WO2017073119A1

WO2017073119A1 - Management server and management method employing same

Info

Publication number: WO2017073119A1
Application number: PCT/JP2016/070711
Authority: WO
Inventors: 美都成小林; 洋輔肥村; 保田　淑子; 眞之五十嵐; 豊井之上
Original assignee: 株式会社日立システムズ
Priority date: 2015-10-30
Filing date: 2016-07-13
Publication date: 2017-05-04
Also published as: JP6564305B2; CN108139965A; CN108139965B; JP2017084270A; MY191557A

Abstract

A problem to be addressed by the present invention is to extract a process event relating to an operation, and to identify a parameter which is associated with the process event. Provided is a management server, which comprises an input device, an output device, a processing device, and a storage device, and which manages operations which are executed by process events, using information processing system resources. With this server, the input device acquires one or more instances of log data which the information processing system has generated. The storage device stores event detection information which defines correspondences between event type detection keys, which are text strings in the log data, and process event types, and parameter detection information which defines correspondences between the process event types and rules for extracting parameters which are associated with resources, said rules being text strings in the log data. The processing device carries out a process event ascertainment process of identifying the occurrence and type of a process event, by searching for matches between instances in the log data and the event type detection keys, and a parameter extraction process of, using the extraction rules, extracting the parameters from the log data, in correspondence with the type of process event which has been identified by the process event ascertainment process. The processing device stores in the storage device process event management information in which the extracted parameters are associated with the process event types.

Description

Management server and management method using the same

The present invention relates to a technique for automating the actual grasp of operation work for resources in a data center or the like. In particular, it is suitable for automating the actual grasp of the operation work for the virtual resource in the cloud environment where the computing resource is virtualized.

In an information processing system, a virtualization technology that logically divides a physical resource such as a network, server, storage, etc. and makes it available as a plurality of virtual resources, or the virtualized resource (referred to as a virtual resource) The use of software to manage (referred to as cloud management infrastructure) has become widespread. As a result, a service form called a cloud is realized in which a virtual resource is cut out from physical resources pooled in advance in the data center to construct an information processing system and provide the system to the user.

In a cloud data center (referred to as a cloud environment), in addition to conventional operations for physical resources, various new operations for virtual resources are required. The operations for virtual resources in the cloud environment include construction of virtual machines (VMs) and virtual network devices, setting change of connection relation between virtual resources, scheduled backup of VMs, and the like.

Generally, operations for virtual resources are performed based on a procedure manual created in advance. The operator refers to the procedure manual and performs daily operations. However, the implementation of human operation work causes a work error and a decrease in efficiency.

把握 To improve these problems, it is effective to grasp the current state of operation work. For example, it is effective to grasp the work time and work target virtual resources (referred to as work target resources) for each operation work performed in the past in a cloud environment.

The current status of the operation work related to virtual resources is generally conducted through interviews with the operation worker and investigation of the operation work procedure manual. And a human error occurs. Therefore, in order to speed up and facilitate the grasp of the operation work related to the virtual resource in the cloud environment, it is necessary to specify the operation work without human intervention.

The operation work related to virtual resources in the cloud environment is a work for achieving one business purpose, such as the above-described VM construction and scheduled backup. One operation work is an operation performed by an operator who performs one or more GUI (Graphical User Interface) operations or CLI (Command-Line Interface) command input operations (hereinafter referred to as operations and operations) on the virtual environment management server and virtualization software. To achieve this. Each operation is executed as one or more processing events in the virtual environment management server or virtualization software.

For these processing events, the execution process and result are output as text data over a plurality of lines together with the output time, debugging message, etc., and recorded as a system log. That is, the system log records not only processing events related to operations but also various information such as a text message for debugging.

Therefore, in order to specify the operation work using such a system log, it is necessary to extract the processing event in the internal processing unit of the virtualization software or the virtual environment management server related to the operation from the system log. In addition, it is necessary to specify the operation work that is the source of the processing event from the extracted processing event.

Patent Document 1 is a conventional technique for extracting an event that matches a specific key from a system log. In Patent Document 1, for the purpose of monitoring logs for one or more devices connected via a network, system log data output by individual devices is sequentially collected in a central server and output by a plurality of devices. Merge multiple related log lines from log mixed data using a specific character string in the log as a key.

JP 2012-94161 A

However, Patent Document 1 only merges a plurality of lines using a specific character string as a key, and cannot extract a processing event related to an operation. In addition, parameters related to the processing event cannot be specified.

An object of the present invention is to extract a processing event related to an operation and specify a parameter related to the processing event.

One aspect of the present invention for solving the above-described problem is management that includes an input device, an output device, a processing device, and a storage device, and manages an operation work executed by a processing event using resources of an information processing system It is a server. In this server, the input device acquires one or more log data generated by the information processing system. The storage device defines the correspondence between the type of processing event and the event type detection key that is a character string in the log data, the resource that is the event detection information, the type of processing event, and the character string in the log data The detailed parameter detection information that defines the correspondence relationship with the parameter extraction rule related to the is stored. The processing device uses an extraction rule corresponding to the type of the processing event identified by the processing event grasping process and the processing event grasping process specifying the existence and type of the processing event by matching the log data with the event kind detection key. Is used to perform parameter extraction processing for extracting detailed parameters from log data, and processing event management information in which the detailed parameters extracted for the types of processing events are associated with each other is stored in the storage device.

Another aspect of the present invention is a management method using the management server or a system managed by the management method.

To illustrate a specific configuration of the present invention, the detailed parameter detection information includes, as an extraction rule, a detailed parameter type, an extraction method corresponding to the detailed parameter type, and a detailed parameter extraction processing target log corresponding to the detailed parameter type. Detailed parameter extraction processing commands corresponding to data types and detailed parameter types are included. The parameter extraction processing identifies one or more detailed parameter types corresponding to the processing event type specified in the processing event grasp processing, and corresponds to the detailed parameter type according to the extraction method and the detailed parameter extraction processing command. Detailed parameters are extracted from one or more log data specified by the detailed parameter extraction processing target log data type corresponding to the detailed parameter type.

To illustrate a more specific configuration of the present invention, the detailed parameter includes an identifier that uniquely identifies the resource, and the storage device further defines the relevance of the resource of the information processing system using the identifier. Stores information management information. Based on the configuration information management information, the processing device performs processing event grouping processing in which processing event group management information obtained by grouping event types and detailed parameters of processing event management information is stored in a storage device.

To illustrate a more specific configuration of the present invention, the storage device further stores operation work mapping information for associating the processing event with the operation work, and the processing device manages the processing event group based on the operation work mapping information. An operation work specifying process is performed in which a plurality of process events included in one group of information are associated with one operation work.

To illustrate a more specific configuration of the present invention, the operation work mapping information includes information on the order of the plurality of process events when a plurality of process events are associated with one operation work.

Another aspect of the present invention is a management server that manages an operation related to a virtual resource including at least a virtual machine, implemented in an information processing system to which a virtualization technology is applied. This management server relates to one or more system log data generated by the information processing system, a type of processing event related to the operation work executed in the information processing system, and an event type character string that is a character string pattern in the system log data Detailed parameter character string pattern, which is a character string pattern in the system log, that indicates the correspondence with the pattern, the type of processing event related to the operation work executed in the information processing system, and the virtual resource that is the work target subordinate to the processing event A log format management table in which the correspondence relationship is defined. Then, by matching the system log data with the event type character string pattern, the processing event grasping unit for specifying the existence and type of the processing event, and the system log data and the detailed parameter character string pattern are specified. In accordance with the type of processing event, processing parameter information related to the operation work including the detailed parameters is extracted and stored by the parameter extraction unit that extracts detailed parameters related to the operation work.

According to the present invention, it is possible to extract a processing event related to an operation and specify a parameter related to the processing event.

1 is an overall configuration diagram of an operation work analysis system in an embodiment of the present invention. It is a functional block diagram of the operation work analysis server in the embodiment of the present invention. It is a functional block diagram of the operation work detection part in this invention Example. It is a table | surface figure of the example of a data model of the management table of the log data which is the analysis material of the analysis process in this invention. It is a table | surface figure of an example of the log data managed by a log data management table. It is a table | surface figure of the example of a data model of the table which manages the processing content of the log data which is analysis object. It is a table | surface figure of the example of a data model of the table which manages the processing event acquired from log data. It is a table | surface figure of the example of a data model of the table which manages the grouping process result with respect to a process event. It is a table | surface figure of the example of a management table of the mapping information which prescribes | regulates the correspondence between a process event and an operation work. It is a table | surface figure of the example of a data model of the cloud configuration information management table utilized by the Example of this invention. It is a table | surface figure of the example of a data model of the table which manages the operation work information mapping process result to a process event. It is a flowchart of an example of the flow of the whole process in this invention Example. It is a flowchart of an example of a processing event extraction processing flow from log data. It is a flowchart of an example of the operation work detection process flow from a process event. It is a top view of the example of a GUI screen of the operation work analysis function in the embodiment of the present invention. It is an implementation sequence diagram of grasping | ascertaining the operational status of the cloud system by utilization of this invention. It is a hardware block diagram of the computer with which this invention is performed.

Hereinafter, Example 1 will be described by taking as an example a case of analyzing and grasping operation work related to virtual resources performed in the past by an operation worker in a cloud environment in which physical resources of a data center are virtualized. The analysis of the virtual resource operation work is performed by the operation work analysis server that embodies this embodiment, and is a process of identifying and grasping past operation work based on the log data. Note that the cloud environment shown in the first embodiment is one form of the application portion of the present embodiment, and includes a cloud environment constructed across a plurality of data centers as an application destination.

FIG. 1 shows the overall configuration of the operational work analysis system in the first embodiment. The components of the operation work analysis system in this embodiment include a data center 101, a network 102 outside the data center, a virtual environment connection terminal 103, and an operation work analysis server 104, and the user 105 analyzes the operation work. The user 105 can grasp the operation work by operating the operation work analysis server.

The cloud environment that is the operation work analysis target of this embodiment is constructed in the data center 101. The components in the data center 101 include a data center network 111, a virtual environment management server 112a-c, a virtual resource configuration management server 113, a network device 114, a virtualization server 115a-d, a SAN (Storage Area Network) 116, a storage 117a-c.

The data center internal network 111 provides a path for communication between various servers and communication with the network 102 outside the data center.

The SAN 116 is configured by a SAN device such as an FC (Fibre Channel) switch, and provides a storage I / O (Input Output) communication path between the storage 117a-c and the virtualization servers 115a-d.

The virtualization servers 115a-d are connected to each other via the network device 114 described above, and are connected to the outside of the data center 101. Further, as will be described later, the storage 117a-c is accessed via the SAN 116 implemented by an FC switch or the like. The virtualization servers 115a-d are equipped with NIC (Network Interface Card), HBA (Host Bus Adapter), or CNA (Converged Network Adapter), and access the LAN and SAN.

The virtualization servers 115a-d are equipped with virtual software VMM (Virtual Machine Monitor) and LPAR (Logical Partitioning), and a plurality of virtual machines (VMs) are generated by the virtualization software. Each virtual machine is a virtual interface on a virtual server such as vNIC (Virtual Network Interface Card), vHBA (Virtual Host Bus Adapter), vCNA (Virtual Converged Network Adapter), etc. Alternatively, the storage 117 is accessed. As virtualization software installed in the virtualization servers 115a-d, VMware ESXi (registered trademark), Microsoft Hyper-V (registered trademark), Linux (registered trademark) KVM (Kernel-based Virtual Machine), and Citrix Xen (registered trademark) ) Etc.

The storage 117a-c provides an external storage area to the virtualization servers 115a-c via the SAN 116. The storages 117a-c include an NPIV (N_Port ID Virtualization) for virtualizing a physical port for storage access, and an LU (Logical Unit) that is a logical volume configured in the physical storage. The storages 117a-c may have a function such as LUN (Logical Unit Number) masking for associating storage ports with LUs and servers.

The virtual environment management servers 112a-c manage physical resources such as the virtualization servers 115a-d and storages 117a-c, and virtual resources such as virtual machines and virtual storages generated using these physical resources. Examples of software that realizes the functions of the virtual environment management server 112a-c include VMware vCenter (registered trademark), Microsoft (registered trademark) System Center Virtual Machine Manager, OpenStack (registered trademark), and the like.

The virtual resource configuration management server 113 targets virtual resources including VMs (Virtual Machines), vNICs (Virtual Network Interface Cards), vDisks (Virtual Disks), etc. This is a configuration management server having a function for collecting and managing connection relation updates in a time series. In this embodiment, the virtual resource configuration management server 113 exists in the data center 101, but the installation location of the virtual resource configuration management server 113 is not limited. Configuration information may be collected periodically by issuing configuration information collection commands to the virtualization software or virtual environment management server, or on demand according to configuration change events from the virtualization software or virtual environment management server Configuration information may be collected at Any method may be used as long as the collected configuration information can be managed as history information together with the time.

The cloud environment constructed on the data center 101 taken up in the first embodiment does not need to include all the devices described above. For example, in this embodiment, SAN-connected storages 117a-c are assumed as the external storage area, but a server built-in disk may be used. Further, a case where there is no virtual environment management server is also assumed. The above are the components in the data center 101.

The network 102 outside the data center is transmitted from a terminal connected to the network 102 outside the data center by an L2 switch, an L3 switch, a firewall, a router or the like (not shown) installed outside the data center like the network 111 inside the data center. It has a role of connecting to the center 101. The network 102 outside the data center may be connected to a wide area network such as the Internet. In addition, by using the function of the network device described above, a connection such as access control may be restricted for connections inside and outside the data center.

The virtual environment connection terminal 103 accesses the virtual environment management servers 112a-c to perform cloud environment operation, and collects log data output by the virtualization software and the virtual environment management server.

The operation work analysis server 104 collects log data distributed and held in the cloud environment, analyzes the log data, and visualizes the operation work. The operation work analysis server 104 includes an operation work visualization unit 121, a log data analysis unit 122, a cloud configuration information management unit 123, and a log data management unit 124. These functional units will be described with reference to FIG. In FIG. 1, the operation work analysis server 104 is directly connected to the virtual environment connection terminal 103. However, the operation work analysis server 104 is connected to the network 102 outside the data center or the network 111 inside the data center and is distributed and held in the cloud environment. You may comprise so that log data may be collected.

The above is an example of components outside the data center 101.

FIG. 2 is a configuration example of the operation work analysis server 104. In FIG. 2, the operation work analysis server 104 includes, as components, an operation work visualization unit 121, a log data analysis unit 122, a cloud configuration information management unit 123, a log data management unit 124, an operation work trend analysis unit 125, and log data management. A table 211, a cloud configuration information management table 212, an operation work management table 213, and a trend analysis unit 214.

The operation work analysis server 104 receives an operation analysis start request from the user 105 via the operation work visualization unit 121. In response to this, the operation work visualization unit 121 executes the acquisition of log data to be analyzed by the log data management unit 124. The log data analysis unit 122 also performs analysis processing on the acquired log data and information managed by the cloud configuration information management unit 123. The analysis result is stored in the operation work management table 213. After the analysis is completed, the operation work visualization unit 121 presents the information of the operation work management table 213 to the user 105. In addition, the results of the operation work analysis for each log data are stored in the trend analysis unit 214, and totalization such as frequency analysis of each operation work is performed.

2 and 3 show the configuration of the embodiment with the function as one block for the sake of explanation. The configuration referred to as a server in the embodiment, such as the operation work analysis server 104, includes an input device, an output device, a processing device (processor or CPU), and a storage device_ (memory) as in a general computer. . The physical configuration of such an embodiment will be described later with reference to FIG. In the present embodiment, functions such as calculation, processing, and control are realized by a program stored in the storage device being executed by the processor, and in cooperation with other hardware as necessary. . A program to be executed or a configuration for realizing the function may be referred to as “function”, “means”, “unit”, “module”, “unit”, or the like in the specification and drawings.

In the following description, the information of the embodiment may be described by expressions such as “˜table”, “˜list”, “˜DB (Database)”, “˜queue”, and the like. , DB, queue, etc. may be expressed other than the data structure to define the relationship between the data. Therefore, “˜table”, “˜list”, “˜DB”, “˜queue”, etc. may be referred to as “˜information” in order to show that they do not depend on the data structure. Moreover, as long as the relationship between the data is maintained, one table or the like may be divided, or a plurality of tables or the like may be integrated.

In describing the contents of each information, the expressions “identification information”, “identifier”, “name”, “name”, “ID (IDentification)” are used, but “identification information”, “identifier”, “ID” is an identification code that is unique and invariant to arbitrary information, but “name” and “name” are variable identification codes. In addition, “identification information”, “identifier”, and “ID” can be replaced with each other. “Name” and “name” can be replaced with each other. A VM name and a VM ID are given as specific name examples indicating the difference between “ID” and “name” in the description of migration. The VM name can be freely changed by an operator who manages the target VM in consideration of the usage of the VM, and duplication in the same cloud environment may be permitted. On the other hand, the VM ID is information for uniquely identifying a target in the same cloud environment, and is therefore unique and unchanging.

The description of each component of the operation work analysis server 104 is as follows.

The operation work visualization unit 121 is a functional unit that serves as an interface between the operation work analysis server 104 and the user 105 as described above. The operation work visualization unit 121 receives a log data collection request or log data input as an operation work analysis request from the user 105. The operation work visualization unit 121 passes this information to the log data management unit 124 and starts log acquisition / management by the log data management unit 124. When the acquisition of the log data is finished, the operation work visualization unit starts processing execution of the log data analysis unit 122. When the analysis by the log data analysis unit 122 is completed, the operation work analysis result is presented to the user 105. As described above, the user 105 inputs a log data collection request from another terminal and user-retained log data to the data acquisition request unit 223, and the operation work flow is visualized and presented by the operation work flow display unit 225. The

The log data analysis unit 122 is a functional unit that performs various analyzes on log data to be analyzed. When an analysis start request is received from the operation work visualization unit 121, the log data reference from the log data management unit 124 and the cloud configuration information reference from the cloud configuration information management unit 123 are performed. Next, based on the referenced information, processing event extraction from log data and operation work detection / specification from the extraction result are performed. Information on the identified operation work is stored in the operation work management table 213.

The cloud configuration information management unit 123 collects virtual resource settings and changes in connection relations between virtual resources from the virtual resource configuration management server 113 in the data center 101 having the cloud environment to be analyzed, at any time. Manage cloud configuration information.

The configuration information to be managed is referred to by the log data analysis unit 122 and used in the process of specifying the operation work from the log data. The cloud configuration information management unit 123 may update in conjunction with the configuration information change process by the virtual resource configuration management server 113. Alternatively, the configuration information may be explicitly updated in the data acquisition request from the data acquisition request unit 223. Any method can be used as long as the cloud configuration information is managed to be the latest.

The log data management unit 124 collects and manages log data used for specifying operation work.

The log data management table 211 collects and manages log data used for operation work analysis processing. Regarding the analysis target log data acquired via the external network or input by the user 105, the log data type, the file path to the log data, and the like are stored. The log data management table 211 will be described with reference to FIGS. 4A and 4B.

The cloud configuration information management table 212 is a table that holds virtual resource setting information and connection relationships collected by the cloud configuration information management unit 123. The cloud configuration information management table 212 will be described with reference to FIG.

The operation work management table 213 stores operation work information detected and specified by the log data analysis unit. The information stored in the operation work management table 213 is referenced and visualized by the operation work visualization unit 121 after the operation work analysis is completed. The operation work management table 213 will be described with reference to FIG.

The trend analysis unit 214 accumulates the operation work analysis results performed by the operation work analysis server 104, and performs aggregation processing and trend analysis processing on the analysis results. Aggregation processing and trend analysis, for example, counts the number according to the set items, such as for each user and each operation work, or totals the cases when two or more operation work is performed continuously, and is highly relevant operation For example, a process for estimating a set of tasks.

(Operation Work Visualization Unit 121)
The operation work visualization unit 121 includes a setting information editing unit 221, a trend analysis display unit 222, a data acquisition request unit 223, an analysis start request unit 224, and an operation work flow display unit 225. In the operation work analysis process, the data acquisition request unit 223 receives the specification of the analysis target log data from the user 105 and starts acquiring the log data. After the log data acquisition, the analysis start request unit 224 performs the analysis process of the log data analysis unit 122. Execute. Further, after the analysis process is completed, the operation work flow display unit 225 displays the analysis result. The setting information editing unit 221 and the trend analysis display unit 222 are not directly involved in the execution of the operation analysis process.

The setting information editing unit 221 provides a user interface that enables interactive editing of the setting information (log format management table 243 and operation work mapping table 237 required for analysis of log data (setting information input unit 1413 in FIG. 14). Shows an example of the edit screen of the operation work mapping table 237).

The analysis start request unit 224 requests the log data analysis unit 122 to analyze the log data.

The data acquisition request unit 223 receives a log data analysis request from the user 105 and issues a collection request for each data necessary for the analysis. When the log data held by the user is input to the log data management unit, the log data is input to the log data receiving unit 232, and when the log data is not input, the user A log data acquisition request including input information (such as access information to a remote server having log data) is issued to the log data collection unit 231. Also, a cloud configuration information collection request is issued to the cloud configuration information management unit 123.

The trend analysis display unit 222 is a function for displaying the analysis result by the trend analysis unit 214. A display example is 1412 in FIG.

The operation work flow display unit 225 provides a function of displaying the obtained analysis result with reference to the operation work management table 213 in which the analysis result by the log data analysis unit 122 is stored.

(Log data management unit 124)
The log data management unit 124 collects and manages log data used for operation work analysis processing. The log data management unit 124 includes a log data collection unit 231 and a log data reception unit 232. Depending on the request content from the data acquisition request unit 223, the log data collection unit 231 collects log data from outside the operation work analysis server, or the log data reception unit 232 accepts log data input by the user 105.

The log data receiving unit 232 receives the log data to be analyzed input by the user 105 via the operation work visualization unit 121. The received log data is stored in the log data management table 211.

The log data collection unit 231 uses the data acquisition request unit 223 based on the analysis target (access information to the remote server or designation of the log file to be acquired (not shown)) input by the user, etc. Collect log data that exists outside the operational work analysis server and log data directly to the cloud environment. The collected log data is stored in the log data management table 211.

(Log data analysis unit 122)
The log data analysis unit 122 includes a processing event extraction unit 233, an operation work detection unit 234, an operation work mapping table management unit 235, a processing event management table 236, and an operation work mapping table 237.

In the log data analysis unit 122, the process event extraction unit 233 stores the analysis target log data from the log data management unit 124, the process event extraction from the log data, and the process event management table 236 of the extraction process event. With reference to the stored processing event, the operation work detection unit 234 identifies the operation work according to the information of the operation work mapping table 237 managed by the operation work mapping table management unit 235. When the operation work detection unit 234 specifies the correspondence between the operation work and the processing event, the operation work detection unit 234 sequentially stores the specified results in the operation work management table 213.

Processing event extraction unit 233 extracts processing events and parameters associated with the processing events from the log data to be analyzed. The extraction processing event is an internal processing unit by the virtual environment management server 112 or the virtualization server 115 in accordance with an operation operation by the virtual resource operator. One or more processing events are processed by one operation operation of the operation worker, and the processing result is output to the log data in a text format. The parameter associated with the processing event includes, for example, an identifier of a virtual resource that is a processing target of the processing event (such as an identifier of VM or vDisk).

The operation work detection unit 234 specifies an operation work from the processing event extracted by the processing event extraction unit 233, and holds the specified operation work information in the operation work management table 213.

The operation work mapping table management unit 235 refers to and edits information for mapping the operation work and the processing event held in the operation work mapping table 237. The operation work and processing event mapping information held in the operation work mapping table 237 can be edited by the user 105 such as information addition or new creation. In this embodiment, the setting information editing unit 221 serves as an interface with the user 105, and the input content to the GUI screen (setting information input unit 1413) is passed to the operation work mapping table management unit 235, and the operation work mapping table 237 is stored. Edited. As another embodiment, even if the user 105 can read a text file or the like created in an environment other than the operation work analysis server 104 without using the GUI, and can edit or newly create the operation work mapping table 237. Good.

The processing event management table 236 holds the processing event extracted by the processing event extraction unit 233 and parameters associated with the processing event, and is referred to by the operation work detection unit 234. The configuration of the processing event management table 236 will be described with reference to FIG.

The operation work mapping table 237 holds processing event sequences and operation work correspondence information, and is referred to by the operation work detection unit 234. The configuration of the operation work mapping table 237 will be described with reference to FIG.

(Processing event extraction unit 233)
The processing event extraction unit 233 includes a processing event grasping unit 241, a parameter extraction unit 242, and a log format management table 243. The processing event extraction unit 233 refers to the analysis processing information matched with the format of the analysis target log data from the log format management table 243. Based on this information, the processing event grasping unit 241 grasps the processing event from the analysis target log data, and the parameter extracting unit 242 extracts the parameters of each processing event.

The processing event grasping unit 241 detects a processing event related to the operation work from the log data to be analyzed.

The parameter extraction unit 242 extracts parameters associated with the processing event for each processing event detected by the processing event grasping unit 241.

The log format management table 243 manages processing contents for log data executed by the processing event grasping unit 241 and the parameter extracting unit 242. The log format management table 243 will be described with reference to FIG.

Detailed processing of the processing event extraction unit 233 will be described with reference to FIG.

(Operation work detection unit 234)
The operation work detection unit 234 includes a process event grouping unit 251, an operation work specifying unit 252, and a process event group management table 253. The operation work detection unit 234 performs grouping processing by the processing event grouping unit on the processing event data set stored in the processing event management table 236, and stores the grouped processing event sequence in the processing event group management table 253. To do. The operation work specifying unit 252 performs a mapping process between a process event partial sequence and an operation work for each grouping process event sequence.

The processing event grouping unit 251 refers to the data set of processing events stored in the processing event management table 236 and the cloud configuration information stored in the cloud configuration information management unit 123. The VM and system identifier information is acquired from the cloud configuration information, and the processing event data set is grouped based on the identifier information. The grouping result is stored in the processing event group management table 253.

The operation work specifying unit 252 first refers to the operation work mapping table 237. For each processing event sequence grouped by the processing event grouping unit 251, the processing event subsequence and the operation work mapping location are detected based on the referenced operation work mapping information. The detected mapping information is stored in the operation work management table 213.

The processing event group management table 253 manages the processing event group by adding information for identifying each group to the processing event sequence grouped by the processing event grouping unit 251. A more detailed description of the operation work detection unit 234 will be given with reference to FIG.

(Operation work detection unit 234)
FIG. 3 shows the configuration of the operation work detection unit 234. The operation work detection unit 234 includes a process event grouping unit 251, an operation work specifying unit 252, and a process event group management table 253. Further, the operation work detection unit 234 includes VM configuration information tables 311a-c as temporary information.

(Processing event grouping unit 251)
The processing event grouping unit 251 includes an in-cloud VM configuration information reference unit 321, a VM related device ID acquisition unit 322, and a processing event group extraction unit 323.

The processing event grouping unit 251 uses the in-cloud VM configuration information reference unit 321 to refer to the cloud configuration information management table 212 for each VM. The VM related device ID acquisition unit 322 acquires identifier information of an arbitrary VM and a device connected to the VM from the configuration information of the referenced VM unit, refers to the processing event management table 236 using the acquired identifier as key information, The reference results are grouped and stored in the processing event group management table 253.

The in-cloud VM configuration information reference unit 321 refers to the table information of the cloud configuration information management table 212 for each VM. The processing event grouping unit 251 uses the VM ID and the device ID related to the VM managed in the configuration information tables 311a-c of each VM in order to group the processing events for each VM. Each VM configuration information table 311a-c is obtained by acquiring row data having the same VM ID 911 value as the configuration information table 311a-c of the same VM with respect to the information included in the cloud configuration management table of FIG.

The VM related device ID acquisition unit 322 extracts information (VM and related device identifier information, configuration information change time, etc.) necessary for processing by the processing event group extraction unit 323 from each VM configuration information table 311a-c, The data is input to the processing event group extraction unit 323.

The processing event group extraction unit 323 refers to the processing event management table 236 using the information input from the VM related device ID acquisition unit 322 as key information. The reference result includes a processing event for a related device in addition to a processing event for a VM. The above reference result is stored in the processing event group management table 253 by newly adding a VM identifier as a group identifier.

(Operation work specifying unit 252)
The operation work specifying unit 252 includes an operation work mapping table reference unit 331, a processing event group reference unit 332, and an operation work mapping processing unit 333.

In the operation work specifying unit 252, the operation work mapping table reference unit 331 refers to the operation work mapping table 237. Next, the processing event group reference unit 332 refers to each processing event group from the processing event group management table 253. The operation work mapping processing unit 333 detects a process event subsequence that matches the mapping information of the operation work and the process event sequence defined in the operation work mapping table from the process event sequence of the referenced process event group, and displays the detection result. Stored in the operation work management table 213.

The operation work mapping table reference unit 331 refers to the operation work mapping table 237.

The processing event group reference unit 332 sets the row data having the same group ID 711 as one processing event group from the processing events stored in the processing event group management table 253, and refers to each processing event group.

The operation work mapping processing unit 333 performs work mapping processing based on each processing event group referred to by the processing event group reference unit 332 and the operation work mapping table 237.

The processing event group management table 253 manages the processing event group by adding information for identifying each group to the processing event sequence grouped by the processing event grouping unit 251. Details of the processing event group management table 253 will be described with reference to FIG. Details of the processing flow of the operation work detection unit 234 will be described with reference to FIG.

(Log data management table 211)
FIG. 4A shows a configuration example of the log data management table 211. The log data management table 211 is a log data type 411, a log data acquisition ID 412, an acquisition date and time 413, and log data reference for individual log data (used as a file in this embodiment) used for operational work analysis. Information 414 is managed. Each

row data

431, 432, 433 manages one log data file.

The log data type 411 includes a cloud environment type 421 and a log file type 422 for each log data file. The format of log data differs depending on the log standard such as virtualization software, virtual environment management server, system log, event log, etc. to realize cloud environment. It is necessary to selectively perform appropriate processing for each file.

Information on the cloud environment type 421 and the log file type 422 is used to select the log format management table 243 as the log type used for analysis.

The log data acquisition ID 412 is information for identifying the relationship between log data in the log data management table 211. In one operation work analysis according to the application of the present embodiment, a plurality of types of log data may be used even in the operation work analysis for a single cloud environment, and the log data acquisition ID 412 associates them. The log data collection unit 231 or the log data reception unit 232 holds the same log data acquisition ID 412 as key information for a plurality of types of log data files obtained by one log data acquisition.

Acquisition date 413 indicates the acquisition date of each log data file. The log data reference information 414 is file path information for referring to the acquired log data file. An example of the log data file associated with the row data 431 414 is shown at 441.

Fig. 4B shows an example of log data. Log data is generated by a device or software constituting the system. The log data is an execution history of processing events executed on the cloud platform as a result of execution of operation work. In general, log data is recorded on a plurality of lines of text data in units of one line for execution results and progress of processing events for processing events executed on a device or software. The log data is information written in units of one line, time data in which execution results and intermediate states are recorded as log data, processing event names (vm.startVm, volume.ExportDisk, etc.), processing event ID (this implementation) In the example, it is expressed as opID = xxx). The information included in the log data includes processing event information executed inside the virtual environment management server and virtualization server, but does not include information that directly suggests the operation work (such as scheduled VM backup). .

(Log format management table 243)
FIG. 5 shows the configuration of the log format management table 243. The log format management table 243 is a table necessary for extracting processing events executed by the virtualization servers 115a to 115d or the virtual environment management server 112 from log data collected for operational work analysis. The log format management table 243 includes event detection information 511 and detailed parameter detection information 512.

The event detection information 511 is mainly referred to by the processing event grasping unit 241 and used for event grasping. The detailed parameter detection information 512 is referred to by the parameter extraction unit 242 in order to acquire a parameter associated with the processing event for each processing event grasped by the processing event grasping unit 241.

The event detection information 511 includes a target log type 521, an event type specific log line detection key 522, and a processing event type 523. The target log type 521 includes a cloud environment type 531 and a log file type 532. The event detection information 511 is used to uniquely determine an event type specific log row detection key 522 for detecting a log row related to a processing event with respect to the analysis target log file, and the log data file is stored in the processing event grasping unit 241. Is input, a row having event detection information 511 that matches the log data type 411 attached to the log file is selected. The process event grasping unit 241 uses the event type specific log line detection key 522 included in the selected log line to detect the presence / absence of a process event from the input log data and to detect the event of each detected process event. Get the log line that contains the type.

(Detailed parameter detection information 512)
The detailed parameter detection information 512 includes an extraction target parameter 524, an extraction method 525, a target log file type 526, and parameter extraction processing template information 527. For each processing event detected by the processing event grasping unit 241, an extraction method 525 for a parameter to be acquired, a target log file type 526 including parameter information, and a parameter for the target log file according to the processing event type of the processing event Extraction processing template information 527 is defined. In the extraction method 525, in addition to the detection of the key value value from the collected log rows, the processing other than the log row related to the processing event is regulated, such as the difference comparison between specific log rows and the reference to the cloud configuration information management table 212. May be.

For the processing information that can be defined by the detailed parameter detection information 512, if the parameter extraction by 543 is taken as an example, the parameter extraction processing for log files other than the log file that detected the processing event in the processing event of the virtual resource setting information change or the like May be specified. As for the extraction method, parameter extraction processing may be defined not only by acquiring key value values of specific log lines but also by differences or comparison of key value values in a plurality of log lines.

The log format management table 243 can be created manually by the system administrator and stored in the storage device of the operation work analysis server 104. By using the event detection information 511 of the log format management table 243, it is possible to detect the processing event and its type from the log file.

Further, by using the rules indicated by the detailed parameter detection information 512 of the log format management table 243, it is possible to extract detailed parameters related to the processing event. For example, the rule includes at least one of the type or parameter name of the parameter to be extracted, the extraction method, the target log file type, the model of the parameter extraction process, and the like corresponding to the processing event. By defining the target log file type, detailed parameters corresponding to the processing event type can be extracted from the log file even when the parameter to be extracted is in another file. The specific extraction process is executed by extracting the detailed parameter character string pattern, which is the character string pattern in the log file, by matching the character string of the information held in the rule with the character string in the log file. Can do.

(Processing event management table 236)
FIG. 6 shows the configuration of the processing event management table 236. The processing event management table 236 is configured to structure each processing event extracted by the processing event extraction unit 233 in a table format and manage it in units of rows. The processing event management table 236 includes an execution time 611, a processing event type 612, and a processing event parameter 613 as information regarding each processing event.

The execution time 611 is information on the execution time of each processing event extracted by the processing event extraction unit 233. The process event type 612 is a process event type name of each process event. The processing event parameter 613 is obtained by storing each parameter acquired by the parameter extraction unit 242 in association with a parameter name and a parameter value for each processing event. The number of parameters for each processing event need not be a fixed length, but may be a variable length. The parameter name includes the type of resource (such as Disk ID) and the type of change target item (such as memory size), and the parameter includes a resource identifier (such as Disk-23) and a set value after change of the change target item (4096). MB).

(Processing event group management table 253)
FIG. 7 shows the configuration of the processing event group management table 253. The processing event group management table 253 includes processing events grouped by the processing event grouping unit 251. The processing event group managed by the processing event group management table 253 has a VM ID 711 as a group ID. In addition, although it has an execution time 611, a processing event type 612, and a processing event parameter 613, these pieces of information are the same column data as the processing event management table 236. Also in the processing event group management table 253, each row corresponds to one processing event. When referring to one processing event group from the processing event group management table 253, the VM ID 711 can be referred to as search key information.

(Operation work mapping table 237)
FIG. 8 shows the configuration of the operation work mapping table 237. The operation work mapping table 237 managed by the operation work mapping table management unit 235 is referred to by the operation work specifying unit 252 and used for processing for specifying the correspondence between the processing event and the operation work. The operation work mapping table 237 has definition information for mapping priority 811, operation work name 812, operation work identifier 813, processing event sequence 814, order 815, association time range 817, and overlap 818.

The mapping priority 811 defines work that needs to be preferentially mapped in the operation work specifying process. Taking 821 and 824 indicating mapping information of different operation tasks as an example, different operation tasks may be candidates for association with respect to the same processing event sequence 814. In order to solve this, the information specifying the processing event and the operation work to be preferentially mapped is the mapping priority 811, and the operation work specifying process is performed in order from the operation work having the highest mapping priority 811. (In the present embodiment, the operation work is performed in order from the smallest priority value).

The operation work name 812 and the operation work identifier 813 are information for identifying the operation work. The process event sequence 814 defines a process event subsequence corresponding to the operation work. The order 815 defines the order in which each processing event should appear in the processing event sequence corresponding to the operation work. A process event sequence in which process events do not appear in the order defined in 815 is not associated with an operation work. The device ID type 816 defines the virtual resource type targeted by each processing event.

The association time range 817 defines the upper limit of the time range from the first processing event to the end processing event for the processing event subsequence corresponding to the operation work. Based on the information in the association time range 817, a plurality of different events greatly separated in time can be prevented from being identified as one operation work. In the example of FIG. 8, the association time range 817 is determined corresponding to the operation work name 812, but may be determined corresponding to the device ID type 816. The method determined in accordance with the device ID type 816 is effective, for example, when there is a difference in the hard disk capacity for each model. The association time range 817 may be a fixed value or may be variable by an operation by an operator.

Duplicate 818 defines whether duplication is allowed in the process event sequence corresponding to the operation work. A flag of “No” is set for an event that should appear only once, and a “Yes” flag is set for an event that may appear once or more. By using the information of the duplication 818, it is possible to appropriately detect the operation work from the system log even when one operation work generates a different number of processing events according to the work content.

As will be described later with reference to FIG. 13, the specific operation work specifying process in the present embodiment is a process event in the process event group stored in the process event group management table 253 (FIG. 7) according to the execution time 611. This is a process for detecting the process event sequence 814 from the process event sequence arranged in the sequence order according to the constraints such as the order and time range defined in the operation work mapping table 237 (FIG. 8). The detected result is stored in the operation work management table 213 (FIG. 10).

(Cloud configuration information management table 212)
FIG. 9 shows the configuration of the cloud configuration information management table 212. The cloud configuration information management table 212 includes configuration information of virtual resources such as VMs and virtual DIsks that exist in the cloud environment in the data center 101. In the example of the cloud configuration information table of the present embodiment, the devices associated with individual VMs do not need to have a fixed length and may be variable. The cloud configuration information management table 212 holds changes in configuration information in time series for each VM.

The cloud configuration information management table 212 has

VM ID

911, 912 configuration information valid period start time 912, configuration information valid period end time 913, and related device connection information shown in 914. Each row indicates the configuration information taken from the configuration information valid period start time 912 to the configuration information valid period end time 913 in the corresponding VM (the time information of both is not necessarily required and at any past time) It only needs to be able to search the configuration information).

931-933 indicates that the configuration change has been made twice for the VM. The cloud configuration information management table 212 has a VM ID 911, and when referring to configuration information and changes thereof for individual VMs, the VM ID 911 can be referred to as key information. The related device connection information 914 in the cloud configuration information management table 212 can indicate the relationship between resources using, for example, a resource identifier. Based on the resource identifier of the related device connection information 914, a processing event having a related resource identifier can be extracted and grouped from a plurality of processing events stored in the processing event management table 236 (FIG. 6). . The grouping result is stored as a processing event group management table 253 (FIG. 7).

(Operation work management table 213)
FIG. 10 shows the configuration of the operation work management table 213. The operation work management table 213 includes a VM ID 711, an execution time 611, an operation work identifier 1011, a process event type 612, and a process event parameter 613. The operation work management table 213 manages the operation work information specified from the processing event group by the operation work detection unit 234 and is referred to from the operation work flow display unit 225.

Since the operation work management table 213 stores information in which the operation work is associated with the process event sequence stored in the process event group management table 253, the VM ID 711, the execution time 611, the process event type 612, The processing event parameter 613 has information equivalent to the information described in the processing event group management table of FIG.

The operation work identifier 1011 is identifier information for identifying the associated operation work for each processing event sequence. In the example of FIG. 10, it can be seen that the processing events from the top to the third line are a series of events of the same operation work.

(Overall processing flow in the operation work analysis server 104)
FIG. 11 shows an overall processing flow from log data acquisition to operation work flow display in the operation work analysis server 104. The operation work analysis server 104 acquires log data according to the input of the user 105 (S1111). As an example of log data acquisition, operation work analysis is performed by inputting external terminal connection information to be accessed for log data collection and sending a log data collection request, or by accepting input of a log data file held by the user 105.

When collecting log data from other terminals, the log data collection unit 231 obtains log data from other terminals based on the connection destination information (IP address, login user name, password, etc.) already entered by the user. The log data thus stored is stored in the log data management table 211 (S1121). As for log data acquisition method from the terminal, a method of acquiring log data already acquired on the virtual environment management terminal by file transfer or the like, or virtual environment management of the data center 101 via the virtual environment connection terminal 103 A method of connecting to the server 112 and acquiring log data is included.

When performing the operation work analysis using the log data held by the user as input, the log data receiving unit 232 stores the log data input by the user in the log data management table 211 (S1122).

In the present embodiment, the cloud configuration information management unit 123 holds the latest cloud configuration information in cooperation with the virtual resource configuration management server 113, but the cloud configuration information is not linked or the latest cloud configuration If the information is not held, the cloud configuration information is acquired from the virtual resource configuration management server 113 and stored in the cloud configuration information management table 212 (S1112).

Next, using the log data acquired in step S1121 or step S1122 and the log format management table 243, processing events are extracted and stored in the processing event management table (S1113). Details of the processing flow of step S1113 will be described with reference to FIG.

Next, the processing event grouping unit 251 uses the cloud configuration information managed in the cloud configuration information management table 212 to group the processing events extracted in S1113 into VM units and stores them in the processing event group management table 253. (S1114). Details of the processing flow of step S1114 will be described with reference to FIG.

Next, the operation work specifying unit 252 specifies an operation work for each process event group managed by the process event group management table 253 using the operation work mapping table 237, and the result is the operation work management table. It is stored in 213 (S1115). Details of the processing flow of step S1115 will be described with reference to FIG.

Finally, the operation work flow display unit 225 refers to the operation work information stored in the operation work management table 213 for each processing event group (VM), and renders the information rearranged in time series (S1116). . The above is the flow of the entire processing flow.

(Processing event extraction process flow)
FIG. 12 shows a flow of processing event extraction processing from log data in the processing event extraction unit 233. In the process event extraction process, the log data management unit 124 refers to the log type of the log data, and reads event detection information matching the analysis target log data type from the log format management table 243 (S1211).

Next, in order from the first line of the log data, log lines including the event type specific log line detection key 522 defined in the log format management table 243 read in S1211 are detected (S1221).

For the detected log line, a process event type is specified by extracting specific field data in the target log line, a character string matching process with a known process event type 523, and the like, and the target log type 521 is stored in the log format management table 243. The detailed parameter detection information 512 defined for each processing event type 523 is read (S1222).

Extraction processing is executed for each extraction target parameter defined in the detailed parameter detection information 512 (S1231-1233). The extraction process is performed by reading the target log file type 526 defined in the detailed parameter detection information 512 and using the parameter extraction process template information 527. Depending on the parameters to be extracted, a file different from the log file in which the processing event was detected in S1221 may be used (543-544).

The extracted processing event stores the processing event name (S1222), the extraction parameter (extracted in S1231-S1233), and time information (such as the time stamp of the detection log line in S1222) in the processing event management table 236 (S1223). The above is the flow of processing event extraction processing from log data in the processing event extraction unit 233.

(Operation work detection process flow)
FIG. 13 shows an operation work detection process flow in the operation work detection unit 234. In the operation work detection process, the in-cloud VM configuration information reference unit 321 acquires the configuration information tables 311a-c for each VM from the cloud configuration information management table 212 (S1311).

Next, the configuration information tables 311a-c acquired in S1311 are read one by one, and the following processes of S1331 to S1335 are repeatedly executed for each (S1321).

The VM related device ID acquisition unit 322 reads one table entry for each configuration information table 311. Each row indicates the configuration information that the VM having the target VM ID 911 took within the configuration information valid period (912, 913). The process event group extraction unit 323 acquires the device ID and VM ID 911 defined in the related device connection information 914 (S1332).

From the processing events stored in the processing event management table 236, a processing event having an execution time 611 within the configuration information validity period (912, 913) and having the device ID or VM ID acquired in S1332 is detected ( S1333).

The processing event detected in S1333 is stored in the processing event group management table 253 in association with the VM ID acquired in S1332 and the group ID 711 of the processing event group (S1334).

The processing of S1332-S1334 is performed for all table entry rows (S1335).

Next, the operation work specifying unit 252 reads the operation work mapping table 237 (S1312), and the process event group reference unit 332 refers to one process event group from the process event group management table 253 (S1341).

The operation work mapping information read in S1312 is read one by one from the one with the highest mapping priority 811 (S1351), and the operation work mapping processing unit 333 performs the mapping process between the operation work and the process event sequence in the process event group. (S1352). In the mapping process, the process event sequence 814 corresponding to each operation work is detected from the process event sequence in the process event group. The detection of the process event sequence is realized by applying, for example, the Brute force algorithm, but the present invention is not limited to this method, and an appropriate method may be used.

The detected process event subsequence is stored in the operation work management table together with the operation work identifier (S1353).

The operation work information obtained by replacing the process event sequence of the process event group with the operation work by repeating the mapping work in the order of the priority of the operation work mapping information for each process event group in the processes of S1352 to S1353 (S1354). Is obtained (S1342). The operation work detection process flow in the operation work detection unit 234 has been described above. In this embodiment, the operation work detection process of FIG. 13 is performed on the automatically generated information in the process event management table of FIG. As another method, processing event types and processing event parameters in the processing event management table may be processed based on data manually input by the operator.

(GUI screen 1401)
FIG. 14 is an example of a GUI (Graphical User Interface) screen 1401 that the operation work visualization unit 121 presents to the user 105. The GUI screen 1401 includes, for example, an operation work analysis operation unit 1411, an operation work trend analysis display unit 1412, and a setting information input unit 1413.

The operation work analysis operation unit 1411 displays and operates the operation work flow acquired as a result of the operation work analysis.

The operation work trend analysis display unit 1412 displays a frequency analysis for each operation work with respect to the operation work analysis result. The operation work trend analysis display unit may provide an analysis process for the operation work analysis result performed in the past.

The setting information input unit 1413 is a functional unit that accepts a change input to setting information (for example, the log format management table 243 and the operation work mapping table 237) used for analysis processing for log data, and the change content is the setting information editing unit 221. Is reflected in each table. Specify the analysis target cloud environment or log data file, and start log data collection and analysis.

The operation work analysis operation unit 1411 includes an analysis target log data acquisition information input unit 1421, an operation work flow display panel operation unit 1422, and an operation work flow display panel unit 1423.

The analysis target log data acquisition information input unit 1421 receives other terminal connection information connected to the log data collection unit 231 and the log data file path to be passed to the log data reception unit 232 in order to acquire log data used for analysis processing. It is a functional part that accepts.

The operation workflow display panel operation unit 1422 operates the display contents of the flowchart displayed on the operation workflow display panel unit 1423. Examples of the operation contents include the presence / absence of designation of a VM for which the operation work is to be grasped, designation of a period for displaying the operation work flow, and the like.

The operation work flow display panel unit 1423 refers to the operation work information managed in the operation work management table 213 for each VM ID 711 as an analysis result, and forms an order shaping flowchart based on the execution time 611 of the referenced operation work information. indicate. Note that the order 0 means no order.

As described above, in this embodiment, regarding the management method for specifying and displaying the operation work for the virtual resource performed in the information processing system, the information processing system generates one or more system log data and specifies the system log data. As input, one or more processing event information or one or more operation work information is specified based on one or more parameters related to configuration information including a virtual resource identifier in the information processing system environment, and processing event information Alternatively, the operation efficiency can be improved by displaying the operation work information.

(Data center operation sequence diagram)
FIG. 15 is a series of sequence diagrams for reviewing the existing operation work status and examining improvement measures by grasping the data center operation work using the operation work analysis server. The log data to be analyzed is automatically generated by daily cloud environment operation work by a data center operator. The log data is acquired via the network by the log data collection unit 231, or the log data receiving unit 232 inputs the log data received from the data center operator in advance by the operation work analysis executor to perform analysis processing. . The operational work flow obtained as an analysis result indicates the current operational work implementation status. Based on this information, the data center operator and the operation work analyst examine operation work improvement measures by automating frequently executed operation work.

(Apparatus configuration of the operation work analysis server 104)
FIG. 16 shows an example of the device configuration of the operation work analysis server 104. In FIG. 16, the operation work analysis server 104 can be realized by using a general computer including a CPU 1621, a memory 1622, and an auxiliary storage device 1623. Furthermore, each function which comprises each apparatus is embodied on the said computer, when CPU runs the program stored in the auxiliary storage device. Each program may be stored in advance in the auxiliary storage device 1623 in the computer. Alternatively, each program may be introduced into the storage device from another device via a medium that can be used by the computer via a communication interface 1624 such as a LAN interface or a media interface 1625 when necessary. The medium refers to, for example, a communication medium (that is, a wired, wireless, optical, or other network, a carrier wave or a digital signal that propagates through the network), or an external storage medium 1613 that can be attached to and detached from the media interface 1625. The operation work analysis server 104 is connected to the console 1633 via the input / output device 1626.

At this time, the external storage device (auxiliary storage device) 1623 operates including the log data management table 211 and the cloud configuration information management table 212 acquired via the virtual environment connection terminal 103 connected via the network 1631. It functions as a storage device for storing a log format management table 243, a processing event management table 236, a processing event group management table 253, and an operation work mapping table 237 used in the work analysis process. The CPU 1621 manages the above-described information used in the operation work analysis, and functions as a controller that constitutes the operation work visualization unit 121, the log data analysis unit 122, the cloud configuration information management unit 123, and the log data management unit 124. The console 1633 is a control target of the controller (CPU 1621) and functions as a display device that displays information according to instructions from the CPU 1621.

According to the embodiment described above, it is possible to identify the operation work performed by the operation worker in the past from the system log data automatically generated by the virtualization software or the virtual environment management server according to the operation work for the cloud environment. . In addition, since the identified operation work can be displayed in time series, the actual condition of the operation work for the cloud environment can be quickly and accurately performed.

In other words, in a management server that manages the operation of virtual resources performed in an information processing system to which virtualization technology is applied, operations can be performed from one or more virtualization software in a cloud environment or a system log generated by the virtual environment management server. One or more processing events related to the can be identified.

Also, in the management server that manages the virtual resource operation work performed in the information processing system to which the virtualization technology is applied, the operation work that is the source of the process event is identified from one or more process events related to the operation be able to.

In the configuration described in the above embodiments, each server may be configured by a single computer, or any other part of an input device, an output device, a processing device, or a storage device may be connected via a network. You may comprise with a computer.

In this embodiment, functions equivalent to those configured by software can be realized by hardware such as FPGA (Field Programmable Gate Array) and ASIC (Application Specific Integrated Circuit). Such an embodiment is also included in the scope of the present invention.

The present invention is not limited to the above-described embodiment, and includes various modifications. For example, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace the configurations of other embodiments with respect to a part of the configurations of the embodiments.

(Supplement)
The inventive concept included in this specification is shown below.

(Invention 1)
In a management server that has an input device, an output device, a processing device, and a storage device, and manages an operation work executed by a processing event using a resource of an information processing system,
The storage device
Processing event management information for managing a plurality of processing events executed in the information processing system in association with a parameter including an identifier for identifying the resource used for the processing event;
Storing configuration information management information indicating the relationship between the resources using the identifier;
The processor is
A processing event grouping unit that refers to the configuration information management information, groups the plurality of processing events for each related processing event, and stores the grouped processing event group management information in the storage device.
Management server or management method using it.

(Invention 2)
The storage device
Corresponding to the operation work, storing operation work mapping information for storing a plurality of processing events together with order information,
The processor is
An operation work specifying unit that refers to the operation work mapping information, associates process events belonging to the same group of process event group management information with different operation works, and stores them in the storage device as operation work management information,
A management server according to invention 1, or a management method using the management server.

(Invention 3)
The configuration information management information includes connection relation information between virtual resources that are resources,
The processing event grouping unit
Identifying one or more virtual resources in a connection relationship based on the connection relationship information between the virtual resources;
The management server of invention 2, or the management method using the same.

(Invention 4)
The connection relation information between the virtual resources includes connection relation information between virtual resources at a plurality of points in time,
The processing event management information includes execution time information of each processing event,
The processing event grouping unit further includes:
Identifying connection relation information between the virtual resources for the execution time information;
A management server according to invention 3, or a management method using the management server.

(Invention 5)
It is a management server that manages an operation work related to a virtual resource including at least a virtual machine, which is implemented in an information processing system to which a virtualization technology is applied. The management server associates a processing event management table that manages one or more processing events executed in the information processing system, one or more processing events, and an operation work performed in the information processing system. A mapping table and system configuration information related to a virtual resource to be operated by the information processing system are provided, and the processing event management table further includes a virtual resource identifier that is processed by each processing event. The management server performs a matching process on the process event in the process event management table based on one or more virtual resource identifiers included in the system configuration information and one or more process events specified by the operation work mapping table. An operation work detection unit is provided, and one or more operation work is specified from the processing event.

It can be applied to the field of automating the actual situation of the operation work for resources in data centers.

101 data center, 102 data center external network, 103 virtual environment connection terminal, 104 operation work analysis server, 105 users, 111 data center network, 112ac virtual environment management server, 113 virtual resource configuration management server, 114 network equipment 115a-d virtualization server, 116SAN, 117a-c storage device, 121 operation work visualization unit, 122 log data analysis unit, 123 cloud configuration information management unit, 124 log data management unit, 211 log data management table, 212 cloud configuration Information management table, 213 operation work management table, 221 setting information editing unit, 222 analysis result trend estimation unit, 223 data acquisition request unit, 224 analysis start request unit, 225 operation work flow display unit, 231 log data collection unit, 232 log Data reception unit, 233 processing event extraction unit, 234 operation work detection unit, 235 operation work mapping table management unit, 236 processing event management table, operation work mapping table management unit, 241 processing event grasping unit, 242 parameter extraction unit, 243 Log format management table, 251 processing event grouping unit, 252 operation work specifying unit, 253 processing event group management table, 237 operation work mapping table, 311a-c VM configuration information table, 321 VM configuration information reference unit in cloud 322 VM related Device ID acquisition unit, 323 processing event group extraction unit, 331 operation work mapping table reference unit, 332 processing event group reference unit, 333 operation work mapping processing unit, 1411 operation work analysis operation unit, 1412 operation work trend analysis Display unit, 1413 setting information input unit, 1421 analysis target log data acquisition information input unit, 1422 operation work flow display panel operation unit, 1423 operation work flow display panel unit, 1621 CPU, 1622 memory, 1623 auxiliary storage device, 1624 communication interface, 1625 media interface, 1626 input / output device, 1631 network, 1632 external storage device, 1533 console

Claims

In a management server that has an input device, an output device, a processing device, and a storage device, and manages an operation work executed by a processing event using a resource of an information processing system,
The input device is:
Obtaining one or more log data generated by the information processing system;
The storage device
Event detection information that defines the correspondence between the type of the processing event and an event type detection key that is a character string in the log data;
Storing parameter detection information that defines a correspondence relationship between the type of the processing event and an extraction rule of a parameter related to the resource that is a character string in the log data;
The processor is
By matching the log data with the event type detection key, a processing event grasping process for specifying the existence of the processing event and its type,
Corresponding to the type of process event specified in the process event grasping process, the extraction rule is used to perform a parameter extraction process for extracting the parameter from the log data,
In the storage device,
Storing processing event management information in which the extracted parameters are associated with the type of processing event;
Management server.
The parameter detection information is, as the extraction rule,
The parameter type, an extraction method corresponding to the parameter type, a parameter extraction processing target log data type corresponding to the parameter type, and a parameter extraction processing command corresponding to the parameter type,
The parameter extraction process includes:
Identifying one or more parameter types corresponding to the type of process event identified in the process event grasping process;
According to the extraction method and parameter extraction processing command corresponding to the parameter type,
Extracting the parameter from one or more log data specified by the parameter extraction target log data type corresponding to the parameter type;
The management server according to claim 1.
The parameter is
Including an identifier that uniquely identifies the resource;
The storage device further includes
Storing configuration information management information that defines relevance of resources of the information processing system using the identifier;
The processor is
Based on the configuration information management information, the event type and parameters of the processing event management information are grouped, processing event group management information is stored in the storage device, and processing event grouping processing is performed.
The management server according to claim 2.
The storage device further includes
Storing operation work mapping information associating the processing event with the operation work;
The processor is
Based on the operation work mapping information, an operation work specifying process is performed for associating a plurality of process events included in one group of the process event group management information with one operation work.
The management server according to claim 3.
The operation work mapping information is:
When a plurality of the processing events are associated with one operation work, the information includes order information of the plurality of processing events.
The management server according to claim 4.
In a management method using a management server that has an input device, an output device, a processing device, and a storage device, and manages an operation work executed by a processing event using a resource of an information processing system,
The input device is:
Obtaining one or more log data generated by the information processing system;
The storage device
Event detection information that defines the correspondence between the type of the processing event and an event type detection key that is a character string in the log data;
Storing parameter detection information that defines a correspondence relationship between the type of the processing event and an extraction rule of a parameter related to the resource that is a character string in the log data;
The processor is
By matching the log data with the event type detection key, a processing event grasping process for specifying the existence of the processing event and its type,
Corresponding to the type of process event specified in the process event grasping process, the extraction rule is used to perform a parameter extraction process for extracting the parameter from the log data,
In the storage device,
Storing processing event management information in which the extracted parameters are associated with the type of processing event;
Management method.
The parameter detection information is, as the extraction rule,
The parameter type, an extraction method corresponding to the parameter type, a parameter extraction processing target log data type corresponding to the parameter type, and a parameter extraction processing command corresponding to the parameter type,
The parameter extraction process includes:
Identifying one or more parameter types corresponding to the type of process event identified in the process event grasping process;
According to the extraction method and parameter extraction processing command corresponding to the parameter type,
Extracting the parameter from one or more log data specified by the parameter extraction target log data type corresponding to the parameter type;
The management method according to claim 6.
The parameter is
Including an identifier that uniquely identifies the resource;
The storage device further includes
Storing configuration information management information that defines relevance of resources of the information processing system using the identifier;
The processor is
Based on the configuration information management information, the event type and parameters of the processing event management information are grouped, processing event group management information is stored in the storage device, and processing event grouping processing is performed.
The management method according to claim 7.
The storage device further includes
Storing operation work mapping information associating the processing event with the operation work;
The processor is
Based on the operation work mapping information, an operation work specifying process is performed for associating a plurality of process events included in one group of the process event group management information with one operation work.
The management method according to claim 8.
The operation work mapping information is:
When a plurality of the processing events are associated with one operation work, the information includes order information of the plurality of processing events.
The management method according to claim 9.
An input device, an output device, a processing device, and a storage device;
In the management method using the management server that manages the operation work executed by the processing event using the resource of the information processing system,
The storage device
Process event management information for managing a plurality of process events executed in the information processing system in association with a parameter including an identifier for identifying the resource used for the process event, or
With reference to the configuration information management information indicating the relevance of the resources using the identifier, for the processing event group management information, the plurality of processing events are grouped for each related processing event,
In response to the operation work, refer to the operation work mapping information that stores a plurality of processing events together with order information,
Operation work management information in which process events belonging to the same group of the process event group management information are associated with different operation work,
Store and
The output device is
A management method comprising displaying the processing event management information or the operation work management information.