JP2002342182A - Operation management support system for network systems - Google Patents

Abstract

(57) [Summary] [Problem] To report a list of components causing a performance bottleneck or a failure, and to quickly identify the cause. An operating information storage unit includes an managed system, a network, and an operation management server. The operating information of each component collected from the managed system through an operating information collection adapter is stored in an operating information storage unit.
Is stored in The analysis operation unit 150 selects one piece of operation information that is arbitrarily or out of a predetermined value range, and quantifies the magnitude of the relation with the other pieces of operation information. At the time of the calculation for quantification, necessary operation information is sequentially extracted from the operation information collection unit 140. Of the operation information subject to the calculation, if the quantified related value exceeds the range of the preset value, it is highly likely that it causes a performance bottleneck or failure. This is reported to the output unit 180.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for managing an operation status in a network system including a plurality of hardware and software connected to a network, and more particularly to a method for specifying a component which is a bottleneck in performance and for identifying a failure. It relates to technology that is effective in identifying the causal component.

[0002]

2. Description of the Related Art Corporate information systems and iDC (Internet Data
In a relatively large-scale network system such as the (Center), since the cost of system management is high, an integrated management system for centrally managing the operation status of the components of the system is often introduced. In this integrated management system, information on the operating status of a plurality of hardware or software to be managed is acquired online and output to a display device connected to the integrated management system.
In order to determine the failure of the system to be managed, there are methods such as setting a threshold value in operation information in advance and evaluating the deviation from the average value. If a failure is determined, the location is reported. Is done.

When the error rate of a certain program is identified as a failure point, the cause of the problem is determined as to whether it is due to insufficient memory capacity, CPU load, or network load. It is necessary to narrow down.
In general, it is necessary to investigate the system logs and parameters of a computer that are likely to be related to the elucidation of the cause, and to rely on the experience and intuition of the system engineer, and it takes time and effort to solve the problem. Japanese Patent Application Laid-Open No. 8-65302 describes a technique in which the size of a relationship is determined in advance for each component, and additional operation information is collected for components having a high relationship in the event of a failure. However, in the above-described technology, the magnitude of the relationship between the components is set in advance, so the magnitude of the relationship according to the actual operation status is not taken into account, and the cause cannot always be specified or the cause is specified. Not very efficient. Also, in the prior art, when it is desired to improve the performance of a managed system, it is difficult to identify which hardware or software is a performance bottleneck as the size of the network system increases. Over-investment and under-investment.

[0004]

As described above, in a relatively large-scale network system, it is necessary to investigate operation information of a plurality of components in order to narrow down a performance bottleneck or a cause of a failure. there were. The problem to be solved by the present invention is to quantify the relationship between the components of the system to be managed based on the operation information, thereby narrowing down the components causing a performance bottleneck or failure, and This is to enable the identification to be realized early.

[0005]

In order to achieve the above object, an operation management support system in a network system according to the present invention comprises: (1) means for communicating with a management device; One or more devices to be managed comprising the above components, communication means for communicating with the devices to be managed, collection means for collecting operation information of the components from the devices to be managed by the communication means, and Storage means for storing the collected operation information; and quantifying the magnitude of the relationship between any one of the operation information and one or more other operation information based on the operation information accumulated by the storage means. It is characterized by comprising an arithmetic means and a management device provided with a judging means for specifying a related component based on the arithmetic result. (2) In the support system according to the above (1), when the collected operation information deviates from a threshold range set in advance for each operation information, the corresponding operation information is replaced with the one of the arbitrary ones. The calculation is performed as the operation information. Also,
(3) For the calculation means in the support system according to (1), a multiple regression analysis is performed using any one piece of operation information as an objective variable and one or more other pieces of operation information as an explanatory variable. It is characterized in that the magnitude of the association is quantified by calculating a statistic representing a contribution to an objective variable such as a partial correlation coefficient or an F value. (4) Regarding the calculation means in the support system described in the above (1), any one of the operation information is a target variable, one or more other operation information is an explanatory variable, and any one of the operation information is arbitrarily determined in advance for each operation information. When the set value range is defined as an abnormal value range, the ratio of the time during which the explanatory variable in the time is simultaneously the abnormal value range to the time when the target variable is the abnormal value range is calculated for each explanatory variable. Thus, the size of the association is quantified. (5) Regarding the calculation means in the support system described in (1) above, when any one piece of operation information is defined as a target variable and at least one other piece of operation information is defined as an explanatory variable, It is characterized in that an explanatory variable is excluded from a calculation target depending on the presence or absence of a dependency based on a known dependency between elements. (6) The determination means in the support system according to (1) has a value range set in advance for the related value quantified by the calculation means, and has operation information that does not deviate from the value range. It is characterized by reporting that components are related. (7) Regarding the determination means in the support system according to (1), when there are a plurality of related values quantified by the calculation means, the components are ranked and reported according to the related values. It is characterized by the following.

[0006]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS FIGS. 1 to 10 show an embodiment of the present invention. In the drawings, the same reference numerals denote the same parts, and the basic structure is the conventional one shown in the drawings. Is the same as Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. FIG. 1 is a block diagram of a network system showing an embodiment of the present invention. This system includes a management target system 200, a network 000, and an operation management server 100.

The managed system 200 includes one or more computers or one or more network devices, and operation information is collected by an operation information collection adapter during operation. Network devices are devices that have unique IP addresses such as network printers and intelligent hubs but do not have an OS. Managed system 2
00 is connected to the network 000 using the communication line 001. In FIG. 1, the connection is made by a single communication line 001 for the sake of convenience. The communication line 001 may be wired or wireless.

FIG. 2 is a block diagram showing an information transmission path according to the present invention. The operation information collected by the operation information collection adapter 120 from the management target system 200 is formatted and stored in the operation information storage unit 140 via the path 52. As a method of collecting the operation information, there is a method in which the operation information collection adapter 120 collects the information on the path 50 and a method in which the managed system 200 collects the information on the path 51 and periodically sends the collected information to the operation collection adapter. When performing the analysis, the analysis operation unit 150 stores the operation information in the operation information storage unit 1 through the path 53.
At 40, the information is obtained, and necessary information is extracted through a route 54. The input / output unit 180 specifies an analysis target through the path 56 and displays the analysis result through the path 55. The path in FIG. 2 is an abstract representation of the information flow, and does not require a specific device.

The operation management server 100 collects operation information from the system to be managed via the operation information collection adapter 120, analyzes the operation information collected by the analysis unit 130, and analyzes the operation result by the input / output unit 180. Means for setting the output and analysis contents. The analysis unit 130 includes an operation information storage unit 140 for storing operation information output from the operation information collection adapter 120 and an analysis operation unit 150 for quantifying the magnitude of the relationship between the components. In FIG. 1, for convenience, the above means are configured in one operation management server 100. However, the operation information collection adapter 120, the operation information storage unit 140, the analysis operation unit 150, and the input / output unit 180 are configured by separate servers. It is also possible.

[0010] The network 000 is a communication line for performing communication between the managed system 200 and the operation management server 100, and may be wired or wireless. When the managed system 200 and the operation management server 100 communicate directly, a configuration without the network 000 is also possible. Note that, for example, when the network 000 is the Internet, a configuration including a plurality of firewalls may be included.

Hereinafter, each component of the managed system 200 will be described in detail. FIG. 3 is a detailed diagram of the managed system shown in FIG. The computer 210 interprets the program,
It comprises a CPU 213 to be executed, a memory 214 for reading programs and data, a communication interface 212 for connecting to a network, and an external storage device 216 for storing programs and data. Communication interface 212, CPU 213, external storage device 216,
The memory 214 is a bus 21 for transmitting and receiving data to and from each other.
They are joined by 1. The memory 210 has a computer 210
One or more programs running on it are loaded. For example, when the computer 210 has a function of mediating a plurality of networks, a configuration may be adopted in which a plurality of communication interfaces are mounted on one managed computer. An external storage device may not be mounted, or a plurality of external storage devices may be mounted. The computer 230 has the same configuration as the computer 210.
In addition, the computer 210 may be a mobile terminal device having an intermittent usage mode such as a small notebook personal computer or a mobile phone that does not always connect to the network but connects to the network only when using it.

FIG. 4 shows an example of the relationship between a service and a program.
Are functions provided without the user being aware of the operation of the program, such as a search service on the Internet / intranet. A service is a function constructed from one or more programs, and a program for constructing one service may be operated by a plurality of computers. The program is a component that is loaded into the memory of the computer and can be managed in process units. One program may constitute a plurality of services. FIG.
, The service 311 includes a program 215 operating on the computer 210 and a program 2 operating on the computer 230.
35.

A managed component 220 in FIG. 3 indicates a range of components of the hardware component and software component of the computer 210 for monitoring the operating state by collecting the operating information. That is, here, the program C, the program E, the communication interface, and the external storage device are components that do not acquire operation information. The managed components can cover all components, but not any components. Managed service 310 in FIG.
3 shows the range of services for monitoring the operation status, similar to the managed components in FIG. 3, and the service 311 is managed here. Managed service 310
Is arbitrary, and it is possible to include all the services 300 operating in the managed system, and not to include all the services 300.

A table 420 in FIG. 5 shows collection targets and collection means when the operation information collection adapter 120 in FIG. 1 collects the operation information 421. The operation information collection adapter 120 has a unit that collects operation information of components within the range of the managed component 220 and the managed service 310, collects the information, and stores it in the operation information storage unit 140. CPU usage rate 431 in FIG.
The details of the operation of the operation information collection adapter 120 are described below. The operation information collection adapter 120 collects the CPU usage rate of the computer 1 using the collection tool A. Collection tool A is an operation information collection adapter 1 every 5 minutes
20 and stores the collected CPU usage rate every 5 minutes in a memory or an external storage device. The operation information collection adapter 120 averages twelve data for one hour of the memory usage rate collected at 5-minute intervals, and stores the average in the operation information storage unit 140. In FIG. 5, the operation information collection adapter 120 is described as calling a collection tool as a collection means, but a method in which the computer 1 has the collection tool as a program and operates its own collection tool independently is also possible. Also, when the collection cycle and the aggregation cycle are the same, the operation information is directly stored in the operation information storage unit 1 without performing the aggregation processing.
It is also possible to store the data at 40. FIG. 5 shows an example of the operation definition information of the operation information collection adapter 120. The collection means 423, the collection period 424, the total period 425, and the total method 4 are shown.
The 26 items need not necessarily be included, and similar information may be stored in an external storage device connectable from the operation management server 100. Arbitrary determination conditions, such as a threshold for automatically reporting, can be defined in the table 420.

The operation information storage unit 140 includes an analysis operation unit 150
Stores operation information used for calculation. FIG. 6 shows a list of operation information stored in the operation information storage unit 140. Row 451 of Table 440 indicates that the value of the CPU usage rate collected from Computer 1 at 12:10 on January 17, 2001 is 22%. As for the amount of data stored in the operation information storage unit 140, the operation information is accumulated and increases as the time for managing the managed system increases. In the operation information storage unit 140, it is necessary that all operation information within the time targeted in the analysis operation be stored at the same time width and at the same time. That is, for row 451, 2001
That is, the operation information on January 17, 12:10 must be stored not only for the CPU usage rate and the memory usage rate of the computer 1 but also for all target components. However, in actual operation, there may be operation information that could not be collected at a certain time, and in that case, the last value, 0 or 100 is stored in the storage location of the operation information.
And other appropriate values. FIG. 6 shows the operation information storage unit 1
This is an example of operation information stored in the storage 40, and the same information may be stored in an external storage device connectable from the operation management server 100 regardless of the data structure.

Hereinafter, the operation of the analysis operation unit 150 in FIG. 1 will be described in detail. FIG. 7 is a diagram in which the operation information of FIG. 6 is graphed with time as an axis. The operation information collected from the managed system 200 includes the service response time 4
There are a total of seven, such as 61. The analysis operation unit 150 includes a unit for quantifying the strength of association between the operation information of interest and other operation information, and a unit for selecting operation information having a strong association with the operation information of interest. There are two types of operation information of interest, one specified by a human in the input / output unit 180 and one exceeding a preset threshold. FIG.
FIG. 9 is a block diagram showing an operation when an instruction is given to perform an analysis on the service response time 461 in the input / output unit 180. The following two methods are used to quantify the strength of the association: a method that uses multiple regression analysis and a method that calculates the contribution rate at the time of abnormality. It is also possible to use a plurality of them in combination.

A method of selecting operation information having a high relation to the service response time 461 from other operation information using multiple regression analysis will be described. In the multiple regression analysis, a multiple regression equation shown in Expression 1 is obtained. In Equation 1, y represents an objective variable, x represents an explanatory variable, α represents a regression coefficient, and f (x) represents an arbitrary function having x as a dependent variable. When f (x) = x, Equation 1 is a linear multiple regression equation, but it is also possible to use any function that fits well. The input / output unit 180 specifies an objective variable and an explanatory variable as analysis conditions 501 for performing multiple regression analysis. The explanatory variables for performing multiple regression analysis can be arbitrarily selected, but at least one must be selected. The multiple regression analysis operation unit 150 interprets the analysis condition 501 and extracts specified operation information from the operation information storage unit 140. The extracted operation information 470 is treated as one set of operation information at each time. That is, in Expression 1, it means that it is treated as y at a certain time and all x at that time.

[0018]

(Equation 1) Multiple regression analysis is performed using the values of the objective variable 472 and the explanatory variable 473 in the operation information 470 extracted from the operation information storage unit 140, and a multiple regression equation and an analysis result are obtained. FIG. 9 shows the detailed contents of the analysis result by the multiple regression equation in FIG. The multiple regression equation of Expression 2 can be described from the analysis result 520 for each explanatory variable. Explanatory variables 521 constituting the multiple regression equation of Expression 2
Is necessary for predicting the target variable 472, using the F value 522. In order to be adopted as an explanatory variable at the significance level α = 0.05, the F value must exceed 18.513, and the only one of the explanatory variables 521 that corresponds to this is the memory usage rate 462 of the computer 2. That is, as a result of analyzing the operation information, the operation information closely related to the service response time 461 of the patent search service is the memory usage rate 462 of the computer 2. The analysis operation unit 150 outputs, to the input / output unit 180, the operation information determined to be sufficiently related to all or a part of the multiple regression equation and the analysis result, here, the memory usage rate of the computer 2. In determining the multiple regression equation of Expression 2, it is also possible to use a means for selecting more optimal explanatory variables, such as a stepwise method. In addition, when selecting the explanatory variables, t
It is also possible to use other criteria such as a value, Akaike information criterion (AIC), and partial correlation coefficient, and any value can be designated as a selection reference value at that time.

[0019]

(Equation 2) A method of analyzing the operation information of FIG. 6 collected from the management target system 200 using the calculation method based on the contribution ratio at the time of abnormality will be described below. The flow of operation in calculating the anomalous contribution rate basically follows that of multiple regression analysis. The input / output unit 180 determines an explanatory variable that is highly relevant to the service response time of the patent search service specified as the objective variable based on the abnormal contribution rate. Regarding the operation information other than the objective variable, the explanatory variable can be used for all the components of the managed system 200 or can be arbitrarily selected. If the operation information 470 is abnormal,
The difference from the average value is large, the device is close to the performance / capacity limit, or the device is not operating normally. In any case, an arbitrary threshold value is set to determine an abnormality. Equation 3 shows a formula for calculating the abnormal contribution rate. Operation information 47
From 0, the sum of the time during which the objective variable was abnormal and the time during which the explanatory variable was abnormal at that time is calculated, and the abnormal contribution rate is determined for each explanatory variable. The abnormal contribution rate is a rate at which the explanatory variable is abnormal at the same time when the objective variable is abnormal, and is an index indicating the possibility of association.

[0020]

(Equation 3) FIG. 10 shows an analysis result based on the abnormal contribution rate. Here, as a means for determining an abnormality, a range of a value that is abnormal in the threshold 542 is designated in advance, and a threshold 543 for the deviation is set.
Although the specification of the range of deviation from the average value of the operation information is used in the above, any threshold value can be specified in any combination. The threshold can be specified in the operation definition of the operation information collection adapter in FIG. 5, or can be specified directly by the analysis operation unit 150 or the input / output unit 180. The time during which the target variable was abnormal in the abnormal time 544 in FIG. 14 is 4 hours, and the value of the time during which the explanatory variable was abnormal at the same time from Equation 3 is the abnormal contribution rate 545. is there. Assuming that the threshold of the abnormal contribution rate for determining that the relation is high is 40%, the operation information that is highly relevant to the service response time 461 of the patent search service is:
The memory usage rate of the computer 2 and the CPU usage rate of the computer 2 are shown. The analysis calculation unit 150 outputs to the input / output unit 180 operation information determined to be sufficiently related to all or a part of the analysis result, here, the memory usage rate of the computer 2 and the CPU usage rate of the computer 2. . The threshold value of the abnormal contribution rate can be left unspecified and can be set to any value.

The input / output unit 180 includes means for designating an objective variable and an explanatory variable, and means for displaying an analysis result. It may have additional input / output functions such as display or setting of device configuration information of the operation target system 200, display or setting of operation definition information of the operation information collection adapter in FIG. 5, and graph display of operation information in FIG. It is possible.
In the input / output unit 180, the threshold information needs to be stored in the operation management server so that the analysis is automatically performed when the target variable and the explanatory variable are not directly specified or when the threshold value is exceeded. When displaying the analysis result, a list of explanatory variables considered to be highly related to the objective variable is displayed. Since the target variable or explanatory variable is essentially operating information and an index indicating the operating status of the component, the list displayed here may cause a performance bottleneck or failure of the component to which the objective variable belongs. This is operation information of a component that is highly likely to be in operation. In the example of FIG. 9, which is a result of performing a multiple regression analysis using the service response time 461 as an objective variable, the operation information affecting the service performance is the memory usage rate of the computer 2. Even when a plurality of calculation methods for quantifying the relationship are used in the analysis calculation unit 150, all the explanatory variables regarded as having a high relationship are displayed.

Incidentally, the operation management support system in the network system of the present invention is not limited to the above-described embodiment, and it is needless to say that various changes can be made without departing from the gist of the present invention. is there.

[0023]

According to the present invention, by quantifying the magnitude of the relationship between the components of the network system,
By reporting a list of components that cause performance bottlenecks and failures, the cause can be identified early.

[Brief description of the drawings]

FIG. 1 is a block diagram showing one embodiment of a configuration according to the present invention of an operation management support system in a network system of the present invention.

FIG. 2 is a block diagram showing a transmission path of information in FIG.

FIG. 3 is a detailed diagram of each component of the managed system in FIG. 1;

FIG. 4 is a block diagram showing a relationship between a program operating on a managed computer in FIG. 1 and a service.

FIG. 5 is a list showing an example of an operation definition of the operation information collection adapter in FIG. 1;

FIG. 6 is a list diagram showing an example of operation information stored in an operation information storage unit in FIG. 1;

FIG. 7 is a diagram illustrating an example of a graph in which operation information collected from the management target system in FIG. 1 is displayed with time as a horizontal axis.

FIG. 8 is an explanatory diagram showing a flow of processing in an analysis operation unit with respect to the operation management server in FIG. 1;

9 is a diagram illustrating an example of an analysis result when multiple regression analysis is used as a calculation method in the analysis calculation unit in FIG. 1;

FIG. 10 is a diagram illustrating an example of an analysis result in a case where a method of calculating an abnormal contribution rate is used as a calculation method in the analysis calculation unit in FIG. 1;

[Explanation of symbols]

000 network, 001 communication line, 100 operation management server, 120 operation information collection adapter, 130
... Analysis unit, 140 ... Operation information storage unit, 150 ... Analysis operation unit, 180 ... Input / output unit, 200 ... Managed system, 2
10: Computer to be managed, 211: Bus, 212: Communication interface, 213: CPU, 214: Memory, 21
5 Program, 220 Management target component, 300
Services provided by the network system, 310 ...
Managed service, 311... Service α.

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 12/24 H04L 12/24 12/26 12/26 H04Q 9/00 301 H04Q 9/00 301B 311 311H 321 321E (72) Inventor Tsutomu Miyahara 5-2 Nihon Odori, Naka-ku, Yokohama-shi, Kanagawa Prefecture Inside Hitachi I.S.S. Software Co., Ltd. (72) Masaharu Akatsu 1099 Ozenji Temple, Aso-ku, Kawasaki-shi, Kanagawa Stock Company GA term HB20 JJ29 MA14 MC30 5B089 JA35 JA36 JB15 JB16 KA12 KA13 KB04 KC28 MC01 5K030 GA11 HB19 HC01 KA01 KA02 MA01 MB09 5K048 BA21 DA02 DB01 DC01 DC03 EB06 EB01 HA01

Claims (7)

[Claims] A communication unit configured to communicate with the managed device; a communication device configured to communicate with the managed device, the communication device configured to communicate with the managed device, the communication device configured to communicate with the managed device; Collecting means for collecting operation information of components from the device to be managed by the means, storage means for storing the operation information collected by the collection means, and arbitrary information based on the operation information accumulated by the storage means. It is composed of arithmetic means for quantifying the magnitude of the association between one piece of operation information and one or more other pieces of operation information, and a management device provided with a judgment means for specifying a related component based on the operation result. An operation management support system for a network system. 2. The method according to claim 1, wherein when the collected operation information deviates from a threshold range set in advance for each operation information, a corresponding operation information is calculated as the arbitrary one operation information. An operation management support system for a network system characterized by performing: 3. A multiple regression analysis is performed on the calculation means in the management device according to claim 1, using any one of the operation information as an objective variable and one or more other operation information as an explanatory variable. An operation management support system for a network system, characterized in that a statistic representing a contribution to an objective variable such as a partial correlation coefficient or an F value is calculated to quantify the magnitude of the association. 4. The operation means in the management device according to claim 1, wherein any one of the operation information is a target variable, and
When one or more operation information is defined as an explanatory variable, and a value range arbitrarily set in advance for each operation information is defined as an abnormal value range,
It is characterized in that the ratio of the time during which the explanatory variable is simultaneously in the abnormal value range to the time when the objective variable is in the abnormal value range is calculated for each explanatory variable, thereby quantifying the magnitude of the association. Operation management support system in a network system. 5. The arithmetic means in the management device according to claim 1, wherein any one piece of operation information is used as a target variable, and
When one or more operation information is defined as an explanatory variable, a network system is characterized in that the explanatory variable is excluded from a calculation target according to the presence or absence of a dependency based on a known dependency between components of the managed device. Operation management support system. 6. A constituent element having operation information that does not deviate from the value range, in which the determination means in the management device according to claim 1 sets a value range in advance for a related value quantified by the calculation means. And an operation management support system in a network system, characterized in that it is reported as relevant. 7. The determining means in the management device according to claim 1, wherein when there are a plurality of related values quantified by the calculating means, the constituent elements are ranked and reported according to the related values. An operation management support system for network systems.