JP2009020545A - Anomaly monitoring device for computer - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To detect the abnormal operation of an OS or an application in an early stage, and to specify the application which has abnormally operated while decreasing the CPU load of a system. <P>SOLUTION: Each application 1A to 1C issues information to specify its own application and application information in which application-categorized monitoring timeout time is written as a request to validate a watch dog function, and successively stores it in an FIFO memory 4 through an operating system 2, and a local CPU 5 successively reads the application information, and operates watch dog monitoring about the application-categorized timeout time. The presence/absence of abnormality is monitored by every application-categorized operation confirmation, and the monitoring is operated by the local CPU through a monitoring agent and the operating system. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an abnormality monitoring apparatus for computers equipped with a plurality of applications, and more particularly to an apparatus for monitoring abnormal operations of applications and OS.

  A watchdog function is generally used for monitoring abnormal operation of a computer. A monitoring method using the watchdog function will be described with reference to FIG. A plurality of computer applications 1 are installed, and their functions are executed via an operating system (OS) 2. As a monitoring function of the computer that executes the application 1, a notification for enabling the watchdog function is generated at a certain period, and this notification is notified to the watchdog function unit 3 through the device driver 2A. The watchdog function unit 3 detects an abnormal operation of the computer when the notification from the computer system is not within a predetermined time (timeout), and resets and restarts the system.

  Since the monitoring method using the watchdog function is set to a timer period of a relatively long time (about 1 to 2 seconds) in order to prevent an increase in the load on the system, the occurrence of an abnormality cannot be detected quickly. Also, it is impossible to identify the cause of the abnormality.

As a monitoring method to quickly detect the occurrence of an abnormality, it directly monitors the address data on the address bus of the computer system, detects an abnormality when it becomes an address space to which no address data is assigned, and interrupts the CPU (For example, refer to Patent Document 1).
JP-A-8-278902

  As described above, the monitoring method using the watchdog function cannot quickly detect the occurrence of an abnormality. When the watchdog function times out, the CPU is interrupted and the system is restarted. However, an abnormality can be detected only when there is no notification of timer update from the application to the watchdog function. It is also difficult to leave information that an abnormality has occurred.

  In this regard, the monitoring method of Patent Document 1 can quickly detect the occurrence of an abnormality without causing an increase in the load on the CPU and can also retain information that an abnormality has occurred, but can only monitor an abnormality in the address space. For this reason, the abnormal operation of the OS or the application itself may not be monitored, and it is not possible to identify which application is abnormal.

  An object of the present invention is to provide an abnormality monitoring apparatus for a computer that can detect an abnormal operation of an OS or an application at an early stage and can identify an abnormally operated application while reducing the CPU load of the system.

  In order to solve the above problems, the present invention monitors the presence / absence of an abnormality by a time determined individually for each application, or monitors the presence / absence of an abnormality by an individual operation check for each application, and performs these monitoring by a local CPU. As described above, it has the following configuration.

(1) An abnormality monitoring apparatus for monitoring abnormal operation of a computer system having a plurality of applications,
Each application has means for issuing information for identifying its own application and application information describing the monitoring timeout period for each application as a request to enable the watchdog function.
The application information is provided through a device driver of an operating system, and includes a FIFO memory that sequentially stores the application information.
It has a local CPU that sequentially reads application information from the FIFO memory, performs watchdog monitoring of the time for each application, and detects an abnormality of the application when there is no next notification from the application within this time It is characterized by.

(2) An abnormality monitoring device for monitoring abnormal operation of a computer system equipped with a plurality of applications,
Each application is provided with a means for issuing a “request for enabling the monitoring function” with information identifying its own application, and thereafter issuing a “working” notification at a fixed period determined for each application.
A monitoring agent that receives a "request for enabling monitoring function" and "in operation" notifications issued from the application and notifies the local CPU of these information through the operating system 2;
When the local CPU receives a “request to enable the monitoring function” from the monitoring agent, the local CPU enters an abnormality monitoring of the application, and when there is a notification of “in operation”, the local CPU performs “confirmation” to the operating system and the monitoring agent. Means for determining that the operating system, the application, and the monitoring agent are normally operable when the “response notification” is returned from the operating system and the monitoring agent in response to the “confirmation notification”. It is provided with.

  (3) The local CPU includes means for storing information to that effect in a nonvolatile memory when an abnormality of an application or an operating system is determined.

  As described above, according to the present invention, the presence or absence of an abnormality is monitored by a time determined individually for each application, or the presence or absence of an abnormality is monitored by individual operation confirmation for each application, and these monitoring are performed by the local CPU. Therefore, the abnormal operation of the OS or application can be detected at an early stage, and the abnormally operated application can be specified while reducing the CPU load of the system.

(Embodiment 1)
FIG. 1 is a main part configuration diagram of an abnormality monitoring apparatus showing an embodiment of the present invention. The computer system is constructed by a plurality of applications 1A to 1C and an operating system (OS) 2. In this embodiment, as a monitoring device of this computer system, an abnormality monitoring function is realized by a FIFO (First in First Out) memory 4, a local CPU 5, and a nonvolatile memory 6.

  The abnormality monitoring process according to this embodiment will be described below.

  (S1) Each of the applications 1A to 1C attaches information for identifying its own application (here, ID) and application information describing a monitoring timeout period individually determined for each application at an appropriate time such as the time of execution. Issue a request to enable the watchdog function.

  (S2) The issuance notification (with application information) for enabling the watchdog function is written into the FIFO memory 4 by the operating system 2 through the device driver 2A. This notification is sequentially stored in the FIFO memory 4 every time a request is issued from the applications 1A to 1C.

  (S3) The local CPU 5 sequentially reads the application information from the FIFO memory 4, and monitors the time information individually determined for each application by ID by the watch dog function. In this monitoring, when there is no next notification from the application within the time determined individually for each ID, it is detected as an abnormality of the application having the ID, and information to that effect is written and stored in the nonvolatile memory 6. At the same time, a system restart or the like is requested by an NMI interrupt or the like to the operating system 2.

  Therefore, according to the present embodiment, the local CPU 5 can monitor an abnormality individually by specifying the application at a time (watchdog timer) determined for each application, and detect and store which application has an abnormality. be able to. By storing the detailed abnormal state, it is possible to analyze the abnormal state.

  In applications that are frequently started, it is possible to quickly detect anomalies and protect the system by shortening the watchdog timer time. Furthermore, the load on the main CPU on the operating system side can be reduced by monitoring the abnormality by the local CPU.

  Further, since the notification from each application is given through the operating system 2, it is possible to monitor the abnormal operation of the operating system 2.

(Embodiment 2)
FIG. 2 is a configuration diagram of the abnormality monitoring apparatus showing the embodiment of the present invention. The computer system is constructed by a plurality of applications 1A and 1B and an operating system (OS) 2. In this embodiment, a monitoring agent (program) 7, a local CPU 8, and a nonvolatile memory 9 implement an abnormality monitoring function as a monitoring device of this computer system.

  The abnormality monitoring process according to this embodiment will be described below.

  (S11) The applications 1A and 1B issue, to the monitoring agent 7 a request for enabling the monitoring function and information for identifying the application (ID here) at an appropriate time such as the time of execution.

  (S12) The monitoring agent 7 notified of the request for enabling the monitoring function (with application ID information) notifies the local CPU 8 through the operating system 2 and the device driver 2A.

  (S13) The local CPU 8 stores a notification of a request for enabling the monitoring function as an application ID.

  (S14) After issuing the request for enabling the monitoring function, the application issues an “in operation” notification that the operation is being performed to the monitoring agent 7 together with the ID information at a fixed period (time determined for each application).

  (S15) The local CPU 8 issues a “confirmation notification” to the operating system 2 at regular intervals when receiving an “in operation” notification of the application from the monitoring agent via the operating system 2.

  (S16) The operating system 2 immediately notifies the local CPU 8 of “acknowledgment notification” of “confirmation notification”. With this notification, the local CPU 8 determines that the operating system 2 is operating normally. When the operating system 2 is not in an operating state, the local CPU 8 writes information to that effect in the nonvolatile memory 9.

  (S 17) “Confirmation notification” from the local CPU 8 is sent from the operating system 2 to the monitoring agent 7.

  (S18) When the monitoring agent 7 receives the “confirmation notification” from the local CPU 8 via the operating system 2, it returns a “response notification” to the local CPU 8 side through the operating system 2 together with the operation information for each application ID.

  (S19) The local CPU 8 determines that the operating system 2, the application, and the monitoring agent 7 are normally operable due to the “response notification”.

  When the application or the monitoring agent 7 is not in a normal operating state, the local CPU 8 stores information to that effect in the nonvolatile memory 9. Also, the operating state of each application is checked, and if the corresponding application is not in the operating state, information to that effect is stored in the nonvolatile memory 9.

  (S20) The local CPU 8 notifies the monitored state and information to other CPUs through some communication path.

  Therefore, according to the present embodiment, the abnormality monitoring is performed by exchanging “response notification” and “confirmation notification” between the application and the operating system 2 and the local CPU. It is possible to detect and record the operating state of the application level (monitoring agent) and to detect and record the operating state of each application program. In addition, it is possible to analyze an abnormal state by obtaining detailed information.

  Similarly to the first embodiment, an application that is frequently started can quickly detect an abnormality and protect the system by shortening the notification time of a predetermined period. Furthermore, the load on the main CPU on the operating system side can be reduced by monitoring the abnormality by the local CPU.

The principal part block diagram of the abnormality monitoring apparatus which shows Embodiment 1 of this invention. The principal part block diagram of the abnormality monitoring apparatus which shows Embodiment 2 of this invention. Monitoring method with watchdog function.

Explanation of symbols

1A to 1C Application 2 Operating system 2A Device driver 4 FIFO memory 5 Local CPU
6 Nonvolatile memory 7 Monitoring agent 8 Local CPU

Claims (3)

An abnormality monitoring device that monitors abnormal operation of a computer system equipped with a plurality of applications,
Each application includes means for issuing information for identifying its own application and application information describing the monitoring timeout period for each application as a request to enable the watchdog function.
The application information is provided through an operating system device driver, and includes a FIFO memory for sequentially storing the application information,
A local CPU is provided that sequentially reads application information from the FIFO memory, performs watchdog monitoring of the time for each application, and detects that there is no next notification from the application within this time. An abnormality monitoring apparatus for a computer characterized by the above. An abnormality monitoring device that monitors abnormal operation of a computer system equipped with a plurality of applications,
Each application is provided with a means for issuing a “request for enabling the monitoring function” with information for identifying its own application and thereafter issuing a “working” notification at a fixed period determined for each application.
A monitoring agent that receives a "request for enabling the monitoring function" and "in operation" notifications issued from the application and notifies the local CPU of these information through the operating system 2;
When the local CPU receives a “request to enable the monitoring function” from the monitoring agent, the local CPU enters an abnormality monitoring of the application, and when there is a notification of “in operation”, the local CPU performs “confirmation” to the operating system and the monitoring agent. Means for determining that the operating system, the application, and the monitoring agent are normally operable when the “response notification” is returned from the operating system and the monitoring agent in response to the “confirmation notification”. An abnormality monitoring apparatus for a computer, comprising:   3. The computer abnormality according to claim 1, wherein said local CPU comprises means for storing information to that effect in a nonvolatile memory when an abnormality of an application or an operating system is determined. Monitoring device.

Images