KR100938676B1 - Event priority level setting method - Google Patents

Abstract

PURPOSE: A failure level determination method of an operation system for securing the stability of an operation system is provided to accurately determine a failure level by considering a method for determining a failure grade. CONSTITUTION: It confirms whether there is a failure event through event information(S101~S107). A failure event elements is subdivided(S109). An environmental variables by a field suitable for an element is set up(S111). A type of the fault event defines(S113). The environment variable is applied to the type definition(S115). The final fault level is determined(S117).

Description

Event Priority Level Setting Method

The present invention is to accurately determine the failure level (criticality) in the event of a failure of an operating system (business processing device, software, system, business processing process, etc.) in charge of operations across IT (information technology) system management or industry. The present invention relates to a method for determining a failure level of an operating system.

In general, the IT system management field is mostly operated by using an operating system such as a computer system having a predetermined operating system. Such an operating system is caused by an internal software failure, a failure in a business process process, or a hardware failure. In this case, it causes a great disruption to the operation of the whole system. Therefore, it is very important to detect faults promptly and to accurately determine the fault level.

In addition, it is very important that the industrial field of mass production of products, in particular, production facilities, such as factories, can be mass-produced by maintaining their normal operating conditions, and that the quality of the products produced is kept constant. Therefore, in these industries, it is important to quickly determine the failure of each equipment or to determine the failure of the software or the operating system in order to continuously produce the product and maintain the quality.

In addition, when the fault event occurs, the determination of the exact fault level (criticality) of the fault event is a very important factor for fault handling. For example, it is very important to accurately determine the level of failure (criticality) in the event of a failure since subsequent actions such as alarm level, processing priority, and anticipated damage situation are determined according to the failure level.

The conventional operating system failure level determination method for determining a failure level when a failure event occurs due to a malfunction or abnormal operation of an operating device in the IT system management field or all industrial fields is performed by receiving a failure event from the operating system. The method determines whether a failure occurs and, if a failure event occurs, assigns a predetermined importance (disability level) for each failure event type (Event_id).

In other words, the importance level is determined in a 1: 1 manner according to the event type (Event_ID) and the event_description information, and the failure level is determined by immediately assigning the corresponding importance level when a failure event occurs. do.

However, this conventional failure level determination technique does not take into account the complex surrounding conditions (event occurrence time, failure resources, operating hours, planned suspension, etc.) of the actual system operator, and thus has very different results from the actual operational importance. Incurred.

In addition, in the conventional technology, the level of disability derived by the system is often different from the result obtained based on the judgment criteria of the person, and thus, there is a disadvantage in that the revalidation work is frequently required by a person, and the revalidation work by a person has been omitted. In some cases, oversight of critical disability events caused large accidents.

Accordingly, the present invention has been proposed to solve various problems occurring in the above-described conventional disability rating method.

The problem to be solved by the present invention is the failure level in the event of a failure of the operating system (business processing equipment, software, systems, business processing processes, etc.) in charge of operations across the IT (information technology) system management field or industry field ( It is to provide a method of determining the failure level of the operating system to accurately determine the importance level.

Another problem to be solved by the present invention is to provide a method for determining the failure level of the operating system to ensure the stability of the system operation by determining the correct grade of the failure event occurred in the operating system, thereby inducing appropriate processing.

In order to solve the above problems, a preferred embodiment of the "determination method of the failure level of the operating system" according to the present invention,

In the method of determining a failure level when a failure occurs in the operating system connected to the operating system,

Performing a connection setup with the operating system, and then receiving event information generated by the operating system to check whether there is a failure event;

A second step of subdividing a fault event component when the check result is a fault event;

Setting a field-specific environment variable suitable for the component and defining a type of the failure event;

And a fourth step of determining a final failure level by applying the environment variable to the defined type.

Here, the present invention,

It is desirable to subdivide the event-description part of the fault event component into resources, numerical fields, and general fields.

The environment variables for each component are weekday_start_time, weekday_end_time, weekday_open_time_importance, weekday_non-hour_importance, weekend_start_time, weekend_end_time, weekend _Operating time_importance, weekend_non-operation time_importance, holiday_operation start_time, public holiday_operation end_time, public holiday_operation time_importance, public holiday_non-operation time_importance, planned holiday schedule

In addition, the type of failure event is the type "M", which is the applicable type in all cases, and the types "R", "S", the type that is applicable when there is one "consider" of importance consideration and the "resource" of importance. "Type" T "," U "which is the type when there are multiple plural types, type" N "which is the type applicable when" Numerical field "with importance considerations exists, type" X "indicating a type that requires special treatment. It is characterized by being.

In addition, the final failure level determination according to the type of failure event,

If the failure event type is "M", the final level is determined by considering the environment variable of the event type. If the failure event type is "R", the final level is determined by considering the environment variable of the resource. In the case of the event class, the final class is determined by considering the environmental variables. If the event type is "S", the final class is determined by considering the environmental variables of the resource. If the failure event type is "T", the resource with the highest priority is considered in consideration of the environment variable of the resource, but if there are multiple top-level resources, the preceding resource is applied first. In the case of event type, the final failure level is determined by applying the importance of the event type. If the failure event type is "U", the environment variable of the resource is considered. If the resource with the highest priority is applied, the priority is applied first if there are multiple top level resources, if there is no resource, the final failure level is determined as the lowest level, and if the failure event type is "N" The importance is determined by the value of the numerical field by event type or by event type and failure resource.If the occurrence value is out of the specified range, the final failure level is determined by applying the event type importance, and the failure event type is "X". In this case, the failure level is determined by performing a special processing program for the corresponding event type, and when the special processing program is not specified, the failure level is determined as the lowest level.

According to the present invention, when a failure event occurs in an operating system (business processing device, software, system, business processing process, etc.) that is in charge of operations in an IT (information technology) system management field or an industrial field, Consideration has the advantage of determining the correct level of disability.

In addition, since it is possible to determine the correct grade of the failure event occurred in the operating system, it is possible to induce appropriate processing when a failure event occurs, there is an advantage to ensure the stability of the system operation.

Hereinafter, described in detail with reference to the accompanying drawings a preferred embodiment of the present invention. If it is determined that the detailed description of the known function or configuration related to the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

1 is a schematic configuration diagram of a failure rating determination system to which the present invention is applied, and includes an operating system 100 and a failure rating determination system 200.

The operating system 100 collectively refers to a business processing device, software, a system, a business processing process, etc., and performs a function of controlling and operating a device or a whole system, and when a failure is detected, a failure event is performed in real time or periodically. Perform the function that occurs.

The failure level determination system 200 is connected to the operating system 100 and, upon receiving a failure event transmitted from the operating system 100, analyzes failure event information to determine a failure level and displays a failure level. Do this.

The failure level determination system 200 stores the received event information and a data interface 210 for requesting event information or receiving the transmitted event information after performing connection establishment with the operating system 100. , Various information for determining the grade of the fault event (for example, information for subdividing the event-description part of the component of the fault event, environment variable information for each field, type definition information for defining the event type, and the final fault) Information for determining a grade, etc.) is stored in the database 220, the failure occurrence determination unit 230 to determine whether a failure occurs by analyzing the event information received through the data interface 210, the data interface When event information is received through the device 210, a failure that occurs through various information stored in the database 220. Disability level determining unit for determining the class of the event, and control the display of the disability level, the disability level indicating the disability level when the failure of the operating system 100 in conjunction with the disability level determining unit 240 And a display unit 250.

The failure rating determination system 200 configured as described above is preferably implemented as one module. When implemented as a module, it can be used as a device to determine the failure level when a failure event occurs in the connected operating system by setting only a connection to a specific operating system.

2 is a flow chart showing a preferred embodiment of the "determination method of the failure level of the operating system" according to the present invention, the failure rating determination unit 240 in the failure rating determination system 200 to determine the failure level in software As a process, S stands for Step.

As shown in the figure, the method for determining a failure level of the operating system according to the present invention, after performing the connection setup with the operating system 100, receives the event information generated in the operating system 100 and fails. A first step (S101 ˜ S107) of checking whether an event is present; A second step (S109) of subdividing a fault event component when the check result is a fault event; A third step (S111 ˜ S113) of setting a field-specific environment variable suitable for the component and defining a type of the failure event; The fourth step (S117 to S119) of determining the final failure level by applying the environment variable to the defined type.

As described above, in the "operation grade determination method of the operating system" according to the present invention, the operation system 100 and the failure grade determination system 200 are physically connected (for example, a communication line) in step S101. Attempts to establish a connection with the operating system 100 through communication as shown.

Thereafter, when a response to the connection establishment is received from the operating system 100, a determination is made as a normal connection. The connection setup will be retried.

After the connection setting with the operating system 100 is normally made, the event information is requested to the operating system 100 in step S103, and the event information transmitted from the operating system 100 is received. .

If event information is received, the event information received in steps S105 and S107 is analyzed to determine whether there is a failure event. If the determination result is a failure event, the control proceeds to step S109 to subdivide the event-description portion among the components of the event. Done. The method of determining whether or not a failure event by analyzing the received event adopts a well-known event occurrence determination method that is well known in the field of monitoring the event, as a detailed description thereof will be omitted.

The method of subdividing the event_description part is as follows.

Events that occur during operation in a general system has a structure as shown in [Table 1] below.

Event structure in a typical operating system Occurrence time Generation (detection) system Event_type (Event_id) Event_description 2008.3.24 13:45:32 SYS1 IEF 4501 JOBA ABEND S037 REASON = OC 2008.3.24 13:46:21 TEC1 Ora_down_RDB_50 Oracle database instance ORADVE down 2008.3.24 13:47:47 NMS22 nw_node_down21 Router NR5334 is unavailable now 2008.3.24 13:49:15 APM3 perf_degrad_35 response time for BIZ3 is 6.4sec (over5)

Descriptive parts of these events are divided into "Resource", "Numeric Field", and "General Field". [Table 2] below shows an example of subdividing the description part of the components.

Example segmentation of event components Occurrence time Generation (detection) system Event_type (Event_id) Event_description 2008.3.24 13:45:32 SYS1 IEF4501 JOBA (Resource) ABEND S037 REASON = OC 2008.3.24 13:46:21 TEC1 Ora_down_RDB_50 Oracle database instance ORADVE (resource) down 2008.3.24 13:47:47 NMS22 nw_node_down21 Router NR5334 (Resource) is unavailable now 2008.3.24 13:49:15 APM3 perf_degrad_35 response time for BIZ3 (resource) is 6.4 (num) sec (over5)

Next, in step S111, an environment-specific environment variable appropriate to each of the above components is set. [Table 3] below shows the environment-specific environmental variables corresponding to each component.

Component Variables Component Environmental variable (importance according to environment) Generation (detection) system Weekday_start_time, weekday_end_time, weekday_hour_importance, weekday_non-hour_importance, weekend_start_time, weekend_end_time, weekend_open_time, Weekend_non-operation time_importance, holiday_operation start_time, holiday_operation end_time, holiday_operation time_importance, holiday_non-operation time_importance, planned holiday schedule Event_id Weekday_start_time, weekday_end_time, weekday_hour_importance, weekday_non-hour_importance, weekend_start_time, weekend_end_time, weekend_open_time, Weekend_non-operation time_importance, holiday_operation start_time, holiday_operation end_time, holiday_operation time_importance, holiday_non-operation time_importance, planned holiday schedule resource Weekday_start_time, weekday_end_time, weekday_hour_importance, weekday_non-hour_importance, weekend_start_time, weekend_end_time, weekend_open_time, Weekend_non-operation time_importance, holiday_operation start_time, holiday_operation end_time, holiday_operation time_importance, holiday_non-operation time_importance, planned holiday schedule Numeric Field by Event_id Classification of importance of numerical interval "by Event_id" or "by Event_id and Disability Resource"

Next, in step S113, an event type type is defined for each of the generated fault events. [Table 4] below shows the definition of event type by event type.

Event type Event type type Contents Importance Handling M Applicable in all cases Make Event_id importance as final R When there is one "Resource" to consider materiality If resources exist, apply their importance. Event type importance is applied when there is no corresponding resource S Apply the importance of resources in the presence of resources. In case of no resource, the final importance is "lowest grade" T When there are multiple "resources" to consider materiality In the presence of resources, apply the importance of resources with the highest possible importance. If multiple top-level resources exist, the preceding resource takes precedence. Event type importance is applied when there is no resource. U In the presence of resources, apply the importance of resources with the highest possible importance. If multiple top-level resources exist, the preceding resource takes precedence. In the absence of resources, the final importance is "lowest grade". N Importance consideration "numeric field" exists Materiality judgment by event type or by numerical type by event type and failure resource Example) 50 or more and less than 80: Severity 3 80 or more and less than 95: Severity 2 95 or more and less than 101: Severity 1 Otherwise: Importance by event type X Other special treatment required Specify special processing program by event type

When the definition of the event type is finished for the generated failure event, the final failure level is determined by applying environment variables for each event type in steps S115 and S117.

That is, if the failure event type is "M", the final grade is determined by considering the environmental variable of the corresponding event type, and when the failure event type is "R", the final grade is determined by considering the environmental variable of the corresponding resource. In case there is no resource, the final class is determined by considering the environment variables of the event type.

In addition, when the failure event type is "S", the final level is determined by considering the environmental variables of the resource. If there is no resource, the final level is applied to the lowest level. When the failure event type is "T", In consideration of the environmental variables of the resource, apply the importance of the resource with the highest importance, but if there are multiple top-level resources, apply the preceding resource first, and if there is no resource, determine the final failure level by applying the event type importance. Done.

If the fault event type is "M", "R", "S" and "T", then consider the environment variables of the event generation system, and the importance of the event occurrence system with the final importance derived above. In higher cases, the importance of the event generating system is determined as the final importance. The final importance cannot exceed the importance of the event generation system in which environmental variables are considered.

In addition, when the failure event type is "U", the priority of the resource with the highest priority is applied in consideration of the environment variable of the resource, but if there are multiple top-level resources, the priority resource is applied first. The lowest grade is used to determine the final level of disability.

In addition, if the fault event type is "N", the importance is determined according to the value of the corresponding event type or the value of the numerical field of each event type and the failure resource. If the occurrence numeric value is outside the specified range, the event type importance is applied to the final failure. The grade will be judged.

Finally, when the failure event type is "X", the failure level is determined by performing a special processing program for the corresponding event type, but when the failure event type is not specified, the failure level is determined as the lowest level.

Subsequently, in step S119, the administrator is notified of the determined disability level, so as to establish a follow-up countermeasure, and the disability level is displayed.

If a failure grade using a failure grade determination method according to the present invention and a failure grade determination method according to the present invention is applied to a failure event occurring in an actual operating system, the following [Table 5].

Materiality judgment case Event Priority Determination Criticality determination of the present invention RAD017 SEOUL21 rader detected a flying object at 56km ahead, in latitude 37 ° 92 'North and in longitude 126 ° 70' East  Level 2: Radar detected an unidentified object.  Level 1: An unidentified object was detected 56km ahead of Seoul Radar, 37 ° 92 'north latitude, and 126 ° 70' east longitude. RAD017 DAIGU47 rader detected a flying object at 96km ahead, in latitude 36 ° 50 'North and in longitude 128 ° 00' East  Level 2: Radar detected an unidentified object. Level 3: An unidentified object was detected at the radar 96 km, 36 ° 50 'north latitude, and 128 ° 00' east longitude.

In conclusion, the conventional disability rating method is a method of assigning only an event type to a predetermined importance level, and thus assigns a uniform disability level to other matters as shown in [Table 5]. It may cause an accident.

On the other hand, since the present invention considers the environmental variables (for example, Seoul, Daegu), and because it is given the optimal level of failure in consideration of the environment in the same issue, the optimal level of failure for the same event as well known Will be given. Therefore, it is possible to prevent problems that cause a major accident by missing important events.

The present invention is not limited to the above-described specific preferred embodiments, and various modifications can be made by any person having ordinary skill in the art without departing from the gist of the present invention claimed in the claims. Of course, such changes will fall within the scope of the claims.

The present invention described above can be applied to an operating system in an IT related field or an industrial field to accurately determine a failure level, and of course, only a data interface can accurately determine a failure level of a corresponding system. It can be extended to all fields such as industry and environmental industry.

1 is a block diagram showing a schematic configuration of a failure determination system to which the present invention is applied.

2 is a flow chart showing a failure rating determination method of the operating system according to the present invention.

<Explanation of symbols for the main parts of the drawings>

100... Operating system

200... Fault Rating Determination System

210... Data interface

220... Database

230... Failure occurrence judging unit

240... Disability Rating Determination

250... Fault level indicator

Claims (6)

delete delete In the method of determining the failure level in the event of a failure of the operating system connected to the operating system for operating equipment or devices, etc. Performing a connection setup with the operating system, and then receiving event information generated by the operating system to check whether there is a failure event; A second step of subdividing a fault event component when the check result is a fault event; Setting a field-specific environment variable suitable for the component and defining a type of the failure event; Including the fourth step of determining the final failure level by applying the environmental variable to the defined type, The environment variables for each component include weekday_operation start_time, weekday_operation end_time, weekday_operation time_importance, weekday_non-operation time_importance, weekend_operation start_time, weekend_operation end_time, Weekend_operating time_importance, weekend_non-operation time_importance, public holiday_operation start_time, public holiday_operation end_time, public holiday_operation time_importance, public holiday_non-operation time_importance, planned holiday Failure level determination method of the operating system, characterized in that. In the method of determining the failure level in the event of a failure of the operating system connected to the operating system for operating equipment or devices, etc. Performing a connection setup with the operating system, and then receiving event information generated by the operating system to check whether there is a failure event; A second step of subdividing a fault event component when the check result is a fault event; Setting a field-specific environment variable suitable for the component and defining a type of the failure event; Including the fourth step of determining the final failure level by applying the environmental variable to the defined type, The type of failure event is In all cases, the type "M", which is an applicable type, and the types "R" and "S", which are applicable types when there is one importance consideration "resource", the type where there are multiple "importance" considerations Phosphorus types "T" and "U", the type "N" which is the type applicable when the importance value "numeric field" exists, and the type "X" which indicates the type that requires special treatment. How to determine your level of disability. The method of claim 4, wherein the final level of disability is determined according to the type of disability event. If the failure event type is "M", the final level is determined by considering the environment variable of the event type. If the failure event type is "R", the final level is determined by considering the environment variable of the resource. In case of event type, the final grade is determined by considering the environmental variables of the event type. If the event type is "S", the final grade is determined by considering the environmental variables of the resource. If the failure event type is "T", the resource of the highest priority is applied in consideration of the environment variable of the resource, but if there are multiple top-level resources, the preceding resource is applied first. If there is no event type, the final failure level is determined by applying the event type importance. If the failure event type is "U", the environment variable of the resource is considered. The priority of the resource with the highest priority is applied. If there are multiple top level resources, the priority is applied first. If there are no resources, the lowest level of failure is determined as the lowest level. If the type of failure event is "N", The importance is determined by the value of the numerical field by event type or by event type and failure resource.If the occurrence value is out of the specified range, the final failure level is determined by applying the event type importance, and the failure event type is "X". If the failure level is determined by performing a special processing program for the event type, if the special processing program is not specified, the failure level is determined by the lowest level. 6. The method of claim 5, wherein when the fault event type is "M", "R", "S" and "T", the environment variable of the event generation system is considered, and the final importance derived above is considered. And determining the importance of the event generating system as the final importance when the importance of the event generating system is higher than the importance of the event generating system.

Images