JP7331581B2 - MONITORING DEVICE, MONITORING METHOD, AND PROGRAM - Google Patents

Description

The present invention relates to a monitoring device, monitoring method, and program for monitoring an information system.

With the spread of cloud computing, DevOps (Development Operations), container-type virtualization technology, and the like, it has become easier to release new versions of information systems that provide large-scale services by incorporating user needs. Accompanying this, information systems (hereinafter referred to as systems) are frequently upgraded and released. When software is used to monitor system performance, the administrator must configure the monitoring settings each time the version is upgraded. Therefore, if version upgrades are performed frequently, the operation manager will need to make monitoring settings for each version upgrade, which may cause delays in service provision. In order to continuously provide services without delay, it is required that the software side continues monitoring without the user being aware of the version upgrade. For example, in monitoring such a system, there is a method of setting a threshold for performance information of the system and detecting an abnormality in performance depending on whether or not the collected performance information exceeds the threshold.

Patent Literature 1 discloses a technique for monitoring a system using a baseline without setting thresholds for performance information. The technique of Patent Literature 1 focuses on the periodicity of system load, generates a baseline using performance information for a certain period of time, and uses the generated baseline instead of a threshold.

In general, performance trends and load conditions may change after a system version upgrade. Therefore, if monitoring is performed using the baseline of the old version as it is, there is a possibility that changes in trends may be mistakenly detected as abnormal. Baseline is usually calculated using the mean and the variance. Since the width of the distribution is small where the change is small in the baseline before the version upgrade, when the load status changes due to the version upgrade, the data value exceeds the baseline of the old version, making it easier to detect anomalies. Therefore, in order to continue monitoring after upgrading, it was necessary to regenerate the baseline, even though the learning period was short.

Patent Literature 2 discloses a performance monitoring device that monitors a system based on a baseline created using performance information history measured by the system. The device of Patent Literature 2 pre-stores system configuration information of the system and a baseline for each system configuration. When the device of Patent Document 2 detects a change in system configuration, it inquires whether system configuration information that matches or is similar to the system after the configuration change is stored. The device of Patent Document 2 replaces the current baseline with a baseline associated with the system configuration after the configuration change when system configuration information that matches or resembles the system configuration after the configuration change is stored.

Further, Patent Literature 3 discloses a technique of comparing differences in application performance information before and after a system upgrade, and extracting performance information whose performance has changed due to the upgrade.

JP 2004-164637 A WO2011/125138 WO2018/037561

According to the method of Patent Document 1, the operation manager does not need to set monitoring such as thresholds each time the system is upgraded. However, in the technique of Patent Document 1, it is necessary to recollect performance information for a certain period of time in order to regenerate the baseline.

Further, according to the method of Patent Document 2, if the system configuration information after the configuration change is stored, the baseline can be replaced automatically, so the chances of recreating the baseline can be reduced. However, in the method of Patent Document 2, if matching or similar system configuration information is not stored, a learning period is required after changing the system configuration while monitoring the current baseline.

That is, the methods of Patent Documents 1 and 2 require a learning period after the system configuration is changed, so there is a problem that a settable baseline cannot be generated immediately after the upgrade.

According to the technique of Patent Document 3, it is possible to extract the performance information that has changed before and after the upgrade, and feed back the extracted performance information to the user. However, the method of Patent Literature 3 requires the user to take measures to change the settings after version upgrade, and there is a problem that the settings related to the new version cannot be made immediately after the new version is deployed.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a monitoring device or the like that can continue monitoring an information system without changing monitoring settings triggered by a version change.

A monitoring device according to one aspect of the present invention is a storage that stores performance information of an application operating in an information system, configuration change information related to a change in configuration information associated with a version change of the application, and a baseline for each version of the application. and the storage unit, predict the baseline reference value in the future version based on the change in the performance information in the past version change of the application, and based on the predicted change in the baseline reference value after the version change and an arithmetic processing unit that generates a baseline of and detects a performance abnormality in the application using the generated baseline.

In the monitoring method according to one aspect of the present invention, performance information of an application operating in an information system, configuration change information related to changes in configuration information associated with a version change of the application, and a baseline for each version of the application are referred to. , predicting the baseline reference value in the future version based on the change in the performance information in the past version change of the application, generating the baseline after the version change based on the predicted change in the baseline reference value, and generated Use baselines to detect performance anomalies in your application.

A program according to one aspect of the present invention refers to performance information of an application operating in an information system, configuration change information related to a change in configuration information associated with a version change of the application, and a baseline for each version of the application. A process of predicting the baseline reference value in the future version based on the change in performance information in the past version change, and a process of generating the baseline after the version change based on the predicted change in the baseline reference value, and a process of detecting performance anomalies in the application using the generated baseline.

According to the present invention, it is possible to provide a monitoring device or the like that can continue monitoring an information system without changing the monitoring settings triggered by a version change.

It is a block diagram showing an example of composition of the whole system concerning a 1st embodiment of the present invention. 4 is a table showing an example of a performance information table generated by the monitoring device according to the first embodiment of the present invention; 4 is a table showing an example of a configuration change information table generated by the monitoring device according to the first embodiment of the present invention; It is a table which shows an example of the baseline table which the monitoring apparatus which concerns on the 1st Embodiment of this invention produces|generates. 4 is a block diagram showing an example of data flow in monitoring setting registration of the monitoring device according to the first embodiment of the present invention; FIG. 4 is a block diagram showing an example of data flow in changing configuration information of the monitoring apparatus according to the first embodiment of the present invention; FIG. 4 is a block diagram showing an example of data flow in performance information monitoring of the monitoring device according to the first embodiment of the present invention; FIG. FIG. 4 is a conceptual diagram showing an example of baselines used by the monitoring device according to the first embodiment of the present invention; FIG. 4 is a conceptual diagram showing an example of a difference in baseline reference values between versions used by the monitoring device according to the first embodiment of the present invention to generate a baseline; FIG. 4 is a conceptual diagram showing an example of a difference in baseline reference values between versions used by the monitoring device according to the first embodiment of the present invention to generate a baseline; FIG. 4 is a conceptual diagram showing an example in which the monitoring device according to the first embodiment of the present invention switches baselines; It is a table which shows an example of the baseline table which the monitoring apparatus which concerns on the 1st Embodiment of this invention uses. FIG. 2 is a conceptual diagram for explaining how the monitoring apparatus according to the first embodiment of the present invention calculates an expected baseline reference value of a future version using an expected baseline reference value of a past version; is. FIG. 4 is a sequence diagram showing an example of a workflow between components in performance information monitoring by the monitoring device according to the first embodiment of the present invention; It is a block diagram which shows an example of a structure of the whole system which concerns on the 2nd Embodiment of this invention. It is a block diagram showing an example of hardware constitutions which realize a monitoring device concerning each embodiment of the present invention.

EMBODIMENT OF THE INVENTION Below, the form for implementing this invention is demonstrated using drawing. However, the embodiments described below are technically preferable for carrying out the present invention, but the scope of the invention is not limited to the following. In addition, in all drawings used for the following description of the embodiments, the same symbols are attached to the same parts unless there is a particular reason. Further, in the following embodiments, repeated descriptions of similar configurations and operations may be omitted. Also, the directions of the arrows in the drawings are only examples, and do not limit the directions of signals between blocks.

(First embodiment)
First, an overall system according to the first embodiment of the present invention will be described with reference to the drawings. The overall system of this embodiment includes a monitoring device that performs baseline monitoring of the information system using performance information of applications running on the information system. It should be noted that the “whole” of the entire system is a word for distinguishing it from the information system. An information system can also be considered an application in itself.

In this embodiment, an information system using container-type virtualization technology is assumed as an environment in which version upgrades are frequently performed. In this embodiment, the information system configured in the container instance is monitored. It should be noted that the method of this embodiment can be applied not only to container-type virtualization technology, but also to physical machines and virtual machines constructed by hypervisor-type virtualization technology.

(composition)
FIG. 1 is a block diagram showing an example of the configuration of an overall system 1 according to this embodiment. The overall system 1 of this embodiment comprises a monitoring device 10 , a terminal device 12 , a container management device 13 and at least one container instance 14 . Note that the configuration included in the monitoring device 10 will be described later.

A monitoring device 10 is connected to a terminal device 12 , a container management device 13 and at least one container instance 14 . For example, the monitoring device 10 is implemented in a general-purpose or dedicated server built in a data center, cloud, or the like. Also, the monitoring device 10 may be realized by a general-purpose or dedicated computer having an information processing function and a communication function.

The monitoring device 10 periodically collects, from at least one container instance 14, performance information of applications operating on the information system constructed in those container instances 14. FIG. The monitoring device 10 accumulates the collected performance information. The monitoring device 10 uses the accumulated performance information to generate, update, and predict baselines for monitoring applications operating on the information system.

If the performance value included in the acquired performance information is outside the baseline range, the monitoring device 10 transmits to the terminal device 12 a notification indicating that a performance abnormality has occurred in the application. For example, when it is determined that there is a performance abnormality when the performance value exceeds the baseline, the fact that the performance value is outside the range of the baseline indicates that the performance value has exceeded the baseline. On the other hand, for example, when it is determined that there is a performance abnormality when the performance value does not exceed the baseline, the fact that the performance value is outside the range of the baseline indicates that the performance value did not exceed the baseline. . The notification sent to the terminal device 12 is referred to by the operations manager. The monitoring device 10 collects configuration information of applications in order to grasp the version upgrade status of applications operating in the information system to be monitored. The monitoring device 10 manages the collected configuration information for each application version.

A terminal device 12 is connected to the monitoring device 10 . The terminal device 12 is one of the components provided by the monitoring device 10 . The terminal device 12 has a function of receiving input of information for operating the monitoring device 10 and a function (not shown) of receiving a notification regarding performance abnormality from the monitoring device 10 and displaying the content of the notification. For example, the terminal device 12 has a display unit (not shown) on which a GUI (Graphical User Interface) used for inputting operations to the monitoring device 10 and displaying notifications regarding performance abnormalities is displayed. The terminal device 12 is arranged outside the monitoring device 10 . For example, the terminal device 12 is implemented by a computer, mobile terminal, or the like having an information processing function and a communication function. Note that the functions of the terminal device 12 may be configured to be included in the monitoring device 10 .

Information for operating the monitoring device 10 is input to the terminal device 12 by the user of the monitoring device 10 . The terminal device 12 transmits information input by the user to the monitoring device 10 . The terminal device 12 also receives performance information collected by the monitoring device 10 . The terminal device 12 causes the display unit (not shown) to display the performance information received from the monitoring device 10 . The terminal device 12 also receives a notification from the monitoring device 10 indicating that an abnormality such as performance deterioration has occurred in the application. The terminal device 12 causes the display unit (not shown) to display information about the received notification.

A container management device 13 (also called a management device) is connected to the monitoring device 10 . A container management device 13 manages at least one container instance 14 . For example, the container management device 13 is an orchestrator that manages starting, stopping, auto-scaling, etc. of the container instances 14 . The container management device 13 manages at least one container instance 14 by associating it with an auto scaling group. For example, the container management device 13 is implemented in a general-purpose or dedicated server built in a data center, cloud, or the like. Also, the container management device 13 may be realized by a general-purpose or dedicated computer having an information processing function and a communication function.

The container management device 13 includes a management information collection section 131 . The management information collection unit 131 collects information about the container instances 14 managed by the container management device 13 .

A container instance 14 (also called computing device) is connected to the monitoring device 10 . The container instance 14 is at least one computing device to be monitored by the monitoring device 10 . An information system in which arbitrary applications and programs operate is configured in the container instance 14 . For example, the container instance 14 is configured in a general-purpose or dedicated server built in a data center, cloud, or the like. Also, the container instance 14 may be configured in a general-purpose or dedicated computer having information processing functions and communication functions.

A container instance 14 includes a performance information collection unit 141 . The performance information collection unit 141 is arranged inside or outside the container instance 14 . The performance information collection unit 141 collects performance information of the container instances 14 .

The above is a description of an example of the configuration of the overall system 1 of the present embodiment. The configuration of FIG. 1 is an example, and the configuration of the overall system 1 is not limited to the form of FIG.

[Monitoring device]
Next, a detailed configuration of the monitoring device 10 will be described with reference to the drawings. The monitoring device 10 has a function of inputting and outputting information, a function of arithmetic processing using the input information, and a function of storing the arithmetically processed information.

As shown in FIG. 1, the monitoring device 10 includes a performance information reception unit 101, a management information reception unit 104, and an operation reception unit 107 as information input/output functions. The monitoring apparatus 10 also includes a performance information processing unit 102, a performance abnormality detection unit 103, a configuration information management unit 105, and a baseline generation unit 106 as functions for arithmetic processing. Furthermore, the monitoring apparatus 10 includes a performance information storage unit 108, a configuration change information storage unit 109, and a baseline storage unit 110 as information storage functions.

The performance information reception unit 101 is connected to at least one container instance 14 . The performance information reception unit 101 receives performance information collected by the performance information collection unit 141 included in at least one container instance 14 . Performance information reception unit 101 transmits the received performance information to performance information processing unit 102 .

Performance information processing unit 102 is connected to performance information reception unit 101 , performance abnormality detection unit 103 , and performance information storage unit 108 . The performance information processing unit 102 receives performance information from the performance information reception unit 101 . The performance information processing unit 102 generates a performance information table using the received performance information. Performance information processing unit 102 stores the generated performance information table in performance information storage unit 108 . Also, the performance information processing unit 102 transmits the generated performance information table to the performance abnormality detection unit 103 . When synchronizing the reception of performance information and the generation of the baseline, the performance information processing unit 102 and the baseline generation unit 106 are connected.

FIG. 2 is an example of a performance information table generated by the performance information processing unit 102 (performance information table 151). Items of the performance information table 151 include collection time, application name, and performance information. The collection time is the time when the performance information was collected in the container instance 14 to be monitored. The application name is the name of the application running on the container instance 14 to be monitored. In the performance information table 151 of FIG. 2, a code representing the version number of the application is added to the end of the application name. The performance information is performance values of applications collected from the container instances 14 to be monitored. The performance information table 151 of FIG. 2 includes the CPU (Central Processing Unit) usage rate (CPU usage rate) and the memory usage rate (memory usage rate) associated with the operation of the application as performance items. Any performance can be designated as the performance item to be monitored according to the user's operation.

The performance abnormality detection unit 103 is connected to the performance information processing unit 102 , the operation reception unit 107 and the baseline storage unit 110 . Note that the performance abnormality detection unit 103 may be connected to the terminal device 12 . The performance abnormality detection unit 103 receives the performance information table from the performance information processing unit 102 . The performance anomaly detection unit 103 refers to the received performance information table and acquires the baseline for monitoring of the source container instance 14 included in the performance information table from the baseline storage unit 110 . The performance anomaly detection unit 103 determines that the performance value of the corresponding container instance 14 is out of the range of the baseline, as a performance anomaly. When the performance abnormality detection unit 103 determines that there is a performance abnormality, the performance abnormality detection unit 103 transmits a notification indicating that the performance abnormality has occurred to the operation reception unit 107 .

The management information reception unit 104 is connected to the configuration information management unit 105 . Also, the management information reception unit 104 is connected to the container management device 13 . The management information reception unit 104 receives configuration information collected by the management information collection unit 131 . The configuration information collected by the container management device 13 includes information on configuration changes such as version upgrades of applications operating in the information system configured in the container instance 14 to be monitored. Management information reception unit 104 transmits the received configuration information to configuration information management unit 105 .

Configuration information management unit 105 is connected to management information reception unit 104 and configuration change information storage unit 109 . The configuration information management unit 105 receives configuration information from the management information reception unit 104 . The configuration information management unit 105 uses the received configuration information to generate a new configuration change information table. The configuration information management unit 105 updates the configuration change information table stored in the configuration change information storage unit 109 to a new configuration change information table.

FIG. 3 is an example of a configuration change information table generated by the configuration information management unit 105 (configuration change information table 153). Items of the configuration change information table 153 include update time, update type, image name, version number of the new version, and version number of the old version. The update time stores the time when the configuration of the application was changed. The update type stores the type of configuration change to the application, such as version upgrade (Update) or new addition (New). The image name stores the name of the application whose configuration has been changed. The new version stores the version number after the configuration change is implemented. The old version stores the version number before the configuration change is implemented.

Baseline generation unit 106 is connected to operation reception unit 107 , performance information storage unit 108 , configuration change information storage unit 109 , and baseline storage unit 110 . The baseline generation unit 106 refers to the baseline table stored in the baseline storage unit 110, the configuration change information table stored in the configuration change information storage unit 109, and the performance information table stored in the performance information storage unit 108. . The baseline generation unit 106 generates a baseline for each performance item based on the referenced baseline table, configuration change information table, and performance information table. The baseline generation unit 106 also updates the baseline and predicts future versions of the baseline. The baseline generation unit 106 generates a baseline table including generated, updated, and predicted baselines. The baseline generator 106 stores the generated baseline table in the baseline storage 110 .

FIG. 4 is an example of a baseline table generated by the baseline generator 106 (baseline table 155). Items in baseline table 155 include baseline time, application name, and baseline. The baseline time is the time for matching the time when the performance information was collected with the baseline. Any period can be specified for the baseline time. The application name is the name of the application to which each baseline is applied. A baseline is a baseline reference value of various performance items for a combination of application name and version at a certain baseline time. The baseline table 155 stores CPU usage and memory usage as baselines. A baseline is generated for each performance item.

The operation reception unit 107 is connected to the performance abnormality detection unit 103 and the baseline generation unit 106 . Also, the operation reception unit 107 is connected to the terminal device 12 . The operation reception unit 107 receives operation details input to the terminal device 22 by the user. The operation reception unit 107 transmits to the baseline generation unit 106 an instruction to regenerate the baseline, change the threshold, or the like, according to the received operation content. The operation reception unit 107 also receives a notification from the performance abnormality detection unit 103 indicating that a performance abnormality has occurred. The operation reception unit 107 transmits to the operation reception unit 107 a notification indicating that the performance abnormality has occurred.

Performance information storage unit 108 is connected to performance information processing unit 102 and baseline generation unit 106 . The performance information storage unit 108 stores a performance information table including performance information of at least one container instance 14 to be monitored. The performance information table stored in the performance information storage unit 108 is recorded in a file, database, or the like. Also, upon receiving a performance information acquisition request, the performance information storage unit 108 provides the pertinent performance information to the requester.

Configuration change information storage unit 109 is connected to configuration information management unit 105 and baseline generation unit 106 . The configuration change information storage unit 109 stores a configuration change information table including configuration change information. The configuration change information table stored in the configuration change information storage unit 109 is recorded in a file, database, or the like. Upon receiving a configuration change information acquisition request, the configuration change information storage unit 109 provides the corresponding configuration change information to the request source.

Baseline storage unit 110 is connected to performance abnormality detection unit 103 and baseline generation unit 106 . The baseline storage unit 110 stores a baseline table including baselines related to application versions. The baseline table stored in the baseline storage unit 110 is stored in a file, database, or the like. Upon receiving a baseline acquisition request, the baseline storage unit 110 provides the corresponding baseline to the requester.

The above is the description of the configuration of the monitoring device 10 . Note that FIG. 1 is an example of the configuration of the monitoring device 10, and the configuration of the monitoring device 10 is not limited to the form in FIG.

(motion)
Next, several cases regarding the operation of the monitoring device 10 according to this embodiment will be described. The data flow in each of monitoring setting registration, configuration information change, and performance information monitoring will be described below.

[Monitoring setting registration]
First, registration of monitoring settings from the terminal device 12 (hereinafter referred to as monitoring setting registration) will be described with reference to the drawings. FIG. 5 is a block diagram for explaining monitoring setting registration from the terminal device 12. As shown in FIG. In FIG. 5, the data flow is indicated by arrows.

Monitoring settings are registered in the terminal device 12 by the operation manager. The terminal device 12 transmits the monitoring settings registered by the operation manager to the operation reception unit 107 .

For example, the operation manager uses the terminal device 12 to make monitoring settings indicating whether or not to overwrite and update the baseline applied to a released application at any point in time during which the application is in operation. register.

Also, for example, the operation manager registers a monitoring setting indicating in which mode, synchronous or asynchronous, baseline generation is to be executed when the monitoring apparatus 10 receives performance information. When synchronizing reception of performance information with generation of a baseline, the baseline generation unit 106 generates a baseline reflecting the performance information in response to reception of the performance information. On the other hand, when the reception of the performance information and the baseline are made asynchronous, the baseline generation unit 106 generates the baseline at preset timings independently of the reception of the performance information.

The operation reception unit 107 receives monitoring settings registered in the terminal device 12 . The operation accepting unit 107 transmits the received monitoring settings to the baseline generating unit 106 .

When receiving the monitoring setting indicating whether or not to overwrite the baseline, the baseline generating unit 106 retains the received monitoring setting. In addition, when the baseline generation unit 106 receives monitoring settings related to baseline mode change, the baseline generation unit 106 transmits information related to the received monitoring settings to the performance information processing unit 102 . The information regarding the monitoring settings transmitted to the performance information processing unit 102 is held in the performance information processing unit 102 .

The above is the description of the monitoring setting registration from the terminal device 12 . FIG. 5 is an example of the data flow in the monitoring setting registration from the terminal device 12, and the data flow in the monitoring setting registration of this embodiment is not limited to the form of FIG.

[Change configuration information]
Next, change of configuration information (hereinafter referred to as configuration information change) will be described with reference to the drawings. FIG. 6 is a block diagram for explaining configuration information change. FIG. 6 shows the flow of data up to the storage of information related to changes in configuration information (hereinafter referred to as configuration change information) based on the content of changes when changing the version of an application or generating a new application. An example of is indicated by an arrow.

The container management device 13 orchestrates at least one container instance 14 to be managed and instructs application deployment. Deploying an application includes, for example, creating a new version container instance 14 and discarding the old version container instance 14 or creating a new application container instance 14 . At this time, the container management device 13 transmits configuration information to the management information reception unit 104 of the monitoring device 10 . The management information reception unit 104 receives configuration information from the container management device 13 . Management information reception unit 104 transmits the received configuration information to configuration information management unit 105 .

The configuration information management unit 105 receives configuration information from the management information reception unit 104 . The configuration information management unit 105 uses the received configuration information to generate a configuration change information table including configuration change information. The configuration information management unit 105 stores the generated configuration change information table in the configuration change information storage unit 109 .

The above is the description of the configuration information change. FIG. 6 is an example of the data flow in changing the configuration information, and the data flow in changing the configuration information is not limited to the form of FIG.

[Performance information monitoring]
Next, monitoring of application performance information (hereinafter referred to as performance information monitoring) will be described with reference to the drawings. FIG. 7 is a block diagram for explaining performance information monitoring. In FIG. 7, arrows indicate an example of a data flow when performing performance anomaly detection using a baseline while a released application is running.

At least one container instance 14 collects performance information of running applications at a predetermined timing. At least one container instance 14 transmits the collected performance information to the performance information reception unit 101 of the monitoring device 10 . After transmitting the performance information, the container instance 14 waits until the next performance information collection timing. For example, the container instance 14 collects performance information at equal intervals such as 30 minute intervals. Note that the container instance 14 may collect the performance information at irregular intervals as long as the timing is set in advance.

The performance information reception unit 101 of the monitoring device 10 receives the performance information of the running application from the container instance 14 . The performance information reception unit 101 of the monitoring device 10 transmits the received performance information to the performance information processing unit 102 .

The performance information processing unit 102 receives the performance information of the running application from the performance information receiving unit 101 . The performance information processing unit 102 generates a performance information table using the received performance information. Performance information processing unit 102 stores the generated performance information table in performance information storage unit 108 .

If synchronization is set in the configuration information change, the performance information processing unit 102 transmits a baseline generation instruction to the baseline generation unit 106 . In this case, upon receiving a baseline generation completion response from the baseline generation unit 106, the performance information processing unit 102 instructs the performance abnormality detection unit 103 to execute the abnormality detection process. On the other hand, if synchronization is not set in the configuration information change, the performance information processing unit 102 instructs execution of anomaly detection processing when performance information is received.

If synchronization is set in the configuration information change, the baseline generation unit 106 refers to the configuration change information storage unit 109 to check whether or not the configuration information has been changed. In this case, the baseline generation unit 106 acquires the latest performance information from the performance information storage unit 108 according to whether or not the configuration information has been changed, and generates, updates, and predicts the baseline. Baseline generator 106 generates a baseline table using the generated, updated, or predicted baselines. The baseline generator 106 stores the generated baseline table in the baseline storage 110 . Note that in the baseline prediction, an existing baseline stored in the baseline storage unit 110 may be obtained.

FIG. 8 is a conceptual diagram showing an example of a baseline generated by the baseline generation unit 106 when synchronization is set in changing configuration information. Each curve in FIG. 8 shows the reference values of the past version 3 baseline (solid line), the current version 4 baseline (solid line), and the future version 5 baseline (dashed line) (also referred to as the baseline reference value). (referred to as ). The past version 3 is not in operation at present. The current version 4 is currently in production. The current version 4 performance information may have been stored any week, or may have been overwritten and updated at any time during the current period. Future version 5 baselines are predicted using information from released versions.

Here, the method for predicting the baseline of version 5 in the future will be described using the following three cases as examples. Note that the following case is just an example, and the performance information monitoring by the monitoring device 10 is not limited to the following method.

[Case 1]
Case 1 is an example of predicting the baseline of the next version based on the difference in the baseline reference values of successive versions of the application. For example, the baseline generator 106 calculates the difference Δ|r _n | between the baseline reference values of the current version and the next version using Equation 1 below, and predicts the baseline of version 5 next.

In Equation 1 above, n is the number of versions of the released application, i is the version number, and Δr _i is the difference in baseline reference value between consecutive versions of the application.

In Equation 1 above, the difference in the baseline reference value between versions is used instead of the baseline reference value itself so that the greater the variation in the performance load between versions, the higher the contribution rate.

9 and 10 are conceptual diagrams for explaining the difference Δr _i in baseline reference value between successive versions of the application. FIG. 9 shows an example in which the performance load increases as the application is updated. For the example of FIG. 9, Δr _i is positive. FIG. 10 shows an example of a case where the performance load greatly fluctuates as the application is updated. In the example of FIG. 10, _Δr1 and _Δr4 are positive and _Δr2 and _Δr3 are negative.

For example, the baseline generation unit 106 calculates the baseline reference value for the next version by adding or subtracting the difference Δ|r _n | calculated using Equation 1 above to or from the baseline reference value for the current version. calculate.

As an example, an example of applying the numerical value of the CPU usage rate (%) of the baseline table 155 of FIG. In the baseline table 155, the number of released application versions n is 4, Δr ₁ is 13 (=45-32), Δr ₂ is -7 (=38-45), and Δr ₃ is -2 (=36-38). is. The following equation 2 is obtained by substituting these values into the equation 1.

As shown in Equation 2 above, Δr ₄ is calculated to be approximately 3.6.

Using Δr ₄ calculated as in Equation 2 above, the next version will be 39.6%, which is the baseline reference value of 36% for the current version's CPU usage (%) plus 3.6. is calculated as the baseline reference value at that baseline time. FIG. 8 shows the time-series changes in baseline baseline values for past Version 3, current Version 4, and next Version 5 (i.e., baseline ) is a graph.

Note that Equation 1 above is similar to the equation for calculating the root mean square, but the inside of the square root is not the square of Δr _i , but the product of Δr _i and |Δr _i |. The product of Δr _i and |Δr _i | can be positive or negative. Therefore, if the above equation 1 is used, (Δr _i )×|Δr _i | becomes negative when the performance load is reduced due to the version upgrade, and the baseline reference value can be lowered by subtracting inside the square root. .

The baseline generation unit 106 predicts the baseline for one cycle through the above process, and stores the predicted baseline in the baseline storage unit 110 . For example, the baseline generator 106 predicts the baseline for one cycle, with one week from Sunday to Saturday as one cycle. Note that the baseline for one cycle is not limited to one week from Sunday to Saturday, and the starting date and time can be arbitrarily set.

FIG. 11 shows an example of switching to the baseline predicted by the method of case 1 at a predetermined timing. In the example of FIG. 11, the version upgrade is performed at midnight on Wednesday, and immediately after the configuration information is updated, the baseline is switched to the predicted version 5.

[Case 2]
Case 2 is a case in which there is a difference between the predicted value and the measured value of the performance information (also referred to as the predicted/actual difference). In case 2, the expected difference at the first baseline time is added to the same value at the subsequent baseline times. Therefore, it is possible to prevent the performance information from being constantly detected outside the range of the upper and lower limits of the predicted baseline until the generation of the baseline for one cycle is completed.

FIG. 12 is an example of a baseline table (baseline table 157) used in case 2. FIG. The baseline table 157 includes columns for storing predicted values and measured values in the item of CPU usage rate (%) indicating performance information. Assume here that postgres-v12 is the current version and postgres-v13 is the next version.

In the baseline table 157 of FIG. 12, 43.5% calculated using the above formula 1 is applied to the baseline reference value from 13:00 to 14:00 on Wednesdays due to the version upgrade to postgres-v12. It is However, in practice, it may be more appropriate to apply a baseline reference value of 36%. In such a case, the baseline generation unit 106 calculates the difference (hereinafter referred to as δ) between 36.0 and 43.5 from the next baseline time (Wednesday 14:00-15:00) -7. 5 is added at all baseline times to globally raise or lower the baseline reference value. As a result, on Wednesday from 14:00 to 15:00, 30.5%, which is the predicted value of 38.0% plus δ, can be applied as the baseline reference value.

Also, for the predicted value of the baseline reference value of postgres-v13 of the next version, the baseline may be predicted using the ratio between the predicted value up to the previous version and the actual value (also referred to as the predicted/actual ratio). For example, as shown in the baseline table 157 in FIG. 12, the forecast-to-actual ratio of postgres-v12, which is the previous version of postgres-v13, on Wednesday 13:00-14:00 is 82.8% (≈36:43.5). be. Using this prediction-to-actual ratio, the predicted value of the CPU usage rate (%) on Wednesday 13:00-14:00 for postgres-v13 is calculated to be 32.7% (≈ 39.5 x 82.8 ÷ 100). be. Note that if the expected actual ratio prior to the previous version is also recorded, the expected actual difference Δr in Equation 1 may be replaced with the expected actual ratio and weighted to calculate the baseline reference value.

[Case 3]
Case 3 is a case where the next version is released before performance information for one cycle is stored. In case 3, the expected baseline metric of the past version is used to calculate the expected baseline metric of the future version. Case 3 makes it possible to predict the baseline for future versions two or three generations ahead.

FIG. 13 is a conceptual diagram showing an example of calculating an expected baseline reference value for a future version using an expected baseline reference value for a past version. In each curve in FIG. 13, the solid line indicates the baseline during the time when the measured performance information is collected, and the dashed line indicates the predicted baseline during the time when the measured performance information is not collected. show.

For example, as shown in FIG. 13, if the version upgrade is performed before the baseline cycle completes, the baseline generation unit 106 further generates the baseline of version 5 using the predicted baseline of version 4. Anticipate. In the example of FIG. 13, the baseline generation unit 106 calculates the difference Δ|r _n+x | between the baseline reference values of the current version and the next version using, for example, Equation 3 below.

In Expression 3, x is a value indicating how many generations ahead of the next version, and Δr' _i indicates a difference between baseline reference values of successive unmeasured versions of the application. In the example of FIG. 13, Δr' _i is the predicted value of the baseline reference value in the unmeasured time period of version 4 (dashed line) and the predicted value of the baseline reference value of version 5 before release (dashed line). Show the difference.

In the baseline table 157 of FIG. 12, the baseline reflecting the measured values of the performance information has already been generated from 13:00 to 14:00 on Wednesday of postgres-v13. On the other hand, on Wednesday from 14:00 to 15:00 of postgres-v13, the baseline reflecting the measured values of the performance information has not yet been generated. In this state, when the next version of postgres-v13 is released on Wednesday from 14:00 to 15:00, postgres-v13 is in operation only at this time, so the number of versions n is 4. Also, Δr ₁ is 10 (=40-30), Δr ₂ is -6 (=34-40), Δr ₃ is -3 (=31-34), Δr' ₄ is 6.2 (=24.8- 31). Substituting these values into Equation 3 gives Equation 4 below.

As shown in Equation 4 above, Δ|r ₄ | is calculated to be approximately 1.0.

Therefore, the baseline metric for the next version at this baseline time is calculated as 25.8%, which is +1.0 added to the expected baseline metric for the current version of 24.8%. The baseline generator 106 calculates baseline reference values for all baseline times.

As shown in Figure 13, in the case where the next version upgrade is performed before the baseline period completes one cycle, the predicted value of the future version is calculated using the predicted value of the baseline reference value of the past version. can do. In addition, in preparation for such a case, prediction may be made for two or three generations ahead.

The above is the description of the workflow between the components in performance information monitoring by the monitoring device 10 . 8 to 12 are examples, and the workflow between the components in performance information monitoring by the monitoring device 10 is not limited to the form of the drawings.

For example, it is assumed that there is a change in the hardware configuration on which the monitoring target operates, or that it is a different machine with the same configuration. When performing baseline prediction in such a case, for example, between the 5th generation and the 9th generation, by multiplying the coefficient derived using benchmark information indicating the difference between CPU generations good too. For example, in a case where the performance information of revision upgrade is used instead of version upgrade, weighting may be performed such as lowering the weight when revision upgrade is executed compared to version upgrade. Also, for example, in the case of using performance information of an upgrade many generations ago, weighting may be performed such as lowering the weight of the version upgrade many generations ago compared to the most recent version upgrade. For example, in a case where performance load distribution is large for each version and there is a difference between the upper and lower limit values of the baseline, the difference between the upper and lower limit values may be predicted using a formula similar to Formula 1.

[Workflow]
Next, a workflow between components in performance information monitoring by the monitoring device 10 will be described with reference to the drawings. FIG. 14 is a sequence diagram showing an example of a workflow between components in performance information monitoring by the monitoring device 10. As shown in FIG. In the sequence diagram of FIG. 14, the monitoring device 10, the terminal device 12, and at least one container instance 14, which constitute the monitoring device 10, will be described as main entities of the operation.

In FIG. 14, first, each of at least one container instance 14 collects the performance information of the application running in each (step S11).

Each of the at least one container instance 14 transmits performance information to the monitoring device 10 at the timing set for each (step S12).

Upon receiving the performance information of each container instance 14, the monitoring device 10 stores the received performance information in the performance information storage unit 108 (step S13).

Here, the monitoring device 10 determines whether the reception of the performance information and the generation of the baseline are synchronized (step S14).

If the reception of the performance information and the generation of the baseline are synchronized (Yes in step S14), the monitoring device 10 executes one of baseline generation, update, and prediction (step S15). On the other hand, if the reception of the performance information and the generation of the baseline are asynchronous (No in step S14), the process proceeds to step S16.

The monitoring device 10 reads the baseline from the baseline storage unit 110 and determines whether or not the performance information is outside the upper and lower limits of the baseline (also called performance abnormality detection) (step S16). If the performance information is outside the baseline upper and lower limits, it indicates that the performance information is an abnormal value.

The monitoring device 10 transmits to the terminal device 12 the determination result as to whether or not the performance information is outside the baseline upper and lower limits (step S17).

The terminal device 12 outputs the determination result received from the monitoring device 10 as a GUI (Graphical User Interface) (step S18).

The above is the description of the workflow between the components in performance information monitoring by the monitoring device 10 . Note that FIG. 14 is an example, and the workflow between components in the performance information monitoring by the monitoring device 10 is not limited to the form of the drawing.

As described above, the monitoring device of this embodiment includes a storage unit and an arithmetic processing unit. The storage unit stores performance information of applications operating in the information system, configuration change information regarding changes in configuration information associated with version changes of the applications, and baselines for each version of the applications. The arithmetic processing unit refers to the storage unit, predicts the baseline reference value for the future version based on the change in the performance information in the past version change of the application, and changes the version based on the predicted change in the baseline reference value. Generate a later baseline. The arithmetic processing unit uses the generated baseline to detect performance anomalies in the application.

In one aspect of the present embodiment, the monitoring device includes an input/output unit that receives application performance information from each of at least one computing device and receives application configuration information from a management device that manages at least one computing device. Prepare.

In one aspect of the present embodiment, the arithmetic processing unit calculates baseline reference values for the current version and the next version using a difference in baseline reference values between two consecutive versions of the past and current versions of the application. Calculate the difference between The arithmetic processing unit generates the next version of the baseline by adding the calculated difference in baseline reference value to the current version of the baseline.

In one aspect of the present embodiment, the arithmetic processing unit predicts the baseline reference value of the future version of the application using the difference between the predicted value and the actual value of the baseline reference value of the past and current versions of the application. .

In one aspect of the present embodiment, the processing unit predicts the expected baseline reference value of a future version of the application using the expected baseline reference value of the past version of the application.

In one aspect of this embodiment, the arithmetic processing unit generates a performance information table, a configuration change information table, and a baseline table, and stores each generated table in the storage unit. The performance information table stores the time when the application performance information was collected, the version of the application, and the application performance information with respect to the application performance information received from each of the at least one computing devices. The configuration change information table stores information related to configuration change information that accompanies a version change of the application received from the management device. For example, the configuration change information table stores the application version update time, version change implementation type, application name, version number after version change, and version number before version change. The baseline table contains the baseline time for matching the time when the performance information was collected with the baseline, the name of the application to which the baseline is applied, and the baseline reference value for each performance item in the performance information. and are stored.

In one aspect of this embodiment, each of the at least one computing device is a container instance managed by a management device. A management device orchestrates at least one container instance and directs application deployment.

In one aspect of this embodiment, the monitoring device performs monitoring based on a baseline using mean and variance for applications undergoing version changes. The monitoring device of this embodiment calculates a baseline using the average and variance of performance information. As an example, the monitoring apparatus of this embodiment uses the average of the performance information as the baseline reference value, and the ends of the upper and lower widths due to the dispersion of the performance information as the upper and lower limits.

The monitoring apparatus of this embodiment can continue monitoring the application without regenerating the baseline before and after the version of the application is changed. The monitoring device of the present embodiment predicts the baseline after the version change based on the increasing/decreasing tendency of the baseline reference value used for each successive version. In other words, the monitoring device of the present embodiment predicts an increase/decrease in performance load in a future version change based on an increase/decrease in performance load in the past version change. Therefore, according to the monitoring device of this embodiment, the learning time for generating a new baseline can be eliminated. That is, according to the monitoring device of the present embodiment, application monitoring can be continued without performing monitoring setting change work triggered by a version change of the application. In other words, according to the monitoring device of the present embodiment, it is possible to continue monitoring the application before and after the version change without generating the baseline again from the beginning after the version change of the application.

According to the method of this embodiment, in monitoring an information system in which a version change occurs, the performance information to be monitored by the monitoring device is predicted prior to the next version change. Therefore, according to the method of this embodiment, a learning period for monitoring settings can be eliminated, and a baseline that can be set immediately after a version change can be generated. You can continue monitoring. In other words, according to this embodiment, it is possible to continue monitoring the information system without changing the monitoring settings triggered by the version change.

The method of this embodiment can be used for any information system as long as it can be monitored using a baseline. In particular, the method of this embodiment is suitable for information systems that use cloud, container-type virtualization technology, etc., assuming that version changes are made.

(Second embodiment)
Next, the overall system of the second embodiment of the present invention will be described with reference to the drawings. The overall system of this embodiment includes a monitoring device that performs baseline monitoring using performance information of applications running on the information system. It should be noted that the “whole” of the entire system is a word for distinguishing it from the information system.

FIG. 15 is a block diagram for explaining an example of the configuration of the overall system 2 of this embodiment. The overall system 2 includes a monitoring device 20 , a terminal device 22 , a management device 23 and at least one computing device 24 .

The monitoring device 20 is connected to a terminal device 22 , a management device 23 and at least one computing device 24 . The monitoring device 20 corresponds to the monitoring device 10 of the first embodiment. For example, the monitoring device 20 is implemented by a general-purpose or dedicated server built in a data center, cloud, or the like. Also, the monitoring device 20 may be realized by a general-purpose or dedicated computer having an information processing function and a communication function.

The monitoring device 20 collects the configuration information of the application and manages the collected configuration information in order to grasp the version upgrade status of the application to be monitored. The monitoring device 20 also collects and accumulates application performance information from at least one computing device 24 that constitutes an information system in which the application to be monitored operates. The monitoring device 20 uses the accumulated performance information to generate, update, and predict baselines. When a performance value outside the baseline range is acquired, the monitoring device 20 transmits a notification indicating that an abnormality has occurred to the terminal device 22 .

A terminal device 22 is connected to the monitoring device 20 . For example, the terminal device 22 is implemented by a computer, mobile terminal, or the like having an information processing function and a communication function.

The terminal device 22 has a function of receiving input of information for operating the monitoring device 20, and a function (not shown) of receiving a performance abnormality notification from the monitoring device 20 and displaying the content of the performance abnormality. . For example, the terminal device 22 has a display unit (not shown) on which a GUI (Graphical User Interface) used for inputting operations to the monitoring device 20 and displaying notifications regarding performance abnormalities is displayed.

Information for operating the monitoring device 20 is input to the terminal device 22 by the user of the monitoring device 20 . The terminal device 22 transmits information input by the user to the monitoring device 20 . The terminal device 22 also receives performance information collected by the monitoring device 20 . The terminal device 22 displays the performance information received from the monitoring device 20 on a display unit (not shown). The terminal device 22 also receives a notification from the monitoring device 20 indicating that an abnormality such as performance deterioration has occurred. The terminal device 22 causes the display unit (not shown) to display information about the received notification.

The management device 23 is connected to the monitoring device 20 . For example, the management device 23 is implemented by a general-purpose or dedicated server built in a data center, cloud, or the like. Also, the management device 23 may be realized by a general-purpose or dedicated computer having an information processing function and a communication function.

The management device 23 manages at least one arithmetic device 24 . For example, the management device 23 manages starting, stopping, auto-scaling, etc. of the computing device 24 . The management device 23 collects information about the arithmetic devices 24 to be managed.

At least one computing device 24 is connected to the monitoring device 20 . For example, the computing device 24 is implemented by the container instance 14 of the first embodiment. For example, the computing device 24 may be realized by a physical computer or a virtual computer. For example, the computing device 24 is configured in a general-purpose or dedicated server built in a data center, cloud, or the like. Further, the computing device 24 may be configured by a general-purpose or dedicated computer having information processing functions and communication functions.

The computing device 24 is at least one computing device to be monitored by the monitoring device 20 . The computing device 24 constitutes an information system in which arbitrary applications and programs operate. Each computing device 24 collects performance information of applications operating in the information system configured in each computing device 24 .

The above is the description of an example of the configuration of the overall system 2 of the present embodiment. The configuration of FIG. 15 is an example, and the configuration of the overall system 2 is not limited to the form shown in the drawing.

[Monitoring device]
Next, the monitoring device 20 of this embodiment will be described with reference to the drawings. The monitoring device 20 includes an input/output unit 210 , an arithmetic processing unit 220 and a storage unit 230 . It should be noted that the main functions of the monitoring device 20 are exhibited by a monitoring section 200 composed of an arithmetic processing section 220 and a storage section 230 . The monitoring unit 200 is the minimum configuration that exhibits the functions of the monitoring device 20 .

Input/output unit 210 is connected to arithmetic processing unit 220 . Also, the input/output unit 210 is connected to the terminal device 22 , the management device 23 , and at least one arithmetic device 24 . The input/output unit 210 exhibits the input/output function of the monitoring device 10 of the first embodiment. That is, the input/output unit 210 has the functions of the performance information reception unit 101 , the management information reception unit 104 , and the operation reception unit 107 of the monitoring device 10 .

The input/output unit 210 receives performance information collected by the computing device 24 from the computing device 24 . The input/output unit 210 also receives configuration information collected by the management device 23 from the management device 23 . The input/output unit 210 also receives from the terminal device 22 information such as operation details input to the terminal device 22 by the user. Input/output unit 210 transmits the received information to arithmetic processing unit 220 . The input/output unit 210 also transmits the determination result received from the arithmetic processing unit 220 to the terminal device 22 .

Arithmetic processing unit 220 is connected to input/output unit 210 and storage unit 230 . The arithmetic processing unit 220 exhibits the arithmetic processing function in the monitoring device 10 of the first embodiment. That is, the arithmetic processing unit 220 has the functions of the performance information processing unit 102 , the performance abnormality detection unit 103 , the configuration information management unit 105 , and the baseline generation unit 106 of the monitoring device 10 .

The arithmetic processing unit 220 receives performance information collected by each of the at least one arithmetic unit 24 from the input/output unit 210 . The arithmetic processing unit 220 generates a performance information table using the received performance information of each arithmetic device 24 . The arithmetic processing unit 220 stores the generated performance information table in the storage unit 230 .

Further, the arithmetic processing unit 220 refers to the generated performance information table and acquires from the storage unit 230 a monitoring baseline for the acquisition source arithmetic device 24 included in the performance information table. The arithmetic processing unit 220 determines that the performance value is abnormal when the performance of the relevant arithmetic device 24 is out of the range of the baseline. When the calculation device 24 determines that the performance value is abnormal, it transmits a notification indicating that the abnormality has occurred to the terminal device 22 .

Further, the arithmetic processing unit 220 receives configuration information collected by the management device 23 from the input/output unit 210 . The arithmetic processing unit 220 generates a configuration change information table using the received configuration information. The arithmetic processing unit 220 updates the configuration change information table stored in the storage unit 230 with the generated configuration change information table.

The arithmetic processing unit 220 also refers to the baseline table, configuration change information table, and performance information table stored in the storage unit 230 . The arithmetic processing unit 220 generates a baseline for each performance item based on the referenced baseline table, configuration change information table, and performance information table. The arithmetic processing unit 220 also updates the baseline and predicts future versions of the baseline. The arithmetic processing unit 220 generates a baseline table including baseline information regarding generated, updated, and predicted baselines. The arithmetic processing unit 220 stores the generated baseline table in the storage unit 230 .

Further, the arithmetic processing unit 220 receives from the input/output unit 210 information about the operation content input to the terminal device 22 by the user. The arithmetic processing unit 220 regenerates the baseline, changes the threshold value, and the like according to the received information about the operation content.

Storage unit 230 is connected to arithmetic processing unit 220 . The storage unit 230 stores a baseline table, a configuration change information table, and a performance information table. The baseline table, the configuration change information table, and the performance information table are stored in the storage unit 230 by the arithmetic processing unit 220 . The baseline table, configuration change information table, and performance information table stored in the storage unit 230 are referred to by the arithmetic processing unit 220 .

The above is a description of an example of the configuration of the monitoring device 20 of the present embodiment. The configuration of FIG. 15 is an example, and the configuration of the monitoring device 20 is not limited to the form shown in the drawing.

As described above, the monitoring device of this embodiment includes a storage unit and an arithmetic processing unit. The storage unit stores performance information of applications operating in the information system, configuration change information regarding changes in configuration information associated with version changes of the applications, and baselines for each version of the applications. The arithmetic processing unit refers to the storage unit, predicts the baseline reference value for the future version based on the change in the performance information in the past version change of the application, and changes the version based on the predicted change in the baseline reference value. Generate a later baseline. The arithmetic processing unit uses the generated baseline to detect performance anomalies in the application.

According to this embodiment, the monitoring of the information system can be continued without changing the monitoring settings triggered by the version change.

(hardware)
Here, the hardware configuration for realizing the monitoring device according to each embodiment of the present invention will be described by taking the information processing device 90 of FIG. 16 as an example. Note that the information processing device 90 of FIG. 16 is a configuration example for realizing the monitoring device of each embodiment, and does not limit the scope of the present invention.

As shown in FIG. 16, an information processing device 90 includes a processor 91 , a main memory device 92 , an auxiliary memory device 93 , an input/output interface 95 , a communication interface 96 and a drive device 97 . In FIG. 16, the interface is abbreviated as I/F (Interface). Processor 91 , main storage device 92 , auxiliary storage device 93 , input/output interface 95 , communication interface 96 and drive device 97 are connected to each other via bus 98 so as to enable data communication. Also, the processor 91 , the main storage device 92 , the auxiliary storage device 93 and the input/output interface 95 are connected to a network such as the Internet or an intranet via a communication interface 96 . FIG. 16 also shows a recording medium 99 on which data can be recorded.

The processor 91 expands a program stored in the auxiliary storage device 93 or the like into the main storage device 92 and executes the expanded program. In this embodiment, a configuration using a software program installed in the information processing device 90 may be used. The processor 91 executes processing by the monitoring device according to this embodiment.

The main memory 92 has an area in which programs are expanded. The main memory device 92 may be a volatile memory such as a DRAM (Dynamic Random Access Memory). Also, a non-volatile memory such as MRAM (Magnetoresistive Random Access Memory) may be configured and added as the main storage device 92 .

The auxiliary storage device 93 stores various data. The auxiliary storage device 93 is configured by a local disk such as a hard disk or flash memory. It should be noted that it is possible to store various data in the main storage device 92 and omit the auxiliary storage device 93 .

The input/output interface 95 is an interface for connecting the information processing device 90 and peripheral devices. A communication interface 96 is an interface for connecting to an external system or device through a network such as the Internet or an intranet based on standards and specifications. The input/output interface 95 and the communication interface 96 may be shared as an interface for connecting with external devices.

The information processing apparatus 90 may be configured to connect input devices such as a keyboard, mouse, and touch panel as necessary. These input devices are used to enter information and settings. Note that when a touch panel is used as an input device, the display screen of the display device may also serve as an interface of the input device. Data communication between the processor 91 and the input device may be mediated by the input/output interface 95 .

Further, the information processing device 90 may be equipped with a display device for displaying information. When a display device is provided, the information processing device 90 is preferably provided with a display control device (not shown) for controlling the display of the display device. The display device may be connected to the information processing device 90 via the input/output interface 95 .

Drive device 97 is connected to bus 98 . Between the processor 91 and a recording medium 99 (program recording medium), the drive device 97 mediates the reading of data and programs from the recording medium 99 and the writing of the processing result of the information processing device 90 to the recording medium 99. . If the recording medium 99 is not used, the drive device 97 may be omitted.

The recording medium 99 can be implemented by, for example, an optical recording medium such as a CD (Compact Disc) or a DVD (Digital Versatile Disc). The recording medium 99 may be realized by a semiconductor recording medium such as a USB (Universal Serial Bus) memory or an SD (Secure Digital) card, a magnetic recording medium such as a flexible disk, or other recording medium. When a program to be executed by the processor is recorded on the recording medium 99, the recording medium 99 corresponds to a program recording medium.

The above is an example of the hardware configuration for realizing the monitoring device according to each embodiment of the present invention. Note that the hardware configuration of FIG. 16 is an example of the hardware configuration for realizing the monitoring device according to each embodiment, and does not limit the scope of the present invention. The scope of the present invention also includes a program that causes a computer to execute processing related to the monitoring apparatus according to each embodiment. Further, the scope of the present invention also includes a program recording medium on which the program according to each embodiment is recorded.

The constituent elements of the monitoring device of each embodiment can be combined arbitrarily. Also, the constituent elements of the monitoring device of each embodiment may be realized by software or circuits.

Although the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

1, 2 overall system 10, 20 monitoring device 12 terminal device 13 container management device 14 container instance 101 performance information reception unit 102 performance information processing unit 103 performance abnormality detection unit 104 management information reception unit 105 configuration information management unit 106 baseline generation unit 107 operation reception unit 108 performance information storage unit 109 configuration change information storage unit 110 baseline storage unit 131 management information collection unit 141 performance information collection unit 151 performance information table 153 configuration change information table 155, 157 baseline table 210 input/output unit 220 Arithmetic processing unit 230 Storage unit

Claims (10)

a storage unit that stores performance information of an application running in an information system, configuration change information related to a change in configuration information associated with a version change of the application, and a baseline for each version of the application;
Predicting a baseline reference value for a future version based on a change in the performance information in a past version change of the application by referring to the storage unit, and changing the version based on the predicted change in the baseline reference value an arithmetic processing unit that generates a later baseline and detects a performance abnormality in the application using the generated baseline. The arithmetic processing unit is
when synchronizing the reception of the performance information of the application and the generation of the baseline, generating a baseline reflecting the performance information in response to the reception of the performance information of the application;
generating the baseline at a preset timing when the reception of the performance information of the application and the generation of the baseline are asynchronous;
A monitoring device according to claim 1 . The arithmetic processing unit is
calculating a baseline metric difference between the current version and the next version using the baseline metric difference between two consecutive versions of the past and current versions of the application;
generating a next version of the baseline by adding the calculated baseline reference value difference to the current version of the baseline;
3. A monitoring device according to claim 1 or 2. The arithmetic processing unit is
Predicting baseline baseline values for future versions of the application using the difference between predicted and actual baseline baseline values for past and current versions of the application;
4. A monitoring device according to any one of claims 1-3. The arithmetic processing unit is
predicting an expected baseline metric for a future version of the application using an expected baseline metric for a past version of the application;
5. A monitoring device according to any one of claims 1-4. an input/output unit that receives performance information of the application from each of the at least one computing device and receives configuration information of the application from a management device that manages the at least one computing device;
The arithmetic processing unit is
generating a performance information table including a time when the application performance information was collected, a version of the application, and the performance information of the application, with respect to the performance information of the application received from each of the at least one computing device;
Regarding the configuration change information accompanying the version change of the application received from the management device, the update time of the version of the application, the implementation type of the version change of the application, the name of the application, and the version after the version change of the application. number, and a configuration change information table containing the version number of the application before the version change,
A baseline time for associating the time when the performance information of the application was collected with the baseline, a name of the application to which the baseline is applied, and a base for each performance item of the performance information of the application. generate a baseline table containing line reference values and
storing the generated performance information table, configuration change information table, and baseline table in the storage unit;
6. A monitoring device according to any one of claims 1-5. each of the at least one computing unit comprising:
A container instance managed by a management device,
The management device
orchestrating at least one of said container instances and directing deployment of said application;
7. A monitoring device according to any one of claims 1-6. a monitoring device according to any one of claims 1 to 7;
a terminal device that is connected to the monitoring device and receives an operation on the monitoring device;
at least one computing device connected to the monitoring device and constituting an information system in which at least one application operates;
a management device connected to the monitoring device and managing the at least one computing device;
A system with With reference to performance information of an application running in an information system, configuration change information related to changes in configuration information associated with a version change of the application, and a baseline for each version of the application, the performance information of the past version change of the application Predict baseline reference values in future versions based on changes in the performance information;
generating a version-changed baseline based on the predicted change in the baseline reference value;
A monitoring method for detecting a performance abnormality in the application using the generated baseline. With reference to performance information of an application running in an information system, configuration change information related to changes in configuration information associated with a version change of the application, and a baseline for each version of the application, the performance information of the past version change of the application A process of predicting baseline reference values in future versions based on changes in the performance information;
a process of generating a version-changed baseline based on the predicted change in the baseline reference value;
A program that causes a computer to execute a process of detecting a performance abnormality in the application using the generated baseline.

Images