JPH11143737A - Object managing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To manage an AP regardless of the state of the AP by providing a means which performs information exchange with an application program(AP) that is a management object and a means which manages an object from log data that are outputted by the AP, an OS, etc. SOLUTION: An AP 70 that is a management object operates under an OS 60, it has a process, etc., supervised by the OS 60 and operates (1) and outputs a log to a system log file 80 (3) when abnormality occurs in the process, etc. Also, the AP 70 outputs various events (start, end, abnormality end, etc.), which accompany job execution to an AP log file 90 (4). An integrated management supporting part 20 supervises the AP 70 (2) by using an object 25 and also input a log (5 and 6). It converts it into a common format after extracting only necessary logs. In such a case, the object 25 is managed by these log information.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system in which an integrated management unit collects, via a network, management information of a management target managed by an integrated management support unit using objects. In particular, it relates to the following two technical fields.

(1) Object management technology for managing an object that manages a managed object from another object. (2) An event output by the managed object is associated with log data, and log data that is detailed information of the event is associated with the event. Management technology to search and collect data

[0003]

2. Description of the Related Art (1) Object management technology Generally, an object manages an object to be managed and is not managed.

(2) Log management technology An OS or AP executed in the information processing device outputs various types of log information. Several methods for collecting output log information are known. For example, JP-A-5-250229
This publication discloses a log data collection method that preferentially transmits log data from a computer in an error state by detecting an error code in the log data in collecting log data from a plurality of computers. Also,
Japanese Patent Application Laid-Open No. 5-28008 discloses an important information processing system that detects that the number of log information stored in a storage unit reaches a certain number when an information processing system collects a failure log, and suppresses log registration. A log information collection method for preventing loss of failure information is disclosed.

[0005]

In a distributed processing system in which a plurality of computers are connected via a network and the computer performs processing while communicating with other computers, in a system management system or a network management system, a management object ( A plurality of computers are centrally managed by commonly managing operating systems and hardware) as objects. However, information exchange between the managed object and the integrated management support unit that manages the object is usually performed by a single means, and there are cases where monitoring cannot be performed depending on the state of the monitored object or the program, which is problematic. Was. Conventionally, the log data of the computer on which the integrated management support unit operates is transferred to the integrated management unit one by one. Therefore, there are problems such as the disk capacity for storing the log data of the integrated management unit and the network load for transfer. Was.

[0006] The present invention has been made in view of the above circumstances, and a purpose thereof is to manage objects by various methods.

Another object of the present invention is to immediately collect only log data related to an event selected by a user in a system for collecting logs from computers at each site.

[0008]

In order to achieve the above object, the present invention provides a means for exchanging information with an object to be managed and an object from log data output by an AP, OS, or the like as the object to be managed. Have means to manage. An object that manages the managed object includes a managed object monitoring unit that is immediately updated when the management information of the managed object changes,
It has means for notifying the integrated management unit of an event having an immediacy that has occurred in the integrated management support unit as an event, and means for reflecting object information in the system topology of the integrated management unit.

According to the present invention, a means for searching and collecting log data accumulated in the integrated management support unit from an event notified from the integrated management support unit to the integrated management unit via a network is provided as processing means of the integrated management unit. Features a computer.

[0010]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below in detail with reference to the drawings.

FIG. 1 is a system configuration diagram showing an example of a communication network to which the present invention is applied. The network is connected to a plurality of LANs 1 and 3 and a WAN (Wide Area Network) 2. Integrated management unit 10
The integrated management unit viewer 30 is a management-side program that is stored in the main storage device of the computer and runs under the OS 60. The integrated management support unit 20 is a program on the managed side that is stored in a main storage device of a computer such as a server and runs under the OS 60. The integrated management unit 10
It is possible to communicate with the integrated management support unit 20 and the integrated management unit viewer 30 via the AN1, 3 or the WAN2.
As shown in FIG. 1, a computer that executes the integrated management support unit 20 can execute another AP (application program) 70 in parallel with the integrated management support unit 20. The computer executed by the integrated management unit 10 and the integrated management unit viewer 30 can execute other APs in parallel with the integrated management unit 10 and the integrated management unit viewer 30. For other configurations, see FIGS. 2O, 3 and 4
Will be described.

FIG. 2 is a diagram showing an outline of processing operations performed by the integrated management unit 10, the integrated management support unit 20, and the integrated management unit viewer 30. AP 70 runs under OS 60
The process (1) is monitored by monitoring the process or the like, and when an error occurs in the process or the like, a log is output to the system log file 80 (3). In addition, the AP 70 determines various events (start, end, abnormal end, etc.) that occur with the execution of the business as A.
Output to the P log file 90 (4). The integrated management support unit 20 monitors the AP 70 using the object 25 (2), inputs a log (5, 6), extracts only necessary logs, and converts them into a common format. At this time, the object 25 is managed by the log information. (7) The integrated management unit viewer 30 via the integrated management unit 10 through the integrated management unit 10 as the event information with the immediacy event of the log information.
(8), and stores the log information in the common log (database or file) 50 (9). Further, the object 25 includes the changed object information (15).
Is reflected in the system topology 40 of the integrated management unit 10 (16). When the system administrator operating the integrated management unit viewer 30 selects the notified event information, the search processing of the log as the detailed information operates (1).
0). When the integrated management unit 10 receives the log search (10) request from the integrated management unit viewer 30, the integrated management support unit 20
Requesting a log search process (11). At this time, the integrated management unit 10 associates the event with the log data using a common key. The integrated management support unit 20 searches the log for log data that matches the requested condition (12), and transfers the log information to the integrated management unit viewer via the integrated management unit 10 (13) (14).

FIG. 3 is a functional block diagram showing the configuration of the integrated management unit 10. The system topology 40 is a database that stores the system topology and events, and is stored in a storage device. The outline of the function of each function module constituting the integrated management unit 10 will be described below.

The data communication 100 is an object management 11
0, a program for performing communication control when the event management 120 and the log search 130 communicate with the integrated management support unit 20 and the integrated management unit viewer 30.

The object management 110 is a program for managing objects of system information and event information stored in the system topology 40.

The event management 120 is an integrated management support unit 20
Is a program for requesting the database management 140 to store the event received from the server, or transferring the event to the integrated management unit viewer 30.

The log search 130 is executed by the integrated management unit viewer 30.
Determines the location and type of log related to an arbitrary event in response to a log search request from
0 is a program for making a log search request.

The database management 140 stores in the system topology 40 system information collected by the object management 110 from the integrated management support unit 20 and event information received by the event management 120 from the integrated management support unit.
The system topology is searched or extracted by a reference request from the object management 110, and event information is extracted by a reference request from the event management 120.

FIG. 4 is a functional block diagram showing the configuration of the integrated management support unit 20. The object 25 manages the AP 70 via the AP monitor 210, and is managed by the log file monitor 230. The outline of the function of each function module constituting the integrated management support unit 20 will be described below.

In the data communication 200, the AP monitor 210, the event management 220, and the common log management 240
This is a program for performing communication control when communicating with the “0”.

The AP monitor 210 is a program for monitoring the AP 70 using the object 25.

The event management 220 notifies the integrated management unit 10 of only the information having an immediate property among the information input from the AP monitor 210 and the log file monitor 230 as an event. Also, the program notifies the AP monitor 210 of an event detected by the log file monitor 230.

The log file monitor 230 inputs log data from the system log file 80 and the AP log file 90, extracts only those related to the AP 70, and converts them into a common format. According to the log data, the object 25
And the event information 22
Notify 0. Further, since the log data converted into the common format is stored in the common log 50, the common log management 24
This is a program that outputs 0. Further, an API (application programming interface) can be provided to log events that the AP 70 notifies the AP monitor 210.

The common log management 240 is a log file monitor 2
The log data input from 30 is stored in the common log 50. The program is a program for extracting and transferring a relevant log in accordance with a log search request from the log search 130 of the integrated management unit 10.

FIG. 5 is a diagram showing conditions under which an AP can be monitored before the present invention is applied.

FIG. 6 is a diagram showing the conditions under which the AP can be monitored after application of the present invention. By managing the object 25 by the log file monitoring 230, it becomes possible to monitor the state other than the stop state of the AP.
There is an effect that P can be monitored.

FIG. 7 is a diagram showing a system of the object 25. The object 25 includes a system object 500, a log object 800, and an event object 850.

FIG. 8 is a diagram showing the hierarchy of the system object 500. The system object 500 is
The objects are hierarchized in the order of the IP object 600 and the AP object 700.

FIG. 9 is a diagram showing the attributes of the system object 500. The system object 500 is
It has an attribute indicating the outline of the lower object, and has a system object identifier (Sys_Obj_ID) 510;
System object name (Sys_Obj_Name)
520, total number of integrated management units (Manager_Num)
530, total number of integrated management support units (Agent_Num)
540, the total number of managed APs (Managing_
Ap_Num) 550, the total number of used DBs (DB
_Num) 560 and a flag (isSys_Obj) 570 for identifying the system object.

FIG. 10 shows an IP node object 600.
It is a figure showing the attribute of. IP node object 60
0 indicates an attribute of an IP node on which the integrated management unit 10 and the integrated management support unit 20 operate, and includes an IP node object identifier (IP_Obj_ID) 610, an IP node object name (IP_Obj_Name) 612, a host name (IP_Hostname) 614, and an IP address. (I
(P_Address) 616, a flag (isIP_Node) 61 for identifying an IP node object
8. A flag (isMgr_Node) 620 for identifying the presence of the integrated management unit at the IP node, a state (Mgr_Node) when the integrated management unit is operating at the IP node
(Status) 622, a flag (isAgt_Nod) for identifying the presence of the integrated management support unit at the IP node
e) 624, state (Agt_Status) 626 when the integrated management support unit is operating on the IP node, A when the integrated management support unit is operating on the IP node
The overall state of the P object (isAP_Obj_S
status) 628, D used by the IP node
A flag (isDB) 630 for identifying the presence or absence of B
Type of used DB (DB_Type) 632, state of used DB (DB_Status) 634,
Total number of integrated management units managing the IP node (Ma
_Ngring_Mgr_Num) 636, a table for recording integrated management unit information (Managing_Mgr_T)
able) 638, the total number of APs managed by the integrated management support unit (Managed_AP_Num) 646,
It comprises a table (Managed_AP_Table) 648 for identifying the managed AP object. The integrated management unit table 638 has an integrated management unit entry (Managing_Mgr_Entry) 640.
The integrated management unit entry 640 includes an index (Index) 642 for identifying the entry and an IP node object identifier (IP_O) where the integrated management unit exists.
bj_ID) 644. AP table 64
8 is an AP entry (Managed_AP_Entr)
y) 650, and the AP entry 650 includes an index (Index) 652 for identifying the entry and the AP.
It consists of an object identifier (AP_Obj_ID) 654.

FIG. 11 is a diagram showing the attributes of the AP object 700. The AP object 700 indicates an attribute of the AP 70 to be managed, an AP object identifier (AP_Obj_ID) 710, an AP object name (AP_Obj_Name) 712, and an IP object identifier (Managing_IP_Obj_ID) indicating a higher-level integrated management support unit that manages the AP. ) 7
14. AP version (AP_Version) 71
6, AP name (AP_Name) 718, time when the AP was installed in the IP node (Installed)
_Time) 720, the overall state of the AP (isAP_
Status) 722, AP status (isAP_Int) acquired by information exchange means between the AP and the integrated management support unit
interface_Status) 724, the status of the AP obtained from the OS and AP logs (isAP_Log_Stata)
tus) 726, a flag (isManaged_AP) 728 for identifying the AP object, the number of scheduled jobs (Job_Num) 730, and a table (Job_Table) 73 for recording job information
2 The job table 732 includes a job entry (Job_Entry) 734. The job entry 734 includes an index (Index) 736 for identifying the entry and a job name (Job_Name).
738 and business name (Business_Name) 740
And the execution cycle of the job (Execution_Cycle)
e) 742, the next scheduled execution time (Schedule_Time) 744 of the scheduled job, the user name (User_Name) 746 for executing the job, and the file name (File_Name) 748 of the job to be executed.
And the end code (Exit_Code) of the previous job 7
50.

FIG. 12 is a diagram showing the hierarchy of the log object 800. The log object 800 is an object hierarchized in the order of the log file monitoring object 810 and the log data object 820. The log object 800 has an attribute indicating the outline of the lower-level object, and is configured from information on the common log 50 that stores the total number of log file monitoring objects and the value of the log data object. The log file monitoring object 810 exists for each log file, and includes a log file name to be monitored, a monitoring interval, (filtering) conditions for extracting only necessary log data, and a regular for converting to a common format. It is composed of chemical conditions. The log data object 820 represents the data itself stored in the common log 50 after normalizing (converting) the log data input by the log file monitor 230 into an attribute having a common format shown in FIG.

FIG. 13 is a diagram showing the hierarchy of the event object 850. Event object 850
Are objects hierarchically arranged in the order of the external event object 860 and the internal event object 870. The external event object 860 is an event transferred to the integrated management unit 10, and the internal event object 870 is an event exchanged between each function module in the integrated management support unit.

FIG. 14 shows a log data object 820.
FIG. 14 is a diagram showing attributes of the event object 850 and the event object 850. The event and the log data are associated by a combination of the message source host name 901 or the message source IP address 902, the message date 903, and the message serial number 904. The distinction between an external event and an internal event is determined by the value of the importance 908. In other words, when the importance level 908 is high, the event is distinguished from: • High: external event, saving to common log • Normal: Saving to internal event, common log • Low: Saving to common log only

FIG. 15 is a diagram showing the contents of the attributes of the log object 800 and the event object 850.

FIG. 16 is a PAD diagram showing the flow of processing of the log file monitoring 230 of the integrated management support unit 20. The log file monitoring 230 is initialized (step 100).
0) to obtain attributes from the log object 800 (step 1001), loop by the number of log file monitoring objects 810 (step 1002), obtain attributes from the log file monitoring objects 810 (step 1003), and After starting monitoring each time (step 1004), the process loops until an end request comes (step 1005) and waits for an event (step 1004).
6). The event includes a log data input request for notifying that log data has been input from the log file monitoring function, which is a sub-function of the log file monitoring 230 (step 1007), and an object addition request from the integrated management unit 10 (step 1007). Step 1016), object deletion request (step 1018), and attribute change request (step 1020)
And an end request (step 1022).

When a log data input request (1007) is received, log data is input from the system log file 80 or the AP log file 90 (step 1008).
Perform filtering processing. The filtering process checks whether the input log data is non-target data (step 1009), and if it is non-target data (Y
ES) clears the input log data (step 101)
0). If the input log data is the target (N
O) is a normalization process (step 10) shown in FIG.
11) After that, only those that need to be notified to the integrated management unit 10 are notified to the event management 220 as external event objects 860 (step 1012), normalization processing of input log data (step 1013), and AP object management (step 1013) 1014), a storage request for input log data is issued to the common log management 240 to store log data in the common log 50 (step 1015). The normalization processing (steps 1011 and 1013) determines whether or not the message text of the input log data includes a predefined condition (a character string, a set of character strings, etc.), and In this case, a value corresponding to the condition or a character string in the message text is set as an attribute value.

If an object addition request (1016) is received from the integrated management unit, it means that the number of log files to be newly monitored has increased, and the log object 800
A log file monitoring object 810 is generated under the subordinate (step 1017).

When an object deletion request (1018) is received from the integrated management unit, it means that monitoring of the monitored log file is stopped, and the log object 8 is deleted.
The corresponding log file monitoring object 8 under 00
10 is deleted (step 1019).

An attribute change request (102) from the integrated management unit
0), the attribute of the corresponding log file monitoring object 810 is changed (step 102).
1).

The log file monitor 230 updates the value of the attribute of the log object 800 when an object is created or added or the attribute is changed.

When an end request is received (step 10
22), exits the loop (step 1023) and performs end processing (step 1024).

FIG. 17 is a PAD diagram showing a flow of AP object management processing which is one of the processing of the log file monitoring 230 of the integrated management support unit 20. IsAP_Log_Status 72 of the corresponding AP object 700 from the message source host name 901 and the control name 907
14 (step 1050), and among the normalized attributes shown in FIG. 14, the message type 914 and the end code 912 expressing the job status (start, end, abnormal end, etc.) and the process information output by the OS 60. Of the corresponding AP 70 is determined from the value of isAP_Log_Stat.
After updating the value of us726 (step 1051), the update is notified to the AP monitor 210 via the event management 220 by an internal event (step 1052).

FIG. 18 is a PAD diagram showing a flow of processing of the common log management 240 of the integrated management support unit 20. The common log management 240 performs initialization (step 1100), loops until an end request is received (step 110).
1) Wait for an event (step 1102). The events include a storage request for the normalized log data from the log file monitor 230 (step 1103), a log search request from the log search 130 of the integrated management unit 10 (step 1105), and a termination request (step 1107). ).

When a log data storage request (step 1103) is received from the log file monitor 230, the log data is stored in the common log 50 in the form of a log data object 820.

When a log search request (step 1105) is received from the integrated management unit 10, a log data object 820 that satisfies the designated condition is responded (step 1106).

When an end request is received (step 11
07), the process exits the loop (step 1108) and performs end processing (step 1109).

FIG. 19 is a PAD diagram showing a processing flow of the event management 220 of the integrated management support unit 20. The event management 220 performs initialization (step 1200), loops until an end request is received (step 120).
1) Wait for an event (step 1202). The event includes an event information transfer request (step 1203) and an end request (step 1208) issued by the AP monitor 210 or the log file monitor 230.

Event information transfer request (step 120)
If 3) is received, event information is input (step 1204), and it is determined whether the event is an external event or an internal event (step 1205). If the event is an external event (YES), an event is issued to the integrated management unit 10 (Step 1206), if the event is an internal event (NO), A
Notify the event to the P monitor 210 (step 120
7).

When an end request is received (step 12
08), the process exits from the loop (step 1209) and an end process is performed (step 1210).

FIG. 20 is a PAD showing the flow of processing of the AP monitor 210 of the integrated management support unit 20. AP monitoring 2
10 performs initial setting (step 1300),
After acquiring the IP node object information from 0 and reflecting it in the attribute (step 1301), an information exchange means with the AP 70 is established (step 1302), the AP object is monitored (step 1303), and a loop is performed until an end request comes. (Step 1304), and waits for an event (step 1305). During the loop (step 1304), event processing (step 1306) and AP object monitoring (step 1307) are performed. If an end request has been received (step 1359), the processing exits the loop (step 1359).
360) Termination processing is performed (step 1308).

FIG. 21 is a PAD diagram showing a flow of an AP object monitoring process which is one of the processes of the AP monitoring 210 of the integrated management support unit 20. The AP object monitoring loops for the number of APs (step 1330), and the AP 70
Get AP object information from AP object 7
After reflecting on the attribute of “00” (step 1331), it is determined whether the object has been changed (step 133).
2). If the object has changed (YES),
The changed object information is notified to the event management 220 as an external event (step 1333).

FIG. 22 shows an AP executed by the integrated management support unit 20.
FIG. 9 is a PAD diagram showing a flow of an event process which is one of processes of a monitor 210. The event includes an event notification from the AP 70 (step 1350) and an internal event notification from the event management 220 (step 1353).
And an object reference request (step 1357) and an end request (step 1359) from the integrated management unit 10.

Event notification from AP 70 (step 1
If 350) is received, AP object information is acquired from the AP 70 and reflected in the attribute of the corresponding AP object 700 (step 1351). Further, the changed object information (attribute and value) is notified to the event management 220 as an external event (step 1352).

When the internal event notification (step 1353) is received from the event management 220, it means that the log file monitor 230 has changed the AP object 700 as shown in FIG.
(Step 135)
4). If possible (YES), execute object processing 1 (step 1355); otherwise (NO), execute object processing 2.

When the object reference request (step 1357) is received from the integrated management unit 10, the requested object information and its value are responded (step 135).
8).

When the end request (step 1359) is received, the process exits the loop (step 1304) (step 1360).

FIG. 23 shows an AP executed by the integrated management support unit 20.
FIG. 9 is a PAD diagram showing a flow of a process of an object process 1 which is one of processes of a monitor 210. The status is obtained from the corresponding AP 70 by the information exchange means, and the isAP_Interface_Stata of the corresponding AP object 700 is obtained.
Set to tus724. In addition, “interface: OK” and isAP_Interface_ are added to the isAP_Status 722 of the corresponding AP object 700.
Set the value of Status 724 (step 137)
1). Then, Ma of the corresponding IP node object
Loop by the value of named_AP_Num 646 (step 1372), the value of isAP_Status 722 is “Interface: OK” and isAP_Inter
The number of AP objects 700 for which the value of face_Status 724 is normal is counted (step 137).
3). The number x of the counted AP objects 700;
For example, the values of a, b (b <a) set by the user are compared (step 1374). If a = x, isAP_Obj_Status6 of the IP node object 600 is compared.
28 is set to “normal” (step 1375), and b <x
If <a, “caution” is set in isAP_Obj_Status 628 (step 1376), and if x = <b, “abnormal” is set in isAP_Obj_Status 628
Is set (step 1377). At this time, it is checked whether the value of the object has been changed (step 137).
8) If there is a change (YES), the object information is notified to the event management 220 to notify the integrated management unit 10 of the object information as an external event (step 137).
9).

FIG. 24 shows an AP executed by the integrated management support unit 20.
FIG. 9 is a PAD diagram illustrating a flow of a process of an object process 2 which is one of processes of a monitor 210. The case where the information exchange means with the corresponding AP 70 cannot be used,
IsAP_Status 722 of object 700
In addition, “Interface: NG” and isAP_Log_
The value of Status 726 is set (step 139).
0). Then, Ma of the corresponding IP node object
Loop by the value of named_AP_Num 646 (step 1391), and count the number of AP objects 700 for which the value of isAP_Status 722 is “interface: NG” and is normal (step 139).
2). The number x of the counted AP objects 700;
For example, the values of a, b (b <a) set by the user are compared (step 1393). If a = <x, isAP_Obj_Status6 of the IP node object 600 is compared.
28 is set to "normal" (step 1394), and b <x
If <a, “caution” is set in isAP_Obj_Status 628 (step 1395), and if x = <b, “abnormal” is set in isAP_Obj_Status 628
Is set (step 1396). At this time, it is checked whether the value of the object has been changed (step 139).
7) If there is a change (YES), the object information is notified to the event management 220 to notify the integrated management unit 10 as an external event (step 139).
8).

FIG. 25 is a PAD diagram showing the flow of the process of the log search 130 performed by the integrated management unit 10. Log search 1
30 performs initialization (step 1400), loops until an end request is received (step 1401), and waits for an event (step 1402). The event includes a log search request from the integrated management unit viewer 30 (step 140).
3), a log search result from the common log management 240 of the integrated management support unit 20 (step 1405), and an end request (step 1407).

If a log search request (step 1403) is received, an event / log correspondence process (step 1403)
4), and the common log management 240 of the integrated management support unit 20
To search log data.

When the log search results (step 1405) are received, the search results are sorted in chronological order and then transferred to the integrated management unit viewer 30 (step 1406).

When an end request is received (step 14
07), the process exits the loop (step 1408) and performs end processing (step 1409).

FIG. 26 is a PAD diagram showing a flow of an event / log correspondence process which is one of the processes of the log search 130 performed by the integrated management unit 10. Integrated Management Department Viewer 3
The system administrator operating “0” acquires the log data of the event from the common log management 240 of the message source host name 901 or the message source IP address 902 of the specified event (step 1450). Whether the log search specified by this system administrator is performed in job units (executed in one computer),
Judgment as to whether it is a business unit (a set of jobs executed across a plurality of computers) (step 1451)
I do.

If the job is in job units, the execution cycle 742 of the job is acquired from the object management 110 (step 1452), and the same job name 910 or job number 909 is sent to the common log management 240 that has generated the message of the event. In addition, a search request for the log data executed in the same execution period is issued (step 1453).

In the case of a business unit, a corresponding business name 91 is obtained from the object management 110 using the business name 740 as a key.
The execution host name 614 or IP address 616 of the job having a value of 5, the job name 738, and the execution cycle 742 of the job
Are acquired (step 1454). Further, the execution order of the job of the corresponding job name is acquired from the job definition information (stored in the system topology 40 or a file) (step 1455). Thereafter, the process loops for the number of the corresponding host names or IP addresses (step 1456), and is sent to the common log management 240 of the integrated management support unit 20 operating with the corresponding host name or IP address. A search request for log data relating to business is issued (step 1457).

As described above, according to the present embodiment: By managing the object managing the management target, the monitoring conditions of the management target can be expanded and the management information can be managed in detail.

The log search 130 can search and collect only log data, which is detailed information of an arbitrary event, and display it on the integrated management unit viewer 30, so that log distribution and network load can be reduced.

Since the integrated management unit viewer 30 is connected to the integrated management unit 10 via a network, objects can be managed from any location regardless of location.

There are the following effects.

[0071]

As described above, according to the present invention, the object which manages the management target not only exchanges information directly with the management target, but also transmits the AP which the OS (operating system) outputs to the system log file. Since the related log and the AP are managed from other means such as log data output to the AP log file and have a means for obtaining management information, the management target can be managed regardless of the state of the management target (AP or the like). .

Also, of the events issued by the management target to the integrated management support unit and the log data output to the log file by the management target (AP, etc.), only those with immediacy are managed as events. A that operates on multiple computers because it can be notified to the
There is an effect that the monitoring of the management target such as P can be unified.

Further, when referring to the log, which is detailed information on the event, in the integrated management unit viewer, logs stored in a plurality of computers can be searched and collected, so that the logs are distributed and the load on the network is reduced. There is an effect that can be reduced.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a network system according to an embodiment.

FIG. 2 is a diagram illustrating an outline of processing operations performed by an integrated management unit, an integrated management support unit, and an integrated management unit viewer according to the embodiment;

FIG. 3 is a functional block diagram illustrating a configuration of an integrated management unit 10 according to the embodiment.

FIG. 4 is a functional block diagram illustrating a configuration of an integrated management support unit 20 according to the embodiment.

FIG. 5 is a diagram showing an observable condition of an object before application of the present invention.

FIG. 6 is a diagram illustrating conditions that can be monitored for an object after application of the present invention.

FIG. 7 is a diagram illustrating an object system according to the embodiment;

FIG. 8 is a diagram illustrating a relationship among a system object, an IP node object, and an AP object according to the embodiment;

FIG. 9 is a diagram illustrating attributes of a system object according to the embodiment.

FIG. 10 is a diagram illustrating attributes of an IP node object according to the embodiment.

FIG. 11 is a diagram illustrating attributes of an AP object according to the embodiment.

FIG. 12 is a diagram illustrating a relationship between log objects according to the embodiment;

FIG. 13 is a diagram illustrating a relation between event objects according to the embodiment.

FIG. 14 is a diagram illustrating attributes of an event object and a log object according to the embodiment.

FIG. 15 is a diagram illustrating contents of attributes of an event object and a log object according to the embodiment.

FIG. 16 is a PAD illustrating a flow of a log file monitoring process performed by the integrated management support unit of the embodiment.

FIG. 17 is a PAD diagram showing a flow of an AP object management process, which is one of the log file monitoring processes performed by the integrated management support unit of the embodiment.

FIG. 18 is a PAD illustrating a flow of a common log management process performed by the integrated management support unit according to the embodiment.

FIG. 19 is a PAD diagram illustrating a flow of an event management process performed by the integrated management support unit of the embodiment.

FIG. 20 is a PAD diagram illustrating a flow of an AP monitoring process performed by the integrated management support unit of the embodiment.

FIG. 21 is a PAD illustrating a flow of an AP object monitoring process which is one of the AP monitoring processes performed by the integrated management support unit of the embodiment.

FIG. 22 is a PA showing a flow of an event process, which is one of the AP monitoring processes performed by the integrated management support unit of the embodiment.
FIG.

FIG. 23 is a PAD illustrating a flow of an object process 1 which is one of the processes of the AP monitoring performed by the integrated management support unit of the embodiment.

FIG. 24 is a PAD diagram showing a flow of a process of an object process 2 which is one of the processes of the AP monitoring performed by the integrated management support unit of the embodiment.

FIG. 25 is a PAD diagram illustrating a flow of a log search process performed by the integrated management unit according to the embodiment.

FIG. 26 is a PAD diagram illustrating a flow of an event / log correspondence process, which is one of the log search processes performed by the integrated management unit according to the embodiment.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 10 ... Integrated management part, 20 ... Integrated management support part, 25 ... Object, 30 ... Integrated management part viewer, 40 ... System topology, 50 ... Common log, 60 ... Operating system (OS), 70 Application program (AP), 80 ... System log file, 90 ... AP log file

Claims (7)

[Claims] An integrated management support unit for managing a management target such as an application program (hereinafter simply referred to as an AP) operating in a computer system (hereinafter simply referred to as a computer); An integrated management unit for collecting management information of the management target and an integrated management unit viewer for viewing the collected management information. The integrated management support unit, the integrated management unit, and the integrated management unit viewer are connected by a communication network. In the network system described above, the integrated management support unit manages the management target using a management object (hereinafter, simply referred to as an object), and manages the management target using information exchange means with the management target. An object management method, wherein the object is managed by another means. 2. The object management method according to claim 1, wherein information is exchanged with the management object, for example, when log data output by the AP and an operating system (hereinafter, simply referred to as OS) is acquired. And updating the value of the object. 3. The object management method according to claim 2, wherein the event or log data output by the management target is identified by a job name or a business name represented by the identification information, output time information, and output. An object management method characterized by converting information into a common format having information for identifying a computer, information for identifying an output management target, and the like. 4. The object management method according to claim 3, wherein the event and the log data are managed in association with a common key. 5. The object management method according to claim 4, wherein log data present in a plurality of remote locations is searched and collected according to the common format condition. 6. The object management method according to claim 5, wherein the computer and the management target such as an AP and a job operating in the computer are managed in a hierarchically associated manner, thereby enabling the management target to operate on a plurality of computers. An object management method characterized by integrally managing configuration information, related information, state information, and the like of an object. 7. An object management method according to claim 1, wherein said object for managing said object to be managed is managed by another means.