine learning server 50 acquires new learning data, that is, historical information of past correspondence contents (S01). The acquisition method is not particularly limited, and for example, the history information recorded in the failure response support server 40 or the like may be automatically transmitted to the machine learning server 50, or the user may access the machine learning server 50 manually. You may upload it.

After that, the preprocessing unit 51 cleanses the failure message included in the learning data (if the learning data contains unnecessary contents other than the failure message, the failure message portion is extracted and then processed). Perform processing. First, the failure message is morphologically analyzed and decomposed into part of speech (S02). For the decomposed result, all the words and phrases of the part of speech may be used, or the words and phrases of a predetermined part of speech may be used only. Usually, it is considered that the accuracy of analysis is improved by limiting to a predetermined part of speech (for example, a noun).

Next, for the words and phrases as a result of the morphological analysis, a BoW (Bag of Words) corpus is created for each failure message and normalized by a numerical value (vector) (S03), and further, as a weighting element for improving the analysis accuracy. An item for day / night division is added (S04).

FIG. 5 is a diagram showing an outline of an example of creating a BoW corpus in the present embodiment. On the upper left side of FIG. 5, an example of the result image obtained by performing morphological analysis on three failure messages and decomposing them into part of speech is shown as morphologically analyzed message 411.

Here, first, based on the morphologically analyzed message 411, a dictionary 412 as shown on the upper right side of FIG. 5 is created. In the dictionary 412, for example, all the words and phrases appearing in each morphologically analyzed message 411 are given unique identification numbers after eliminating duplication (in the example of FIG. 5, one word or phrase is added to the word or phrase'a'). It holds the data that has been added to the dictionary (2, ..., etc.). Then, as shown in the middle part of FIG. 5, for each failure message, a BoW corpus 413 (occurrence frequency vector) having each occurrence count as an element in the order of all the words and phrases registered in the dictionary 412 is created.

By the way, as described above, there are two items of information included in the recommended / recommended response contents for the failure message: (A) necessity of customer contact and (B) workaround candidates. Of these, regarding (A) the necessity of customer contact, in addition to the importance of the failure, for example, the judgment criteria for the necessity changes greatly depending on whether the failure message occurs in the daytime or at night. As a rule of thumb, we know that we will get (if it is night, refrain from contacting customers as much as possible).

Therefore, in the present embodiment, a predetermined weighted value is added to the BoW corpus 413 so that the feature items that do not directly appear in such a failure message can be weighted and determined. For example, as shown in the lower part of FIG. 5, the value of the item of the day / night division is added to the end of each BoW corpus 413. Here, for example, it is determined whether it is daytime or nighttime based on the information of the time stamp included in the failure message, and the value (1 or 0) of the corresponding category is weighted 10 times. Indicates that you are adding. As a result, it is possible to adjust the classification of day and night when a failure occurs so as to emphasize (A) when determining the necessity of customer contact.

Returning to FIG. 4, next, TF-IDF (Term Frequency --Inverse Document Frequency) is calculated for each BoW corpus 413 in order to evaluate the feature amount according to the frequency of appearance of words (S05). TF-IDF is generally used as an index showing the characteristics of a sentence, and is a value indicating the high frequency of appearance in the target sentence for a certain word and the frequency of appearance in another sentence. It is a numerical value obtained by multiplying the value indicating the lowness of. It can be said that a phrase having a high value is a phrase that characterizes the target sentence well. By calculating this for each word in each BoW corpus 413, each BoW corpus 413 can be converted into a feature vector for each failure message. The items of the day / night division added to the BoW corpus 413 in step S04 are excluded from the calculation of TF-IDF.

When the data cleansing (normalization) and the evaluation of the feature quantity are completed, the analysis unit 52 performs machine learning using these data as teacher data to construct the analysis model 53 (S06). Then, the constructed analysis model 53 is recorded in a file, database, or the like and saved (S07), and the process is terminated.

The content of the analysis model 53 and the algorithm used for the analysis differ depending on (A) the necessity of customer contact and (B) the workaround candidate included in the recommended / recommended response content. (A) The analysis model 53 for determining the necessity of customer contact determines either "unnecessary (0) / required (1)" for the target failure message, and is used by a so-called classification algorithm. Be done. On the other hand, for (B) workaround candidates, similar failure cases in the past are extracted, and the corresponding contents at that time are recommended / recommended, and various algorithms for analyzing the degree of similarity can be appropriately used. .. For example, various algorithms have been proposed, such as a method of calculating the closeness of a predetermined geometric distance and the closeness of the direction of a vector (the smallness of the angle formed), and a method of calculating the similarity of aggregates.

FIG. 6 is a diagram showing an outline of an example of the flow of the online analysis process in the present embodiment. Here, when the occurrence of a failure in the monitored server 10 is detected by the monitoring system 20 and the failure mail 31 is transmitted from the failure mail server 30, the failure response support server 40 that receives the failure mail 31 is the machine learning server 50. The failure message is analyzed, the response content is acquired, and the response content mail 44 is transmitted to the person in charge 2 (person in charge terminal 60). Therefore, the process is executed with the failure response support server 40 receiving the failure message as a trigger.

First, when the failure message extraction unit 41 of the failure response support server 40 receives the failure mail 31 (S11), it extracts only the part of the failure message necessary for analysis as shown in the example of FIG. (S12). Then, the analysis process of the machine learning server 50 is called using the extracted failure message as a parameter (S13). As described above, various methods such as calling an API and sending an e-mail of an execution instruction can be taken according to the specifications of the external interface provided by the machine learning server 50.

In the machine learning server 50, the acquired failure message is morphologically analyzed by the preprocessing unit 51 and decomposed into part of speech (S14) in the same manner as in the case of batch processing shown in FIG. 4, and a BoW corpus 413 is created. (S15), the day / night division is added (S16), and the TF-IDF is calculated (S17) to cleanse / normalize the failure message and evaluate the feature amount. Since these processes are basically the same as steps S02 to S05 in the example of FIG. 4, the description thereof will be omitted again.

In the process of creating the BoW corpus 413 in step S03 in the example of FIG. 4, as shown in FIG. 5, a dictionary 412 is created from the morphologically analyzed message 411 which decomposes the failure message which is the teacher data to be learned into part speech. , The BoW corpus 413 is created based on the words and phrases registered in this dictionary 412. That is, the words and phrases registered in the dictionary 412 are words and phrases included in the failure message (morphologically analyzed message 411) to be learned.

On the other hand, in the process of creating the BoW corpus 413 in step S15 of FIG. 6, the dictionary 412 is not created (updated), and the already created dictionary 412 is used. At this time, the failure message to be processed may be a new failure message that is not included in the teacher data to be learned when the existing dictionary 412 is created. That is, the phrase included in the morphologically analyzed message 411 related to the failure message to be processed may include a new phrase that is not registered in the existing dictionary 412. In this case, since the phrase is not registered in the dictionary 412, it is not considered in the process of creating the BoW corpus 413 in step S15. Therefore, the accuracy of the analysis may be reduced.

Therefore, for example, the batch processing shown in the example of FIG. 4 is periodically performed to perform re-learning, and the dictionary 412 and BoW corpus 413 related to the existing failure message to be learned are updated to the latest information. It is desirable to keep it. Further, when there is a phrase included in the morphologically analyzed message 411 related to the new failure message that is not registered in the dictionary 412, only the phrase is the existing failure message to be learned and the new failure. A BoW corpus 413 may be created for both messages.

Then, using the learned analysis model 53 constructed in step S06 in the example of FIG. 4, the BoW corpus 413 related to the new failure message is analyzed (S18), and the analysis result is sent to the failure response support server 40. Respond (S19). In the analysis, for example, with respect to the item (A) whether or not customer contact is necessary, it is determined whether the target failure message is classified into unnecessary (0) or necessary (1). At that time, a numerical value indicating the certainty and possibility may be output together with the classification result. Further, regarding (B) workaround candidates, similar failure cases are extracted from past failure messages, and the corresponding contents at that time are acquired and output as a workaround. At that time, a numerical value indicating the degree of similarity may also be output.

The response content acquisition unit 42 of the failure response support server 40 acquires the analysis result returned from the machine learning server 50 (S20), and shapes the data into the form of the response content email 44 as shown in the example of FIG. (S21), the data is transmitted to the person in charge 2 (person in charge terminal 60) (S22), and the process is completed.

The person in charge 2 can deal with a failure by referring to the received correspondence content mail 44, that is, can contact the customer 3 when necessary, and carry out a workaround or give an instruction. Here, the response content described in the response content email 44 is recommended / recommended by the failure response support server 40 and the machine learning server 50, and may not match the actual situation and may not be appropriate. Including such a case, the person in charge 2 can feed back the response content actually taken or the response content that should have been taken as a result to the failure response support server 40 to relearn. .. In the present embodiment, in order to reduce the workload of the person in charge 2 related to the feedback, feedback can be easily provided by sending the response reply mail 45 as a reply to the received response content mail 44.

FIG. 7 is a diagram showing an outline of an example of feedback of the response contents by the person in charge 2 in the present embodiment. FIG. 7A shows feedback in the response reply email 45 when (A) necessity of customer contact (“required” in the example in the figure) is recommended in the response content email 44 from the failure response support server 40. An example of is shown. If the person in charge 2 actually contacted or should have contacted the customer (that is, if the recommended response content was appropriate), a blank email ("" in the figure) was used as the response reply email 45. Reply (shown) (marked with a circle in the figure). Alternatively, it is assumed that no reply is made, and it may be determined that it is appropriate when the failure response support server 40 does not receive the response reply mail 45 for a certain period of time or longer.

On the other hand, if the person in charge 2 did not actually contact the customer or should not have contacted the customer (that is, if the recommended response content was inappropriate), the response reply mail 45 indicates that fact. Return simple identifiable information (“x” in the figure) (x mark in the figure). By analyzing these response reply emails 45, the failure response support server 40 can grasp and accumulate the recommended (A) content of the necessity of customer contact as appropriate or inappropriate. , Can be reflected in the analysis model 53 as training data in the subsequent analysis.

FIG. 7B shows a response reply email 45 when (B) a workaround candidate (“because it is a temporary failure ...” in the example in the figure) is recommended in the response content email 44 from the failure response support server 40. Here is an example of feedback in. If the recommended workaround is appropriate, a blank email is returned as the corresponding reply email 45 (marked with a circle in the figure). Or do not reply anything. On the other hand, if the recommended workaround is inappropriate, the response reply mail 45 will be replied with the contents of the workaround actually carried out or should have been carried out by the person in charge 2 as a sentence. .. (B) When a plurality of workaround candidates are recommended in the response content mail 44 from the failure response support server 40, the person in charge 2 should return information on which candidate was actually selected from them. You may.

By analyzing these response reply emails 45, the failure response support server 40 can grasp whether the recommended (B) workaround candidate was appropriate or inappropriate, and can accumulate it. It can be reflected in the analysis model 53 as training data in the analysis.

As described above, the failure response support server 40 periodically requests the machine learning server 50 for re-learning, reflects the content fed back from the person in charge 2 in the analysis model 53, and is in the latest state. Update to. However, in the regular re-learning, there may be an interval depending on the timing before the result of feedback that the person in charge 2 is inappropriate is re-learned and reflected in the analysis model 53. In this case, for example, if similar failures occur continuously, a response content email 44 recommending inappropriate response content similar to the previous time will be repeatedly sent until periodic re-learning is performed. ..

Therefore, in the present embodiment, when the person in charge 2 replies the corresponding reply mail 45, he / she can request immediate re-learning. FIG. 7C shows an example in which the person in charge 2 gives feedback on the correspondence and requests immediate re-learning. As shown in the figure, for example, in the response reply mail 45, in addition to the description of the content of the workaround to be fed back, a predetermined description requesting immediate re-learning (in the example in the figure, the wording of "immediate re-learning"). Is added. The predetermined contents are not particularly limited as long as they can be recognized by the failure response support server 40.

In the response content reflection unit 43 of the failure response support server 40 that received the request for immediate re-learning by the response reply mail 45, the machine learning server 50 performs re-learning by the same processing as the batch processing shown in FIG. The analysis model 53 can be updated. At this time, depending on the amount of teacher data to be learned, the time required for analysis may become very long.

Therefore, in the present embodiment, when an immediate re-learning request is received, the response content reflection unit 43 estimates the time required for re-learning in advance, and when the feedback content is reflected in the analysis model 53. Reply to the person in charge 2 by the mail 46 scheduled to be reflected as information. In the example of FIG. 7, it is expressed as the date and time to be reflected, but it may be expressed by the relative time / elapsed time such as “after XX hours”. The person in charge 2 refers to the information related to the timing of the reflection schedule described in the reflection schedule mail 46, and whether or not to actually perform the immediate re-learning (waits until the re-learning in the next periodic batch processing). Whether or not) can be determined.

The method for estimating the time required for re-learning is not particularly limited, but for example, a model for estimating the required time based on various parameters can be constructed, and calculation can be performed based on the model. The parameters included in the model include, for example, the actual value of the time required in the past machine learning, the server specifications of the machine learning server 50, the processing load status, the number of teacher data to be analyzed, and the parameters in the analysis model 53. Various things such as numbers and types of algorithms used for analysis can be used as appropriate. Further, the model for estimating the required time as described above may be targeted for machine learning by the machine learning server 50 to improve the accuracy.

As described above, according to the failure response support system 1 according to the embodiment of the present invention, when the occurrence of a failure is detected in the monitored server 10, the machine learning server 50 recommends it based on the failure message. -It is possible to perform a series of steps of analyzing the recommended response content and sending it to the person in charge 2 as the response content mail 44 without human intervention. This makes it possible to efficiently cooperate with the machine learning engine and present / recommend a highly accurate response method for the failure detected by the monitoring system 20.

Although the invention made by the present inventor has been specifically described above based on the embodiments, the present invention is not limited to the above embodiments and can be variously modified without departing from the gist thereof. Needless to say. For example, the above-described embodiment has been described in detail in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to the one including all the described configurations. Further, it is possible to add / delete / replace a part of the configuration of the above-described embodiment with another configuration.

For example, in the above embodiment, the failure mail 31 from the failure mail server 30 is transmitted to the failure response support server 40 and the person in charge 2, and the failure response support server 40 determines whether or not to contact the customer 3. However, in the initial action when a failure occurs, the failure mail 31 from the failure mail server 30 is sent only to the failure response support server 40, and the failure response support server 40 also determines whether or not it is necessary to contact the person in charge 2. It may be configured to be used.

At this time, in the machine learning server 50, even if the analysis model 53 for determining the necessity of contacting the person in charge 2 and the analysis model 53 for determining the necessity of contacting the customer 3 are the same. Good, but preferably different. Normally, the standard is adopted that the person in charge 2 should check the contents of the disability even if the disability is a little less important, and the contact with the customer 3 should be limited to the ones of higher importance. This is because it is often done. Therefore, in order to correspond to such a standard, the analysis model 53 for determining the necessity of contacting the person in charge 2 and the analysis model 53 for determining the necessity of contacting the customer 3 should be separately configured. Is desirable.

Further, each of the above configurations, functions, processing units, processing means and the like may be realized by hardware by designing a part or all of them by, for example, an integrated circuit. Further, each of the above configurations, functions, and the like may be realized by software by the processor interpreting and executing a program that realizes each function. Information such as programs, tables, and files that realize each function can be placed in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

The present invention can be used in a failure response support system that presents a method for responding to a detected failure to a person in charge.

1 ... Failure response support system, 2 ... Person in charge, 3 ... Customer,
10 ... Monitored server,
20 ... Monitoring system,
30 ... Failure mail server, 31 ... Failure mail,
40 ... Failure response support server, 41 ... Failure message extraction unit, 42 ... Response content acquisition unit, 43 ... Response content reflection unit, 44 ... Response content email, 45 ... Response reply email, 46 ... Reflection schedule email,
50 ... Machine learning server, 51 ... Preprocessing unit, 52 ... Analysis unit, 53 ... Analysis model,
60 ... Person in charge terminal

Claims (7)

It is a failure response support system that outputs the response content recommended to the user for the failure that occurred in the monitored target.
A failure notification device that transmits a failure notification including a failure message related to the failure, and
A failure response support device that acquires the response content based on the failure message and transmits a response content notification including the response content to the user.
It has a machine learning device for acquiring the corresponding contents by using an analysis model constructed in advance by machine learning based on the accumulated information of the past trouble correspondence for the trouble message.
The failure notification device transmits the failure notification to the user and the failure response support device.
The failure response support device extracts the failure message from the received failure notification, and requests the machine learning device to acquire the corresponding content for the extracted failure message.
With respect to the acquired failure message, the machine learning device classifies the necessity of contacting the customer from the user regarding the failure from the first analysis model and the past failure response similar to the failure. the second analysis model for extracting the candidate, to obtain the corresponding contents,
In the trouble response support device, as a reply to the response content notification from the user, feedback information as to whether or not the necessity of contacting the customer included in the response content notification was appropriate is described. A failure response support system that receives a response reply notification and uses the feedback information as learning data for re-learning in the machine learning device. In the failure response support system according to claim 1,
The machine learning device decomposes existing failure messages included in the accumulated information of past failure correspondence into words and phrases for each part, creates a dictionary consisting of the words and phrases for some or all of the part words, and prepares a dictionary consisting of the words and phrases for each existing part. For the failure message, a first appearance frequency vector having the appearance frequency as an element is created for the word / phrase included in the dictionary, and a feature related to the appearance frequency of the word / phrase with respect to the first appearance frequency vector. A failure handling support system that calculates a quantity, generates a first feature vector, and constructs the analysis model using the first feature vector as learning data in machine learning. In the failure response support system according to claim 2,
The machine learning device decomposes the acquired failure message into words and phrases for each part of speech, creates a second appearance frequency vector for the words and phrases included in the dictionary, and creates a second appearance frequency vector having the appearance frequency as an element. For the second appearance frequency vector, the feature amount related to the appearance frequency of the phrase is calculated to generate the second feature vector, and the analysis model is applied to the second feature vector to correspond to the second feature vector. A failure response support system that acquires the contents. In the failure response support system according to claim 3,
The machine learning device adds, as an element, a weighted index related to a predetermined item related to the first analytical model to the first occurrence frequency vector and the second occurrence frequency vector. Correspondence support system. In the failure response support system according to claim 1,
When the response reply notification received from the user includes an instruction to immediately relearn the feedback information included in the response reply notification in the machine learning device. A failure response support system that estimates the time required for re-learning before re-learning by the machine learning device, and sends a reflection schedule notification including information related to the scheduled completion time of the re-learning to the user. It is a failure response support system that outputs the response content recommended to the user for the failure that occurred in the monitored target.
A failure notification device that transmits a failure notification including a failure message related to the failure, and
A failure response support device that acquires the response content based on the failure message and transmits a response content notification including the response content to the user.
It has a machine learning device for acquiring the corresponding contents by using an analysis model constructed in advance by machine learning based on the accumulated information of the past trouble correspondence for the trouble message.
The failure notification device transmits the failure notification to the user and the failure response support device.
The failure response support device extracts the failure message from the received failure notification, and requests the machine learning device to acquire the corresponding content for the extracted failure message.
The machine learning device is a first analysis model that classifies whether or not the user needs to contact the customer about the failure with respect to the acquired failure message, and / or a past failure response similar to the failure. The corresponding content is acquired by the second analysis model that extracts the candidate of the corresponding content from the above .
The machine learning device decomposes existing failure messages included in the accumulated information of past failure correspondence into words and phrases for each part of speech, creates a dictionary consisting of the words and phrases for some or all part of speech, and creates a dictionary consisting of the words and phrases for each existing part of speech. Regarding the failure message, a first appearance frequency vector having the appearance frequency as an element is created for the word / phrase included in the dictionary, and a feature related to the appearance frequency of the word / phrase with respect to the first appearance frequency vector. The quantity is calculated to generate a first feature vector, and the analysis model is constructed using the first feature vector as training data in machine learning.
The machine learning device decomposes the acquired failure message into words and phrases for each part of speech, creates a second appearance frequency vector for the words and phrases included in the dictionary, and creates a second appearance frequency vector having the appearance frequency as an element. For the second appearance frequency vector, the feature amount related to the appearance frequency of the phrase is calculated to generate the second feature vector, and the analysis model is applied to the second feature vector to correspond to the second feature vector. Get the content,
The machine learning device adds, as an element, a weighted index related to a predetermined item related to the first analysis model to the first occurrence frequency vector and the second appearance frequency vector.
Failure response support system. It is a failure response support system that outputs the response content recommended to the user for the failure that occurred in the monitored target.
A failure notification device that transmits a failure notification including a failure message related to the failure, and
A failure response support device that acquires the response content based on the failure message and transmits a response content notification including the response content to the user.
It has a machine learning device for acquiring the corresponding contents by using an analysis model constructed in advance by machine learning based on the accumulated information of the past trouble correspondence for the trouble message.
The failure notification device transmits the failure notification to the user and the failure response support device.
The failure response support device extracts the failure message from the received failure notification, and requests the machine learning device to acquire the corresponding content for the extracted failure message.
The machine learning device is a first analysis model that classifies whether or not the user needs to contact the customer about the failure with respect to the acquired failure message, and / or a past failure response similar to the failure. The corresponding content is acquired by the second analysis model that extracts the candidate of the corresponding content from the above .
The failure response support device receives from the user a response reply notification in which feedback information about the response content included in the response content notification is described as a reply to the response content notification, and receives the feedback information. , As learning data when re-learning in the machine learning device
When the response reply notification received from the user includes an instruction to immediately relearn the feedback information included in the response reply notification in the machine learning device. Before re-learning is performed by the machine learning device, the time required for re-learning is estimated, and a reflection schedule notification including information related to the scheduled completion time of re-learning is transmitted to the user.
Failure response support system.

Images