JPH09305443A - Process monitoring device and method therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a monitoring device, etc, which can accurately and easily detect the abnormal state of a process. SOLUTION: A reference data storage means 22 stores reference data as data corresponding to operation that the process should perform. A gathering decision start means 30 substantially operates an operation data gathering means 24 and an abnormality decision means 28 when the operation state that an operation state detecting means 28 detects corresponds to a specific operation state. The operation data gathering means 24 gathers the operation data as the data corresponding to the actual operation. The abnormality decision means 26 compares the reference data stored in the reference data storage means 22 with the operation data gathered by the operation data gathering means 24 to decide whether or not abnormality occurs to the process. Therefore, it can be decided as part of a program whether the abnormality occurs to the process.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a process monitoring device and a process monitoring method, and more particularly, to detecting an abnormal state of a process.

[0002]

2. Description of the Related Art As a method for detecting an abnormality in a program (process) being executed, C for the program running time is used.
A method of monitoring the ratio of PU usage time (load average) is used.

When a program such as software (word processing software) for a Japanese word processor is executed using the CPU, the CPU does not always perform an arithmetic operation, but rather is in an input / output waiting state. There are many. Therefore, the load average is relatively low when the process is in a normal state.

On the other hand, when the process goes into a runaway state, the CP
Due to the extreme increase in U usage time, the load average becomes extremely high. So we monitor the road average,
When the load average becomes higher than a predetermined value, it is determined that an abnormality has occurred in the process.

[0005]

However, such a conventional detection method has the following problems.
As software, there are programs such as technical calculation software that include a portion that originally increases the load average even if it is operating normally. For such a program, the normality / abnormality of the process cannot be accurately determined only by the height of the load average.

In order to solve such a problem, a method of detecting an abnormal state of a process by hardware can be considered. However, in order to realize such a method,
This is difficult to implement because special hardware or operating system (OS) must be created for each program.

An object of the present invention is to provide a process monitoring apparatus and a process monitoring method which can solve such conventional problems and can accurately and easily detect an abnormal state of a process.

[0008]

[Means for Solving the Problems]

[0009]

[Technical idea devised to solve the problem] In order to detect the abnormal state of the process accurately and easily, by comparing the reference data with the operation data, it is possible to determine whether or not an abnormality has occurred in the process. It was decided to judge.

That is, as described in FIG. 1, the process monitoring apparatus according to claim 1 is a monitoring apparatus for monitoring a process, and stores reference data which is data corresponding to an operation to be performed by the process. Reference data storage means 2
2. Operation data collecting means 24 for collecting operation data which is data corresponding to the operation actually performed by the process, comparing the reference data stored in the reference data storage means 22 with the operation data collected by the operation data collecting means 24. By doing so, the abnormality determining means 26 for determining whether or not an abnormality has occurred in the process is provided.

According to a second aspect of the present invention, there is provided the process monitoring device according to the first aspect.
In the above process monitoring apparatus, the reference data is data indicating a procedure of an operation to be performed by the process.

The process monitoring apparatus of claim 3 is the same as that of claim 1.
In the process monitoring device according to item 1, the reference data is data to be generated by executing the process.

The process monitoring apparatus according to claim 4 is the method according to claim 1.
In the process monitoring device according to any one of claims 1 to 3, operating state detecting means 2 for detecting the operating state of the process.
8. Only when the operating state detected by the operating state detecting means 28 corresponds to a predetermined operating state, the operation data collecting means 2
4 and a sampling determination activation means 30 for substantially operating the abnormality determination means 26.

The process monitoring apparatus of claim 5 is the same as that of claim 1.
In the process monitoring device according to any one of claims 1 to 4, the operation data collecting means 24 collects the operation data,
The abnormality determining means 26 is configured to determine whether or not an abnormality has occurred in the process asynchronously with the process.

As described in FIG. 3, the process monitoring apparatus according to the sixth aspect of the invention has a normal execution unit 42 that executes a process to be monitored, and a process that is asynchronous with the process in the normal execution unit 42. The monitored unit 40 including the asynchronous execution unit 44 that executes the first operation, and the first signal is generated when the operating state of the monitored unit 40 corresponds to a predetermined operating state.
Is a process monitoring device for generating a second signal after a lapse of a predetermined time after the signal is generated, the asynchronous execution unit 44 being based on the first signal generated by the monitoring device 46. The normal execution unit 42 is configured to perform trace setting, the trace result is analyzed based on the second signal generated by the monitoring unit 46, and the analysis result is given to the monitoring unit 46. The part 42 is configured to trace its own processing based on the trace setting made by the asynchronous execution part 44.

The process monitoring method according to claim 7 is a monitoring method for monitoring a process, wherein reference data, which is data corresponding to an operation to be performed by the process, is stored, and data corresponding to an operation actually performed by the process is stored. Is collected, and the stored reference data is compared with the collected operation data to determine whether or not an abnormality has occurred in the process.

The process monitoring method according to claim 8 is the method according to claim 7.
In the process monitoring method described in 1., the operating status of the process is detected, and only when the detected operating status corresponds to the predetermined operating status, the operation data is collected and it is determined whether or not an abnormality has occurred in the process. Characterize.

A storage medium according to claim 9 is a computer-readable storage medium storing a computer-executable program, and the program realizes the apparatus or method according to any one of claims 1 to 8. It is characterized by being a thing.

[0019]

[Definition of terms] The concept of the terms in the claims for expressing the technical idea devised to solve the problem is defined as follows, and the relationship between the terms and the embodiments is described.

"Process": A unit of control of an operating system, which refers to an operation or sequence of operations performed by a processor under the control of a program. In the embodiment, the monitored process 40 or the like shown in FIG. 3 corresponds.

"Reference data": Refers to data corresponding to the operation to be performed by the process, and includes data indicating the procedure of the operation to be performed by the process, data to be generated by executing the process, and the like. In the embodiment, the execution order table of the function shown in FIG.

"Data indicating the procedure of operations to be performed by a process": Data indicating the order of operations to be performed by a process, the time required for each operation, and the like. In the embodiment, the execution order table of the function shown in FIG.

"Data to be generated by execution of process": Data that will be generated as the process is executed. In the embodiment, the predicted output value table of the function shown in FIG. 8 is applicable.

"Operation data": Data corresponding to the operation actually performed by the process. In the embodiment, the trace data of FIG. 7 corresponds.

"Trace": A recording of some or all of the steps performed by a computer program. In the embodiment, the process in step S4 of FIG. 4 corresponds.

"Process operating status": The operating status of a process. In the embodiment, the load average detected in step S6 of FIG. 3 corresponds.

"Asynchronous": A state in which a process executed by a computer program is executed substantially independently of other processes. In the embodiment, the relationship between the process in the normal execution unit 42 and the process in the asynchronous execution unit 44 in FIG. 3 corresponds.

[0028]

According to the process monitoring apparatus of the first aspect and the process monitoring method of the seventh aspect, by storing the reference data, collecting the operation data, and comparing the reference data with the operation data, it is possible to confirm that the process is abnormal. It is characterized by determining whether or not it has occurred.

Therefore, when the collected operation data is different from the reference data predetermined for each process,
It is determined that an abnormality has occurred in the process. For this reason,
Process anomalies can be detected without depending on whether the load average is high or low. Further, as a part of the program, it is possible to determine whether or not an abnormality has occurred in the process. Therefore, it is not necessary to prepare special hardware or operating system (OS) for each program. That is, the abnormal state of the process can be detected accurately and easily.

The process monitoring apparatus according to a second aspect is characterized in that the reference data is data indicating a procedure of an operation to be performed by the process. Therefore, if the actual behavior of the process differs from the predetermined behavior,
Determine that an error has occurred in the process. That is, the process abnormality can be detected more accurately.

The process monitoring apparatus according to claim 3 is characterized in that the reference data is data to be generated by executing the process. Therefore, when the data actually generated in the process is different from the predicted generated data, it is determined that an abnormality has occurred in the process. That is,
A process abnormality can be detected more accurately.

The process monitoring apparatus according to claim 4 and the process monitoring method according to claim 8 detect the operating state of a process, and only when the operating state corresponds to a predetermined operating state,
It is characterized by collecting operation data and determining whether or not an abnormality has occurred in the process. Therefore, for example, the operation of detecting the abnormal state of the process can be performed only when the load average becomes high. Therefore, in the normal state, the execution of the process to be monitored is not hindered. That is, in the normal state, without interrupting the execution of the monitored process,
If necessary, an abnormal state detecting operation can be performed.

According to a fifth aspect of the present invention, there is provided the process monitoring apparatus, wherein the operation data is collected and whether the process has an abnormality is determined asynchronously with the process.

Therefore, the abnormal state detecting operation is performed substantially independently of the process to be monitored. Therefore, it is not necessary to interrupt the execution of the process to be monitored when performing the abnormal state detection operation. That is, the process to be monitored can be continuously executed even when the abnormal state detecting operation is executed.

The process monitoring apparatus according to a sixth aspect is characterized in that the monitored means 40 includes a normal execution section 42 and an asynchronous execution section, and the monitoring means 46 is provided separately from the monitored means 40.

Therefore, by providing the normal execution unit 42 and the asynchronous execution unit 44 in the same non-monitoring unit 40, the trace setting / monitoring for the normal execution unit 42 to be monitored is performed.
The cancellation and the analysis of the trace result can be easily and asynchronously performed by using the asynchronous execution unit 44. Further, by providing the monitoring means 46 separately from the monitored means 40, it is possible to easily realize a configuration in which one monitoring means 46 monitors a plurality of monitored means 40.

According to a ninth aspect of the present invention, a storage medium stores a program for implementing the process monitoring apparatus or process monitoring method according to any one of the first to eighth aspects using a computer.

Therefore, it is possible to realize a process monitoring device and the like by causing the computer to read. That is, it is possible to realize a process monitoring device or the like that can more easily detect an abnormal state of a process.

[0039]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 shows the overall structure of a process monitoring apparatus 20 according to an embodiment of the present invention. The reference data storage means 22 stores reference data which is data corresponding to an operation to be performed by a process. The reference data is
The data indicating the procedure of the operation to be performed by the process and the data to be generated by executing the process are used.

The operation data collection means 24 collects operation data which is data corresponding to the operation actually performed by the process. The abnormality determination means 26 is the reference data storage means 2
By comparing the reference data stored in 2 with the operation data collected by the operation data collecting means 24, it is determined whether or not an abnormality has occurred in the process.

The operating state detecting means 28 detects the operating state of the process. The sampling determination activating means 30 substantially operates the operation data sampling means 24 and the abnormality determining means 26 only when the operating state detected by the operating state detecting means 28 corresponds to a predetermined operating state.

The operation data collecting means 24 collects the operation data, and the abnormality determining means 26 determines whether or not an abnormality has occurred in the process.

Each function of the process monitoring device 20 shown in FIG.
FIG. 2 shows an example of a hardware configuration when it is realized by using a PU.

The hard disk 2, which is the reference data storage means 22, stores a program for process monitoring, reference data, and the like. The main memory 4 is loaded with programs and the like stored in the hard disk 2. CP
U6 executes the program loaded in the main memory 4.

CP via the keyboard 8 and mouse 10.
A command is sent to U6. The CRT 12 displays a judgment output of abnormality judgment and the like. Transfer of programs and various data to and from an external device (not shown) is performed by a flexible disk (not shown) via an FDD (flexible disk drive) 14.

The CPU 6 is the operation data collecting means 2 of FIG.
4, the abnormality determining means 26, the operating state detecting means 28, and the sampling determination activating means 30.

FIG. 3 is a flow chart showing the flow of processing when detecting an abnormal state of a process using the process monitoring device 20. In this embodiment, the CP
The U6 executes a plurality of processes while sequentially switching according to the time sharing function of the operating system (OS). That is, as shown in FIG. 3, the CPU 6 appropriately switches and executes the monitored process 40 corresponding to the monitored unit and the monitored process 46 corresponding to the monitored unit.

The monitored process 40 is a normal execution unit 4 that executes a process to be monitored (for example, a technical calculation process).
2 and an asynchronous execution unit 44 that executes a part of the monitoring process asynchronously with the process in the normal execution unit 42.

When executing the monitored process 40, the CPU
6 normally executes only the normal execution unit 42. On the other hand, when the CPU 6 receives a signal from the monitoring process 46 via the OS, the CPU 6 executes the normal execution unit 42 and also executes the asynchronous execution unit 44 according to the type of the signal. In addition, what kind of processing the asynchronous execution unit 44 performs according to the type of signal is registered in advance.

With this setting, when executing the monitored process 40, the CPU 6 appropriately switches between the normal execution unit 42 and the asynchronous execution unit 44 in accordance with the time sharing function of the OS. You can

FIG. 4 shows the normal execution unit 4 of the processing of FIG.
3 is a flowchart showing a detailed processing flow in 2. However, in FIG. 4, a process (for example, a technical calculation process) itself to be monitored is omitted. Based on FIGS. 2 to 4, the process for detecting the abnormal state of the process will be described with reference to FIGS. 5 to 7.

According to the time-sharing function of the OS, the CPU 6 executes the normal execution part 42 (see FIG. 4) in the monitored process 40 shown in FIG. 3 while executing the load average of the monitored process 40 in the monitored process 46. Process operating status) is being monitored.

As shown in FIG. 4, in the normal execution unit 42, the CPU 6 determines whether or not the trace setting is made (step S2). If the trace setting is not made, the CPU 6 determines without tracing. Perform technical calculation processing and the like according to the procedure.

When the monitoring process 46 detects an abnormality in the load average of the monitored process 40 (step S6), the CPU 6 sends a first signal which is a first signal (step S8). In this embodiment, the first signal is transmitted when the load average exceeds a predetermined value. This is because if the load average is high, it is highly possible that the process is in a runaway state.

On the basis of the first signal transmitted, the CP
U6 activates the asynchronous execution unit 44 of the monitored process 40 and turns on the trace setting flag of the normal execution unit 42 (step S16). After turning on the trace setting flag, the CPU 6 returns the control to the normal execution unit 42.

The CPU 6 continues the execution of the technical calculation processing in the normal execution unit 42. As shown in FIG. 4, the normal execution unit 42 is provided with a step of appropriately confirming the trace setting flag between technical calculation processes and the like. The CPU 6 confirms the trace setting flag in this step (step S2).

Since the trace setting flag is ON, the CPU 6 traces the execution of the technical calculation processing in the normal execution unit 42 (step S4). In this embodiment, the trace, as shown in FIG.
Trace data (operation data) such as the execution order of the functions executed by the PU 6, the function name, and the execution time is collected.

On the other hand, in the monitoring process 46, the first
After sending a signal, after waiting for a certain time (step S1
0), the CPU 6 sends a second signal (step S12). The monitored process 40 waits for a certain period of time.
This is because it takes time to acquire the trace data.

On the basis of the second signal transmitted, the CP
U6 controls the asynchronous execution unit 44 of the monitored process 40.
Then, the trace result is analyzed based on the collected trace data (step S18).

In this embodiment, the hard disk 2 stores the order of the functions to be executed by the normal execution unit 42 and the function execution order table (see FIG. 5) that stores the functions that call the functions, and the prediction of the functions. The time table (see FIG. 6) is stored. The data described in these two tables correspond to the reference data.

The CPU 6 compares these tables with the collected trace data (see FIG. 7). When the normal execution unit 42 is performing an operation different from the scheduled operation, it is determined that the normal execution unit 42 has an abnormal state. In the example of FIG. 7, the collected trace data is judged to be abnormal in the following two points.

First, as shown in FIG. 6, the estimated time required for "hfunc" is 5 to 10 μsec. In this example, however, as shown in FIG.
sec (190-175) is required, and the 7th order "hfun"
It takes 30 μsec (220-190) for c ”.

Second, as shown in FIG. 5, "hfunc" is
Although it should be called only from “bfunc” or “cfunc”, in this example, as shown in FIG. 7, “hfunc” in the sixth order is called from “afunc”, and the seventh order and the eighth order. Both "hfunc" in the sequence are called from "hfunc" itself.

In this way, the CPU 6 determines whether or not an abnormal state has occurred in the normal execution part 42 of the monitored process 40 based on the trace data, and notifies the monitoring process 46 of the determination result (step S20). ). Then CP
U6 turns off the trace setting flag of the normal execution unit 42
(Step S22).

On the other hand, the monitoring process 46 receives the determination result (step S14), and executes processing such as stopping the monitored process 40 according to the determination result.

As described above, the asynchronous execution unit 44
However, steps S16 and S18 to S
Even while executing 22, the normal execution unit 42 executes the technical calculation process or the like to be monitored without interruption according to the time sharing function of the OS. That is, in this embodiment, the monitoring process can be performed without interrupting the technical calculation process or the like to be monitored.

In the above-described embodiment, the monitoring process 46 sent a fixed time after sending the first signal.
The monitored process 40 is configured to start the analysis of the trace result based on the second signal from, but the monitored process 40 itself detects that the series of traces has ended without using the second signal, It is also possible to start the analysis of the trace result based on the detection signal.

Further, in the above-described embodiment, after notifying the monitoring process 46 of the determination result as to whether or not an abnormal state has occurred, the trace setting flag of the normal execution unit 42 is set to OF.
However, the judgment result is monitored by the monitoring process 46.
It is also possible to configure to continue the tracing without notifying the setting flag after turning off the notification. With this configuration, it is possible to obtain a plurality of determination results and make a more accurate determination.

Further, in the above-described embodiment, the data (see FIGS. 5 and 6) indicating the procedure of the operation to be performed by the process is used as the reference data, but the reference data is generated by the execution of the process. Power data can be used.

FIG. 8 is a drawing showing a predicted output value table of a function which is an example of data to be generated by executing a process. In FIG. 8, the predicted output value represents the range of output values that would be obtained as a result of executing the function in each step. Therefore, as a result of tracing, if the actual output value at each step exceeds the range, CP
U6 determines that an abnormal state has occurred in the normal execution unit 42.

Further, in the above embodiment, the process in the asynchronous execution unit 44 is configured to be executed asynchronously with the process in the normal execution unit 42.
It is also possible to configure so that the process defined in 1) is performed in synchronization with the process in the normal execution unit 42. However, with this configuration, the processing in the normal execution unit 42 is interrupted while the processing prescribed by the asynchronous execution unit 44 is being performed.

Further, in the above-mentioned embodiment, the trace is executed only when the abnormality of the load average of the monitored process 40 is detected. However, the trace is executed regardless of the abnormality of the load average. Can be configured.

In each of the above embodiments, CP
U6 controls each unit according to the program stored in the hard disk 2. This program is called FDD1
4, the program is read from the flexible disk in which the program is stored and installed on the hard disk 2. Note that, in addition to the flexible disk, a hard disk 2 may be stored on a computer-readable storage medium storing a program such as a CD-ROM or an IC card.
May be installed. Furthermore, you may make it download using a communication line.

In each of the above embodiments, the program is installed from the flexible disk to the hard disk 2 so that the computer indirectly executes the program stored in the flexible disk. However, the present invention is not limited to this, and the program stored in the flexible disk may be directly executed from the FDD 14. Note that, as a program executable by a computer, not only a program that can be directly executed by installing it as it is, but also a program that needs to be temporarily converted into another form (for example, a program that has been compressed, is decompressed) Etc.), and also includes those that can be executed in combination with other module parts.

In each of the above embodiments, the CP
The case where each function of the process monitoring device 20 shown in FIG. 1 is realized by using U6 has been described as an example, but a part or all of each function may be realized by hardware logic.

[Brief description of drawings]

FIG. 1 is a drawing showing an overall configuration of a process monitoring device 20 according to an embodiment of the present invention.

FIG. 2 is a block diagram illustrating each function of the process monitoring device 20 of FIG.
It is a figure which shows an example of the hardware constitutions when it implement | achieves using.

FIG. 3 is a flowchart showing an example of a processing flow when an abnormal state of a process is detected using the process monitoring device 20.

FIG. 4 is a flowchart showing a detailed processing flow in the normal execution unit 42 of the processing of FIG.

FIG. 5 is a function execution order table that stores a function order to be executed by the normal execution unit and a function that calls the function.

FIG. 6 is a predicted required time table that stores predicted required times of functions to be executed by the normal execution unit 42.

FIG. 7 is an execution order of functions executed by the CPU 6, a function name,
It is a figure showing trace data, such as execution time.

FIG. 8 is a predicted output value table in which predicted output values of a function to be executed by the normal execution unit 42 are stored.

[Explanation of symbols]

 22 ... Reference data storage means 24 ... Operation data collection means 26 ... Abnormality determination means 28 ... Operating state detection means 30 ... Collection determination start means

Claims (9)

[Claims] 1. A monitoring device for monitoring a process, comprising reference data storage means for storing reference data which is data corresponding to an operation to be performed by the process, and operation which is data corresponding to the operation actually performed by the process. An operation data collecting unit for collecting data, and an abnormality judging unit for judging whether or not an abnormality has occurred in the process by comparing the reference data stored in the reference data storage unit with the operation data collected by the operation data collecting unit. A process monitoring device characterized by being provided with. 2. The process monitoring device according to claim 1, wherein the reference data is data indicating a procedure of an operation to be performed by a process. 3. The process monitoring device according to claim 1, wherein the reference data is data to be generated by executing a process. 4. The process monitoring device according to claim 1, wherein the operating state detecting means for detecting the operating state of the process and the operating state detected by the operating state detecting means correspond to a predetermined operating state. Only in such a case, there is provided a sampling judgment starting means for substantially operating the operation data collecting means and the abnormality judging means. 5. The process monitoring device according to any one of claims 1 to 4, wherein operation data is collected by operation data collecting means, and
It is characterized in that the abnormality determining means determines whether or not an abnormality has occurred in the process, asynchronously with the process. 6. A monitored means provided with a normal execution part for executing a process to be monitored and an asynchronous execution part for executing the process asynchronously with the process in the normal execution part, and an operating state of the monitored part. A process monitoring apparatus comprising: a monitoring unit that generates a first signal when a predetermined operating condition is met and a second signal after a lapse of a predetermined time after the first signal is generated. The execution unit sets the trace for the normal execution unit based on the first signal generated by the monitoring unit, and analyzes and analyzes the trace result based on the second signal generated by the monitoring unit. A process monitoring device configured to give a result to a monitoring means, and the normal execution unit to trace its own processing based on a trace setting made by an asynchronous execution unit. 7. A monitoring method for monitoring a process, wherein reference data, which is data corresponding to an operation to be performed by the process, is stored, and operation data, which is data corresponding to the operation actually performed by the process, is collected. A process monitoring method characterized by determining whether or not an abnormality has occurred in a process by comparing the stored reference data with the collected operation data. 8. The process monitoring method according to claim 7, wherein the operating status of the process is detected, and the operation data is collected and an abnormality occurs in the process only when the detected operating status corresponds to a predetermined operating status. What is characterized by determining whether or not. 9. A computer-readable storage medium storing a computer-executable program, wherein the program realizes the apparatus or method according to any one of claims 1 to 8. Storage medium.