WO2016063816A1 - Dispositif et procédé pour détecter des pré-indications d'anomalie dans un système informatique - Google Patents

Dispositif et procédé pour détecter des pré-indications d'anomalie dans un système informatique Download PDF

Info

Publication number
WO2016063816A1
WO2016063816A1 PCT/JP2015/079383 JP2015079383W WO2016063816A1 WO 2016063816 A1 WO2016063816 A1 WO 2016063816A1 JP 2015079383 W JP2015079383 W JP 2015079383W WO 2016063816 A1 WO2016063816 A1 WO 2016063816A1
Authority
WO
WIPO (PCT)
Prior art keywords
condition
computer system
satisfied
trace
abnormality
Prior art date
Application number
PCT/JP2015/079383
Other languages
English (en)
Japanese (ja)
Inventor
英児 西島
直之 武田
Original Assignee
株式会社日立製作所
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 株式会社日立製作所 filed Critical 株式会社日立製作所
Publication of WO2016063816A1 publication Critical patent/WO2016063816A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment

Definitions

  • the present invention relates to an abnormality sign detection apparatus and method for detecting a sign of a failure in an information system or a control system.
  • the conventional abnormality sign detection method assumes a situation that can be assumed in advance, and determines the measurement items for monitoring the situation, and with respect to the regularly monitored measurement value, the threshold value in the normal range Whether it is an abnormal condition is detected depending on whether it is within the range.
  • the situations that can be assumed in advance are, for example, the amount of communication traffic and the ping response time in Japanese Patent Laid-Open No. 2010-009313.
  • the usage amount of the computer resource may be, for example, the usage amount of OS management resources such as CPU load, memory load, shared memory, and the like.
  • OS management resources such as CPU load, memory load, shared memory, and the like.
  • System failures include computer resource usage (CPU load, memory load, communication load, usage of OS management resources such as shared memory) and abnormal conditions (around 100% CPU load, memory exhaustion, increased communication volume, shared memory, etc.) May occur regardless of the OS management resource exhaustion).
  • system failures are relatively likely to occur due to insufficient design or missing items during testing, that is, insufficient coverage. Specifically, since it is difficult to identify all abnormal situations in tests during pre-setting and on-site adjustment, and it is difficult to create abnormal situations in a test environment, test items are missing. That is, a system failure occurs when an abnormal state that occurs during actual operation cannot be assumed.
  • the present invention aims to detect a situation in which a situation in which a system failure occurs cannot be assumed in advance, that is, a sign of an unknown abnormality.
  • a trace unit that traces the feature points extracted by the feature point extraction unit and holds the trace results, and when there is no failure in the computer system
  • a comparison unit that compares the reference data that is the trace result of the current and the current trace result, and determines whether the comparison result satisfies a first condition that is set in advance, and when the determination satisfies the first condition, It is implement
  • the “Execution path feature point extraction unit” calculates the execution path and frequency of each function for each program such as an application for each normal processing test and abnormal processing test.
  • a path operated during the normal processing test is regarded as a normal path
  • a path operated during the abnormal processing test is regarded as an abnormal path.
  • a function to be a feature point of each path is specified, and the function as the feature point is set as a function trace point during operation. This reduces the function trace load during operation.
  • the “measurement pattern calculation and comparison unit” calculates the execution path and frequency based on the function name as a feature point for each program in the actual environment.
  • the statistical reference pattern in the actual environment is different from the latest measurement pattern, it is determined that there is a possibility of an abnormal state (specifically, a situation where the coverage is missing during the test).
  • FIG. 1 is a block diagram showing a software configuration of a computer 100 to which the first embodiment is applied.
  • the software configuration of the computer includes a program group 101, a trace unit 102, various trace data 103, function trace data 104, an execution path feature point extraction unit 111, a function call graph 112, a function execution path frequency table 113, and a reference pattern calculation unit. 121, a feature function frequency table 122, a reference pattern 123, a sign determination condition table setting unit 131, a sign determination condition table 132, a measurement pattern calculation and comparison unit 133, and a measurement pattern 134.
  • the measurement pattern 134 also stores an exclusion pattern, a capture pattern, etc., which will be described later.
  • the trace unit 102 outputs various trace data 103 and function trace data 104 for the program group 101.
  • the execution path feature point extraction unit 111 is executed at the time of the test, receives the function trace data 104, and outputs the function call graph 112 and the function execution path frequency table 113.
  • the reference pattern calculation unit 121 is executed during operation and outputs a reference pattern 123 based on the function trace data 104.
  • the measurement pattern calculation and comparison unit 133 is executed at the time of operation, calculates the measurement pattern 134, compares it with the reference pattern 123, and increases or decreases the number of trace items with respect to the trace unit 102 when the conditions of the predictor determination condition table 132 are matched. Instruct. That is, a detailed failure analysis can be performed by increasing the number of trace items when an abnormality sign is detected.
  • the execution path feature point extraction unit 111, the function call graph 112, the function execution path frequency table 113, etc. are enclosed by solid lines, and are modules that are executed when pre-setting is performed during system development.
  • the portion surrounded by the dotted line including the reference pattern calculation unit 121, the feature function frequency table 122, the reference pattern 123, etc. may be set at the time of development, but is usually set using an actual system such as local adjustment. This is the module that will be executed. In actual operation, all the modules in FIG. 1 may be executed.
  • FIG. 2 is an example of a hardware configuration diagram of a computer according to the present invention.
  • the computer 100 includes a CPU 211, a memory device 231, an external storage device 241 for auxiliary storage, an input device 261 such as a keyboard and a mouse, an output device 271 such as a liquid crystal display, and an external device. It can be realized by a general computer provided with a network device 251 for performing data communication with the device.
  • the CPU 211 is an arithmetic unit having one or a plurality of processor cores 212 to 215.
  • the program group 101, the trace unit 102, the execution path feature point extraction unit 111, the reference pattern calculation unit 121, the sign determination condition table setting unit 131, and the measurement pattern calculation and comparison unit 133 are performed by the CPU 211. This is realized by loading a predetermined program stored in advance in the external storage device 241 into the memory device 231 and executing it.
  • FIG. 3 is a flowchart showing a processing flow of the feature point extraction unit 111 of the execution path in FIG.
  • the feature point extraction unit 111 of the execution path is a process to be operated at the time of a test such as a single unit or a combination as a preliminary preparation.
  • the trace unit is set to collect all function unit traces.
  • Step 320 performs a test on the program group 101 in FIG. 1 and collects a trace of each program for each function.
  • This test is divided into a normal processing test and an abnormal processing test.
  • this abnormality processing test is performed separately for mild abnormality processing and moderate abnormality processing.
  • Examples of a mild abnormality processing test include a memory securing retry process and a communication retry process.
  • An example of a moderate abnormality processing test is restarting a program that has been stopped due to some abnormality.
  • examples of the program group 101 in FIG. 1 are application A, application B, and the like. In the following, for ease of explanation, the application A in the program group 101 will be mainly described.
  • the output result of the function trace in step 320 is as shown in FIGS.
  • FIG. 4 is an example of the function trace data 104, which is function trace data during a normal processing test.
  • the first column 2010140701 is the date
  • the second column 10: 00: 00.001 is the time
  • the third column application A is the program name
  • the fourth column main () is the function name. It is the function trace data arranged.
  • the functions main (), funcA_a1 (), funcA_a2 (), and exit () of the application A are repeatedly executed.
  • Fig. 5 shows function trace data during a mild abnormality processing test.
  • the functions main (), funcA_b1 (), funcA_b2 (), and exit () of the application A are repeatedly executed.
  • Fig. 6 shows the function trace data during the medium abnormality processing test.
  • the functions main (), funcA_b1 (), funcA_c1 (), and exit () of the application A are repeatedly executed.
  • step 330 a call graph of the function of each program is created based on the collected function trace.
  • FIG. 7 is an example of a call graph of a function created based on the function trace data shown in FIGS.
  • the part where the function call relationship is main () 710 ⁇ funcA_a1 () 720 ⁇ funcA_a2 () 730 ⁇ exit () 740 is based on the function call order of the function trace data in the normal processing test of FIG. Created.
  • the part where the function call relation is main () 710 ⁇ funcA_b1 () 750 ⁇ funcA_b2 () 760 ⁇ exit () 740 is based on the function call order of the function trace data in the mild abnormality processing test of FIG. Created.
  • the part in which the function call relation is main () 710 ⁇ funcA_b1 () 750 ⁇ funcA_c1 () 770 ⁇ exit () 740 is the function call order of the function trace data in the middle abnormal processing test of FIG. Created from. Note that this is actually a complicated relationship, but here, for the sake of clarity, this example is used.
  • step 340 extracts all the patterns of the execution paths of the functions of each program based on the function call graph.
  • the first execution path of the function is main () 710 ⁇ funcA_a1 () 720 ⁇ funcA_a2 () 730 ⁇ exit () 740
  • the second is main () 710 ⁇ funcA_b1 () 750 ⁇ funcA_b2 () 760 ⁇ exit () 740
  • the third is main () 710 ⁇ funcA_b1 () 750 ⁇ funcA_c1 () 770 ⁇ exit () 740.
  • Step 350 calculates the execution frequency for each execution path of the function of each program based on the collected function trace.
  • FIG. 8 is an example of the function execution path frequency table 113.
  • the function execution path frequency table 113 includes a program name column 801, a function execution path column 802, a normal processing frequency column 803, a mild abnormal processing frequency column 804, and a moderate abnormal processing frequency column 805. Consists of.
  • the application name A is set in the program name column 801 and the function execution path column 802 is main () ⁇ funcA_a1 () ⁇ funcA_a2 () based on the function trace data in FIGS.
  • the normal processing frequency column 803 sets the execution frequency of 100 times, 0 times, and 0 times per unit time for each path, and the mild abnormality processing column 804 sets 0 times, 5 times, An execution frequency of 0 times is set, and an execution frequency of 0 times, 0 times, and 3 times per unit time is set for each path in the moderate abnormality processing frequency column 805.
  • Step 360 extracts a characteristic function uniquely determined for each execution path.
  • the characteristic function is funcA_a1 () or funcA_a2 () in the execution path of main () ⁇ funcA_a1 () ⁇ funcA_a2 () ⁇ exit (), and one of them is selected and funcA_a2 ( ).
  • the execution path of main () ⁇ funcA_b1 () ⁇ funcA_b2 () ⁇ exit () is funcA_b2 ()
  • the execution path of main () ⁇ funcA_b1 () ⁇ funcA_c1 () ⁇ exit () is funcA_c1 () Become.
  • characteristic functions hereinafter, characteristic functions will be referred to as characteristic functions.
  • FIG. 9 is a flowchart showing the flow of processing of the reference pattern calculation unit 121 of FIG.
  • the reference pattern calculation unit 121 is a process that is operated during actual system operation after on-site adjustment.
  • Step 910 is set to collect traces only for functions that are characteristic points for the trace part.
  • the functions that are feature points are funcA_a2 (), funcA_b2 (), and funcA_c1 () extracted in step 360 of FIG.
  • the function trace collection load can be reduced by focusing not on all function names but on feature functions limited among them.
  • Step 920 executes the program group 101 of FIG. 1 and collects a trace of the feature function in operation.
  • the output result of the feature function trace in step 920 is as shown in FIG. FIG. 10 has the same format as FIG.
  • Step 930 calculates the execution frequency for each execution path corresponding to the feature function based on the collected feature function trace.
  • FIG. 11 is an example of the feature function execution count table 122 calculated in step 930 based on the feature function trace of FIG.
  • the feature function execution count table 122 includes a program name row 1101, a feature function name row 1102, a function execution path row 1103, a processing section row 1104, and an execution count row 1105.
  • the application name in the third column in FIG. 10 is set in the program name row 1101, and the function function column 1102 is funcA_a2 () and funcA_b2 () as the function names in the fourth column in FIG. , FuncA_c1 () is set, and in the function execution path column 1103, the contents of the function execution path column 802 in FIG. 8 are set in association with the feature functions.
  • the process classification column 1104 is a process (for example, the part with the highest frequency) that is strongly related to the numerical value of the execution frequency in each of the columns 802 to 805 in FIG. Either “abnormal processing” or “medium abnormal processing” is set by the user.
  • the execution frequency column 1105 it is assumed that, for example, 100 times, 10 times, and 3 times are set for each path as the number of appearances of the function name in the fourth column in FIG.
  • Step 940 proceeds to step 950 when the number of executions exceeds the predetermined number of times in the predetermined period, but returns to step 920 when it does not exceed the predetermined number.
  • the predetermined period may be set in units of weeks or months according to the business characteristics of the program group 101. Further, the predetermined number of times may be set such that the number of executions of normal processing is, for example, 100 times or more. Note that the predetermined period is a period in which no failure occurs in order to calculate the reference pattern.
  • Step 950 calculates a statistical value for a predetermined period and calculates a reference pattern.
  • FIG. 12 (a) is an example of the cumulative execution number graph 123 obtained in step 950
  • FIG. 12 (b) is a cumulative execution number table.
  • FIG. 10 is a graph showing the cumulative execution number graph and the trace data of the characteristic function of FIG. 10.
  • the horizontal axis represents time
  • the vertical axis represents the cumulative execution number of the function.
  • the cumulative number of executions for each feature function corresponding to normal processing, mild abnormal processing, and moderate abnormal processing is shown for each time.
  • the ratio of the cumulative number of executions of the normal function feature function fancA_a2 increases with the passage of time compared to other feature functions.
  • the execution ratio of the feature function of T3 is obtained as the reference pattern.
  • the accumulated number of execution times of the feature function may be measured based on the measurement period of a system with a similar configuration, or when the execution ratio of each feature function is in a steady state.
  • FIG. 13 is a flowchart showing the process flow of the measurement pattern calculation and comparison unit 133 of FIG.
  • the measurement pattern calculation and comparison unit 133 is a process of operating the reference pattern calculation unit of FIG. 9 during actual operation after completing the operation.
  • Step 1310 calculates a statistical value in a predetermined period and calculates a measurement pattern.
  • This measurement pattern can be calculated by the same method as in steps 910 to 950 in FIG.
  • FIG. 14A is an example of the cumulative execution number graph 134 calculated in step 1310, and FIG. 14B is a cumulative execution number table of feature functions.
  • FIG. 14A is similar to the cumulative execution frequency graph of FIG. 12A, but FIG. 14A is different from FIG. 12A, and funcA_c1 execution frequency for performing moderate abnormality processing at T3. Indicates that the movement has increased.
  • the increase in funcA_c1 execution frequency means that the frequency of execution of moderate abnormality processing with respect to the reference pattern 1130 has increased, and if actual operation is continued in the future, the possibility of failure will increase. It indicates a sign of abnormality.
  • Step 1320 compares the reference pattern with the latest measurement pattern. For example, this comparison method calculates the execution frequency from the number of executions for each feature function between the reference pattern and the measurement pattern, normalizes the normal function feature function funcA_a2 to be 100%, and then executes each execution. Calculate the frequency.
  • Step 1330 proceeds to Step 1340 when the comparison result matches the sign determination condition, and returns to Step 1310 when it does not match.
  • FIG. 15 is an example of the sign determination condition table 132 set by the user.
  • the sign determination condition table 132 includes a program name line 1421, a sign determination condition line 1422, and a trace setting level line 1423.
  • the program name line 1421 is a part 1410 that defines a common sign judgment condition set by default.
  • the setting for each individual program is defined by specifying the program name in the program name column 1421.
  • a sign determination condition for the application A 1420 is defined.
  • the sign determination condition line 1422 is a part describing a condition for the sign determination.
  • a determination condition it is indicated that the execution frequency of the mild abnormality process exceeds 110% of the reference value and is less than 120% of the reference value “reference pattern ⁇ 120%> execution frequency of mild abnormality process> reference
  • Common examples of the program are divided into the condition of “medium abnormality processing execution frequency> reference pattern ⁇ 110%” indicating that the frequency of normal abnormality processing exceeds 110% of the reference value, and other conditions. It is defined as sign determination conditions for treatment.
  • the trace setting level line 1423 for example, normal priority, medium priority, and high priority are set in association with the sign determination condition as the priority of the number of items for the trace portion.
  • Step 1330 is a process of selecting which of the indication determination condition column 1422 is applicable.
  • Step 1340 selects a trace setting level that matches the sign determination condition. In FIG. 15, when the “prediction determination condition” field 1422 matches “reference pattern ⁇ 120%> frequency of minor abnormality processing> reference pattern ⁇ 110%”, medium priority is selected as the trace setting level. .
  • Step 1350 instructs the trace unit 102 in FIG. 1 to set trace items according to the trace setting level based on the trace item designation table in FIG.
  • FIG. 16 is an example of a trace item designation table.
  • the trace item designation table is a table for designating trace items according to the trace setting level.
  • the trace item specification table includes a trace item 1501 line, a trace setting level high priority line 1502, a medium priority line 1503, and a normal priority line 1504.
  • the line of the trace item 1501 describes an item name for tracing the internal operation of the operating system. For example, memory-related, timer-related, system call, disk driver, communication driver, peripheral driver, etc.
  • “ ⁇ ” is described for the collected items
  • “X” is described for the uncollected items.
  • the total load factor column 1510 the total load factor of the calculated trace collection itself is calculated and set.
  • the total buffer column 1520 a total value of used buffer amounts per unit time by trace collection is obtained and set.
  • the step 1350 collects trace items according to any of the trace item at the high priority 1502 of the trace setting level, the trace item at the medium priority 1503, and the trace item at the normal priority 1504. Select the target.
  • Step 1360 outputs the contents of the changed trace setting level to notify the user when the trace setting level has been changed between the previous time and the current time. For example, either the high priority, the medium priority, or the normal priority is output as the current time and the corresponding trace setting level.
  • an abnormal sign can be detected according to the sign determination condition in the default setting, and in order to further facilitate the failure analysis, the number of trace items is increased and an exclusion pattern is added. If the default sign determination condition is satisfied, the trace information can be reduced or the trace information can not be output.
  • FIG. 17 is a flowchart showing a process flow of the predictor determination condition table setting unit 131 in FIG.
  • the sign determination condition table setting unit 131 is executed when the user changes the sign determination condition shown in the sign determination condition table 132 of FIG.
  • Step 1610 corrects the default setting, which is a sign determination condition common to applications.
  • One of the indication determination condition columns 1422 can be selected to change, for example, the percentage value of “reference pattern ⁇ 120%> frequency of minor abnormality processing> reference pattern ⁇ 110%”.
  • the reference pattern in Fig. 12 (a) uses the result calculated using the following formula as a reference.
  • step 1630 based on the program name column 1421 of the sign determination condition table 132, the user selects a corresponding program name from the list of displayed program names. For example, app A is selected.
  • Step 1640 inputs or corrects an exclusion pattern for the sign determination condition.
  • “Minor abnormality processing execution frequency” indicates that the frequency of execution of minor abnormality processing as the exclusion pattern is substantially the same as the reference value, and the frequency of execution of moderate abnormality processing is less than 130% of the reference value.
  • the input result is reflected in the exclusion pattern 1430 of the sign determination condition table 132. This exclusion pattern 1430 is identified as an exclusion pattern in step 1330 of FIG.
  • a range may be given to allow a certain degree of error. For example, when determining whether or not it is the same as the reference value, it may be determined that it is the same as the reference value if it does not exceed 101% of the reference value. How much error is allowed depends on the reliability required for the system.
  • FIG. 18 is a graph showing this exclusion pattern.
  • the format of the exclusion pattern is expressed in the same format as the table shown in FIG.
  • Step 1650 proceeds to step 1660 when the capture pattern is added or changed, and ends when it is not added or changed.
  • the format of the capture pattern is expressed in the same format as the table shown in FIG.
  • FIG. 18 has a format similar to FIG. 12 (a) and FIG. 14 (a).
  • the vertical axis represents the cumulative number of executions, and the horizontal axis represents time. 1830 indicates that the situation is different from 1130 in FIG. 12A.
  • the execution frequency of funcA_b2 at T3 is smaller than that of FIG. 12, and the execution frequency of “mild abnormality processing” (funcA_b2) is smaller. Means sudden increase.
  • FIG. 19 has the same format as FIG. The vertical axis represents the cumulative number of executions, and the horizontal axis represents time.
  • FIG. 19 shows that the situation is different from that in FIG. 12A.
  • “mild abnormality processing” (funcA_b2) and “medium abnormality processing” (funcA_c1) It shows that the number of executions of both is increasing rapidly.
  • step 1660 based on the program name column 1421 of the sign determination condition table 132, the user selects a corresponding program name from the list of program names. For example, app A is selected.
  • Step 1670 inputs or corrects the capture pattern for the sign determination condition.
  • the user inputs “Minor abnormality process execution frequency> Reference pattern ⁇ 50% && Medium abnormality process execution frequency> Reference pattern ⁇ 300%” as the capture pattern, and the trace setting level is “High priority. ".
  • the input result is reflected in the capture pattern 1440 of the sign determination condition table 132.
  • This capture pattern 1430 is identified as a pattern to be captured in step 1330 of FIG.
  • FIG. 19 is a graph showing this capture pattern. For example, if the user does not investigate the cause even after analyzing the various types of trace data 103, it is possible to collect a more detailed trace by increasing the priority in that situation (setting a trap). .
  • the default setting, the exclusion pattern, and the capture pattern of the sign determination condition table 132 can be changed, and it becomes possible to cope with the characteristics of the program.
  • 101 program group 101 program group, 102 trace section, 103 various trace data, 104 function trace data, 111 execution path feature point extraction section, 112 function call graph, 113 function execution path frequency table, 121 reference pattern calculation section, 122 feature function Frequency table, 123 reference pattern, 131 sign determination condition table setting unit, 132 sign determination condition table, 133 measurement pattern calculation and comparison unit, 134 measurement pattern, exclusion pattern, capture pattern, 135 input / output unit, 211 CPU, 231 memory device 241 external storage device, 251 network device, 261 input device, 271 output device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Debugging And Monitoring (AREA)

Abstract

L'invention a pour but de détecter une condition qui ne peut pas être supposée à l'avance être une condition dans laquelle une défaillance de système se produira, en d'autres termes, l'invention a pour but de détecter une pré-indication d'une anomalie jusqu'ici inconnue. Pour atteindre ce but, des données d'essai sont utilisées pour exécuter un traitement normal, un traitement légèrement anormal et un traitement modérément anormal, et la fréquence d'exécution des fonctions de point caractéristique des programmes exécutés par chaque processus est obtenue. Un modèle de référence de fréquences d'exécution est comparé à un modèle d'exécution courant, et l'apparition d'une fréquence d'exécution de fonction qui diffère du modèle de référence est déterminée comme étant une pré-indication d'anomalie, indiquant une probabilité élevée qu'une anomalie de système se produira et un avertissement est émis pour un utilisateur.
PCT/JP2015/079383 2014-10-23 2015-10-16 Dispositif et procédé pour détecter des pré-indications d'anomalie dans un système informatique WO2016063816A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2014215903A JP6375200B2 (ja) 2014-10-23 2014-10-23 計算機システムの異常予兆検出装置および方法
JP2014-215903 2014-10-23

Publications (1)

Publication Number Publication Date
WO2016063816A1 true WO2016063816A1 (fr) 2016-04-28

Family

ID=55760853

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2015/079383 WO2016063816A1 (fr) 2014-10-23 2015-10-16 Dispositif et procédé pour détecter des pré-indications d'anomalie dans un système informatique

Country Status (2)

Country Link
JP (1) JP6375200B2 (fr)
WO (1) WO2016063816A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11093371B1 (en) 2020-04-02 2021-08-17 International Business Machines Corporation Hidden input detection and re-creation of system environment

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019180794A1 (fr) * 2018-03-19 2019-09-26 三菱電機株式会社 Dispositif de traitement d'informations, logiciel médiateur, procédé de traitement d'informations et programme
JP6666489B1 (ja) * 2019-02-25 2020-03-13 株式会社東芝 障害予兆検知システム

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2003122599A (ja) * 2001-10-11 2003-04-25 Hitachi Ltd 計算機システムおよび計算機システムにおけるプログラム実行監視方法
JP2011258019A (ja) * 2010-06-09 2011-12-22 Nippon Telegr & Teleph Corp <Ntt> 異常検知装置、異常検知プログラムおよび異常検知方法
JP2014115768A (ja) * 2012-12-07 2014-06-26 Toshiba Corp ログ判定システム、ログ判定基準構築装置及びログ判定方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2003122599A (ja) * 2001-10-11 2003-04-25 Hitachi Ltd 計算機システムおよび計算機システムにおけるプログラム実行監視方法
JP2011258019A (ja) * 2010-06-09 2011-12-22 Nippon Telegr & Teleph Corp <Ntt> 異常検知装置、異常検知プログラムおよび異常検知方法
JP2014115768A (ja) * 2012-12-07 2014-06-26 Toshiba Corp ログ判定システム、ログ判定基準構築装置及びログ判定方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11093371B1 (en) 2020-04-02 2021-08-17 International Business Machines Corporation Hidden input detection and re-creation of system environment

Also Published As

Publication number Publication date
JP6375200B2 (ja) 2018-08-15
JP2016085496A (ja) 2016-05-19

Similar Documents

Publication Publication Date Title
JP6394726B2 (ja) 運用管理装置、運用管理方法、及びプログラム
JP5874936B2 (ja) 運用管理装置、運用管理方法、及びプログラム
US8285414B2 (en) Method and system for evaluating a machine tool operating characteristics
TW201941058A (zh) 異常檢測方法及裝置
US20160378583A1 (en) Management computer and method for evaluating performance threshold value
US9524223B2 (en) Performance metrics of a computer system
US8448025B2 (en) Fault analysis apparatus, fault analysis method, and recording medium
JP6655926B2 (ja) 異常診断システム
US10114718B2 (en) Prevention of event flooding
US20160246661A1 (en) Analyzing the availability of a system
Jin et al. What helped, and what did not? An evaluation of the strategies to improve continuous integration
JP5387779B2 (ja) 運用管理装置、運用管理方法、及びプログラム
WO2016063816A1 (fr) Dispositif et procédé pour détecter des pré-indications d&#39;anomalie dans un système informatique
JP2018060332A (ja) インシデント分析プログラム、インシデント分析方法、情報処理装置、サービス特定プログラム、サービス特定方法及びサービス特定装置
Zoppi et al. Context-awareness to improve anomaly detection in dynamic service oriented architectures
JP2010152539A (ja) 障害発見システム検証装置、障害発見システム検証方法及び障害発見システム検証制御プログラム
WO2020044898A1 (fr) Dispositif et programme de surveillance d&#39;état de dispositif
CN115168224A (zh) 微服务系统健康度的评估方法及相关设备
JP2009151420A (ja) ソフトウェア動作監視装置、プログラム
KR20140055292A (ko) 원자력발전소의 기능적중요도결정 기기목록을 활용한 고장설비와 정비효과성감시모듈 성능기준간 자동 연계 시스템 및 그 방법
Malik et al. Classification of post-deployment performance diagnostic techniques for large-scale software systems
JP5224759B2 (ja) 検査式作成支援システム、検査式作成支援方法、および検査式作成支援プログラム
CN115037636A (zh) 服务质量的感知方法、装置、电子设备和存储介质
JP2014232478A (ja) 動作監視装置および動作監視方法
JP2023136444A (ja) 解析プログラム、解析方法、および情報処理システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15853226

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15853226

Country of ref document: EP

Kind code of ref document: A1