JPH0869395A - Storing device for log information on system fault event - Google Patents

Abstract

PURPOSE: To store faulty event information by automatically selecting a storage control means for the faulty event information corresponding to the occurring frequency of a fault by detecting the occurring frequency of the fault by an occurring status monitoring means. CONSTITUTION: This device is provided with a means which stores inputted faulty event information 100 by detecting the occurring status of the fault when the faulty event information 100 is inputted. It is provided with the storage control means 5 which controls the storage of the faulty event information 100, and the occurring status monitoring means 1 which detects the occurring frequency of the fault and controls the storage control means 5 based on a detected result. The occurring status monitoring means 1 refers to an occurring status managing table 12 to manage the occurring status of the fault in the past, and compares an occurring interval between the fault in the faulty event information 100 and the one last time with prescribed time, and also compares the number of times of occurrence of the fault occurring continuously at a time interval shorter than the prescribed time with prescribed number of times, and detects the occurring frequency of the faulty event information 100. Therefore, it is possible to select a storage system in accordance with the detected result.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system failure event log information storage device, and more particularly to a system failure event log information storage device that stores failure event information based on the occurrence status of failure event information.

More specifically, a failure event information storage method is automatically selected on the basis of the frequency of occurrence of failure event information, and more error event information necessary for analyzing failure events is stored in a log file having a limited capacity. The present invention relates to a system failure event log information storage device that enables storage.

[0003]

2. Description of the Related Art Conventionally, as a method for accumulating a large amount of failure event information in a log file having a limited capacity, the same failure event count accumulation for reducing the log information by preventing duplicate accumulation of the same failure event shown below is performed. There is a method.

An example of the conventional same failure event count storage method will be described below. FIG. 10 is a block diagram of a conventional same failure event count storage device. The same failure event count storage device 9 shown in the figure comprises a failure event information storage unit 4, a comparison management table 32, an event monitoring unit 7, and a total event count storage control unit 8.

The fault event information storage unit 4 is a database for storing the fault event information 100 input from the total event count storage control unit 8. The comparison management table 32 is a table that stores failure event information that has occurred in the past, the number of times each failure event has occurred, and the registration position of each failure event information in the failure event information storage unit 4. Referenced or updated. The event monitoring unit 7 monitors the input of the failure event information 100, and when the failure event information 100 is input, all of the input failure event information 1
00 is output to the total event count accumulation control unit 8. The all-event count accumulation control unit 8 confirms whether or not the same failure event as the failure event information 100 input from the event monitoring unit 7 is registered in the comparison management table 32, and is input from the event monitoring unit 7. If the same failure event as the failure event information 100 is not registered in the comparison management table 32,
The failure event information 100 input from the event monitoring unit 7 is registered in the comparison management table 32, output to the failure event information storage unit 4, and the storage position information of the failure event information 100 in the failure event information storage unit 4 is displayed. It is stored in the registration position of the corresponding failure event information in the comparison management table 32. When the same failure event as the failure event information 100 input from the event monitoring unit 7 is registered in the comparison management table 32, the occurrence time of the failure event information in the comparison management table 32 is set to the event monitoring unit 7 Replaced with the occurrence time of the failure event information 100 input from, the number of occurrences of the failure event information of the comparison management table 32 is incremented.

FIG. 11 is a diagram showing an example of a conventional failure event information storage unit. FIG. 11B shows an example in which the failure event information shown in FIG. 11A is input to the conventional same event information count storage device 9 and stored in the failure event information storage unit 4. The failure event information storage unit 4 in FIG. 11B displays the failure event information storage location, the failure event occurrence time, the resource type and resource name in which the failure occurred, the failure cause code, and the number of occurrences of the failure event. It consists of a counter that represents.

According to the above conventional example, when the same failure event information as the input failure event information 100 is registered in the comparison management table 32, the input failure event information 100 is stored in the failure event information. Instead of accumulating in the section 4, based on the accumulation position information of the same failure event information as the input failure event information 100 registered in the comparison management table 32, the accumulation position in the failure event information accumulation section 4 is stored. The occurrence time of the failure event information accumulated in the above is replaced with the occurrence time of the input failure event information 100. Next, the input failure event information 100 can be stored as the number of occurrences by incrementing the number of occurrences of the failure event information stored in the storage location in the failure event information storage unit 4, that is, It is possible to store more failure event information 100 in a log file with a limited capacity.

[0008]

However, the system shown in the above-mentioned conventional example has the following problems.

The first problem is that it requires a great deal of memory and CPU power. Since the method shown in the conventional example is a method in which the input failure event information 100 is always counted and accumulated, all the failure event information that occurred in the past is always stored in the comparison management table 32 and newly input. Items other than the occurrence time of the failure event information 100 corresponding to the failure event information 100 registered in the comparison management table 32, and newly input failure event information 100
It is necessary to confirm whether or not the same failure event information as in the above is registered in the comparison management table 32. Further, according to the result of the comparison between the items except the occurrence time of the input failure event information 100 and the items of the failure event information registered in the comparison management table 32, the input failure event information 100 is compared with the comparison management table. The number of occurrences of failure event information added to 32 or registered in the comparison management table 32 must be incremented. Therefore, the comparison management table 32 stores all the failure event information since the start of the accumulation of the log information, which requires an extremely large amount of memory. Further, since it is necessary to compare the input failure event information 100 with the comparison management table 32 every time, many C
PU power is required.

The second problem is that it is impossible to grasp a failure event that has occurred within an arbitrary time. For example,
In the example of FIG. 11B in which the result of inputting the example of the failure event information of FIG. 11A described above to the same failure event information count storage device 9 is stored in the failure event information storage unit 4, the resource type is “line”. As for the failure event information of the cause code “02” that occurred in the resource name “LINE01”, the same failure event as the failure event is shown in the counter “5” after the failure event information is first generated and accumulated. Information indicating that it has occurred 5 times (indicating that it has occurred 5 times after the first failure, and a total of 6 failures have occurred), and the occurrence of the last failure event. Only the time "19:02" is recorded. For example, the resource type "line" and the resource name "LINE0" that occurred between 10:00 and 10:05.
A desired search result cannot be obtained by searching for a failure event of "1" and a cause code of "02". However, FIG.
In the example of the failure event information shown in (A), from 10:00 to 1
Between 0:05, resource type "line" and resource name "LIN
The failure event of "E01" and the cause code "02" has occurred five times.

In the system shown in the above-mentioned conventional example, the same failure event that occurred once in the past may be a recent failure event or may have occurred in the past. Count accumulation by the number of times,
Since the latest failure occurrence time is stored in the failure event information, it is not possible to grasp the occurrence time of the failure that occurred between the first occurrence of the failure and the latest failure. It becomes impossible to grasp the failure event that occurred. The log information accumulated by the conventional same failure event count accumulating device 9 can be grasped as to the number of occurrences by failure event from the start of accumulation of failure event information to the present and the latest occurrence time of the failure event. It is a degree.

The present invention has been made in view of the above points, and provides a system failure event log information storage device that automatically selects and stores a failure event information storage method according to the occurrence frequency of failure events. The purpose is to

In addition, the memory and CPU power used for counting and storing the failure event information is suppressed, and more failure event information is stored in the log file having a limited capacity while suppressing the reduction of the information amount due to the failure event information storage. It is an object of the present invention to provide a system failure event log information storage device capable of performing the above.

Further, there is provided a system failure event log information storage device for accumulating failure event information capable of grasping failure events which are the cause of a series of failure events that occur based on the accumulated failure event information. The purpose is to

[0015]

FIG. 1 is a block diagram showing the principle of the present invention.

The present invention has means for detecting the occurrence status of a failure when the failure event information 100 is input due to the occurrence of a failure and for accumulating the input failure event information 100 based on the detection result.

Further, according to the present invention, the storage control means 5 for controlling the storage of the failure event information 100, the occurrence frequency of the failure when the failure event information 100 is input, and the storage control means based on the detection result. It has an occurrence status monitoring means 1 for determining 5.

The occurrence status monitoring means 1 of the present invention refers to the occurrence status management table 12 for managing the occurrence status of past failures, and refers to the occurrence interval between the failure of the input failure event information 100 and the previously generated failure. Is compared with a predetermined time (T ₁ ), and the number of consecutive failures that occur consecutively at a time interval shorter than the predetermined time (T ₁ ) is compared with a predetermined number (C) to input It has a first comparing means for detecting the occurrence frequency of the trouble event information 100.

Further, the occurrence status monitoring means 1 of the present invention stops the accumulation of the input failure event information 100 when the failure occurrence frequency exceeds a predetermined value (T ₃ ).

The storage control means 5 of the present invention detects the occurrence status of a failure event when the occurrence status monitoring means 1 detects that the failure occurrence frequency is equal to or higher than a predetermined value (T ₁ ). The failure event information 100 input based on the failure event information 100 or the failure occurrence frequency of the entered failure event information 100 is accumulated in the failure event information accumulating section 4, and the occurrence frequency is monitored by the occurrence status monitoring section 1. Is detected to be smaller than a predetermined value (T ₁ ), the failure event information storage section 4 always stores the input failure event information 100.

Furthermore, the count accumulation control means 3 of the present invention
Refers to the past failure event information and the comparison management table 32 for managing the occurrence status of the failure, and refers to the occurrence interval between the failure in the input failure event information 100 and the latest failure registered in the comparison management table 32. Is compared with a predetermined time (T ₂ ) and whether the same failure event information as the input failure event information 100 is registered in the comparison management table 32, thereby inputting the failure event information. It has a second comparison means for detecting the occurrence status of 100.

[0022]

The system failure event log information storage device of the present invention can select the storage method according to the detection result by monitoring the failure occurrence status and detecting the failure occurrence frequency.

By managing the information about the previous failure event in the occurrence status management table and monitoring the failure occurrence interval and the number of consecutive occurrences, it is possible to detect the failure occurrence frequency based on the value. At the same time, it becomes possible to stop the accumulation of failure event information based on the frequency of occurrence of failures.

Further, by monitoring the frequency of occurrence of failures, whether the failure event information input based on the result of the monitoring is failure event information that should always be accumulated, or failures that should be accumulated according to the number of times of failure occurrence It is possible to select a storage method such as whether it is event information.

Furthermore, since only the failure event information that has occurred consecutively at a time interval shorter than the predetermined time interval is stored in the occurrence status management table, it will occur continuously at a time interval shorter than the predetermined time interval. It is possible to accumulate the failure event information according to the number of occurrences of each failure event information.

[0026]

Embodiments of the present invention will now be described in detail with reference to the drawings.

FIG. 2 shows a system configuration diagram of a system failure event log information storage device according to an embodiment of the present invention. The system failure event log information storage device 6 shown in the figure includes an occurrence status monitoring unit 1, a constant storage control unit 2, and a count storage control unit 3.
And a failure event information storage unit 4.

The fault event information 100 input in this embodiment is fault event information consisting of the time of occurrence, resource type, resource name, and cause code shown in FIGS.

The occurrence status monitoring section 1 has a first comparing section 11 and an occurrence status management table 12. The occurrence status management table 12 is a table for managing the occurrence status of past failure events, and is referred to or updated by the first comparing unit 11. FIG. 3 is a diagram showing an example of an occurrence status management table according to an embodiment of the present invention. The occurrence status management table 12 shown in the figure includes an occurrence time 121 and an occurrence counter 122. In the example of the figure, the occurrence time 121 of the last failure event is “10:07” and the occurrence counter 122
As shown in "5" represents that the predetermined time up to the present (T ₁₎ 5 consecutive at shorter intervals than, i.e. a total of 6 times the failure event has occurred.

The first comparing section 11 is provided with the failure event information 100.
There Referring to occurrence status management table 12 to be inputted is shorter than the interval of generation of a failure event entered the previous fault event is less than the predetermined time (T _1), and the predetermined time (T ₁₎ When the number of consecutive failure events occurring at intervals is equal to or greater than a predetermined number (C), "count accumulation" is selected as the accumulation pattern of the relevant failure event information 100, and the relevant failure event information 100 is counted and accumulated by the control unit. Output to 3.
In addition, in cases other than the above, “constant storage” is selected as the storage pattern of the failure event information 100, and the failure event information 100 is output to the continuous storage unit 2.

The constant accumulation control unit 2 accumulates the failure event information 100 in the failure event information storage unit 4 when it is selected by the first comparison unit 11 of the occurrence status monitoring unit 1 and the failure event information 100 is input. .

The count accumulation control unit 3 includes a second comparison unit 3
1 and a comparison management table 32. The comparison management table 32 is a table that manages failure event information that has occurred in the past and failure occurrence status, and is referenced or updated by the second comparison unit 31. FIG. 4 is a diagram showing an example of the comparison management table according to the embodiment of the present invention. The comparison management table 32 shown in the figure has an occurrence time 321, a resource type 322,
It is composed of a resource name 323, a cause code 324, a counter 325, and a storage position 326. In the example of the figure, the resource type 322 is set at the occurrence time 321 “10:05” of the failure event.
The failure event of cause code 324 “02” that occurred in “line” and resource name 323 “LINE01” is stored,
Since the counter 325 is “1”, it means that the failure event has already occurred twice (indicates that the same failure event has occurred once since the failure event that occurred first). That is, it means that a total of two trouble events have occurred). In addition, the accumulation position 326 “2”
Indicates that the failure event information is stored in the storage location 41 “2” of the failure event information storage unit 4.

When the second comparing section 31 is selected by the first comparing section 11 of the occurrence status monitoring section 1 and the failure event information 100 is input, the second comparing section 31 refers to the comparison management table 32 and registers it in the comparison management table 32. The comparison management table 32 stores the latest failure event information and the input failure event information 100 whose occurrence interval is equal to or longer than a predetermined time (T ₂ ) and is the same as the input failure event information 100. If registered in the, the comparison management table 32 and the input failure event information 1 stored in the failure event information storage unit 4 are registered.
The values of the counters 325 and 46 of the same failure event information as 00 are incremented. In addition, in cases other than the above, the input failure event information 100 is registered in the comparison management table 32 and stored in the failure event information storage unit 4.

The fault event information storage unit 4 is a database for storing the fault event information 100 input from the second storage unit 31 of the constant storage control unit 2 and the count storage control unit 3. FIG. 5 is a diagram showing an example of a failure event information storage unit according to an embodiment of the present invention. The accumulation result in the trouble event information accumulation unit of FIG. 5B shows an example in which the example of the trouble event information shown in FIG. The detailed accumulation process of the input failure event information 100 will be described later. The failure event information storage unit 4 shown in FIG. 5B has a storage location 41, an occurrence time 42, a resource type 43, and a resource name 4.
4, a cause code 45, and a counter 46. For example, in the first record of the failure event information storage unit 4, the failure event at the occurrence time 42 “10:00” is stored in the storage position 41 “0” of the failure event information storage unit 4, Indicates that a fault of cause code 45 “02” has occurred in the resource type 43 “line” and the resource name “LINE01”. In addition, the counter 46
"0" means that the failure event is "10:00"
It means that the event has occurred for the first time (that is, the number of occurrences of the event information is once). Further, the counter 46 “2” of the storage position 41 “2” is
It indicates that the failure event accumulated in "2" has occurred three times in total by "10:05" after the failure event occurred at "10:01" (after 10:01). Following the fault event that has occurred, it is indicated that the same fault event has occurred two more times, that is, a total of three faults have occurred.

Next, the first comparing section 1 of the occurrence status monitoring section 1
The operation 1 will be described in detail with reference to the drawings. FIG. 6 is a flow chart showing the operation of the first comparing section according to the embodiment of the present invention.

(Step 1) When the fault event information 100 is input, the time of occurrence of the fault is extracted from the input fault event information 100.

(Step 2) Occurrence status management table 1
Nothing is registered in 2 or the occurrence interval between the occurrence time 121 stored in the occurrence status management table 12 and the occurrence time extracted in the above step 1 is a predetermined time (T ₁ ) or more. To move to step 6.

(Step 3) Occurrence status management table 1
The occurrence time extracted in step 1 is set to the occurrence time 121 of No. 2, and the value of the occurrence counter 122 is incremented.

(Step 4) Occurrence status management table 1
When the value of the generation counter 122 of No. 2 is equal to or more than the predetermined number (C), the accumulation pattern is set to "count accumulation", and the process proceeds to the count accumulation process of Step 5,
If the value of is smaller than the predetermined number of times (C), the accumulation pattern is set to "constant accumulation", and the process proceeds to the constant accumulation process of step 7.

(Step 5) Count accumulation control unit 3
Then, a count accumulation process described later is performed.

(Step 6) Nothing is registered in the occurrence status management table 12 in the above step 2, or the occurrence time 121 stored in the occurrence status management table 12 and the occurrence time extracted in the above step 1 If the interval between occurrences of and is equal to or greater than the predetermined time (T ₁ ), the above step 1 is performed at the occurrence time 121 of the occurrence status management table 12.
In addition to setting the occurrence time extracted in step 1, the occurrence counter 1
The value of 22 is reset to 0.

(Step 7) Following step 6 or in step 4, the occurrence status management table 12
When the value of the generation counter 122 is smaller than the predetermined number (C), the constant accumulation control unit 2 performs the constant accumulation process described later.

Next, the operation of the second comparison section 31 of the count accumulation control section 3 will be described in detail with reference to the drawings. The second comparison unit 31 of the count accumulation control unit 3 performs the count accumulation process in step 5 above. FIG. 7 is a flow chart showing the operation of the second comparing section according to the embodiment of the present invention.

(Step 50) Comparison management table 32
Nothing is registered in, or the occurrence interval between the occurrence time 321 of the latest time among the occurrence times 321 stored in the comparison management table 32 and the occurrence time extracted in step 1 is a predetermined time. If (T ₂ ) or more, the process proceeds to step 51, and if other than the above, step 5
Go to 6.

(Step 51) Comparison management table 32
Clear all information stored in.

(Step 52) Comparison management table 32
Occurrence time 321, resource type 322, resource name 323,
And the cause code 324 stores the occurrence time, resource type, resource name, and cause code of the failure event information 100 input in step 1, and the occurrence counter 325 is set to 0.

(Step 53) An accumulation record for accumulating the failure event information 100 input in Step 1 in the failure event information storage unit 4 is created. In addition, the value of the counter 46 at the time of storing in the failure event information accumulating unit 4 is set to 0, and an accumulation record is created.

(Step 54) The accumulated record created in the above step 53 is additionally accumulated at the end of the trouble event information accumulating section 4 to obtain the accumulation position 41 in the trouble event information accumulating section 4 of the accumulated record.

(Step 55) In the accumulation position 326 where the failure event information stored in the comparison management table 32 in the above step 52 is not stored, the accumulation position of the failure event information acquired in the above step 54 in the failure event information storage unit 4 Four
The value of 1 is set, and the accumulation processing of the failure event information 100 input in step 1 is completed.

(Step 56) In Step 50,
Some information is registered in the comparison management table 32, and the occurrence interval between the occurrence time 321 of the latest time among the occurrence times 321 stored in the comparison management table 32 and the occurrence time extracted in step 1 is If it is smaller than the predetermined time (T ₂ ), other information except the occurrence time of the failure event information 100 input in step 1, that is, the failure event having the same resource type, resource name, and cause code It is verified whether the information is stored in the comparison management table 32. If the same failure event information is not stored in the comparison management table 32 as a result of the comparison, step 5
Move to 2.

(Step 57) Comparison management table 32
Of the failure event information 100 input in step 1 except the occurrence time, that is, the counter 325 of failure event information having the same resource type, resource name, and cause code.
Increment the value.

(Step 58) Comparison management table 32
Of the failure event information 100 input in step 1 other than the occurrence time, that is, the failure event information having the same resource type, resource name, and cause code, and the value of the failure event information storage position 326. The storage position 41 of the same value as the value of the storage position 326 of the failure event information storage unit 4 is referred to.
The value of the counter 46 of the failure event information accumulated in the step 1 is incremented, and the process of accumulating the failure event information 100 input in step 1 is completed.

Next, the operation of the constant storage control unit 2 will be described in detail with reference to the drawings. The constant accumulation control unit 2 performs the constant accumulation process in step 7 above. FIG. 8 is a flowchart showing the operation of the constant storage control unit according to the embodiment of the present invention.

(Step 70) An accumulation record for accumulating the failure event information 100 input in step 1 in the failure event information storage unit 4 is created. In addition, the value of the counter 46 at the time of storing in the failure event information accumulating unit 4 is set to 0, and an accumulation record is created.

(Step 71) The accumulated record created in the above step 70 is additionally accumulated at the end of the trouble event information accumulation unit 4, and the trouble event information 1 input in step 1 is added.
The accumulation process of 00 is terminated.

A specific example of using this system failure event log information storage device will be shown below. The configuration and operation of the system failure event log information storage device 6 are the same as in the above example. It is assumed that the example of the failure event information shown in FIG. 5 (A) is sequentially input to the device 6 as time passes, and the occurrence status management table 12 and the comparison management table 32 of the device 6 at the start of the description, It is assumed that nothing is registered in the failure event information storage unit 4. It should be noted that the value of the predetermined time (T ₁ and T ₂ ) in the description of the above embodiment is T ₁
= T ₂ = 5 (minutes), and the value of a certain number of times (C) is C = 2
As described below.

[Input of failure event information shown in failure number 1]
When the failure event information 100 is input, the occurrence status monitoring unit 1
The first comparing unit 11 of the
The time of occurrence of the failure, “10:00”, is extracted from (step 1), but since nothing is registered in the occurrence status management table 12 (step 2, YES), the occurrence time 121 of the occurrence status management table 12 is set. Set "10:00" extracted in step 1 and set the value of the occurrence counter 122 to 0.
(Step 6). Furthermore, the first comparison unit 1
1 is the input failure event information 100 indicated by the failure number 1.
"Continuous accumulation" is selected as the accumulation pattern of, and the process is transferred to the constant accumulation control unit 2 (step 7).

The continuous storage control unit 2 receives the fault number 1
An accumulation record for accumulating the failure event information 100 shown in 1 in the failure event information storage unit 4 is created. The value of the counter 46 when storing in the failure event information storage unit 4 is set to 0 to create a storage record (step 70).

Next, the created storage record is stored in the storage position 41 "0" of the failure event information storage unit 4 (step 71).

[Input of failure event information shown in failure number 2]
When the failure event information 100 is input, the occurrence status monitoring unit 1
The first comparing unit 11 of the
"10:01", which is the time when the failure occurred, is extracted (step 1). The first comparison unit 11 has a predetermined occurrence interval (1 minute) between the occurrence time 121 “10:00” stored in the occurrence status management table 12 and the occurrence time “10:01” extracted in step 1. Since the value is smaller than the time (T ₁ = 5 minutes) (1 minute <5 minutes) (step 2, NO), “10:01” is set to the occurrence time 121 of the occurrence status management table 12 and the occurrence counter 122 is set to “0:01”. The value is incremented to "1" (step 3).

Next, the first comparing section 11 compares the value "1" of the occurrence counter 122 of the occurrence status management table 12 with a predetermined number of times (C = 2), and the value of the occurrence counter 52 is predetermined. Since it is smaller than the number of times (1 <2) (step 4, NO), "constant accumulation" is selected as the accumulation pattern of the failure event information 100 indicated by the input failure number 2, and the constant accumulation control unit 2 continuously accumulates. Processing is performed (step 7).

The constant accumulation control unit 2 stores the input failure event information 100 indicated by the failure number 2 in the failure event information storage unit 4
Create a storage record to store in. The value of the counter 46 when storing in the failure event information storage unit 4 is 0.
A storage record is created as (step 70).

Next, the created storage record is stored in the storage position 41 "1" of the failure event information storage unit 4 (step 71).

[Input of failure event information indicated by failure number 3]
When the failure event information 100 is input, the occurrence status monitoring unit 1
The first comparing unit 11 of the
"10:02", which is the time when the failure occurred, is extracted (step 1). The first comparison unit 11 has a predetermined occurrence interval (1 minute) between the occurrence time 121 “10:01” stored in the occurrence status management table 12 and the occurrence time “10:02” extracted in step 1. Since the value is smaller than the time (T ₁ = 5 minutes) (2 minutes <5 minutes) (step 2, NO), “10:02” is set as the occurrence time 121 of the occurrence status management table 12, and the occurrence counter 122 of the occurrence counter 122 is set. The value is incremented to "2" (step 3).

Next, the first comparing section 11 compares the value "2" of the occurrence counter 122 of the occurrence status management table 12 with a predetermined number of times (C = 2), and the value of the occurrence counter 52 is predetermined. Since it is more than the number of times (2 ≧ 2) (Step 4, YE
S), the failure event information 100 indicated by the input failure number 4
"Count accumulation" is selected as the accumulation pattern of, and the count accumulation control unit 3 performs the count accumulation processing (step 5).

Second comparison section 31 of count accumulation control section 3
When the comparison management table 32 is referred to in, there is nothing registered in the comparison management table 32 (step 50,
If YES, the comparison management table 32 is cleared and initialized (step 51).

Next, the second comparing section 31 sets the occurrence time 321, the resource type 322, the resource name 323, and the cause code 324 of the comparison management table 32 to the failure event information 100 indicated by the failure number 4 inputted. Occurrence time "10: 0
2 ”, resource type“ line ”, resource name“ LINE01 ”,
Store the cause code “02” and set the occurrence counter 325 to 0.
(Step 52).

The second comparing section 31 compares the input failure event information 100 indicated by the failure number 4 with the failure event information accumulating section 4
Create a storage record to store in. The value of the counter 46 when storing in the failure event information storage unit 4 is 0.
A storage record is created as (step 53).

Next, the second comparing section 31 stores the created accumulated record at the last accumulation position 41 "2" of the trouble event information accumulating section 4, and the accumulated event records in the trouble event information accumulating section 4 are stored. The accumulation position 41 “2” is acquired (step 54), and the value “2” of the accumulation position 41 acquired in step 54 is acquired in the accumulation position 326 not stored in the failure event information stored in the comparison management table 32 in step 52. Is set (step 55).

[Input of failure event information shown in failure number 4]
When the failure event information 100 is input, the occurrence status monitoring unit 1
The first comparing unit 11 of the
The time of failure occurrence, "10:04", is extracted from (step 1). The first comparison unit 11 has a predetermined occurrence interval (2 minutes) between the occurrence time 121 “10:02” stored in the occurrence status management table 12 and the occurrence time “10:04” extracted in step 1. Since the value is smaller than the time (T ₁ = 5 minutes) (1 minute <5 minutes) (step 2, NO), “10:04” is set as the occurrence time 121 of the occurrence status management table 12 and the occurrence counter 122 is set. The value is incremented to "3" (step 3).

Next, the first comparing section 11 compares the value "3" of the occurrence counter 122 of the occurrence status management table 12 with a predetermined number of times (C = 2), and the value of the occurrence counter 52 is predetermined. Since it is more than the number of times (3 ≧ 2) (step 4, YE
S), the failure event information 100 indicated by the input failure number 5
"Count accumulation" is selected as the accumulation pattern of, and the count accumulation control unit 3 performs the count accumulation processing (step 5).

Second comparison section 31 of count accumulation control section 3
Is the occurrence time 3 stored in the comparison management table 32.
Occurrence time 321 “10: 0” of the latest time in 21
2 ”and the occurrence time“ 10:04 ”extracted in step 1 have an occurrence interval (1 minute) smaller than a predetermined time (T ₂ = 5 minutes) (1 minute <5 minutes) (step 50, NO). Of the input fault event information 100 indicated by fault number 5, other information except the time of occurrence, that is, fault event information matching the resource type “line”, resource name “LINE01”, and cause code “02” is When it is checked whether or not it is stored in the comparison management table 32, the matching failure event information is stored in the comparison management table 32 (step 56, YE
S) In the comparison management table 32, the value "0" of the counter 325 of the failure event information matched by collation is incremented to "1" (step 57). Then, the second
Of the failure event information storage unit 4 based on the value of the failure event information storage position 326 “2” in the comparison management table 32 that matches the failure event information of the failure event information storage unit 4 of “2”. Count accumulation is performed by incrementing the value "0" of the information count 46 to "1" (step 58).

[Input of failure event information shown in failure number 5]
When the failure event information 100 is input, the occurrence status monitoring unit 1
The first comparing unit 11 of the
"10:05", which is the time when the failure occurred, is extracted (step 1). The first comparison unit 11 sets a predetermined occurrence interval (1 minute) between the occurrence time 121 “10:04” stored in the occurrence status management table 12 and the occurrence time “10:05” extracted in step 1. Since the value is smaller than the time (T ₁ = 5 minutes) (1 minute <5 minutes) (step 2, NO), “10:05” is set to the occurrence time 121 of the occurrence status management table 12 and the occurrence counter 122 of the occurrence counter 122 is set. The value is incremented to "4" (step 3).

Next, the first comparing section 11 compares the value "4" of the occurrence counter 122 of the occurrence status management table 12 with a predetermined number of times (C = 2), and the value of the occurrence counter 52 is predetermined. Since it is more than the number of times (4 ≧ 2) (step 4, YE
S), the failure event information 100 indicated by the input failure number 5
"Count accumulation" is selected as the accumulation pattern of, and the count accumulation control unit 3 performs the count accumulation processing (step 5).

Second comparator 31 of count accumulation controller 3
Is the occurrence time 3 stored in the comparison management table 32.
Occurrence time 321 “10: 0” of the latest time in 21
4 ”and the occurrence time“ 10:05 ”extracted in step 1 (1 minute) is shorter than a predetermined time (T ₂ = 5 minutes) (1 minute <5 minutes) (step 50, NO). Of the input fault event information 100 indicated by fault number 5, other information except the time of occurrence, that is, fault event information matching the resource type “line”, resource name “LINE01”, and cause code “02” is When it is checked whether or not it is stored in the comparison management table 32, the matching failure event information is stored in the comparison management table 32 (step 56, YE
S) In the comparison management table 32, the value "1" of the counter 325 of the failure event information that is matched by collation is incremented to "2" (step 57). Then, the second
The comparison unit 31 of No. 1 of the failure event information whose accumulation position 41 of the failure event information accumulation unit 4 is “2” based on the value of the accumulation position 326 “2” of the failure event information that is matched by the comparison of the comparison management table 32 Count accumulation is performed by incrementing the value "1" of the count 46 to "2" (step 58).

[Input of failure event information indicated by failure number 6]
When the failure event information 100 is input, the occurrence status monitoring unit 1
The first comparing unit 11 of the
The time of occurrence of the failure, "10:07", is extracted from (step 1). The first comparing unit 11 sets a predetermined occurrence interval (2 minutes) between the occurrence time 121 “10:05” stored in the occurrence status management table 12 and the occurrence time “10:07” extracted in step 1. Since the value is smaller than the time (T ₁ = 5 minutes) (2 minutes <5 minutes) (step 2, NO), “10:07” is set to the occurrence time 121 of the occurrence status management table 12 and the occurrence counter 122 is set. The value is incremented to "5" (step 3).

Next, the first comparing section 11 compares the value "5" of the occurrence counter 122 of the occurrence status management table 12 with a predetermined number of times (C = 2), and the value of the occurrence counter 52 is predetermined. Since it is more than the number of times (5 ≧ 2) (Step 4, YE
S), the failure event information 100 indicated by the input failure number 6
"Count accumulation" is selected as the accumulation pattern of, and the count accumulation control unit 3 performs the count accumulation processing (step 5).

Second comparison section 31 of count accumulation control section 3
Is the occurrence time 3 stored in the comparison management table 32.
Occurrence time 321 “10: 0” of the latest time in 21
5 ”and the occurrence time“ 10:07 ”extracted in step 1 (2 minutes) is smaller than the predetermined time (T ₂ = 5 minutes) (2 minutes <5 minutes) (step 50, NO). Of the input failure event information 100 indicated by failure number 5, other information except the time of occurrence, that is, the failure event information matching the resource type “line”, the resource name “LINE03”, and the cause code “04” is When it is collated with the comparison management table 32, the matching failure event information is not stored in the comparison management table 32 (step 56, N).
O), the occurrence time 321, the resource type 322, the resource name 323, and the cause code 324 of the comparison management table 32,
Occurrence time "10:07" of the fault event information 100 indicated by the input fault number 6, resource type "line", resource name "L"
INE03 "and the cause code" 04 "are stored, and the occurrence counter 325 is set to 0 (step 52). Then the second
The comparison unit 31 of 1 creates a storage record for storing the input failure event information 100 indicated by the failure number 6 in the failure event information storage unit 4. The failure event information storage unit 4
The value of the counter 46 at the time of storing is stored as 0 to create an accumulated record (step 53).

Next, the second comparing section 31 stores the created storage record in the storage location 41 "3" which is the last of the failure event information storage section 4, and the failure event information storage section 4 of the storage record stores it. The storage position 41 “3” is acquired (step 54), and the value “3” of the storage position 41 acquired in step 54 is stored in the storage position 326 not stored in the failure management information stored in the comparison management table 32 in step 52. Is set (step 55).

[Input of failure event information indicated by failure number 7]
When the failure event information 100 is input, the occurrence status monitoring unit 1
The first comparing unit 11 of the
The failure occurrence time, "19:02" is extracted from (step 1). The first comparing unit 11 determines that the occurrence interval (8 hours 55 minutes) between the occurrence time 121 “10:07” stored in the occurrence status management table 12 and the occurrence time “10:02” extracted in step 1 Since the predetermined time (T ₁ = 5 minutes) or more (8 hours 55 minutes ≧ 5 minutes) (step 2, YE
S), the occurrence time “19:02” extracted in the above step 1 is set to the occurrence time 121 of the occurrence status management table 12, the value of the occurrence counter 122 is reset to 0 (step 6), and the input failure is input. "Continuous accumulation" is selected as the accumulation pattern of the failure event information 100 indicated by number 7, and the constant accumulation control unit 2 performs the constant accumulation process (step 7).

The continuous accumulation control unit 2 stores the input failure event information 100 indicated by the failure number 7 in the failure event information storage unit 4
Create a storage record to store in. The value of the counter 46 when storing in the failure event information storage unit 4 is 0.
A storage record is created as (step 70). The constant storage control unit 2 stores the created storage record in the storage position 41 "4" of the failure event information storage unit 4 (step 71).

The result of accumulating the failure event information in the failure event information storage unit 4 according to the above embodiment is shown in FIG.
Here, for example, when searching for the number of times of the failure event having the resource type “line”, the resource name “LINE01”, and the cause code “02” between 10:00 and 10:05, it is found that 3 The corresponding failure event information is searched, but if the counts 46 of the failure event information are all added to the three search results, it is possible to know five cases that are equal to the actual number of failure events. This is not possible with the conventional same failure event count storage device 9.

In this embodiment, the input failure event information 100 is the occurrence time, resource type, resource name, and cause code, but the input failure event information 100 is limited to the above information. It is possible to set it freely. For example, as the failure event information 100, in addition to the information used in this embodiment, it is possible to input the execution address at the time of the failure, the value of the register at the time of the failure, and the like.

Further, in the present embodiment, the determination as to whether the input failure event information 100 and the failure event information registered in the comparison management table 32 are the same failure event excludes the failure occurrence time. Information, ie resource type, resource name,
Although it is determined whether or not the cause codes match, the determination method is not limited to the method of this embodiment.

For example, in addition to the occurrence time, resource type, resource name and cause code used in this embodiment, the failure event information 100 input to the apparatus 6 as in the comparative example shown in FIG. The execution address at the time and the value of the register at the time of failure may be added. In this case, it is determined whether the input failure event information 100 and the failure event information registered in the comparison management table 32 in the figure are the same failure event information in the input failure event information 100 and the comparison management table 32. It can also be determined by matching the contents of all items except the occurrence time of the registered failure event information [FIG. 9 (A)].

If the input failure event information 100 matches the resource type, resource name, cause code, and execution address in the comparison management table [FIG. 9 (B)], it is determined that the failure event information is the same. . Also, the input failure event information 100
If the resource type, the resource name, and the cause code in the comparison management table match [FIG. 9 (C)], it is possible to determine that they are the same failure event information.

In this way, the failure event information 10 input
There are various methods for determining whether or not 0 and the failure event information stored in the comparison management table 32 are the same failure event information, but in order to improve the accuracy of recording the failure event information, It is desirable to determine whether or not failure event information that completely matches the input failure event information 100 is stored in the comparison management table 32.

In the present embodiment, the time of occurrence is "HH: M".
However, the expression format of time is not limited, and it is also possible to use, for example, the total seconds from the reference date.

In this embodiment, the predetermined time is T ₁ = T
_{Although 2} = 5 (minutes) and the predetermined number of times is C = 2 (times), the values used in this embodiment are not optimum as these predetermined values. In practice, it is desirable to compare the occurrence intervals in a shorter time or to use a larger value for the number of consecutive occurrences.

Further, when the number of consecutive failure events has exceeded a predetermined value, various failure event information that frequently occur in a chain due to the same failure cause is stored in the failure event information storage unit 4. By writing a large amount, it is possible to prevent the failure event information that has occurred in the past and has been stored in the failure event information storage unit 4 from being overwritten and lost, and to prevent the failure event information storage period from being shortened. Therefore, it is possible to perform a process of stopping the accumulation of the failure event information in the failure event information storage unit 4.

The present invention is not limited to the above examples, and various modifications and applications are possible within the scope of the claims.

[0092]

As described above, according to the present invention, by detecting the occurrence frequency of a failure by the occurrence status monitoring means, the accumulation control means of the failure event information is automatically selected according to the occurrence frequency of the failure. Then, it becomes possible to accumulate.

Further, by selecting either the continuous accumulation control means or the count accumulation control means in accordance with the occurrence frequency of the failure in the occurrence status monitoring means, the failure event information is not accumulated, but all failure event information is accumulated. Depending on the frequency of occurrence of, it is possible to constantly store, count, or stop storing the failure event information.

As a result, only the failure event information that has occurred during the period in which the failure frequency is high may be registered in the comparison management table during that period, and the number of registrations of the failure event information in the comparison management table is reduced. Therefore, the memory size used can be suppressed. In addition, the number of times of comparison between the input failure event information and the comparison management table can be reduced, and count accumulation can be performed with less CPU power.

Further, since the failure event information accumulating and post-natal means can be selected according to the failure occurrence frequency, the failure occurrence frequency is high even after the failure occurrence frequency becomes high and the failure event information is counted and accumulated. If it becomes lower, the accumulation method changes to always accumulation, so that it is possible to grasp the past occurrence status of a failure by using the accumulated failure event information.

Further, by using the constant accumulation and the count accumulation together, it becomes possible to accumulate more trouble event information in the log file having a limited capacity.

[Brief description of drawings]

FIG. 1 is a principle configuration diagram of the present invention.

FIG. 2 is a system configuration diagram of a system failure event log information storage device according to an embodiment of the present invention.

FIG. 3 is a diagram showing an example of an occurrence status management table according to an embodiment of the present invention.

FIG. 4 is a diagram showing an example of a comparison management table according to an embodiment of the present invention.

FIG. 5 is a diagram showing an example of a failure event information storage unit according to an embodiment of the present invention.

FIG. 6 is a flowchart showing the operation of the first comparing section according to the embodiment of the present invention.

FIG. 7 is a flowchart showing the operation of the second comparison unit according to the exemplary embodiment of the present invention.

FIG. 8 is a flowchart showing the operation of the constant storage control unit according to the embodiment of the present invention.

FIG. 9 is a diagram showing an example of comparison between input failure event information and a comparison management table.

FIG. 10 is a configuration diagram of a conventional same failure event count storage device.

FIG. 11 is a diagram showing an example of a conventional failure event information storage unit.

[Explanation of symbols]

 1 occurrence status monitoring means, occurrence status monitoring section 2 constant accumulation control means, constant accumulation control section 3 count accumulation control means, count accumulation control section 4 failure event information accumulation section, failure event information accumulation section 5 accumulation control section, accumulation control section 6 system failure event log information storage device 7 event monitoring unit 8 all event count storage control unit 9 same failure event count storage device 11 first comparing unit, first comparing unit 12 occurrence status management table 31 second comparing unit, Second comparison unit 32 Comparison management table 41 Accumulation position 42 Occurrence time 43 Resource type 44 Resource name 45 Cause code 46 Counter 121 Occurrence time 122 Occurrence counter 321 Occurrence time 322 Resource type 323 Resource name 324 Cause code 325 Counter 326 Accumulation position

Claims (6)

[Claims] 1. System fault event log information, wherein, when fault event information is input due to the occurrence of a fault, the occurrence state of the fault is detected and the fault event information is accumulated based on the detection result. Storage device. 2. Storage control means for controlling storage of the failure event information, and detection of the occurrence frequency of the failure when the failure event information is input, and determination of the storage control means based on the detection result. The system failure event log information storage device according to claim 1, further comprising: 3. The occurrence status monitoring means refers to the occurrence status management table for managing the occurrence status of past failures, and refers to the occurrence status management table to determine the occurrence interval between the failure and the previously generated failure. No. 1 for detecting the occurrence frequency of the failure event information by comparing the number of occurrences of a failure that occurs continuously at a time interval shorter than the predetermined time with a predetermined number of times. The system failure event log information storage device according to claim 2, further comprising a comparison means. 4. The accumulation control means detects the occurrence status of the failure event when the occurrence status detection means detects that the occurrence frequency is equal to or higher than a predetermined value, and based on the detection result, the failure event information. Alternatively, when the number of occurrences of the failure event is accumulated in the failure event information storage means, and the occurrence status monitoring means detects that the occurrence frequency is smaller than a predetermined value, the failure event information is stored. 3. The system failure event log information storage device according to claim 2, further comprising: a constant storage control means for storing the failure event information storage means. 5. The count accumulation control means refers to the comparison management table for managing past failure event information and failure occurrence status, and references the comparison management table to register the failure and the comparison management table. By comparing the occurrence interval with the latest failure that is present with a predetermined time, and comparing whether the same failure event information as the failure event information is registered in the comparison management table, the failure event information The system failure event log information storage device according to claim 4, further comprising second comparing means for detecting an occurrence status. 6. The system failure event log information storage device according to claim 3, wherein the first comparing means stops the storage of the failure event information when the number of occurrences exceeds a predetermined value.