JPH1049219A - Fault occurrence evading device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To estimate a fault to possibly occur and automatically take a measure against the fault before it occurs by providing a fault evading means which performs an operation process based upon an evading method stored in a fault information data base while related to a fault judged by a fault judging means. SOLUTION: Observation data of respective clients which are inputted to a fault management server 8-21 are outputted to an operation state data base 1-5 on a data base server 12-25 according to a DB server specification file that a fault management server 8-21 has. The fault management server 8-21 judges the danger that a fault is about to occur on the basis of the operation state data base 1-5 and a fault information data base 1-6 that the data base server 12-25 has. When the danger of fault occurrence is judged, a client is so instructed to implement an evading method for fault occurrence which is recorded in the fault information data base 1-6 that the data base server 12-25 has.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a failure occurrence avoidance apparatus for detecting occurrence of a failure beforehand, automatically taking measures for the possible failure, and avoiding the occurrence of the failure.

[0002]

2. Description of the Related Art As a conventional example of a fault occurrence avoiding device, there is one disclosed in Japanese Patent Application Laid-Open No. 4-161823. This is to avoid the occurrence of a failure due to a mechanical cause caused by hardware such as equipment and products.
It is shown in FIG.

In FIG. 15, reference numeral 15-1 denotes equipment,
Shows production equipment. Reference numeral 15-2 denotes a monitoring unit, which is connected to the facility 15-1 and which is obtained from the facility 15-1.
5-1 Observe data such as internal temperature and dimensions of products to be produced. Reference numeral 15-4 denotes a database, which is connected to the monitoring unit 15-2 and is a pattern code based on data observed by the monitoring unit 15-2 when a trouble has occurred in the past, and a cause of the trouble found at that time. And the frequency of occurrence of the trouble are accumulated as one record. A diagnostic unit 15-3 is connected to the monitoring unit 15-2 and the database 15-4, and searches the database 15-4 using the pattern code as a search key.

Next, the operation of the conventional example shown in FIG. 15 will be described. The equipment 15-1 produces a product, for example. Then, the monitoring unit 15-2 observes the temperature inside the facility 15-1 and the dimensions of the products produced from the facility 15-1. On the other hand, the database 15-4 stores a pattern code based on data observed by the monitoring unit 15-2 when a trouble occurs, a cause of the trouble, a frequency of occurrence of the trouble, and a trouble that has occurred in the past. Are stored as one record.

[0005] The diagnosis unit 15-3 searches the database 15-4 based on the pattern code obtained from the newly observed data. At this time, database 1
When the corresponding pattern is retrieved from 5-4, the administrator is notified that a trouble is likely to occur before the corresponding trouble occurs. Then, the administrator who has received the notification performs a process for avoiding a trouble that may occur.

Another conventional example is disclosed in Japanese Patent Laid-Open No.
There is one disclosed in JP-A-7-3886. This is C
FIG. 16 shows the monitoring of whether or not a failure has occurred by observing only the data relating to the load status of the PU. In FIG. 16, reference numerals 16-1 to 16-5 denote ordinary business LAN adapters. 16-6 to 16-10 are
This is a backup LAN adapter. 16-11 to 1
Reference numeral 6-14 denotes an active CPU, which includes normal business LAN adapters 16-1 to 16-4 and backup LAN adapters 16-6 to 16-9.

For example, the working CPU 16-11 has a normal business LAN adapter 16-1 and a backup LAN adapter 16-6, and the working CPU 16-12 has a normal business LAN adapter 16-2 and a backup LAN adapter.
It has an adapter 16-7. A backup CPU 16-15 has a normal business LAN adapter 16-5 and a backup LAN adapter 16-10.

Reference numeral 16-16 denotes a normal business LAN, and a normal business LAN adapter 1 included in each of the active CPUs 16-11 to 16-14 and the backup CPU 16-15.
6-1 to 16-5 are connected. Reference numeral 16-17 denotes a backup LAN, and each of the active CPUs 16-11 to 16-16
-14 and the backup LAN adapters 16-6 to 16-10 of the backup CPU 16-15 are connected.

Next, the operation of the conventional example shown in FIG. 16 will be described. The backup CPU 16-15 transmits failure monitoring data to each of the active CPUs 16-11 to 16-14 at regular time intervals. And backup CP
U16-15 sets each working CPU 16-11 within a predetermined time.
It is determined whether or not a failure has occurred based on whether or not CPU load status information indicating the CPU load status, which is a response to the failure monitoring data, is returned from .about.16-14.
That is, if there is no response within a predetermined time, the backup CPUs 16-15 determine that a failure has occurred in the current CPU. Then, the administrator receives a notification based on this determination and performs a process for correcting the failure.

Further, another conventional example is disclosed in Japanese Unexamined Patent Publication No.
There is one disclosed in Japanese Patent Publication No. 310160. This is to estimate the spread of damage caused by the failure and to reduce the damage caused by the failure.
Shown in In FIG. 17, reference numeral 17-1 denotes an input unit, which is connected to a plurality of devices (not shown) via a network, and receives fault occurrence information output from a faulty device. Reference numeral 17-2 denotes a network configuration database in which information on the names and models of each of a plurality of devices constituting the network and connection information indicating a connection relationship between the devices are recorded.

Reference numeral 17-3 denotes a failure database, which records failure occurrence information including the contents of failures and names of failures input from the respective devices constituting the network, and information regarding the range of influence of the failures on the respective devices. You. 17-4 is an inference unit, which is a network configuration database 17-
2. Searching the network configuration database 17-2 and the failure database 17-3 connected to the failure database 17-3 and the input unit 17-1, based on the failure occurrence information input to the input unit 17-1, Predict the impact range of the failure that has occurred.

Reference numeral 17-5 denotes an output unit, which is an inference unit 17-4.
And based on the inference result by the inference unit 17-4,
Information about the affected area of the fault that has occurred is output. 1
An editor 7-6 is connected to the network configuration database 17-2 and the failure database 17-3.
It is used when correcting information recorded in the network configuration database 17-2 and the failure database 17-3.

Next, the operation of the conventional example shown in FIG. 17 will be described. The failure occurrence information output from the failed device is input to the input unit 17-1. And inference unit 1
7-4 searches the network configuration database 17-2 and the failure database 17-3 based on the failure occurrence information input to the input unit 17-1, and predicts the affected range of the occurred failure.

The information on the affected range of the fault inferred by the inference unit 17-4 is output to the output unit 17-5. Then, the administrator performs a process for correcting the fault that has occurred based on the information regarding the affected range of the fault output to the output unit 17-5. The network configuration database 17-
When correcting information recorded in the failure database 17-3 and the failure database 17-3, new information is input from the editor 17-6.

[0015]

SUMMARY OF THE INVENTION FIG.
In the conventional fault occurrence avoiding device disclosed in Japanese Patent No. 61823, a pattern in which a fault occurs is created from mechanical data such as the internal temperature of equipment and dimensions of a product, and the created pattern and observed data are created. And the occurrence of a failure was detected beforehand.

However, in this conventional apparatus, a configuration for avoiding a failure due to a mechanical cause due to hardware such as equipment or a product is disclosed, but a failure due to a functional cause due to software for operating the equipment is disclosed. Was unable to respond.

In other words, in the conventional fault occurrence avoiding device, no countermeasures are taken against a fault caused by software, and the occurrence of a fault caused by software cannot be avoided. . Further, in the conventional fault occurrence avoiding device, even if the occurrence of the fault is detected beforehand, the fault is dealt with by a human, and the action is taken after the fault occurs. It was difficult to use it for continuous operation.

FIG. 16 shows an example of Japanese Patent Application Laid-Open No. 6-17-3886.
In another fault occurrence avoiding device disclosed in Japanese Patent Application Laid-Open No. H10-157, only a single piece of data, that is, information relating to the load status of a CPU is observed to determine a fault. However, a failure that actually occurs often involves a plurality of elements.

That is, it is difficult to determine a fault that has occurred only by observing a certain element, and it is difficult to take measures corresponding to the fault that has occurred. Also, in the conventional fault occurrence avoiding device, when the occurrence of a fault is detected beforehand, a measure for the fault caused by a human is performed, and the action is performed after the fault has occurred. However, it is difficult to use such a device for continuous operation.

[0020] Further, FIG.
In another failure occurrence avoidance device disclosed in the publication, after a certain failure has occurred, information on a range that is considered to be damaged by the certain failure is shown. The failure occurrence avoidance device is started only after a failure has occurred, and informs an administrator of the device so that the failure does not increase.

In the fault occurrence avoiding device, an administrator of the device takes action for the fault that has occurred. Therefore, in order to suppress the spread of the damage caused by the occurred failure and to promptly deal with the occurred failure, the administrator of the failure prevention device needs to have a great deal of knowledge, and The burden was very heavy. In addition, administrator actions are taken after a failure occurs,
It has been difficult to use such a device for continuous operation such as an industrial computer.

The present invention has been made in view of these problems, and observes a plurality of items so as to avoid occurrence of a failure due to software of a failure occurrence avoiding device.
It is an object of the present invention to obtain a failure occurrence avoidance device that estimates a possible failure and automatically performs a measure for the failure before the failure occurs. Also, the present invention provides a method in which one server is connected to a LAN.
Observation of multiple items so as to avoid the occurrence of failures of multiple clients connected via, estimating possible failures, and automatically taking action against the failures before they occur The aim is to obtain a device.

[0023]

A fault occurrence avoiding device according to the present invention is connected to an operation status observing device for observing the operation status of a plurality of elements, and the observation data observed by the operation status observing device. And a failure information database and an operation status database that record the failure in association with a failure, a trend of the operation status of a plurality of elements that cause the failure, and an avoidance method for avoiding the occurrence of the failure. A failure determination unit connected to the failure information database, comparing the observation data recorded in the operation status database with the tendency of the operation status recorded in the failure information database, and determining a failure related to the operation status; The failure information database is connected to the determination means and the failure information database, and is associated with the failure determined by the failure determination means. Failure avoidance means for performing an operation processing based on the workaround recorded in the over scan, but with a.

Further, the fault occurrence avoiding apparatus according to the present invention observes operation states of a plurality of elements, outputs operation data obtained by observation, and an operation processing instruction inputted. A first computer having failure avoidance means for performing a failure avoidance process based on the operation state database in which observation data output from the operation state observation means of the first computer is inputted and recorded; and A failure information database in which the operation status trends of a plurality of elements causing the failure and an avoidance method for avoiding the occurrence of the failure are recorded in association with each other, and the operation status database and the failure information database are connected to each other. The recorded observation data is compared with the trends in the operating status recorded in the fault information database to determine faults related to the operating status. And a failure determination unit that outputs an operation processing instruction for performing an operation process based on the avoidance method recorded in the failure information database in association with the failure to the failure avoidance unit of the first computer. A second computer.

Further, in the fault occurrence avoiding device according to the present invention, the plurality of elements observed by the operation status observing means are a plurality of elements set in the configuration file.

Further, the fault occurrence avoiding device according to the present invention is connected to an operation status database, and extracts operation data indicating a tendency of a predetermined operation status from the observation data recorded in the operation status database. When,
It is connected to the operation abnormality search means and the failure information database, and records in the failure information database the observation data extracted by the operation abnormality search means, the failure indicating a tendency of a predetermined operation situation, and the avoidance method for avoiding the failure in association with each other. Failure information creating means.

Further, in the fault occurrence avoiding device according to the present invention, the observation data extracted by the operation abnormality search means is a plurality of elements set in the search specification file.

[0028]

BEST MODE FOR CARRYING OUT THE INVENTION

Embodiment 1 of the Invention FIG. 1 shows an embodiment of a failure occurrence avoiding device according to the present invention. In FIG. 1, reference numeral 1-1 denotes an operation status monitoring unit which is an operation status observation means, and observes the operation status. Reference numeral 1-5 denotes an operation status database which is connected to the operation status monitoring unit 1-1 and records observation data including a plurality of elements based on the observation result by the operation status monitoring unit 1-1.

Reference numeral 1-6 denotes a failure information database in which a failure pattern, which is a tendency of an operation status relating to a failure that has occurred in the past, is recorded. In the failure pattern recorded in the failure information database 1-6, observation data for a predetermined period is recorded for a plurality of observation items until a certain failure occurs.

Reference numeral 1-4 denotes a failure processing management unit which is a failure determination means and a failure avoidance means.
5 is connected to the failure information database 1-6 and the observation data recorded in the operation status database 1-5 applies to the failure pattern recorded in the failure information database 1-6, and whether or not a certain failure is occurring Is determined.

An operation abnormality search unit 1-2 is connected to the operation status database 1-5. Operation abnormality search unit 1-
2 indicates a case where the failure processing management unit 1-4 shows the same tendency of the detection data as that at the time of occurrence of the failure, and when it is determined that there is a possibility of occurrence of the failure, the predetermined data recorded in the operation status database 1-5 Search observation data.

Reference numeral 1-3 denotes a fault information generating unit which is an operation error detecting means and a fault information generating means.
-2, the observation data searched by the operation abnormality search unit 1-2 is input, and a new failure pattern is created. 1
-7 is a fault occurrence avoiding device, which is an operation status monitoring unit 1-
1. Operation status database 1-5, failure information database 1-6, failure processing management unit 1-4, operation abnormality search unit 1
2 and a fault information creation unit 1-3.

Next, the first embodiment of the present invention shown in FIG.
The operation of the failure occurrence avoiding device will be described with reference to FIG. In FIG. 2, step (hereinafter abbreviated as S) 1
Then, the failure occurrence avoidance device is activated. When S1 ends, the process proceeds to S2.

At S2, the operation status monitoring section 1-1 checks the configuration file set for the items observed by the operation status monitoring section 1-1. Then, based on the confirmed configuration file, the operation status monitoring unit 1-1 periodically checks the CPU load, the memory load,
Observe the network load, operation process, etc., and store the obtained observation data in the operation status database 1-
Record in 5.

It is assumed that a failure has occurred in S3. Note that S2 is repeatedly performed unless a failure occurs. Also,
When S3 ends, the process proceeds to S4. In S4, the operation abnormality search unit 1-2 reads the observation data for a predetermined period up to the time of occurrence of the failure from the observation data recorded in the operation status database 1-5, and reads the failure information creation unit 1-3. Output to

Then, the failure data creation unit 1-3 receives the observation data output from the operation abnormality search unit 1-2. The failure information creating unit 1-3 to which the observation data is input,
The predetermined observation data is extracted from the input observation data based on a search specification file in which predetermined conditions for determining the cause of the generated failure are set.

The fault information creating unit 1-3 associates the extracted observation data with the fault that has occurred, and records the obtained information as one fault pattern in the fault information database 1-6. When S4 ends, the process proceeds to S5. S
In step 5, the failure information creation unit 1-3 further associates the information on the avoidance method for the failure with the failure pattern recorded in the failure information database 1-6. When S5 ends, the process proceeds to S6.

In S6, the operation status monitoring unit 1-1 checks the configuration file as in S2. Then, the operation status monitoring unit 1-1 periodically observes the CPU load, the memory load, the network load, the operation process, and the like based on the confirmed configuration file, and stores the obtained observation data in the operation status database 1. Record at -5. When S6 ends, the process proceeds to S7.

In S7, the fault processing management unit 1-4 determines the same tendency as the tendency of the observation data at the time of occurrence of the fault indicated by the fault pattern recorded in the fault information database 1-6. It is confirmed whether or not it can be found in the observation data newly recorded in the database 1-5. At this time, the failure status management unit 1-4 operates the operation status database 1
If it is not determined that the observation data newly recorded in -5 has a tendency to indicate when a failure occurs, the process proceeds to S8.

At this time, if the failure processing management unit 1-4 determines that the observation data newly recorded in the operation status database 1-5 has a tendency to be seen when a failure occurs, the process proceeds to S10. Proceed to. In S8, the failure processing management unit 1-4 determines whether or not a failure is likely to occur in a new failure pattern that is different from the existing failure pattern but that is similar in operation status. At this time, if no failure has occurred in the new failure pattern, the process returns to S7. At this time, if a failure is likely to occur in a new failure pattern, the process proceeds to S9.

It is assumed that a failure of a new failure pattern has occurred in S9. When a failure of this new failure pattern occurs, the process returns to S4, and the observation data for a predetermined period from the observation data recorded in the operation status database 1-5 to the point in time when the new tendency of failure occurrence is observed is obtained. The predetermined observation data is extracted based on the search specification file which is read and the predetermined condition is set, and a failure indicating a tendency of a similar operation situation and a method of avoiding the failure are associated with each other, and the failure information is set as a new failure pattern. Database 1
Record at -6.

In S10, the fault processing management unit 1-4 compares the tendency of the observation data similar to the past observation data indicated by the fault pattern recorded in the fault information database 1-6 with the operation status database. If it is detected from the latest observation data recorded in 1-5, the failure processing management unit 1
-4 performs the avoidance method recorded in association with the failure pattern recorded in the failure information database 1-6.

The avoidance method recorded in association with the failure pattern is determined based on a combination of the situations of a plurality of items constituting the observation data. When S10 ends, the process proceeds to S11. In S11, the operation abnormality search unit 1-
2 extracts the observation data for a predetermined period recorded in the operation status database 1-5 and outputs it to the fault information creation unit 1-3. Then, the fault information creation unit 1-3 to which the observation data extracted from the operation status database 1-5 is input.
Performs the same processing as in S4, and creates a new failure pattern based on the input observation data.

When S11 ends, the process proceeds to S12. S1
In 2, the existing failure pattern recorded in the failure information database 1-6 is compared with the failure pattern for the same failure newly created in S11. And
The characteristic part common to these two failure patterns is extracted, a more characteristic new failure pattern is created,
The existing failure pattern recorded in the failure information database 1-6 is updated. When S12 ends, the process returns to S5.

If the failure information database 1-6 already has a failure pattern relating to the failure when the failure occurrence avoiding device is activated in S1, the processing of S2 to S5 may be omitted.

Next, the configuration file used in S2 of FIG. 2 will be described with reference to FIG.
In the configuration file, observation data observed by the operation status monitoring unit 1-1 of the failure occurrence avoiding apparatus, and conditions such as timing of observing the observation data are set. The conditions set in this configuration file are expressed in three types of formats.

The three types of formats include “character string: alphabetic character (y / n)” (3-2) set with a character string and alphabetic characters, and “character string” (3) set only with a character string. -1) and "character string (TIME):
Numerals: English letters (D / H / M / S) "(3-3). In the first format “character string: English character (y / n)” set in the configuration file, it is set whether or not to record observation data relating to the specified character string in the operation status database 1-5. Things.

The character strings set in the configuration file include CPU, MEMORY, COLLI
There are four types: SION and PROCESS. The CPU
This is a command for instructing to obtain observation data on the load status of the CPU. MEMORY is a command for instructing to obtain observation data on the load status of the memory.

"COLLISION" is a command for instructing to obtain observation data on the load status of the network. PROCESS is a command for instructing to obtain observation data on an operation process which is an operation process being executed. The alphabetic character shown on the right side of each character string with a colon (:) indicates whether or not to record the observation result obtained based on the command indicated by each character string in the operation status database 1-5. It is specified.

On the right side of each command with a colon between them,
When the letter y is specified, the observation result obtained based on each command is recorded in the operation status database 1-5. Also, with a colon between them, on the right side of each command,
When the letter n is specified, the observation result obtained based on each command is not recorded in the operation status database 1-5. The "character string", which is the second format set in the configuration file, is recognized by the failure occurrence avoiding device as the set character string itself as a command.

The failure avoidance device obtains observation data based on the command. And the failure occurrence avoiding device is
The obtained observation data is recorded in the operation status database 1-5. The command set in the second format can be created by the user of the failure occurrence avoidance apparatus. When a user of the failure occurrence avoidance device needs detailed observation data for an element that is likely to cause a failure, a command based on this character string can be used to generate a predetermined command. Observation data based on is obtained.

The third format "character string (TIME): numeral: alphabetic character (D / H / M / S)" set in the configuration file is set in the first and second formats. A time interval for recording observation data obtained from the operation status monitoring unit 1-1 of the failure occurrence avoiding device in the operation status database 1-5 for the observation item is set.

An instruction, which is a command set in the third format, is composed of three blocks. The "character string", which is the first block set in the third format, indicates that a predetermined observation item is to be observed at a predetermined period, "TIM
E ”is set. In the“ numerals ”, which is the second block set in the third format, the observation data obtained by the operation status monitoring unit 1-1 is stored several times in a predetermined period. Whether to record in the operation status database 1-5 is set. Third
The unit of time for observing the observation data is set in the “alphabet”, which is the third block set in the format described above.

The unit of the observation time set in the third format is D indicating “1 day”, H indicating “1 hour”,
There are four types, M indicating “1 minute” and S indicating “1 second”. For example, when “TIME: 1: H” is set in the configuration file, “TIME: 1: H”
Is issued by the fault avoidance device once an hour.
And that the observation data relating to the observation item specified in the second format is recorded in the operation status database 1-5.

Next, FIG. 4 shows a modification of the configuration file shown in FIG. 3 to which more set conditions are added so as to obtain more detailed observation data, which will be described below. In the configuration file shown in FIG. 4, a period for storing observation data obtained by observation by the failure occurrence avoiding device in the operation status database 1-5 can be set. In the configuration file shown in FIG. 4, the amount of observation data obtained by observation by the failure occurrence avoidance device recorded in the operation status database 1-5 can be controlled temporally or quantitatively.

The configuration file in FIG. 4 has three types of formats to be set. A command that is a condition is set in these three types of formats. The first format is “numerical string A: numeric string B: character string: alphabetic character (y / n)”.
(4-1) is to set whether or not the command based on the character string is executed during the period indicated by the numeral string A and the numeral string B.

The second format is “numerical string A: numeric string B: character string” (4-3), and a command based on the character string is performed during the period indicated by numeric string A and numeric string B. Is to be enforced. The third format is similar to the “third format in FIG. 3,“ character string: number: character (D / H / M / S) ”(4-
2).

The first format "numerical string A: numeric string B: character string: alphabetic character" (4-1) is obtained by adding an observation corresponding to numeric string A to the command shown in the format (3-2) of FIG. The setting for the time at which the recording of the observed data is started and the time at which the recording of the observed data, which is the numeric string B, is ended are added.

The format "numerical string A: numeric string B: character string" (4-3) is a numeric string A in the command shown in the first format (3-1) of FIG. The setting for the time at which the recording of the observation data is started and the time at which the recording of the observation data, which is the numeric string B, is ended are added. Note that the numeric string A and the numeric string B are composed of five elements. The five elements are "minute, hour, day / day of the week, month, year", and are set in the order described.

For example, the parts of the numeric string A and the numeric string B are extracted from the equations (1) to (6) in FIG. 4, and the meaning of the commands in those parts will be described below. Note that “*” indicates “optional”. Expression (1) "* * * * *: *
The part of “***” means “always”. The part of “00 09 * * *: 00 17 * * *” in the equation (2) means “every day from 9:00 to 17:00”. The part of “00 09 Mo **: 00 17 Fr **” in equation (3) means “from 9:00 to 17:00 every Monday to Friday”.

Equation (4) “** Mo **: ** Fr *
The part “*” means “every Monday to Friday”. The part of “* Mo 04 95: ** Fr 07 95” in the equation (5) means “every Monday to Friday from April 1995 to July 1995”. "00 09 03 05 95: 3" in equation (6)
The part “0 18 25 12 96” means “from 9:00 to 18:30 from 3rd to 25th of every month from May 1995 to December 1996”.

Further, the third format "character string: number: alphabetic character" (4-2) is the same as that described in the third format (3-3) of FIG. In addition, the third format (4-
In 2), the character string that is the first block is “SAVE”
The case where is added. When “SAVE” is set in the character string that is the first block, the failure occurrence avoiding device limits the observation data stored in the operation status database 1-5 in terms of period or quantity.

A numeral is set in the numeral which is the second block. Further, an alphabetic character (Y, M, n) is set for the alphabetic character which is the third block. The alphabetic characters set in the third block indicate a period during which observation data is stored in the operation status database 1-5, where "Y" indicates one year and "M" indicates one month. In addition, when it is desired to limit the observation data recorded in the operation status database 1-5 quantitatively instead of limiting it periodically, an alphabetic character “n” is set in the third block. Then, a predetermined number of observation data is recorded in the operation status database 1-5.

When the alphabet “n” is set in the third block, the period for storing the observation data is not limited, and the observation data is stored in the operation status database 1-5 by the number set in the second block. Be recorded. If the letter “n” is set in the third block and the number of observation data set in the second block has already been recorded in the operation status database 1-5, the newly observed observation data is Replacement of old observation data, operation status database 1
5 is recorded.

For example, if “SAVE: 1: Y” is set in the configuration file, “SAVE: 1: Y”
1: Y "means that" observation data up to one year ago is recorded in the operation status database 1-5 ". Observation data before that is deleted.

For example, when “SAVE: 10000: n” is set in the configuration file,
“SAVE: 10000: n” means “record 10,000 observation data in the operation status database”. It should be noted that 10,000 observation data are recorded in the operation status database 1-5, and the observation data of more than 10000 are deleted in the oldest order.

Next, the search designation file used in S4 of FIG. 2 will be described with reference to FIG. In the search specification file, conditions for searching characteristic observation data from the observation data retrieved by the operation abnormality retrieval unit 1-2 from the operation status database 1-5 are set. The condition set in the search designation file is indicated by a format “character string: number: character” (5-1) composed of three blocks of “character string”, “number”, and “character”.

In the first block, items to be searched are shown. For example, when “DATA” is indicated in the character string, it indicates that observation data for a predetermined period is to be searched. Further, for example, when "DEVATION" is indicated in the character string, it indicates that observation data satisfying a predetermined standard deviation is searched. Further, for example, when "DELETE" is indicated in the character string, it indicates that the observation data satisfying a predetermined inclination is searched based on the observation data arranged in time series.

In the number of the second block constituting the condition set in the search designation file, a number used to form a predetermined condition for the character string of the first block is set. For the characters of the third block constituting the conditions set in the search specification file, the period and range in which the observation data is searched are set based on the character string of the first block.

For example, when "DATA" indicating that observation data for a predetermined period is searched is set in the first block, the third block is a time range of the observation data to be searched. The character that sets the period is set.
There are five types of characters set in this third block,
The five types are “Y” indicating “year”, “M” indicating “month”, “W” indicating “week”, “D” indicating “day”, and “H” indicating “time”. 5 types.

"DATA: 1: W" in the search specification file
Is set, the conditional sentence “DATA: 1: W” indicates that “search for observation data within one week”. For example, in the first block, "DEV" indicating that observation data satisfying a predetermined standard deviation is searched.
In the case where "IATION" or "DELTA" indicating that observation data satisfying a predetermined inclination is searched based on observation data arranged in time series is set, the third block is set to the second block. A character indicating a predetermined range is set based on the numeral.

There are three types of characters set in the third block, B, S, and E, where B is BIG for "more than", S is SMALL for "less", and E is "equal". ".

In the search specification file, "DEVIATIO"
N: 60: B ”, this“ DEVIAT ”
The condition statement “ION: 60: B” indicates that “standard deviation is 60
Search the above observation data. " When “DELTA: | 2 |: B” is set in the search specification file, the conditional statement “DELTA: | 2 |: B” indicates that the absolute value of the slope of the observation data shown in time series is Search for two or more observation data. "

Next, the operation status database 1 shown in FIG.
The conceptual diagram of -5 will be described with reference to FIG. As shown in FIG. 6, the operation status database 1-5 records observation data such as CPU load, memory load, network load, operation process, and disk capacity for each time.

6-1 is an observation item list, which shows a plurality of observation items recorded in the operation status database 1-5. Note that the observation items shown in the observation item list 6-1 change based on the contents of the configuration file set in the failure occurrence avoidance device.

The observation items composed of a plurality of observation data such as the operation process and disk capacity are recorded in a table different from the observation item list 6-1. In FIG. 6, observation data on the operation process is recorded in the table 6-2. Further, the observation data regarding the disk capacity is recorded in the table 6-3. In the column of the operation process, the disk capacity, and the like in the observation item list 6-1, a separately provided table 6-2,
The address of 6-3 is recorded.

Next, the fault information database 1 shown in FIG.
The conceptual diagram of -6 will be described with reference to FIG. As shown in FIG. 7, the failure information database 1-6 stores conditions,
The details of the failure and the processing are recorded.

A plurality of processing contents may be set as the processing contents for the failure contents. Reference numeral 7-1 denotes a failure pattern list, which is the failure content recorded in the failure information database 1-6, conditions indicating characteristics of each observation item when the failure occurs, and information for avoiding the occurrence of the failure. The processing contents indicated by the processing means are shown.

The details of the failure and the processing contents of the failure are recorded in a table different from the failure pattern list 7-1. The failure content is recorded in the table 7-2. The processing contents of the failure are recorded in the table 7-3.

In the column of failure contents and processing contents of the failure pattern list 7-1, a separately provided table 7-
2, 7-3 addresses are recorded. In addition, the user can freely add, delete, and change the processing contents set in the processing table 7-3.

As described above, the fault occurrence avoiding apparatus according to the first embodiment of the present invention shown in FIG. 1 includes an operation status monitoring unit 1-1, an operation status database 1-5, a fault information database 1-6,
The system includes a failure processing management unit 1-4, an operation abnormality search unit 1-2, and a failure information creation unit 1-3.

In the fault occurrence avoiding device, the operation status monitoring unit 1-1 periodically checks the CPU load, the memory load, the network load, the operation process, and the like based on the configuration file set. The observation and the obtained observation data are recorded in the operation status database 1-5.

Then, the failure processing management section 1-4 stores the observation data recorded in the operation status database 1-5 and the observation data indicated in the failure pattern relating to the occurrence of the failure recorded in the failure information database 1-6. It is determined whether or not a similar tendency is found with the tendency.

At this time, when the failure processing management unit 1-4 finds a tendency regarding the occurrence of a failure from the observation data recorded in the operation status database 1-5, the failure processing management unit 1-4
4 executes a method of avoiding a possible failure indicated by the failure pattern recorded in the failure information database 1-6.

If the failure processing management section 1-4 determines that a failure may occur, the operation abnormality search section 1-2 searches the operation data stored in the operation situation database 1-5 for a predetermined period. Read the observation data of.

Then, based on the search specification file, the failure information creating unit 1-3 uses the observation data read by the operation abnormality search unit 1-2 to determine the observation data that matches a predetermined condition for determining the cause of the failure. Is extracted.

Further, the fault information creating unit 1-3 creates a new fault pattern by associating the extracted observation data, the fault, and a method of avoiding the fault with each other. The newly created failure pattern is stored in the failure information database 1
-6 is compared with the existing failure pattern recorded in
A characteristic failure pattern created based on characteristic parts common to these two failure patterns is created and recorded in the failure information database 1-6.

As described above, the operation status monitoring unit 1-1 sets the CP based on the configuration file set.
In order to observe the load of U, memory load, network load, operation process, etc., even if a failure is likely to occur in the software started in the equipment monitored by the failure avoidance device, the failure occurrence is anticipated. Can be avoided.

When a fault that can occur is detected in the fault processing management unit 1-4, the fault information database 1-
The avoidance method associated with the failure pattern recorded in 6 is automatically executed and can be used for those requiring continuous operation such as an industrial computer.

Further, when a fault that can occur is detected by the fault processing management unit 1-4, a measure for avoiding the possible fault is recorded in the fault information database 1-6. Is also performed by the failure occurrence avoidance device itself, so that the administrator of the failure occurrence avoidance device can focus on thinking about a method of dealing with a newly generated failure, and the burden on the administrator of the failure occurrence avoidance device Can be lightened.

The observation items observed by the fault occurrence avoiding device can be changed by setting the configuration file, so that the items considered appropriate for detecting the occurrence of a fault are changed sequentially. And a detailed response to the occurrence of a failure becomes possible.

Further, the observation items observed by the fault occurrence avoiding device can be set in the configuration file by setting a command independently, so that it is considered appropriate to detect the occurrence of a fault beforehand. Items can be sequentially set, and detailed responses to the occurrence of failures can be made.

When the failure avoidance device determines the risk of occurrence of a failure, the failure occurrence avoidance device refers to a search designation file, and the change amount of observation data is set in the search designation file. . For this reason, the fault occurrence avoiding device can cope with a change in the equipment to be observed or the like, and can take a measure according to the change.

Embodiment 2 of the Invention Next, another embodiment of the present invention will be described with reference to FIG. The second embodiment shown in FIG. 8 is a failure avoidance device configured by connecting a plurality of computers via a LAN cable, and one of the plurality of computers constituting the failure occurrence avoidance device includes:
It has a failure information database 1-6 necessary to determine the occurrence of a failure, and monitors the occurrence of a failure that can occur in all computers connected to the LAN cable.

In FIG. 8, reference numeral 8-20 denotes a failure management unit, which includes an operation status monitoring unit 1-1, an operation abnormality search unit 1-2, a failure information creation unit 1-3, and a failure processing management unit 1-4. Be composed. Reference numeral 8-7 denotes a failure management communication unit, which is connected to the failure management unit 8-20. Reference numeral 8-21 denotes a failure management server, which is hostA, and includes a failure management unit 8-20, an operation status database 1-5, a failure information database 1-6, and a failure management communication unit 8-7.

Reference numeral 8-10 denotes a second operation status database. Reference numeral 8-9 denotes a second fault management unit, which is connected to the second operation status database 8-10. 8-8 is
A second fault management communication unit, which is a second fault management unit 8-9
Connected to. 8-22 is a first client which is hostB, and a second operation status database 8-10,
Second failure management unit 8-9 and second failure communication management unit 8
-8.

Reference numeral 8-13 denotes a third operation status database. Reference numeral 8-12 denotes a third failure management unit, which is connected to the third operation status database 8-13. 8-11
Is a third fault management communication unit, and the third fault management unit 8
-12. Reference numeral 8-23 denotes a second client, which is hostC, and a third operation status database 8-23.
13, a third failure management unit 8-12, and a third failure management communication unit 8-11.

The fault management communication unit 8-7 of the fault management server 8-21, the second fault management communication unit 8-8 of the first client 8-22, and the second client 8
The third fault management communication unit 8-11 included in -23 is connected by a LAN cable 8-24 to form one network. In FIG. 8, the same or corresponding parts as those in the embodiment shown in FIG. 1 are denoted by the same reference numerals, and the description thereof will be omitted, and the parts different from FIG. 1 will be described.

When a plurality of computers are connected by a LAN cable to constitute a failure avoidance apparatus as in the second embodiment, each computer is provided with a management server designation file 9-.
1 or a failure target designation file 9-2.

These two files will be described with reference to FIG. The failure management server 8-21 is specified in the management server specification file 9-1. The computer that has this file is the client. The clients 8-22 and 8-23 are specified in the failure target specification file 9-2. The computer having this file becomes the fault management server.

The server designation file 9-1 is possessed by each of the clients 8-22 to 8-23, and the name of the fault management server 8-21 is set in this file. The fault management server 8-21 set in the server specification file 9-1
Is basically one.

The failure target designation file 9-2 is included in the failure management server 8-21. This file contains the client 8-2 managed by the fault management server 8-21.
2 to 8-23 are set. The number of clients set in the failure target specification file 9-2 may be one or more.

Each of the clients 8-22 to 8-23 confirms the failure management server 8-21 by looking at the server specification file 9-1 of each of the clients 8-22 to 8-23. Further, the failure management server 8-21 looks at the failure target designation file 9-2 of the failure management server 8-21, and
Check the clients 8-22 to 8-23.

Each client 8-22 to 8-23
The failure management server 8-21 specified in the server specification file 9-1 of the client and the clients 8-22 to 8-23 specified in the failure target specification file 9-2 of the failure management server 8-21 When this is the case, a failure occurrence avoidance device is configured, and the failure management server 8-21 manages the occurrence of a failure for the clients 8-22 to 8-23.

The failure management server 8-21 specified in the server specification file 9-1 of each of the clients 8-22 to 8-23 and the failure target specification file 9-2 included in the failure management server 8-21 are specified. Each client 8-
When 22 to 8-23 do not correspond, the failure occurrence avoiding device is not configured, and the occurrence of the failure is not managed.

Next, the operation of the second embodiment shown in FIG. 8 will be described with reference to FIG. First, the failure management server 8-21 in FIG. 10 starts the failure management server 8-21 in step (hereinafter abbreviated as A) 1. A
When 1 is completed, the process proceeds to A2.

In A2, the fault management server 8-21 determines the same tendency as the observation data when the fault indicated by the fault pattern recorded in the fault information database 1-6 occurs in the operation status database. In 1-5, it is confirmed whether or not it can be found in the newly recorded observation data output from each of the clients 8-22 to 8-23.

At this time, if the failure management server 8-21 does not determine that the observation data newly recorded in the operation status database 1-5 is likely to appear when a failure occurs, the process of A2 is performed. Repeated.

At this time, if the fault management server 8-21 determines that the observation data newly recorded in the operation status database 1-5 tends to appear when a fault occurs, the process proceeds to A3.

At A3, the failure management server 8-21 compares the tendency of the observation data similar to the past observation data indicated by the failure pattern recorded in the failure information database 1-6 with the operation status database 1 If the failure is detected from the latest observation data recorded in -5, the fault management server 8
-21 is a client 8 that outputs the observation data so as to perform the avoidance method recorded in association with the failure pattern recorded in the failure information database 1-6.
-22 to 8-23. When A3 ends, the process proceeds to A4.

At A4, the failure management server 8-21 transmits the operation status database 1- 1 of the client in which a tendency similar to the tendency of the observation data indicated by the failure pattern recorded in the failure information database 1-6 is detected. From 5, the observation data for a predetermined period is read. Then, the failure management server 8-21 extracts the observation data based on the search designation file from the read observation data, and newly creates a failure pattern.

Further, the fault management server 8-21 compares the newly created fault pattern and the fault pattern already recorded in the fault information database 1-6 for the same fault occurrence, and A characteristic part common to the patterns is extracted, a more characteristic new failure pattern is created, and recorded in the failure information database 1-6.

Further, the fault management server 8-21 also records a related avoidance method in the fault pattern newly recorded in the fault information database 1-6. When A4 ends, the process returns to A2.

Next, the operation of the client shown in FIG. 10 will be described. In step (hereinafter abbreviated as B) 1, the client is activated. When B1 ends, the process proceeds to B2. In B2, the client checks the set configuration file.

The client periodically records observation data such as CPU load, memory load, network load, and operation process in the operation status database 1-5 of the client based on the confirmed configuration file. I do. When B2 ends, B
Proceed to 3.

In B3, the client periodically transmits the observation data recorded in the operation status database 1-5 of the client to the failure management server 8-21 from the failure management unit of each client via the failure management communication unit. Output to It should be noted that the client sends the failure management server 8-2
The information output to 1 is the fault management server 8-2 until then.
Only the observation data updated in the operation status database of the client, excluding the observation data transmitted to 1, may be transmitted. When B3 ends, the process proceeds to B4.

At B4, the client determines whether the observation data regarding the client transmitted to the failure management server 8-21 corresponds to the failure pattern recorded in the failure information database 1-6 of the failure management server 8-21. It is informed whether or not. When it is determined that a failure is occurring in the client, the process proceeds to B5. If it is not determined that a failure is occurring in the client, the process proceeds to B2.

In B5, the client whose failure is judged to be occurring by the failure management server 8-21 executes the failure avoidance method instructed by the failure management server 8-21. When B5 ends, the process returns to B2.

Next, an operation when a failure of a new failure pattern not registered in the failure information database 1-6 occurs in the client constituting the second embodiment shown in FIG. 8 will be described with reference to FIG. Will be explained. First, it is assumed that a new failure not recorded in the failure information database 1-6 has occurred on the client side. this,
Step (hereinafter abbreviated as C) 1 is assumed. When C1 ends, the process proceeds to C2.

At C2, the client outputs information on the fault that has occurred and the time at which the fault has occurred to the fault management server 8-21. When C2 ends, the process proceeds to C3. In C3, the setting of the avoidance method for the fault that occurred
A selection is made as to whether or not the administrator of the failure occurrence avoidance device sets. When the administrator of the failure occurrence avoidance apparatus sets an avoidance method for the occurred failure, the process proceeds to C4.

If the administrator of the failure occurrence avoidance apparatus does not set an avoidance method for the failure, the C5
Proceed to. At C4, the client notifies the failure management server 8-21 of the avoidance method for the occurred failure based on the setting at C3. When C4 ends, the process proceeds to C5.
At C5, the client performs the processing after B2 shown in FIG.

Next, the fault management server 8-21 in FIG.
The operation on the side will be described. In step (hereinafter abbreviated as D) 1, the failure management server 8-21 receives the contents of the failure output from the client and information on the time of occurrence of the failure. When D1 ends, the process proceeds to D2.

At D2, the failure management server 8-21 transmits the information input from the client to the failure management server 8-2.
1 is recorded in the failure information database 1-6. D
When 2 is completed, the process proceeds to D3.

At D3, the fault management server 8-21 determines the operating status of the client for a predetermined period until a fault occurs based on the information on the fault occurrence time included in the information input from the client. Obtained from the operating status database of the client where the error occurred. When D3 ends, the process proceeds to D4.

At D4, the fault that occurred in the client is
It is determined whether the failure is already recorded in the failure information database 1-6, but has a different tendency in the operation status until the failure occurs.

The failure that has occurred in the client is a failure that has already been recorded in the failure information database 1-6, but if the tendency of the operating status up to the failure is different, the process proceeds to D4-1. If the failure that has occurred in the client is a failure that has already been recorded in the failure information database 1-6, but the tendency of the operating status up to the failure is not different, the process proceeds to D4-2.

In D4-1, the fault management server 8-21
Records the failures already recorded in the failure information database 1-6, the method of avoiding the failures, and the tendency of the operating status of the occurred client in the failure information database 1-6. When D4-1 ends, the process proceeds to D5.

In D4-2, the fault management server 8-21
Records in the failure information database 1-6 the association between the method of avoiding the failure input from the client and the tendency of the operating status of the failed client. When D4-2 is completed, the process proceeds to D5. In D5, the failure management server 8-21 performs the processing after A2 shown in FIG.

As described above, the fault occurrence avoiding apparatus according to the second embodiment of the present invention shown in FIG. 8 includes the fault management server 8-21, the first client 8-22, and the second client 8-22.
23 are connected to each other by a LAN 8-24. The failure management server 8-21 includes a failure management unit 8-20,
Operation status database 1-5, failure information database 1
-6, and a fault management communication unit 8-7.

The first client 8-22 includes a second operation status database 8-10, a second fault management unit 8-
9 and a second fault communication management unit 8-8.
The second client 8-23 includes a third operation status database 8-13, a third fault management unit 8-12, and a third fault management communication unit 8-11.

The failure management unit 8-20, the second failure management unit 8-9, and the third failure management unit 8-12 are composed of an operation status monitoring unit 1-1, an operation abnormality search unit 1-2, It comprises a failure information creation unit 1-3 and a failure processing management unit 1-4.
Further, the failure management communication unit 8-7 and the second failure management communication unit 8
-8 and the third fault management communication unit 8-11 are connected by a LAN cable 8-24.

In the fault occurrence avoiding device, the clients 8-22 to 8-23 periodically determine the load on the CPU based on the configuration file set.
The load on the memory, the load on the network, the operation process, and the like are observed, and the obtained observation data is recorded in the operation status database 1-5 of the failure management server 8-21.

Then, the fault processing management section 1-4 of the fault management server 8-21 includes the observation data recorded in the operation status database 1-5 of the fault management server 8-21 and the fault information database 1-6. It is determined whether or not a similar tendency is observed with the tendency of the observation data indicated in the failure pattern related to the occurrence of the failure recorded in the above.

At this time, if the failure processing management section 1-4 of the failure management server 8-21 finds a tendency regarding the occurrence of a failure from the observation data recorded in the operation status database 1-5, the failure management server 8-21. Failure management unit 1-4
Commands the client to execute a method for avoiding a possible failure indicated by the failure pattern recorded in the failure information database 1-6.

The client instructed to execute the avoidance method for a failure that may occur from the failure management server 8-21 executes the instructed avoidance method. When the failure processing management unit 1-4 of the failure management server 8-21 determines that a failure can occur, the operation abnormality search unit 1-2 uses the observation data recorded in the operation status database 1-5 to determine , And reads the observation data for a predetermined period.

Then, based on the search specification file, the fault information creating unit 1-3 uses the observation data read by the operation abnormality search unit 1-2 to determine the observation data that matches a predetermined condition for determining the cause of the fault. Is extracted. Further, the fault information creating unit 1-3 creates a new fault pattern by associating the extracted observation data, the fault, and a method of avoiding the fault with each other.

The newly created fault pattern is compared with an existing fault pattern recorded in the fault information database 1-6, and a feature created based on a characteristic part common to these two fault patterns. A typical failure pattern is created and recorded in the failure information database 1-6.

Thus, each of the clients 8-22 to 8-8
The equipment monitored by the fault occurrence avoiding device to observe the CPU load, the memory load, the network load, the operation process, and the like based on the configuration file set by the operation status monitoring unit 1-1 of -23. Thus, even if a failure is likely to occur in the software to be activated, the failure can be prevented from occurring.

If a fault that can occur in the fault processing management unit 1-4 of the fault management server 8-21 is detected,
The avoidance method associated with the failure pattern recorded in the failure information database 1-6 is automatically executed, and can be used for those requiring continuous operation such as an industrial computer.

Further, when a possible failure is detected in the failure processing management section 1-4 of the failure management server 8-21, a measure for avoiding the possible failure is provided in the failure information database 1--1. 6, the execution of the measures is also performed by the fault occurrence avoiding device itself, so that the administrator of the fault occurrence avoiding device can focus on thinking about a method of dealing with a newly generated fault, and The burden on the administrator of the avoidance device can be reduced.

Since the observation items observed by the failure occurrence avoiding device can be changed by setting the configuration file, the items which are considered appropriate for detecting the occurrence of the failure are sequentially changed. And a detailed response to the occurrence of a failure becomes possible.

Further, since the observation items observed by the failure occurrence avoiding device can be set in the configuration file by setting a command independently, it is considered appropriate to detect the occurrence of a failure beforehand. Items can be sequentially set, and detailed responses to the occurrence of failures can be made.

When the fault occurrence avoiding device determines the risk of occurrence of a fault, the fault occurrence avoiding device refers to a search designation file, and the change amount of observation data is set in the search designation file. . For this reason, the fault occurrence avoiding device can cope with a change in the equipment to be observed or the like, and can take a measure according to the change.

Further, the fault occurrence avoiding apparatus according to the second embodiment comprises a fault management server 8-21 and a plurality of clients 8-22 to 8-23. Clients 8-22
By monitoring the operation status of 8-23, it is possible to prevent a failure of a plurality of clients from occurring.

Embodiment 3 of the Invention Next, another embodiment of the present invention will be described with reference to FIG. In the fault occurrence avoiding apparatus of the third embodiment shown in FIG. 12, a fault management server 8-21, clients 8-22 to 8-23, and a database server 12-25 are connected via a LAN cable 12-24. It is composed. In the fault occurrence avoiding apparatus according to the third embodiment, one of a plurality of computers connected via a LAN cable concentrates the operation statuses and fault information of all the other computers connected to the LAN cable. And manage it.

Reference numeral 12-25 denotes a database server, which stores a failure information database 1-6 and a failure management server 8.
-21 and the operation status database 1-5 are combined into one computer. Operation status database 1
-5, the fault management server 8-21 and the clients 8-22 to 8-8 that constitute the fault occurrence avoidance device of the third embodiment.
The operation statuses of all the computers of -23 are recorded.

The fault information database 1-6 includes:
A failure pattern relating to the failure is recorded. 12-14
Is a database management unit, which is connected to the operation status database 1-5 and the failure information database 1-6. Reference numeral 12-15 denotes a fourth failure management communication unit, which is connected to the database management unit 12-14 and communicates observation data and failures with the failure management server 8-21 and the clients 8-22 to 8-23. Information such as a command for avoiding occurrence is transmitted and received.

In the fault occurrence avoiding apparatus of the third embodiment, the database server 12-25 operates in the operation status database 1
-5, and a failure information database 1-6. Then, the fault management server 8-2 constituting the fault occurrence avoiding device
1 and the computers of the clients 8-22 to 8-23 share the operation status database 1-5 and the failure information database 1-6 of the database server 12-25.

The operation status database 1-5 and the failure information database 1-6 are controlled by the database management unit 12 provided in the database server 12-25.
-14. The database management unit 12-14,
The processing is executed based on a request command for reading / writing to / from the operation status database 1-5 and the failure information database 1-6 input via the fourth failure management communication unit 12-25.

The failure management server 8-21 includes an operation status monitoring unit 1-1, an operation abnormality search unit 1-2, and a failure information creation unit 1-
Management unit 8-2 including the network management unit 3 and the failure processing management unit 1-4
0, and a fault management communication unit 8-7. Also,
Failure management unit 8-20 of failure management server 8-21
Has a DB server designation file 12-13 for designating a database server 12-25 having an operation status database 1-5 and a failure information database 1-6.

The DB server designation file 12-13
The failure management server 8-21 or the client 8-
22 to 8-23 may be specified. When the database server 12-25 is designated as the failure management server 8-21 or the clients 8-22 to 8-23, the failure management server 8-21 or the clients 8-22.
The configuration of 8-23 has “the configuration of the fault management server 8-21 (or the clients 8-22 to 8-23) + the configuration of the database server 12-25”.

The first client 8-22 has a second fault management unit 8-9 and a second fault management communication unit 8-8. The second client 8-23 has a third fault management unit 8-12 and a third fault management communication unit 8-11. In FIG. 12, the same or corresponding parts as those of the embodiment shown in FIG. 8 are denoted by the same reference numerals, and the description thereof will be omitted. The parts different from FIG.

In the third embodiment, the fault management server 8-
21 make a determination about the occurrence of a failure. Fault management server 8 that constitutes a fault occurrence avoiding device according to the third embodiment
A series of processes until it is determined that a failure is occurring in each of the computers -21, the clients 8-22 to 8-23, and the database server 12-25 will be described below. Each of the clients 8-22 to 8-23 transmits the observed data to the fault management server 8-21.

The observation data of each client input to the fault management server 8-21 is output to the operation status database 1-5 of the database server 12-25 based on the DB server designation file of the fault management server 8-21. You. The failure management server 8-21 determines the danger that a failure is occurring, based on the operation status database 1-5 and the failure information database 1-6 of the database server 12-25.

When the failure management server 8-21 determines that there is a risk of occurrence of a failure, the database server 12-2
The client is instructed to execute an avoidance method for avoiding occurrence of a failure recorded in the failure information database 1-6 of the client 5. Fault management server 8-2
The client receiving the command from 1 executes a method for avoiding the occurrence of a failure based on the command to prevent the failure from occurring.

In the third embodiment, the fault management server 8
-21 judges the risk of occurrence of a failure, but does not set a failure management server, and the database server 12-25 makes a judgment on the risk of occurrence of a failure. -23 may include the DB server designation file 12-23.

At this time, the clients 8-22 to 8-23, which are the first computers,
The observation data is directly transferred to the database server 12-25, which is the second computer, based on the DB server designation file 12-23 of the -23. Then, the database server 12-25 determines that a failure is occurring, and the database server 12-25 directly instructs the client regarding processing for the occurring failure.

Next, the operation status database 1 shown in FIG.
The conceptual diagram of -5 will be described with reference to FIG. FIG.
As shown in FIG. 3, the operation status database 1-5 records observation data such as CPU load, memory load, network load, operation process, and disk capacity for each time. 13-1 is an observation item list, which shows a plurality of observation items recorded in the operation status database 1-5.

The observation items shown in the observation item list 13-1 change based on the contents of the configuration file set in the failure occurrence avoiding device. The observation data recorded in the operation status database 1-5 is
Fault management server 8-21 and each client 8-22
The corresponding computer such as ８8-23 is recorded so as to be understood.

Further, the observation items composed of a plurality of observation data such as the operation process and the disk capacity are recorded in a table different from the observation item list 13-1. In FIG. 13, observation data on the operation process is recorded in a table 13-2.

The observation data relating to the disk capacity is recorded in the table 13-3. In the column of the operation process, the disk capacity, and the like in the observation item list 13-1, addresses of the separately provided tables 13-2 and 13-3 are recorded.

Next, a conceptual diagram of the failure information database 1-6 shown in FIG. 12 will be described with reference to FIG. As shown in FIG. 14, the failure information database 1-6 includes:
The conditions, fault contents, and processing contents of each computer are recorded. A plurality of processing contents may be set as the processing contents for the failure contents. 14-1 is a failure pattern list, which is a failure management server 8-21 or a client 8;
-Name of computer such as -22 to 8-23, condition, content of failure,
Processing contents are shown.

When a plurality of host names are indicated in the host name column indicating the names of the computers in the fault pattern list table 14-1, it can be understood that a fault is occurring in the plurality of hosts. When a plurality of host names are indicated in the failure pattern list 14-1, the host names are separated by commas. In addition, failure pattern list 1
If “*:” is displayed in the column of the host name of 4-1, this indicates the failure management server 8-21 and all the clients 8-22 to 8 that constitute the failure occurrence avoiding apparatus of the third embodiment.
-23 indicates that a fault is occurring.

Similar failures can occur in the computers of the failure management server 8-21 and each of the clients 8-22 to 8-23, but methods of avoiding the possible failures depend on the computers. It often differs depending on the environment in which the computer is used, such as using the computer in a special test. Therefore, the fault information database 1-6 of the fault occurrence avoiding apparatus according to the third embodiment can be set so that the computer in which the fault is occurring executes a computer-specific avoidance method.

As described above, the fault occurrence avoiding apparatus according to the third embodiment of the present invention shown in FIG. 12 includes a fault management server 8-21, a first client 8-22, and a second client 8-2.
3, and the database server 12-25 is connected to the LAN
8-24. The failure management server 8-21 includes a failure management unit 8-20 and a failure management communication unit 8-7.

The first client 8-22 includes a second fault management unit 8-9 and a second fault communication management unit 8-8. The second client 8-23 includes a third failure management unit 8-12 and a third failure management communication unit 8-11.
Consists of

The fault management unit 8-20, the second fault management unit 8-9, and the third fault management unit 8-12 include an operation status monitoring unit 1-1, an operation abnormality search unit 1-2, It comprises a failure information creation unit 1-3 and a failure processing management unit 1-4.
The database server 12-25 includes an operation status database 1-5, a failure information database 1-6, a database management unit 12-14, and a fourth failure management communication unit. Further, the failure management communication unit 8-7, the second failure management communication unit 8-8, the third failure management communication unit 8-11, and the fourth failure management communication unit are respectively connected to the LAN cable 8-2.
4 are connected.

The fault occurrence avoiding device periodically determines the load on the CPU in each of the clients 8-22 to 8-23 based on the configuration file set.
The load on the memory, the load on the network, the operation process, and the like are observed, and the obtained observation data is output to the failure management server 8-21.

Then, the failure management server 8-21 converts the input observation data into the operation status database 1 of the database server 12-25 based on the DB server designation file 12-13 of the failure management server 8-21.
Transfer to -5. Further, the database server 12-25 to which the observation data has been input records the input observation data in the operation status database 1-5 of the database server 12-25.

[0170] The fault management section 1-4 of the fault management server 8-21 includes the database server 12-2.
5 is compared with the observation data recorded in the failure information database 1-6 of the database server 12-25, which is also shown in the failure pattern relating to the occurrence of the failure. Then, it is determined whether a similar tendency is observed in the two observation data.

At this time, if the failure processing management section 1-4 of the failure management server 8-21 finds a tendency regarding the occurrence of a failure from the observation data recorded in the operation status database 1-5, the failure management server 8-21. Failure management unit 1-4
Commands the client to execute a method for avoiding a possible failure indicated by the failure pattern recorded in the failure information database 1-6.

The client instructed to execute the avoidance method for a failure that may occur from the failure management server 8-21 executes the instructed avoidance method. When the failure processing management unit 1-4 of the failure management server 8-21 determines that a failure can occur, the operation abnormality search unit 1-2 uses the observation data recorded in the operation status database 1-5 to determine , And reads the observation data for a predetermined period.

Then, based on the search specification file, the failure information creating unit 1-3 uses the observation data read by the operation abnormality search unit 1-2 to determine the observation data that matches a predetermined condition for determining the cause of the failure. Is extracted. Further, the fault information creating unit 1-3 creates a new fault pattern by associating the extracted observation data, the fault, and a method of avoiding the fault with each other.

The newly created fault pattern is compared with an existing fault pattern recorded in the fault information database 1-6, and a feature created based on a characteristic portion common to these two fault patterns. A typical failure pattern is created and recorded in the failure information database 1-6.

As described above, each of the clients 8-22 to 8-8
The equipment monitored by the fault occurrence avoiding device to observe the CPU load, the memory load, the network load, the operation process, and the like based on the configuration file set by the operation status monitoring unit 1-1 of -23. Thus, even if a failure is likely to occur in the software to be activated, the failure can be prevented from occurring.

When a fault which can occur in the fault management section 1-4 of the fault management server 8-21 is detected,
The avoidance method associated with the failure pattern recorded in the failure information database 1-6 is automatically executed, and can be used for those requiring continuous operation such as an industrial computer.

Further, when a possible failure is detected in the failure processing management section 1-4 of the failure management server 8-21, a measure for avoiding the possible failure is provided in the failure information database 1--1. 6, the execution of the measures is also performed by the fault occurrence avoiding device itself, so that the administrator of the fault occurrence avoiding device can focus on thinking about a method of dealing with a newly generated fault, and The burden on the administrator of the avoidance device can be reduced.

Since the observation items observed by the failure occurrence avoiding device can be changed by setting the configuration file, the items that are considered appropriate for detecting the occurrence of the failure are sequentially changed. And a detailed response to the occurrence of a failure becomes possible.

Further, the observation items observed by the fault occurrence avoiding device can be set in the configuration file by setting a command independently, and thus it is considered appropriate to detect the occurrence of a fault beforehand. Items can be sequentially set, and detailed responses to the occurrence of failures can be made.

When the failure avoidance device determines the risk of occurrence of a failure, the failure occurrence avoidance device refers to a search specification file, and the change amount of observation data is set in the search specification file. . For this reason, the fault occurrence avoiding device can cope with a change in the equipment to be observed or the like, and can take a measure according to the change.

Further, the fault occurrence avoiding device according to the third embodiment includes a fault management server 8-21, a plurality of clients 8
-22 to 8-23, and the database server 12-25
And one fault management server 8-21.
By monitoring the operation status of the plurality of clients 8-22 to 8-23, it is possible to avoid the occurrence of a failure in the plurality of clients.

Further, the failure generating device of the third embodiment
Fault management server 8-21, multiple clients 8-22
8-23 and a database server 12-25, and one database server 12-25.
The operation status database 1-5 and the failure information database 1-6 of the plurality of clients 8-22 to 8-23 can be consolidated, and the miniaturization of the device is promoted.

[0183]

As described above, the fault occurrence avoiding device according to the present invention is connected to the operation status observation means for observing the operation status of a plurality of elements, An operation status database in which data is recorded, a failure information database, an operation status database in which a failure, a tendency of the operation status of a plurality of elements causing the failure, and an avoidance method for avoiding the occurrence of the failure are recorded. And a failure information database, which is connected to the failure information database, compares the observation data recorded in the operation state database with the tendency of the operation state recorded in the failure information database, and determines a failure related to the operation state, and The failure information data is connected to the failure determination means and the failure information database, and is associated with the failure determined by the failure determination means. Fault observing means for performing an operation process based on the avoiding method recorded in the fault information database. Observation data obtained by observing a plurality of elements by the operation status observing means, and a fault recorded in the fault information database. Is compared with the tendency of at least one operation state of a plurality of elements that cause the occurrence of a failure, and the occurrence of a failure related to the operation state is determined. If it is determined that a failure may occur,
The failure avoidance method set in the failure information database is executed for the determined failure. For this reason, the occurrence of a failure can be avoided beforehand, and continuous operation of the device whose operation status is observed becomes possible.

Further, the fault occurrence avoiding apparatus according to the present invention observes the operation status of a plurality of elements, outputs the observation data obtained by the observation, and the input operation processing instruction. A first computer having failure avoidance means for performing a failure avoidance process based on the operation state database in which observation data output from the operation state observation means of the first computer is inputted and recorded; and A failure information database that records the tendency of the operation status of a plurality of elements causing the failure and an avoidance method for avoiding the occurrence of the failure in association with the operation status database and the failure information database, and is connected to the operation status database. The recorded observation data is compared with the trends in the operating status recorded in the fault information database to determine faults related to the operating status. And a failure determination unit that outputs an operation processing instruction for performing an operation process based on the avoidance method recorded in the failure information database in association with the failure, to the failure avoidance unit of the first computer. A second computer, and the observation data obtained by the operation state observation means of the first computer recorded in the operation state database of the second computer, and recorded in the failure information database of the second computer Then, the occurrence of a failure related to the operation state is determined by comparing the operation state with the tendency of the operation state that causes the failure. Then, when it is determined that a failure can occur in the second computer, the first computer uses the failure avoidance method set in the failure information database of the second computer for the determined failure. ,Run. For this reason, it is possible to prevent the failure of the first computer from occurring, and it is possible to continuously operate the first computer in which the operation status is observed.

Further, in the fault occurrence avoiding apparatus according to the present invention, the plurality of elements observed by the operation status observing means are a plurality of elements set in the configuration file,
Since multiple elements set in this configuration file can be changed, it is possible to accurately understand the cause of a failure that may occur in the device whose operation status is observed, and to provide details on the possible failure. Measures can be taken.

Further, the fault occurrence avoiding device according to the present invention is connected to an operation status database, and extracts operation data indicating a tendency of a predetermined operation status from observation data recorded in the operation status database. When,
It is connected to the operation abnormality search means and the failure information database, and records in the failure information database the observation data extracted by the operation abnormality search means, the failure indicating the tendency of the predetermined operation status, and the avoidance method for avoiding the failure in association with each other. Fault information creating means, and when a tendency of a predetermined operating situation similar to a certain fault recorded in the fault information database is observed from the operating situation observing means, the observation data recorded in the operating situation database is A new tendency of the operating situation is clarified by using the information, and a fault having a similar tendency of the operating situation and a method of avoiding the fault are associated with each other and newly recorded in the fault information database. For this reason, when a tendency of the operating situation similar to the trend of the operating situation of the fault recorded up to that time recorded in the fault information database occurs, the newly observed tendency of the operating situation, the fault, and the avoidance of the fault. The methods are associated with each other and recorded in the fault information database, and the number of faults that can be avoided can be gradually increased. As the operation progresses, the reliability increases.

Further, the fault occurrence avoiding apparatus according to the present invention uses observation data extracted by the operation abnormality search means as a plurality of elements set in a search specification file, and the plurality of elements set in the search specification file include: Since the change can be made, it is possible to accurately grasp the cause of a failure that may occur in the device in which the operation status is observed, and to take a detailed countermeasure against the possible failure.

[Brief description of the drawings]

FIG. 1 is a configuration diagram illustrating a failure occurrence avoiding device according to a first embodiment.

FIG. 2 is a flowchart illustrating an operation of the failure occurrence avoidance device according to the first embodiment.

FIG. 3 is a conceptual diagram of a configuration file for setting a recording content and a recording period with respect to an operation state of the failure occurrence avoidance device of the first embodiment.

FIG. 4 is a conceptual diagram of another configuration file for setting a recording content and a recording period with respect to an operation status of the failure occurrence avoidance device of the first embodiment.

FIG. 5 is a conceptual diagram of a search specification file in which content to be searched is set from information recorded in an operation status database included in the failure occurrence avoidance device of the first embodiment.

FIG. 6 is a conceptual diagram of an operation status database included in the failure occurrence avoidance device of the first embodiment.

FIG. 7 is a conceptual diagram of a failure information database included in the failure occurrence avoidance device of the first embodiment.

FIG. 8 is a configuration diagram illustrating a failure occurrence avoidance device according to a second embodiment.

FIG. 9 is a management server designation file included in a fault management server of the fault occurrence avoidance apparatus according to the second embodiment, and the second embodiment.
FIG. 3 is a conceptual diagram of a failure target designation file possessed by a client of the failure occurrence avoidance apparatus of FIG.

FIG. 10 is a flowchart illustrating an operation when an existing failure recorded in a failure information database is occurring in the failure occurrence avoidance device of the second embodiment.

FIG. 11 is a flowchart illustrating an operation when a new failure not recorded in the failure information database is occurring in the failure occurrence avoidance device of the second embodiment.

FIG. 12 is a configuration diagram illustrating a failure occurrence avoiding device according to a third embodiment.

FIG. 13 is a conceptual diagram of an operation status database included in the failure occurrence avoidance device of the third embodiment.

FIG. 14 is a conceptual diagram of a failure information database included in the failure occurrence avoidance device according to the third embodiment.

FIG. 15 is a conventional example disclosed in JP-A-4-161823.

FIG. 16 shows a conventional example disclosed in JP-A-6-17-3886.

FIG. 17 shows a conventional example disclosed in Japanese Patent Application Laid-Open No. 4-310160.

[Explanation of symbols]

1-1 Operation state monitoring unit, 1-2 Operation abnormality search unit 1-3 Failure information creation unit, 1-4 Failure processing management unit 1-5 Operation state database, 1-6 Failure information database 1-7 Failure occurrence avoidance device 3-1 Format of Configuration File (Part 1) 3-2 Format of Configuration File (Part 2) 3-3 Format of Configuration File (Part 3) 4-1 Format of Another Configuration File (Part 1) 4-2 Format of Another Configuration File (Part 2) 4-3 Format of Another Configuration File (Part 3) 6-1 Observation Item List, 6-2 Operation Process Table 6-3 Disk Capacity Table 7- 1 failure pattern list, 7-2 failure table 7-3 processing table 8-7 failure management communication unit, -8 second fault management communication section 8-9 second fault management section, 8-10 second operation status database 8-11 third fault management communication section, 8-12 third fault management section 8- 13 Third operation status database 8-20 Failure management unit, 8-21 Failure management server 8-22 First client, 8-23 Second client 8-24 LAN cable 9-1 Server designation file, 9-1 Failure target specification file 12-13 DB server specification file, 12-14 Database management unit 12-15 Fourth failure management communication unit 12-25 Database server 13-1 Information items, 13-2 Operation process table 13-3 Disk Capacity table 14-1 Information items 15-1 Equipment 15-2 Monitoring unit 15-3 Diagnostic unit 15-4 Database 16-1 to 16 -5 LAN adapter for normal business 16-6 to 16-10 LAN adapter for backup 16-11 to 16-14 Active CPU 16-15 CPU for backup, 16-16 LAN for normal business 16-17 LAN for backup 17-1 Input unit, 17-2 Output unit 17-3 Inference unit 17-4 Network configuration database 17-5 Failure database, 17-6 Editor

Claims (5)

[Claims] An operation status observing means for observing the operation status of a plurality of elements, an operation status database connected to the operation status observing means and recording observation data observed by the operation status observing means, a fault, A failure information database that records the tendency of the operation states of the plurality of elements causing the failure and an avoidance method for avoiding the occurrence of the failure, and is connected to the operation state database and the failure information database; A failure determination unit that compares the observation data recorded in the operation status database with the tendency of the operation status recorded in the failure information database, and determines a failure related to the operation status; and the failure determination unit. And the failure information database, and is associated with the failure determined by the failure determination means. Failure avoidance means for performing an operation processing based on the workaround recorded in the information database,
A failure occurrence avoidance device comprising: 2. An operation status observing means for observing the operation status of a plurality of elements and outputting observation data obtained by the observation, and a fault for performing a fault avoiding process based on the input operation processing instruction. A first computer having avoidance means, an operation state database in which the observation data output from the operation state observation means of the first computer is inputted and recorded, and a plurality of failures and the plurality of failure occurrences. A failure information database that records the tendency of the operation status of the elements and the avoidance method for avoiding the occurrence of the failure in association with the operation status database and the failure information database, and is recorded in the operation status database. Comparing the observed data with the tendency of the operating status recorded in the fault information database, and determining the fault related to the operating status. Outputting the operation processing command for performing an operation process based on the avoidance method recorded in the failure information database in association with the disconnected failure to the failure avoiding means of the first computer And a second computer having a failure determination unit that performs the failure determination. 3. The failure occurrence avoiding device according to claim 1, wherein the plurality of elements observed by the operation status observing means are a plurality of elements set in a configuration file. 4. An operation abnormality search means connected to the operation state database and extracting the observation data indicating a predetermined tendency of the operation state from the observation data recorded in the operation state database; It is connected to the failure information database and records the observation data extracted by the operation abnormality search means, the failure indicating the tendency of the predetermined operation situation, and the avoidance method for avoiding the failure in the failure information database in association with each other. The fault occurrence avoiding device according to any one of claims 1 to 3, further comprising fault information creating means. 5. The fault occurrence avoiding apparatus according to claim 4, wherein the observation data extracted by the operation abnormality search means is a plurality of elements set in the search specification file.