KR20170108315A - Method and apparatus for monitoring fault of system - Google Patents

Abstract

The present invention relates to a method and an apparatus for monitoring a fault of a system. According to the present invention, provided is the method for monitoring a fault of a system, which comprises the steps of: determining whether a fault of a system occurs based on monitoring data; searching a fault causative parameter when the fault of the system occurs; and adjusting a monitoring period on monitoring target parameters based on a search result of the fault causative parameter.

Description

[0001] METHOD AND APPARATUS FOR MONITORING FAULT OF SYSTEM [

The present invention relates to a system fault monitoring method and apparatus.

In order to identify the cause of the failure and to record the data, the system should store various monitoring data on the platform, and the amount of the data increases exponentially over time.

Therefore, a method for increasing the storage efficiency of the monitoring data is needed.

An object of the present invention is to dynamically designate data of a parameter having a value as failure cause analysis information in order to improve storage efficiency of monitoring big data in a big data based failure analysis system.

It is an object of the present invention to specify a differential period for each of multiple monitoring parameters.

In order to accomplish the objects of the present invention as described above and achieve the characteristic effects of the present invention described below, the characteristic structure of the present invention is as follows.

According to one embodiment, a method for monitoring system faults, comprising: determining whether a system fails based on monitoring data; If it is determined that the system has failed, searching for a failure cause parameter; And adjusting the monitoring period for the monitored parameters based on the search result of the failure cause parameter.

According to another embodiment, adjusting the monitoring period may reduce the monitoring period for the detected failure cause parameter if the failure cause parameter is found.

According to another embodiment, adjusting the monitoring period may increase the monitoring period for other monitored parameters except for the detected failure cause parameter.

According to another embodiment, adjusting the monitoring period may reduce the monitoring period for the monitored parameters if the failure cause parameter is not found.

According to another embodiment, the step of searching for the failure cause parameter may include calculating a correlation between the failure cause parameter and the monitoring target parameters, and searching the failure cause parameter based on the correlation .

According to another embodiment, the step of searching for the failure cause parameter may include calculating a correlation coefficient for the monitored parameters and searching for the failure cause parameter based on the correlation.

According to another embodiment, the step of searching for the failure cause parameter may be to search for a failure cause parameter based on the magnitude of the correlation change in the analysis window.

According to another embodiment, the step of searching for the failure cause parameter may be to calculate the magnitude of the change in the correlation based on the value of the correlation coefficient in the analysis window.

According to another embodiment of the present invention, the step of searching for the failure cause parameter may include comparing a magnitude of a change in the correlation with the monitoring target parameters and a threshold value, and comparing the magnitude of the correlation with the monitoring target parameters, The target parameter can be added as a cause of failure.

According to another embodiment, there is provided a system fault monitoring method, comprising the steps of: generating a message relating to a monitored parameter of the added fault cause; And transmitting the generated message to the system management terminal.

According to another embodiment, a system fault monitoring method includes: collecting monitoring data using a monitoring agent; And classifying the fault information among the collected monitoring data.

According to an embodiment, there is provided a system fault monitoring method, comprising: determining a cause of a fault of a system fault that occurs when a fault occurs in the system; Searching for a failure cause parameter based on the determined failure cause; And differentially setting a monitoring period for the parameters of the system based on the searched fault cause parameter.

According to an embodiment, there is provided a system fault monitoring apparatus comprising: a fault occurrence determination unit that determines whether a system fault has occurred based on monitoring data; A parameter search unit for searching for a failure cause parameter if the failure of the system is determined to have occurred; And a monitoring period setting unit that adjusts a monitoring period for monitoring target parameters based on the search result of the failure cause parameter.

According to another embodiment, the system fault monitoring apparatus may further include: a message generating unit for generating a message relating to the monitored parameter of the added fault cause; And a message transmission unit for transmitting the generated message to the system management terminal.

According to another embodiment, a system fault monitoring apparatus includes: a monitoring data collector for collecting monitoring data using a monitoring agent; And a fault information classifying unit for classifying fault information among the collected monitoring data.

The present invention has the effect of controlling the storage rate differentially according to the fault correlation, rather than storing a lot of fixed data in storing analysis data in a big data platform.

The present invention can provide an enhancement of the failure cause analysis probability by increasing the monitoring data storage amount of the parameters related to the failure. Therefore, the present invention has the effect of improving the data storage efficiency by reducing the monitoring data storage amount of the parameters not mainly related to the failure.

1 is a conceptual diagram illustrating a system fault monitoring method according to an embodiment of the present invention.
2 is a block diagram of an embodiment of the present invention. This shows the flow of the system fault monitoring method.
3 is a flowchart illustrating a system fault monitoring method according to an embodiment of the present invention.
4 illustrates a system fault monitoring method according to an embodiment of the present invention.
5 is a flowchart illustrating a system fault monitoring method according to an embodiment of the present invention.
FIG. 6 is a graph showing a system fault monitoring method according to an embodiment of the present invention.
7 is a system fault monitoring method according to an embodiment of the present invention, which is a correlation change table.
8 is a block diagram illustrating a system fault monitoring apparatus according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram illustrating a system fault monitoring method according to an embodiment of the present invention.

Referring to FIG. 1, a system failure monitoring apparatus 110 for analyzing faults using a big data platform can be known as a fault analysis monitoring system based on a data analysis platform. At this time, the system fault monitoring apparatus 110 can monitor the faults of the system 1 (131) to the system N (132) by communicating with the monitoring agent as a distributed component. At this time, each of the monitoring agents may monitor the fault of the matching system, and may transmit the fault information monitored by the system fault monitoring apparatus 110 according to the period set by the system fault monitoring apparatus 110.

According to one embodiment, as a big data-based fault analysis system, the system fault monitoring device 110 may store monitoring data in the database 111 at a specific fixed period. In this case, since data stored in a fixed period may be highly unlikely to be valuable as failure analysis information, it is necessary to adaptively store valuable data as failure analysis information in order to improve data storage efficiency. For example, the system fault monitoring apparatus 110 can specify a differential period for each monitoring data.

In addition, according to one embodiment, the system fault monitoring apparatus 110 may store the received fault information in the database 111, and the cycle or system fault monitoring apparatus 110 monitored by the monitoring agent may perform a big data analysis And can transmit the monitored result to the system administrator terminal 120. [0154] FIG.

2 is a block diagram of an embodiment of the present invention. This shows the flow of the system fault monitoring method.

Referring to FIG. 2, the system fault monitoring method performed by the system fault monitoring apparatus may include the following steps.

In step 201, the system fault monitoring apparatus may determine whether a system failure has occurred based on the monitoring data. At this time, the monitoring data may be stored in a database inside the system fault monitoring apparatus. Of course, in some cases, the monitoring data may be stored in a connected database outside the system fault monitoring device.

In step 202, the system fault monitoring apparatus can search for a failure cause parameter if it is determined that a system failure has occurred.

Specifically, the system fault monitoring apparatus can calculate the correlation between the failure cause parameter and the monitoring target parameters, and search for the failure cause parameter based on the correlation. In addition, the system fault monitoring apparatus can calculate a correlation coefficient for the monitored parameters and search for the failure cause parameter based on the correlation.

In addition, the system fault monitoring apparatus can search for the fault cause parameter based on the magnitude of the correlation change in the analysis window. Also, the system fault monitoring apparatus can calculate the magnitude of the correlation change based on the value of the correlation coefficient in the analysis window.

The system fault monitoring apparatus may also compare the magnitude of the change in the correlation to the monitored parameters with the threshold value and add the monitored parameter corresponding to the magnitude of the change in the correlation that exceeds the threshold as a failure cause .

In step 203, the system fault monitoring device can adjust the monitoring period for the monitored parameters based on the search result of the failure cause parameter.

Specifically, the system fault monitoring apparatus can reduce the monitoring period for the detected failure cause parameter when the failure cause parameter is found. At this time, the system fault monitoring apparatus can increase the monitoring period for other monitoring target parameters except the detected failure cause parameter. In addition, the system fault monitoring apparatus can reduce the monitoring period for the monitoring target parameters when the failure cause parameter is not found.

According to one embodiment, the system fault monitoring apparatus can generate a message relating to the monitored parameter of the added fault cause. Next, the system fault monitoring apparatus can transmit the generated message to the system management terminal.

According to one embodiment, the system fault monitoring device can collect monitoring data using a monitoring agent. Next, the system fault monitoring apparatus may classify the fault information among the collected monitoring data.

3 is a flowchart illustrating a system fault monitoring method according to an embodiment of the present invention.

According to one embodiment, a system fault monitoring method performed by the system fault monitoring apparatus may include the following steps.

In step 301, the system fault monitoring device can determine the cause of the failure of the system failure that occurs if a failure occurs in the system.

In step 302, the system fault monitoring apparatus can search for the fault cause parameter based on the determined fault cause.

In step 303, the system fault monitoring apparatus can differentially set a monitoring period for the parameters of the system based on the searched fault cause parameter.

4 illustrates a system fault monitoring method according to an embodiment of the present invention.

Referring to FIG. 4, the configuration of the system failure monitoring apparatus 410 can be known as a failure analysis system based on a big data analysis platform that improves the monitoring big data storage efficiency.

According to one embodiment, in order to analyze the system failure through the big data platform and to increase the data storage efficiency by adaptively lightening the amount of failure related monitoring data, the system failure monitoring apparatus 410 includes a big data analysis method and a platform Can analyze many parameters and data at the same time. In particular, when a system failure occurs, the system failure monitoring apparatus 410 may use a big data analysis to identify the cause of the failure.

According to one embodiment, the system fault monitoring apparatus 410 includes a monitoring data storage 411, a monitoring data collection and storage unit 412, a device event classification unit 413, Unit 414, and a monitoring period setting unit 415. However, the present invention is not limited thereto. At this time, the monitoring data storage 411, the monitoring data collection and storage unit 412, the device event classification unit 413, the failure cause parameter searching unit 414, and the monitoring period setting unit 415, A memory, and a memory. However, the present invention is not limited thereto.

According to one embodiment, the monitoring data collection and storage unit 412 of the system fault monitoring apparatus 410 monitors multiple monitoring data generated by the components distributed in the system 1 to system N from the monitoring agents 421, 422, 423, 424). ≪ / RTI > Next, the device event classification unit 413 of the system fault monitoring apparatus 410 can confirm the fault event. Next, the failure cause parameter search unit 414 of the system failure monitoring apparatus 410 can analyze the cause of the failure. Next, the monitoring period setting unit 415 of the system fault monitoring apparatus 410 may control the collection period of the monitoring data according to the correlation of the failure cause.

5 is a flowchart illustrating a system fault monitoring method according to an embodiment of the present invention.

Referring to FIG. 5, as a system fault monitoring method performed by the system fault monitoring apparatus, an algorithm for controlling the fault monitoring data storage period can be known.

According to one embodiment, a system fault monitoring method performed by the system fault monitoring apparatus may include the following steps.

First, in step 511, the system fault monitoring apparatus can collect monitoring data through the monitoring agent of each component.

At step 512, the system fault monitoring device may classify fault information in the monitoring data. At this time, the failure information may be performance degradation, error occurrence log, and the like, but is not limited thereto. Also, at step 513, the system fault monitoring device may store all monitoring data.

In step 514, the system fault monitoring device may return to collecting monitoring data (step 511) if no faults are found in the system.

Next, in step 515, the system fault monitoring apparatus can notify the system administrator of the occurrence of a fault when a fault is detected in the system. Also, at step 516, the system fault monitoring device may analyze the cause of the fault.

의 모니터링 주기를 기존 모니터링 주기인

에서 변경 후 모니터링 주기인

으로 모니터링 주기의 변화 크기

만큼 감소(

) 시켜서 차기에 장애 원인 분석 확률을 향상시킬 수 있다. 또한, 시스템 장애 모니터링 장치는, 모니터링 데이터를 수집하는 단계(511)로 돌아갈 수도 있다.If, in step 517, the system fault monitoring device fails to find a fault cause parameter, then in step 518, the system fault monitoring device determines whether all parameters

The monitoring cycle of

In the monitoring cycle after the change

Changes in Monitoring Cycle by Size

Decrease by

), It is possible to improve the probability of analyzing the cause of failure at the next time. The system fault monitoring device may also return to collecting monitoring data (step 511).

Next, in step 519, when the system failure monitoring device finds the failure cause parameter, it first notifies the system administrator of the failure cause.

) 시켜서, 주요 장애 원인으로 모니터링 관심도를 높일 수 있다. 또한, 단계(521)에서, 시스템 장애 모니터링 장치는, 장애 원인이 아닌 파라미터들의 모니터링 주기를 증가(

)시켜서 모니터링 데이터 저장량을 감소시켜서 저장 효율을 향상시킬 수 있다. 또한, 시스템 장애 모니터링 장치는, 모니터링 데이터를 수집하는 단계(511)로 돌아갈 수도 있다.Next, in step 520, the system fault monitoring apparatus reduces the monitoring period of the failure cause parameters (step < RTI ID = 0.0 >

) To increase monitoring interest as a major cause of disability. Also, at step 521, the system fault monitoring device may increase the monitoring period of parameters that are not the cause of the fault

) To reduce the amount of monitoring data stored, thereby improving storage efficiency. The system fault monitoring device may also return to collecting monitoring data (step 511).

의 모니터링 주기의 변화 크기

는 시스템 관리자의 정책에 따라서 가변 수치 또는 고정 수치로 지정될 수 있다. 예를 들어,

가 가변 수치로 지정되는 경우에는 파라미터의 중요도에 따라서 모니터링 주기의 변화 폭이 조정될 수 있다. 또한,

의 중요도에 따른

의 지정 값은

와 장애를 일으킨 파라미터인

와의 상관 관계 변화 크기인

와

의 곱으로 연산될 수 있다.At this time,

Change in Monitoring Cycle of Size

May be designated as a variable value or a fixed value according to the policy of the system administrator. E.g,

Is set to a variable value, the variation width of the monitoring period can be adjusted according to the importance of the parameter. Also,

Depending on the importance of

The specified value of

And the parameter causing the failure

And the magnitude of the correlation change

Wow

. ≪ / RTI >

로 모니터링 주기의 변경 주기를 결정하고, 모니터링 주기를 증가시키는 경우

으로 모니터링 주기의 변경 주기를 결정할 수 있다. 이때,

는 지속적으로 변화하는 값이므로,

또한 유동적으로 변화될 수 있다. 또한,

를 고정 수치로 지정하는 경우

는 상수로 설정될 수 있다. 예를 들어

가 2로 지정되는 경우, 변경 후 모니터링 주기는

이 되고 모니터링 주기는 점진적으로 변경될 수 있다. According to one embodiment, the system fault monitoring device may be configured to reduce the monitoring period

To determine the change period of the monitoring period and to increase the monitoring period

The change period of the monitoring period can be determined. At this time,

Is a continuously changing value,

It can also be changed flexibly. Also,

If you specify a fixed number

Can be set to a constant. E.g

Is set to 2, the monitoring cycle after the change is

And the monitoring period can be gradually changed.

FIG. 6 is a graph showing a system fault monitoring method according to an embodiment of the present invention.

Referring to FIG. 6, a method for monitoring a system failure performed by the system failure monitoring apparatus can identify a failure analysis method.

<= 1)를 계산할 수 있다. 또한, 시스템 장애 모니터링 장치는, 장애 시점 이전의 지정된 분석 윈도우 내에서 상관 관계 변화 크기 계산식으로서 하기 수학식 1을 이용하여 상관 관계 변화 크기인

를 계산할 수 있다. 이때, 수학식 1에서

는 윈도우 내의 상관계수 최대값,

는 윈도우 내의 상관계수 최소값을 나타낼 수 있다.According to one embodiment, the system fault monitoring apparatus can correlate both the data of the faulty parameter Pe and the data of the faulty parameter Pk. At this time, the system fault monitoring apparatus calculates the correlation coefficient (-1 <=

&Lt; = 1). In addition, the system fault monitoring apparatus may calculate a correlation change magnitude, which is a magnitude of a correlation change magnitude,

Can be calculated. At this time, in Equation (1)

Is the maximum correlation coefficient in the window,

Can represent the minimum correlation coefficient in the window.

7 is a system fault monitoring method according to an embodiment of the present invention, which is a correlation change table.

Referring to FIG. 7, a system failure monitoring method performed by the system failure monitoring apparatus can be known as a correlation change comparison method.

According to one embodiment, the system fault monitoring apparatus can predict a failure cause if the magnitude of the correlation change with the parameter exceeds the set threshold value. At this time, the threshold value may be specified by the system administrator, but is not limited thereto. For example, if the threshold is 0.5, a parameter that is 0.5 or greater can be expected to be the cause of the failure. Also, for example, if the threshold is 0.4, a parameter that is greater than 0.4 may be expected to be the cause of the failure.

8 is a block diagram illustrating a system fault monitoring apparatus according to an embodiment of the present invention.

Referring to FIG. 8, the system fault monitoring apparatus 800 may include a fault occurrence determination unit 810, a fault cause parameter search unit 820, and a monitoring period setting unit 830. At this time, the system fault monitoring apparatus 800 may be a computing device such as a server. The failure occurrence determination unit 810, the failure cause parameter search unit 820, and the monitoring period setting unit 830 may include at least one of a memory, a processor, and a data transceiver. However, no.

The failure occurrence determination unit 810 can determine whether or not a system failure has occurred based on the monitoring data. At this time, the monitoring data may be stored in a database inside the system fault monitoring apparatus. The monitoring data may also be stored in a connected database outside the system fault monitoring device.

The failure cause parameter search unit 820 can search for the failure cause parameter when it is determined that the system failure has occurred. For example, the failure cause parameter search unit 820 can calculate the correlation between the failure cause parameter and the monitoring target parameters, and search for the failure cause parameter based on the correlation. Also, as occasion demands, the failure cause parameter search unit 820 may calculate a correlation coefficient for the monitored parameters and search for the failure cause parameter based on the correlation.

According to one embodiment, the failure cause parameter search unit 820 can search for failure cause parameters based on the magnitude of the correlation change in the analysis window. In addition, the failure cause parameter search unit 820 may calculate the magnitude of the correlation change based on the value of the correlation coefficient in the analysis window.

In addition, according to one embodiment, the failure cause parameter search unit 820 compares the magnitude of the change in the correlation with respect to the monitoring target parameters and the threshold value, and monitors (monitors) the magnitude of the change in the correlation exceeding the threshold The target parameter can also be added as a cause of failure.

The monitoring period setting unit 830 can adjust the monitoring period for the monitoring target parameters based on the search result of the failure cause parameter. For example, the monitoring period setting unit 830 may reduce the monitoring period for the detected failure cause parameter when the failure cause parameter is found. At this time, the monitoring period setting unit 830 may increase the monitoring period for other monitoring target parameters except the detected failure cause parameter. In some cases, the monitoring period setting unit 830 may reduce the monitoring period for the monitoring target parameters when the failure cause parameter is not found.

According to one embodiment, the system fault monitoring apparatus may further include a message generating unit and a message transmitting unit. At this time, the message generating unit and the message transmitting unit may include at least one of a memory, a processor, and a data transceiver, but the present invention is not limited thereto. For example, the message generating unit may generate a message relating to the monitoring target parameter of the added failure cause. Next, the message transmission unit may transmit the generated message to the system management terminal.

In addition, according to one embodiment, the system fault monitoring apparatus may further include a monitoring data collecting unit and a fault information classifying unit. The monitoring data collecting unit and the fault information classifying unit may include at least one of a memory, a processor, and a data transceiver, but the present invention is not limited thereto. For example, the monitoring data collector may collect monitoring data using a monitoring agent. Next, the fault information classification unit may classify the fault information among the collected monitoring data.

According to an exemplary embodiment, the system fault monitoring apparatus may include a fault cause determining unit, a fault cause parameter searching unit, and a monitoring period setting unit, as the case may be. At this time, the failure cause determining unit, the failure cause parameter searching unit, and the monitoring period setting unit may include at least one of a memory, a processor, and a data transceiver, but the present invention is not limited thereto. For example, the failure cause determination unit can determine the cause of the failure of a system failure that occurs when a failure occurs in the system. Next, the failure cause parameter search unit can search for the failure cause parameter based on the determined failure cause. Next, the monitoring period setting unit may set a monitoring period for the parameters of the system based on the searched failure cause parameter.

The methods according to embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and configured for the present invention or may be available to those skilled in the art of computer software.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. This is possible.

Therefore, the scope of the present invention should not be limited by the illustrated embodiments, but should be determined by the equivalents of the claims, as well as the claims that follow.

Claims (15)

In a system fault monitoring method,
Determining whether a system failure has occurred based on the monitoring data;
If it is determined that the system has failed, searching for a failure cause parameter;
Adjusting a monitoring period for monitoring parameters based on a search result of the failure cause parameter
Wherein the system failure monitoring method comprises: The method according to claim 1,
Wherein the adjusting the monitoring period comprises:
And if the failure cause parameter is found, reduces the monitoring period for the detected failure cause parameter. 3. The method of claim 2,
Wherein the adjusting the monitoring period comprises:
And increases the monitoring period for other monitored parameters except for the detected failure cause parameter. The method according to claim 1,
Wherein the adjusting the monitoring period comprises:
And if the failure cause parameter is not found, reduces the monitoring period for the monitored parameters. The method according to claim 1,
Wherein the step of searching for the failure cause parameter comprises:
Calculating a correlation between the failure cause parameter and the monitoring target parameters, and searching the failure cause parameter based on the correlation. The method according to claim 1,
Wherein the step of searching for the failure cause parameter comprises:
Calculating a correlation coefficient for the monitored parameters, and searching for the failure cause parameter based on the correlation. The method according to claim 1,
Wherein the step of searching for the failure cause parameter comprises:
Wherein the failure cause parameter is searched based on the magnitude of the change in the correlation within the analysis window. 8. The method of claim 7,
Wherein the step of searching for the failure cause parameter comprises:
And calculates the magnitude of the change in the correlation based on the value of the correlation coefficient in the analysis window. The method according to claim 1,
Wherein the step of searching for the failure cause parameter comprises:
Comparing the magnitude of a change in the correlation with the monitoring target parameters and a threshold value and adding a monitoring target parameter corresponding to a magnitude of the correlation change exceeding the threshold as a failure cause. 10. The method of claim 9,
Generating a message relating to the monitored parameter of the added failure cause; And
Transmitting the generated message to the system management terminal;
Further comprising the steps of: The method according to claim 1,
Collecting monitoring data using a monitoring agent; And
Classifying fault information among the collected monitoring data;
Further comprising the steps of: In a system fault monitoring method,
Determining the cause of the failure of the generated system failure if the system fails;
Searching for a failure cause parameter based on the determined failure cause;
Differentially setting a monitoring period for the parameters of the system based on the searched fault cause parameter
Wherein the system failure monitoring method comprises: A system fault monitoring apparatus comprising:
A fault occurrence determination unit for determining whether a fault has occurred in the system based on the monitoring data;
A parameter search unit for searching for a failure cause parameter if the failure of the system is determined to have occurred;
A monitoring period setting unit for adjusting a monitoring period for monitoring parameters based on a search result of the failure cause parameter;
And a system fault monitoring device. 14. The method of claim 13,
A message generating unit for generating a message relating to the monitored parameter of the added failure cause; And
A message transmission unit for transmitting the generated message to the system management terminal;
Wherein the system fault monitoring device further comprises: 14. The method of claim 13,
A monitoring data collection unit for collecting monitoring data using a monitoring agent; And
A fault information classifying unit for classifying fault information among the collected monitoring data,
Wherein the system fault monitoring device further comprises:

Images