JP7001422B2 - Information processing equipment, information processing methods, and programs - Google Patents

Description

The present invention relates to an information processing apparatus, an information processing method, and a program.

In a system that operates devices such as various servers, a load is often predicted and optimization is attempted based on the predicted load (see, for example, Patent Document 1). Patent Document 1 describes that load prediction is performed based on load actual data obtained by periodically collecting actual load data. In the load prediction described in Patent Document 1, fluctuations in the day pattern showing similar changes for each time zone of the day are taken into consideration.

Japanese Unexamined Patent Publication No. 2017-021497

Here, Patent Document 1 discloses that the prediction accuracy is improved, but does not sufficiently describe how the predicted load is used.

Some aspects of the present invention have been made in view of the above-mentioned problems, and provide an information processing device, an information processing method, and a program that enable a suitable system operation based on load prediction. Is one of the purposes.

The information processing apparatus according to one aspect of the present invention uses a prediction model generated by deep learning of training data in which each time is associated with an actually measured system load which is a system load measured at each time. The first prediction unit that generates the prediction system load that predicts the system load at the second time after the first time based on the actual measurement system load detected by the first time, and the actual measurement at the second time. It is provided with a detection unit for detecting a system load and an output unit for outputting when the difference between the predicted system load and the actually measured system load at the second time exceeds the threshold value.

The information processing method according to one aspect of the present invention uses a prediction model generated by deep learning of training data in which each time is associated with an actually measured system load which is a system load measured at each time. Then, based on the measured system load detected by the first time, the step of generating the predicted system load that predicts the system load at the second time after the first time and the measured system load at the second time are set. The information processing apparatus performs a step of detecting and a step of outputting when the difference between the predicted system load and the measured system load at the second time exceeds the threshold value.

The program according to one aspect of the present invention uses a prediction model generated by deep learning of training data in which each time is associated with an actually measured system load which is a system load measured at each time. Based on the measured system load detected by the first time, the process of generating the predicted system load that predicts the system load at the second time after the first time and the actual measurement system load at the second time are detected. When the difference between the predicted system load and the measured system load at the second time exceeds the threshold value, the computer is made to execute the process and the process of outputting to that effect.

In the present invention, the "part", "means", "device", and "system" do not simply mean physical means, but the "part", "means", "device", and "system". Including the case where the function of "" is realized by software. Further, even if the functions of one "part", "means", "device", or "system" are realized by two or more physical means or devices, two or more "parts" or "means", The functions of "device" and "system" may be realized by one physical means or device.

It is a figure which shows the functional structure of the system including the system monitoring apparatus which is an embodiment of an information processing apparatus. It is a flowchart which shows the processing flow of the system monitoring apparatus shown in FIG. It is a flowchart which shows the processing flow of the system monitoring apparatus shown in FIG. It is a figure which shows the specific example of the hardware composition of the system monitoring apparatus shown in FIG.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the embodiments described below are merely examples, and there is no intention of excluding the application of various modifications and techniques not specified below. That is, the present invention can be variously modified and implemented without departing from the spirit of the present invention. Further, in the description of the following drawings, the same or similar parts are represented by the same or similar reference numerals. The drawings are schematic and do not necessarily match the actual dimensions and ratios. Even between drawings, there may be parts where the relationship and ratio of dimensions differ from each other.

[Embodiment]
[1 Overview]
When providing various information processing services such as web services using an information processing system consisting of multiple servers, the load of the information processing system (processing capacity of the processor) is due to the fact that requests from users etc. are constantly changing. , Network communication capacity, memory usage, storage usage, etc.) also change from moment to moment. If the system load exceeds the processing capacity of the information processing system, a serious situation such as a service stop may occur. Therefore, it is extremely important to measure the load of the information processing system and detect an abnormality.

Conventionally, an abnormality in an information processing system has been performed by an administrator manually setting a static monitoring threshold value. In this case, when the system load exceeds or falls below the monitoring threshold value, it is detected as a system abnormality. However, since system requirements have become complicated in recent years, there has been a situation in which system abnormalities cannot be sufficiently detected by manually setting a reference monitoring threshold value for a system load. For example, since the monitoring threshold is customarily set to detect only when the load is high, an abnormality when the load is low, for example, a system abnormality such as a decrease in the cache hit rate due to a decrease in the load of the cache storage. Detection is often delayed or overlooked. It is difficult to set an appropriate monitoring threshold in all systems because it is necessary to deeply investigate the characteristics of each information processing system in order to set a monitoring threshold that can detect such abnormalities at low load. ..

In addition, many services such as web services include seasonal factors in the load tendency, but even if the system load rises or falls, for example, it is managed to judge whether it is due to a system abnormality or a seasonal factor. This usually leads to an increase in operating costs, as it is usually left to the discretion of the person. In addition, when the system load becomes high, measures such as increasing the number of servers are taken, but since it is an ex post facto response after it is detected that the load has become high, it is temporary after the abnormality is detected. It is easy for a situation such as deterioration of performance to occur. That is, it is desirable to detect in advance that the load will increase and take measures such as increasing the number of servers.

Therefore, in the system monitoring device according to the present embodiment, load prediction using a prediction model using deep learning and abnormality detection based on the load prediction are performed. By automatically detecting an abnormality and notifying the administrator by the system monitoring device, it is possible to prevent the detection of the abnormality from being delayed or overlooked, and to reduce the workload for the administrator to investigate. Is. In addition, by predicting the future system load, it is possible to increase the number of servers in advance in preparation for a high load and prevent the service performance from deteriorating.

In the load prediction of the system monitoring device in the present embodiment, a prediction model by LSTM (Long Short Term Memory) is used. Since LSTM is a recursive neural network capable of long-term memory, high-speed load prediction considering long-term seasonal factors is possible. Further, the system monitoring device according to the present embodiment enables high-speed abnormality detection in consideration of long-term seasonal factors by comparing such load prediction with the actually measured load and performing abnormality detection. There is.

In addition, when generating a prediction model by LSTM, it is necessary to learn load information over a long period of time in order to reflect long-term seasonal factors in the prediction model. That is, it is necessary to retain all the load information over a long period of time as learning data. However, in order to retain all the load information in the past, a huge storage capacity is required, and learning using the storage capacity also requires a huge amount of time. Therefore, in the system monitoring device of the present embodiment, only the load information newly obtained after learning is relearned by transfer learning for the trained prediction model. As a result, the system monitoring device only needs to hold the load information after the time point used when generating the previous prediction model and train it, so that the holding cost of the load information and the time required for re-learning can be increased. It is possible to reduce the cost.

Further, when an abnormality is detected, the system monitoring device in the present embodiment executes suitable operation information (workflow) according to the detected abnormality and the predicted load. This makes it possible to reduce the operational load on the administrator.

[2 Function configuration]
[2.1 Overview of Information Processing System 1]
Hereinafter, the overall configuration of the information processing system 1 including the system monitoring device 100 according to the present embodiment will be described with reference to FIG. 1. The information processing system 1 is roughly divided into servers 200a to 200n (hereinafter, collectively referred to as server 200) that provide various services such as web services, and a system monitoring device 100 that monitors the system load status related to the server 200. And include.

The system monitoring device 100 is communicably connected to each server 200, and at least the system load status of the server 200, for example, the processing status of a CPU (Central Processing Unit), the communication capacity of the network, the memory usage, and the storage usage. Etc. are monitored sequentially. Further, when a system abnormality is detected, the system monitoring device 100 takes measures (operations) for dealing with the system abnormality, such as operation of a new server 200. The service provided by the server 200 is not limited to the web service, and may be any service.

As shown in FIG. 1, the system monitoring device 100 includes a load detection unit 101, a load information DB (database) 103, a first prediction unit 107, a second prediction unit 109, a learning unit 111, an abnormality determination unit 113, and an output unit 115. , The coping unit 117, and the operation DB 119.

Here, in the system monitoring device 100 according to the present embodiment, the load information 105 from the current time (for example, time T) to the time point before a certain time (for example, time Tt1. T1> 0) is used at present. The system load at time T is predicted by the first prediction unit 107 (prediction system load). On the other hand, the load detection unit 101 also detects the actual system load at the current time T (actual measurement system load). The abnormality determination unit 113 compares the predicted system load and the measured system load at time T, and if the deviation between the two is larger than the threshold value, it is assumed that an unexpected abnormality has occurred, and the output unit 115 informs the administrator. Notify, etc.

At the same time, the second prediction unit 109 predicts the system load at a time point (time T + t2. T2> 0) after a certain time from the current time T by using the load information 105 up to the current time T. When the abnormality determination unit 113 detects an abnormality, the coping unit 117 reads the operation information 121 according to the system load expected to occur at the time T + t2 in the future, and detects the operation information 121 based on the operation information 121. It is possible to deal with the system abnormality that has occurred and the system load that is expected in the future.

In the present embodiment, the operation information 121 corresponding to the prediction system load at the current time T + t2 is read and the countermeasure is taken, but the present invention is not limited to this. For example, it is conceivable to read the operation information 121 according to the type of the abnormality detected by the abnormality determination unit 113 and take a countermeasure. In this case, the system monitoring device 100 does not necessarily have to include the second prediction unit 109.

[2.2 Functions of system monitoring device 100]
Hereinafter, each function of the system monitoring device 100 will be described. It should be noted that each function of the system monitoring device 100 shown in FIG. 1 does not necessarily have to be physically realized as one device, but may be realized by a plurality of cooperating computers. For example, it is conceivable to realize the prediction model 107a and the learning unit 111 for generating and relearning the prediction model 107a and the prediction model 109a of the first prediction unit 107 and the second prediction unit 109, and other functions on different devices.

The load detection unit 101 is provided so as to be able to communicate with each server 200, and detects the actual system load of the server 200. Various methods for detecting the system load can be considered. For example, a method of receiving information measured by the server itself from the server 200 can be considered, and the load detection unit 101 measures the system load by observing the operation of the server 200. It is also possible. The load detection unit 101 can be configured to detect a plurality of types of system loads such as a processor operating status and a memory usage status.

The load information DB 103 manages the load information 105. The load information 105 includes the value of the system load detected by the load detection unit 101 and the time of detection or measurement (whether it is an absolute time or a relative time with respect to a predetermined time point). And at least the information of. Here, if there are multiple types of loads to be monitored, such as processor operating status, memory usage status, network bandwidth usage status, etc., the value of each system load is associated with the time information. It is stored in the load information DB 103 as the load information 105.

The first prediction unit 107 and the second prediction unit 109 use the prediction model 107a and the prediction model 109a, respectively, to make predictions after a predetermined time, for example, after 30 minutes, based on the load information 105 obtained from the load information DB 103, respectively. Predict system load. For example, the prediction model 107a and the prediction model 109a calculate the system load at time t (t> 0; the same applies hereinafter) ahead of time Tx, that is, the system load at time Tx + t, based on the load information 105 up to time Tx. be able to. The first prediction unit 107 and the second prediction unit 109 periodically predict such a system load, for example, every 60 seconds.

It should be noted that a plurality of the first prediction unit 107 and the second prediction unit 109 can be prepared for each type of system load to be monitored, such as the operating status of the processor, the usage status of the memory, and the usage status of the network bandwidth. Alternatively, it can be prepared to handle a plurality of system loads together. Here, it is assumed that it is prepared for each system load. In that case, the learning unit 111, which will be described later, learns and relearns the prediction model 107a and the prediction model 109a for each type of system load.

The prediction model 107a and the prediction model 109a may be the same or different models. If they are different, the system load at time Tx + t1 (t1> 0) is based on the load information 105 up to time Tx in the prediction model 107a, and the time Tx + t2 (t2) based on the load information 105 up to time Tx in the prediction model 109a. The system load of t2> 0) can be predicted respectively. Here, the prediction model 107a used in the first prediction unit 107 and the prediction model 109a used in the second prediction unit 109 are the same, that is, if the same load information 105 is input, the same prediction system is used. It will be described as assuming that a load can be obtained. By making the prediction models 107a and 109a the same, it is possible to reduce the operating cost because the learning and the re-learning for generating the prediction model 107a and the prediction model 109a are performed once each.

Further, the load information 105 input by the prediction model 107a and the prediction model 109a may be only the load information 105 at one time Tx, or from the load information 105 over a certain time width, for example, from the time Tx-t. It is also conceivable to use the load information 105 up to the time Tx.

The input load information 105 is different between the first prediction unit 107 and the second prediction unit 109. For example, the first prediction unit 107 predicts the system load at time T by inputting the load information 105 up to time Tt, and the second prediction unit 109 inputs the load information 105 up to time T as input to the system load at time T + t. Predict. When operating the time T as the current time, the first prediction unit 107 determines the system load of the current time T predicted from the system operation status up to the past time Tt (for example, 30 minutes before the current time). Is calculated. On the other hand, the second prediction unit 109 calculates the system load at the future time T + t (for example, 30 minutes after the current time) from the system operation status up to the current time T.

The learning unit 111 performs learning for generating the prediction model 107a and the prediction model 109a, and re-learning thereof. As described above, since the prediction models 107a and 109a are the same in the present embodiment, the prediction model 107a will be described here as being generated / relearned. If the prediction model 107a and the prediction model 109a are different from each other, the following learning and relearning processes may be performed for each of them.

The learning unit 111 generates a prediction model 107a by performing learning by LSTM using the load information 105 stored in the load information DB 103 as learning data. As described above, the service provided by the server 200 changes according to various seasonal factors such as the season, the month, the day of the week, and the time zone. Therefore, it is preferable that the load information 105 used when first generating the prediction model 107a is as long as possible. Since LSTM is a recursive neural network capable of long-term memory, it is possible to generate a prediction model 107a considering long-term seasonal factors by learning load information 105 over a longer period of time.

Further, the learning unit 111 also has a function of re-learning the already generated prediction model 107a by transfer learning. At this time, for example, if the prediction model 107a is generated using the load information 105 up to an arbitrary time Tn as learning data, for example, from time Tn + 1 (arbitrary time ahead of time Tn on the time axis) to time Tn + x. The learning unit 111 may relearn the prediction model 107a using the load information 105 of the above as training data. If the re-learning of the load information 105 up to the time Tn + x is completed and the load information 105 is reflected in the prediction model 107a, the load information 105 up to the time Tn + x can be deleted from the load information DB 103. Is. As a result, it is not necessary to hold the load information 105 for a long period of time, so that it is possible to suppress the operating cost of the system monitoring device 100.

The learning unit 111 can automatically relearn the prediction model 107a periodically and automatically, for example, once a day and once a week. Since the learning unit 111 periodically relearns, the amount of load information 105, which is the learning data used for one relearning, is reduced, so that the time required for each relearning of the prediction model 107a is reduced. be able to.

The abnormality determination unit 113 detects an abnormality based on the difference between the value of the prediction system load predicted by the first prediction unit 107 and the actual system load (actual measurement system load) detected by the load detection unit 101. That is, if the value of the predicted system load at time T predicted from the system operating status up to time Tt and the value of the system load at time T actually observed deviate from each other by, for example, a threshold value or more, it is abnormal. The determination unit 113 determines that it is abnormal. This is because the prediction system load generated by the first prediction unit 107 is calculated from the system operation status up to a certain time t in consideration of seasonal factors, so that the value of this prediction system load and If there is a large deviation from the actual measured system load value, it is considered that something unexpected has happened (a large amount of unexpected processing requests have been received, there is a problem with the operating status of some part of the server 200, etc.). Because it is done.

The output unit 115 outputs the abnormality determination result by the abnormality determination unit 113. As an output method, for example, by displaying a message on a display device, outputting a voice from a speaker, or notifying a message such as an e-mail or a messenger application, the administrator is notified, or the time and its as a log file are output. It is conceivable to output the normal / abnormal state at the time.

When an abnormality is detected by the abnormality determination unit 113, the coping unit 117 takes a coping (operation) for the abnormality. At this time, the coping unit 117 can refer to the operation information 121 stored in advance in the operation DB 119. The contents of the operation described in the operation information 121 include, for example, the operation of the dormant server 200, the operation of some of the servers 200, and the restart of the server 200, depending on the type of system load in which the abnormality is detected. Etc. can be considered.

At this time, it is conceivable that the coping unit 117 takes measures according to the expected future load of the prediction system. In this case, the coping unit 117 uses the abnormality determination result output from the abnormality determination unit 113 at the current time T and the prediction system load at the time T + t generated by the second prediction unit 109 to provide operation information. You may refer to 121. As a result, for example, when an abnormality at the current time T is detected by the abnormality determination unit 113, the coping unit 117 can take measures according to the system load at the time T + t calculated by the second prediction unit 109. Become. Further, for example, if the predicted system load expected at time T + t is high, a new server is started, but if the predicted system load expected at time T + t is within the normal range, no action is taken. Operation is also possible.

[3 Processing flow]
Hereinafter, the processing flow of the system monitoring device 100 will be described with reference to FIGS. 2 and 3. 2 and 3 are flowcharts showing the processing flow of the system monitoring device 100.

It should be noted that each processing step described later can be arbitrarily changed in order or executed in parallel within a range that does not cause a contradiction in the processing content, and even if another step is added between each processing step. good. Further, the step described as one step for convenience can be executed by being divided into a plurality of steps, and the step described as being divided into a plurality of steps can be executed as one step for convenience.

[3.1 Processing flow when anomaly is detected]
First, with reference to FIG. 2, a process related to system abnormality detection by the system monitoring device 100 will be described. FIG. 2 is a flowchart showing a processing flow of the system monitoring device 100 for detecting a system abnormality.

First, the load detection unit 101 detects the system load (measured system load) of the server 200 at the current time T (S201). As described above, the system load detection method by the load detection unit 101 may detect the system operation status of the server 200 or the like by observing the load detection unit 101, or by receiving from the server 200 side. It is also possible to detect it. The detected actual measurement system load is stored as load information 105 in the load information DB 103 in association with the time T.

The first prediction unit 107 reads the load information 105 stored in the load information DB 103, which is time t (t> 0) earlier than the time T, up to the time Tt, and inputs the load information 105 into the prediction model 107a. By doing so, the prediction system load at time T is calculated (S203).

The abnormality determination unit 113 calculates the difference between the value of the prediction system load at time T calculated by the first prediction unit 107 and the value of the actual measurement system load at time T detected by the load detection unit 101 (S205). .. As a result, if the difference between the predicted system load and the measured system load is equal to or greater than a predetermined threshold value (Yes in S207), the abnormality determination unit 113 determines that an abnormality has occurred, and to that effect. Is output from the output unit 115 (S115). By looking at the output, the administrator can grasp that some abnormality has occurred in the system including the server 200, and therefore, it is possible to take some measures against the abnormality accordingly.

Further, the second prediction unit 109 reads the load information 105, which is the actual measurement system load up to the time T, and inputs the load information 105 into the prediction model 109a to calculate the prediction system load at the time T + t (S211). .. The coping unit 117 reads the operation information 121 based on the abnormality detected by the abnormality determination unit 113 and the prediction system load at the time T + t from the operation DB 119, and executes the operation (S215). When the administrator mainly deals with the system abnormality, it is not always necessary to perform the processes of S211 to S215.

In S207, when the deviation between the value of the predicted system load and the value of the measured system load is less than the threshold value (No of S207), the processing related to S209 to S215 is unnecessary.

When the system management by the system monitoring device 100 is continued (No of S217), the system monitoring device 100 sets the time T to T + 1 (arbitrary time in a predetermined time unit ahead on the time axis, for example, 30 seconds of the time T). It may be updated to (S219) and the processing after S201 may be performed again.

[3.2 Flow of processing related to learning of the prediction model 107a]
Next, with reference to FIG. 3, a process related to learning of the prediction model 107a used by the system monitoring device 100 to predict the system load will be described. FIG. 3 is a flowchart showing a processing flow of the system monitoring device 100 for learning the prediction model 107a. As described above, in the present embodiment, the prediction model 109a is the same as the prediction model 107a, so that both the prediction model 107a and the prediction model 109a are generated by the process of FIG. If the two are different, the prediction model 109a can also be generated by the same procedure, although there is a difference in the load information 105 as the training data.

If the prediction model 107a has not been generated yet, the learning unit 111 of the system monitoring device 100 reads all the load information 105 up to the time Tn in order to generate the prediction model 107a (S301), and this is the learning data. As a result, the prediction model 107a is generated by LSTM (S303). By loading the generated prediction model 107a into the first prediction unit 107, the first prediction unit 107 can predict the system load based on the load information 105.

After that, when the preset re-learning time of the prediction model 107a arrives (Yes in S305), the learning unit 111 reads the prediction model 107a generated by the learning by the load information 105 up to the time T (S307). , The load information 105 up to the time Tn + 1 to Tn + t (Tn + t> Tn + 1, where t is an arbitrary time) is read from the load information DB 103 (S309). The learning unit 111 performs re-learning by transfer learning of the prediction model 107a using the load information 105 at the read times Tn + 1 to Tn + t. As a result, the learning unit 111 can assume that the prediction model 107a considering the load information 105 up to the time Tn considers the load information 105 up to the time Tn + t. Therefore, the learning unit 111 updates the time Tn indicating the latest time reflected in the prediction model 107a at the time Tn + t (S313). At this time, the learning unit 111 may delete the load information 105 stored in the load information DB 103 up to the time Tn + t.

When the system management by the system monitoring device 100 is continued (No of S315), the system monitoring device 100 can periodically update the prediction model 107a by repeating the processes of S305 to S313.

[4 Hardware configuration]
Hereinafter, the hardware configuration of the computer (information processing device) capable of realizing the system monitoring device 100 will be described with reference to FIG. The system monitoring device 100 includes a control unit 401, a storage unit 405, a communication interface (I / F) unit 411, an input unit 413, and a display unit 415, and each unit is connected via a bus line 417. ..

The control unit 401 includes a CPU (Central Processing Unit, not shown), a ROM (Read Only Memory, not shown), a RAM (Random Access Memory) 403, and the like. By executing the control program 407 stored in the storage unit 405, the control unit 401 can execute the processing related to each configuration of the system monitoring device 100 shown in FIG. 1 in addition to the function as a general computer. Will be done. For example, the load detection unit 101, the first prediction unit 107, the second prediction unit 109, the learning unit 111, the abnormality determination unit 113, the output unit 115, and the coping unit 117 shown in FIG. 1 are temporarily stored in the RAM 403. Therefore, it can be realized as a control program 407 that operates on the CPU.

Further, the RAM 403 temporarily stores a part or all of the load information 105, the operation information 121, the determination result by the abnormality determination unit 113, and the like, in addition to the code included in the control program 407. Further, the RAM 403 is also used as a work area when the CPU executes various processes.

The storage unit 405 is a non-volatile storage medium such as an HDD (Hard Disk Drive) or a flash memory. The storage unit 405 stores an operating system (OS) and a control program 407 for realizing a function as a general computer, and a DB 409 which is data necessary for executing the control program 407. The DB 409 may include the load information DB 103 and the operation DB 119.

The communication I / F unit 411 is a device for performing wired or wireless data communication with the server 200 and other information processing devices as needed. For example, it is conceivable that the load detection process by the load detection unit 101 for detecting the load of the server 200 is performed via the communication I / F unit 411.

The input unit 413 is a device for receiving various input operations from the administrator of the system monitoring device 100. Specific examples of the input unit 413 include a keyboard, a mouse, a touch panel, and the like.

The display unit 415 is a display device for presenting various information to the manager who manages the system monitoring device 100. Specific examples of the display unit 415 include a liquid crystal display, an organic EL (Electro-Luminescence) display, and the like. For example, when a system abnormality is detected by the abnormality determination unit 113, the output unit 115 may display the display unit 415 to that effect.

[5 Effects of the present embodiment]
As described above, in the system monitoring device 100 according to the present embodiment, the prediction system load is calculated using the prediction model 107a that can consider long-term seasonal factors, and the prediction system load and the actual measurement system load are used. Abnormalities are detected by comparing. As a result, even when the system load is not high, an abnormality is detected if the situation is different from the prediction, so that it is possible to suppress an abnormality detection omission or the like.

In addition, by calculating the prediction system load at time T + t before the time T to be monitored and making it possible to take measures based on this, if performance deterioration due to high load etc. is expected in the future, it will be done in advance. It is possible to take measures such as increasing the number of servers.
Further, since it is possible to detect an abnormality and automatically deal with it, it is possible to reduce the operation cost by the administrator.

[6 Addendum]
The embodiments described above are for facilitating the understanding of the present invention, and are not for limiting the interpretation of the present invention. Each element included in the embodiment and its arrangement, material, condition, shape, size, and the like are not limited to those exemplified, and can be appropriately changed. Further, it is possible to partially replace or combine the configurations shown in different embodiments.

1 ... Information processing system, 100 ... System monitoring device, 101 ... Load detection unit, 103 ... Load information database (DB), 105 ... Load information, 107 ... First prediction unit, 107a ... Prediction model, 109 ... Second Prediction unit, 109a ... Prediction model, 111 ... Learning unit, 113 ... Abnormality determination unit, 115 ... Output unit, 117 ... Coping unit 119 ... Operation DB, 121 ... Operation information, 200 ... Server, 401 ... Control unit, 403 ... RAM, 405 ... Storage unit, 407 ... Control program, 411 ... Communication interface (I / F) unit, 413 ... Input unit, 415 ... Display unit, 417 ... Bus line

Claims (6)

An actual measurement system detected by the first time using a prediction model generated by deep learning of training data in which each time and the actual measurement system load, which is the system load measured at each time, are associated with each other. A prediction unit that predicts the system load at the second time after the first time based on the load, and the first prediction unit that generates the system load.
A detection unit that detects the actual measurement system load at the second time, and
An information processing device including an output unit that outputs when the difference between the predicted system load and the measured system load at the second time exceeds a threshold value. The claim further comprises a second prediction unit that uses the prediction model to generate a prediction system load at a third time after the second time, based on the measured system load detected by the second time. 1. The information processing apparatus according to 1. The management department that manages operations according to the system load,
The information processing apparatus according to claim 2, further comprising a control unit that executes the operation according to the prediction system load at the third time when the difference at the second time exceeds the threshold value. The prediction model generated by the first learning data related to the actual measurement system load up to the fourth time is used, and the prediction model is obtained by using the second learning data related to the actual measurement system load from the fourth time to the fifth time. The information processing apparatus according to any one of claims 1 to 3, further comprising a re-learning unit for re-learning. An actual measurement system detected by the first time using a prediction model generated by deep learning of training data in which each time and the actual measurement system load, which is the system load measured at each time, are associated with each other. A step to generate a predicted system load that predicts the system load at the second time after the first time based on the load.
The step of detecting the measured system load at the second time and
An information processing method in which an information processing apparatus performs a step of outputting a step when the difference between the predicted system load and the measured system load at the second time exceeds a threshold value. An actual measurement system detected by the first time using a prediction model generated by deep learning of training data in which each time and the actual measurement system load, which is the system load measured at each time, are associated with each other. A process to generate a predicted system load that predicts the system load at the second time after the first time based on the load.
The process of detecting the actual measurement system load at the second time and
A program that causes a computer to execute a process of outputting a process when the difference between the predicted system load and the measured system load at the second time exceeds a threshold value.

Images