JP2011197817A - Monitoring system, monitoring device, method for monitoring service execution environment, and program for monitoring device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a monitoring system, for enabling a device user to appropriately correct a monitoring rule without having any huge knowledge or experience related to a service execution environment, or the like.SOLUTION: The monitoring system includes: an analyzing part 11 for determining whether the state of a service execution environment 30 satisfies each monitoring condition of a monitoring rule; and a manager device 10 for detecting the difference of each determination, and for announcing monitoring failure showing that monitoring setting concerning each monitoring condition is unsuitable. The manager device 10 includes: an analysis history storage part 19 for respectively storing the state of a service execution environment 30 (each performance information) corresponding to each monitoring condition used for each determination as a history; and a condition generation part 18 for, when a plurality of respective monitoring conditions are different determination results, calculating a threshold for setting the plurality of respective monitoring conditions to the same determination result based on the history of the performance information of the analysis history storage part 19, and for generating this as monitoring conditions related to the correction of the monitoring failure.

Description

  The present invention relates to a system for monitoring the operating conditions of a device that executes a predetermined application in a service execution environment, and in particular, a monitoring system, a monitoring device, and a service execution environment monitoring method capable of performing monitoring settings according to the actual environment, And a monitoring device program.

  In a general-purpose monitoring system (operation monitoring technology) that comprehensively manages and monitors monitoring targets such as various server groups, how to properly execute an autonomous loop of "monitoring", "analysis", and "handling" It has become a big issue. Among them, there is no method to verify the correctness of the analysis results, and it is required that the analysis results become appropriate by continuing operation, that is, the monitoring settings are automatically optimized. It has been.

  For this purpose, it is necessary for the monitoring system itself to evaluate whether or not the monitoring setting is appropriately made and to prompt the administrator to make a change or to automatically correct the monitoring setting.

  Here, in order for the monitoring system itself to evaluate whether or not the monitoring setting is properly made, whether the real failure has occurred or whether the monitoring setting is not appropriate is a “monitoring failure state”. The monitoring system must be distinguishable.

  As related technologies of the monitoring system for confirming the validity of the monitoring conditions as described above, for example, Patent Document 1 and Patent Document 2 shown below can be cited.

Among these, in Patent Document 1, a plurality of sets of information are aggregated based on different sets of processing rules (conditions), thereby improving the reliability of abnormality determination and enabling determination of abnormality level and the like. Techniques relating to fire alarm devices are disclosed.
In this Patent Document 1, the processing means obtains a plurality of sets of function values corresponding to a plurality of sets of processing rules, and generates a plurality of fire information in which information is aggregated for each of the plurality of sets of function values. The determination means performs abnormality determination based on a plurality of fire information, confirms the first abnormality determination result by the second information aggregation based on different processing rules with different angles, and based on a plurality of sets of fire information The final abnormality judgment result.
In such a patent document 1, after the first function processing, the second function processing is performed using the processing rule at the time of abnormality, and the validity of the first processing is evaluated, and abnormality determination is performed under a plurality of conditions. To improve the determination accuracy.

Patent Document 2 discloses a camera monitoring system that improves the consistency (increases the correct answer rate) by comparing the evaluation result evaluated by the monitoring person with the determination result of the determining means.
Specifically, in the camera monitoring system disclosed in Patent Document 2, first, the determination unit discriminates based on the evaluation result input from the evaluation input unit and the first determination condition including the first detection operation parameter of the detection unit. The control means compares and verifies the determined first determination result, and if it is not a positive detection, the determination means discriminates and determines based on a second determination condition including a second detection operation parameter. The second determination result is compared with the inputted evaluation result, and if the second determination result corresponds to the positive detection, the first determination condition (first Control to change from measurement condition for vehicle speed data: first measurement section distance and first measurement frequency) to second determination condition (measurement condition for second vehicle speed data: second measurement section distance and second measurement frequency) Configuration to do You have me.

  For example, when the monitoring person evaluates the event as “false detection” or “not detected”, the control means refers to the log table (second table) and determines the determination condition (vehicle speed) (Measurement conditions concerning data: measurement section distance and measurement frequency) are determined, and the determination condition of the positive detection is set as the determination condition from the next time.

Here, since the traveling speed of the vehicle has a determination condition including a combination of the measurement section distance and the measurement frequency, the table (first table) having several different measurement results corresponding to the determination condition is included.
For example, as shown in paragraph number [0056] of Patent Document 2, the log table (second table) used for determination is the first measurement interval distance obtained from the table (first table) and the first measurement frequency. 1 vehicle speed data (vehicle group speed), second vehicle speed data (vehicle group speed) based on the second measurement section distance and the second measurement frequency, third vehicle speed data (vehicle group) based on the third measurement section distance and the third measurement frequency (Velocity), ..., etc., and different vehicle speed data groups corresponding to changes in parameters (measurement conditions) such as measurement frequency and measurement section distance.

Of these, when the first vehicle speed data is set to be used, the determination means is “vehicle group” which is one of the determination criteria such as “low speed” and “congestion” set separately from the first vehicle speed data according to this setting. Compared with a fixed value of “congestion when speed is below a certain value”, for example, it is determined as an abnormal event of “congestion”.
The control means sets an alarm for an abnormal event of “traffic jam” and measurement conditions (first measurement section distance and first measurement frequency) relating to the first vehicle speed data as determination conditions for the vehicle speed data, Vehicle speed data, second vehicle speed data, third vehicle speed data (vehicle group speed), and so on are acquired.

The control means uses these judgment conditions (measurement conditions), vehicle speed data and alarms, judgment results of abnormal event judgment conditions, and the evaluation of the supervisor (the "superdetection" is based on the empirical sense from the video of the monitor by the supervisor. As a result of evaluation based on “false detection” and “not detected”, image processing data such as determination condition candidates and vehicle speed listed in the table are received and stored together with time information (time tag) in the log table.
And a control means performs control which selects the determination conditions after the next with reference to a log table.

  Here, the selection of the determination condition includes “measurement interval / distance”, “measurement frequency”, “determination use”, which are parameters of the event determination condition (event determination conditions of the detection operation parameter in the table shown in FIG. 4), and extraction operation parameters. This is a change of the judgment target (for example, vehicle speed data) such as “algorithm”, “threshold”, “tracking point”, etc. This does not change “the time is a traffic jam” (Patent Document 2 does not disclose a judgment criterion for “car jam”).

  Further, the control means statistically processes the evaluation result of the observer for each event, each determination condition corresponding to the event, and the estimated evaluation result, and determines a determination condition having a large number of times corresponding to “correct detection”. Search from the log table and use the determination conditions for the next and subsequent determinations.

  Further, the control means aggregates and compares the determination results (for example, “congestion”) obtained from a plurality of determination conditions and the determination results of the monitor (for example, the evaluation result of “false determination”), thereby comparing a plurality of determination criteria If the result of the judgment of “traffic jam” is large and the judgment result of the camera surveillance system is estimated to be more appropriate than that of the surveillance staff, the surveillance monitor judges and evaluates the recommendation information to review the evaluation. Display and report.

  Further, the control means sets a plurality of judgment condition candidates by changing the combination with the first or second detection operation parameter, and collects the judgment results of the respective judgment condition candidates to take a majority vote. As a result, for example, “congestion” is selected, and the monitoring staff is notified of “congestion”.

Japanese Patent Laid-Open No. 06-318292 JP 2005-176077 A

  However, in Patent Document 1, when it is evaluated that the validity of the first process is low by the second function process, the processing rule used for the first process is not a correction target, and the first process. There is no disclosure or even suggestion of amending the processing rules used in this processing.

  That is, in this patent document 1, the monitoring setting cannot be automatically optimized according to the actual environment. For this reason, if the determination result does not match between the first process and the second process in a certain state, the first process result and the second process result do not match even if the determination result is the same after that. It remains.

  As described above, in Patent Document 1, the entire monitoring rule is not subject to correction by the administrator, and there is a problem in that the condition is not properly changed.

  Patent Document 2 is based on the premise that an evaluation result is input based on an empirical feeling of a monitoring person, and an error is included in the determination, and the evaluation is not dependent on the empirical feeling of the monitoring person. It has become something that does not get. For this reason, since the condition is changed based on the evaluation made by the person, there is a disadvantage that the condition is not changed appropriately.

  Further, in Patent Document 2, the selection of the determination condition is a change of the determination target of the event determination condition parameters (such as the event detection condition of the detection operation parameter of the table and the feature extraction method of the extraction operation parameter). Since it does not change a certain “congestion when the vehicle group speed is below a certain value”, there is a disadvantage that the determination criterion is not changed appropriately.

  Further, even if the determination condition and the estimated evaluation result are statistically processed or the result of majority decision is taken, since the evaluation made by the person is taken into account, the above-described inconveniences are not solved.

  In addition, even if it is found that the determination result by the determination unit is more appropriate than the evaluation result of the monitoring staff, it is only requested to review the monitoring staff. The device user (system administrator) needs vast knowledge and experience about the service execution environment to determine which setting condition item should be changed (corrected) to what value to properly modify the monitoring condition. there were.

  An object of the present invention is to solve the above-described problems of the related art, and the apparatus itself evaluates whether or not the monitoring setting is appropriately made and prompts the administrator to make a change. It is an object of the present invention to provide a monitoring system, a monitoring apparatus, a service execution environment monitoring method, and a monitoring apparatus program that can effectively improve the occurrence of the problem.

In order to achieve the above object, a monitoring system of the present invention has an agent device for grasping the state of a service execution environment to be monitored, and a manager device for managing the monitoring rules of the service execution environment. The manager device includes an analysis unit that determines whether the state of the service execution environment satisfies a plurality of conditions defined in the monitoring rule, and a difference between the determinations in the plurality of monitoring conditions The monitoring system can notify a monitoring failure indicating that the monitoring setting related to each monitoring condition is inappropriate by detecting the monitoring condition, and the manager device uses each monitoring condition used for each determination. Each of the plurality of monitoring conditions is different from an analysis history storage unit that stores each performance information as a history corresponding to the state of the service execution environment corresponding to each When a predetermined result is obtained, a threshold value is calculated based on the performance information history of the analysis history storage unit so that the plurality of monitoring conditions have the same determination result, and the threshold value is corrected for the monitoring failure. And a condition generation unit that generates as a new condition.

  In order to achieve the above object, the monitoring device of the present invention has a function of managing monitoring rules of the service execution environment via an agent device for grasping the state of the service execution environment to be monitored, and the service execution environment A function for determining whether or not the state of each of the monitoring conditions satisfies a plurality of monitoring conditions defined in the monitoring rule, and a difference between the determinations in each of the plurality of monitoring conditions is applied to each monitoring condition. A monitoring device having a function of notifying a monitoring failure indicating that the monitoring setting is inappropriate, and each of the service execution environment states corresponding to each of the monitoring conditions used for each of the determinations An analysis history storage unit for storing each performance information as a history is provided, and when each of the plurality of monitoring conditions results in a different determination result, the performance information of the analysis history storage unit A configuration is provided that includes a condition generation unit that calculates a threshold value that results in the same determination result for each of the plurality of monitoring conditions based on a history, and generates the threshold value as a new monitoring condition for correcting the monitoring failure. Is adopted.

  To achieve the above object, the service execution environment monitoring method of the present invention manages the service execution environment monitoring rules via an agent device for grasping the status of the service execution environment to be monitored, and It is determined whether or not the state of the execution environment satisfies each of the plurality of monitoring conditions defined in the monitoring rule, and each monitoring condition is affected by detecting a difference in each of the plurality of monitoring conditions. A service execution environment monitoring method capable of notifying a monitoring failure indicating that the monitoring setting is inappropriate, wherein the service execution environment is in a state corresponding to each of the monitoring conditions used for each of the determinations. The analysis history storage unit stores each piece of performance information as a history, and when the plurality of monitoring conditions result in different determination results, the performance information of the analysis history storage unit is checked. Based on the above, the threshold value is calculated so that each of the plurality of monitoring conditions has the same determination result, and the condition generation unit generates the threshold value as a new condition for correcting the monitoring failure. Yes.

In order to achieve the above object, the program for a monitoring device of the present invention includes a function for managing a monitoring rule of the service execution environment via an agent device for grasping a state of the service execution environment to be monitored, and the service A function for determining whether the state of the execution environment satisfies a plurality of monitoring conditions defined in the monitoring rule and each monitoring condition by detecting a difference between the determinations in the plurality of monitoring conditions A monitoring device having a function of notifying a monitoring failure indicating that the monitoring setting is inappropriate.
An analysis history accumulation processing function for accumulating and processing each performance information as a history of the state of the service execution environment corresponding to each of the monitoring conditions used for each of the determinations, and determination results of the plurality of monitoring conditions being different And calculating a threshold value that results in the same determination result for each of the plurality of monitoring conditions based on the performance information history accumulated by the analysis history accumulation processing function. A condition generation function that is generated as a new monitoring condition related to the correction of the above is configured to be executed by a computer.

  According to the present invention, since the condition generation unit presents an appropriate threshold value for the monitoring condition based on the performance information accumulated in the analysis history accumulation unit, the monitoring failure indicating that the monitoring setting is not appropriate. When the monitoring condition is corrected under the condition, the device itself evaluates whether or not the monitoring setting is appropriately performed, presents an appropriate threshold value of the monitoring condition, and prompts the administrator to change the monitoring condition. It is possible to effectively improve the occurrence of poor monitoring due to settings, and this enables proper operation monitoring to correct the monitoring rules without the equipment user having vast knowledge and experience about the service execution environment. An excellent monitoring system, a monitoring apparatus, a service execution environment monitoring method, and a monitoring apparatus program that can be performed can be provided.

It is a block diagram which shows an example of the whole structure of the monitoring system by one Embodiment of this invention. It is explanatory drawing which shows an example of the data structure of the monitoring rule in the monitoring system of FIG. It is a flowchart which shows an example of the operation | movement procedure in the monitoring system by one Embodiment of this invention.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

(Basic configuration of monitoring system)
First, the basic configuration of the monitoring system will be described.
The monitoring system 1 of the present embodiment includes an agent device 20 for grasping the state of the service execution environment 30 to be monitored, and a manager device 10 as a monitoring device for managing the monitoring rules of the service execution environment 30. I have.

  The manager device 10 determines whether or not the state of the service execution environment 30 satisfies a plurality of monitoring conditions defined in the monitoring rule, and detects a difference in each determination under the plurality of monitoring conditions. By doing so, it has a function of notifying a monitoring failure indicating that the monitoring setting for each monitoring condition is inappropriate.

  In addition, the manager device 10 includes an analysis history storage unit 19 that stores each performance information as the history of the service execution environment 30 corresponding to each monitoring condition used for each determination.

  Further, the manager device 10 has the same determination result for each of the plurality of monitoring conditions based on the history of the performance information in the analysis history storage unit 19 when the plurality of monitoring conditions result in different determination results. A condition generation unit 18 is provided for calculating a threshold value and generating this threshold value as a new monitoring condition for correcting the monitoring failure.

  The manager device 10 as a monitoring device in the monitoring system 1 manages the monitoring rules of the service execution environment 30 via the agent device 20 for grasping the state of the service execution environment 30 to be monitored, and the service execution environment It is determined whether or not the state of 30 satisfies a plurality of monitoring conditions defined in the monitoring rule, and the monitoring according to each of the monitoring conditions is detected by detecting a difference in each determination under the plurality of monitoring conditions. It is possible to notify a monitoring failure indicating that the setting is inappropriate.

  According to the basic configuration of the manager device 10 in such a monitoring system 1, the condition generation unit 18 that presents an appropriate threshold value of the condition based on the performance information stored in the analysis history storage unit 19 is configured. Therefore, when the condition is corrected in the state of poor monitoring indicating that the monitoring setting is not appropriate, an appropriate threshold value for the condition can be presented, and the device user has vast knowledge and experience regarding the service execution environment 30. Even without this, it is possible to correct the monitoring rules and perform appropriate operation monitoring of the monitoring system.

(Overall configuration of monitoring system)
In FIG. 1, an example of the whole structure of the monitoring system 1 of 1st Embodiment in this invention is shown.

  As shown in FIG. 1, the monitoring system 1 according to the present embodiment includes a service execution environment 30 to be monitored, an agent device 20 for grasping the state of the service execution environment 30 to be monitored, And a manager device 10 as a monitoring device for managing the monitoring rules of the service execution environment 30.

  The service execution environment 30 includes various service execution environments such as applications to be monitored.

  The agent device 20 extracts performance information from the service execution environment 30 and monitors the performance information and transmits the performance information to the manager device 10, and various commands (for example, failure resolution) sent from the manager device 10. And a control unit 22 that controls the processing operation for transmitting the various commands to the service execution environment 30 and executing the operation according to the command.

  Among these, the monitoring unit 21 has a function of extracting performance information from the service execution environment 30, generating information related to the performance information as an event, and notifying the manager device 10.

  The control unit 22 has a function of receiving a command as an action for solving a failure from the manager device 10 and issuing the command to the service execution environment 30 to eliminate the failure.

  The manager device 10 determines whether or not the state of the service execution environment 30 satisfies a plurality of monitoring conditions defined in the monitoring rule, and detects a difference in each determination under the plurality of monitoring conditions. Thus, a function of notifying a monitoring failure indicating that the monitoring setting related to each monitoring condition is inappropriate is provided.

  In addition, the manager device 10 includes an analysis history storage unit 19 that stores each performance information as a history, which is the state of the service execution environment 30 corresponding to each of the monitoring conditions used for each determination, When each of the monitoring conditions has a different determination result, a threshold value for calculating the same determination result for each of the plurality of monitoring conditions is calculated based on the performance information history of the analysis history storage unit 19. Is generated as a new condition for correcting the monitoring failure.

  Further, the manager device 10 acquires an event indicating performance information of the service execution environment 30 from the agent device 20 and analyzes the event, and a monitoring rule for accumulating a monitoring rule relating to the state of the service execution environment 30 The storage unit 12, the monitoring failure verification unit 13 that verifies whether the monitoring setting of the monitoring rule is not appropriate, and the failure display that displays failure determination result information indicating whether the main condition included in the monitoring rule is a failure ant Part 14.

  The manager device 10 further issues a monitoring failure display unit 15 that displays a monitoring failure warning indicating that the monitoring setting is not appropriate, a monitoring rule update unit 16 that updates the monitoring rule, and a command for solving the failure. The command issuing unit 17, the condition generating unit 18 that corrects the main condition and the sub-condition for the monitoring rule to the optimum conditions and generates the corrected sub-condition, and each performance information that is the state of the service execution environment 30 An analysis history storage unit 19 for storing each history is provided.

  Among these, the analysis unit 11 has a condition determination function that receives an event from the agent device 20 and determines whether the conditions of the monitoring rules stored in the monitoring rule storage unit 12 are satisfied.

  In addition, when the monitoring condition is satisfied (when it is determined as a failure ant), the analysis unit 11 transmits failure determination result information related to the determination to the monitoring failure verification unit 13, and also transmits this to the failure display unit 14. It has a function of transmitting and displaying a screen indicating that there is a failure by the failure display unit 14 and notifying the administrator.

  The monitoring rule accumulation unit 12 stores and manages monitoring rules that hold a plurality of conditions for determining a failure.

  The monitoring failure verification unit 13 receives the failure determination result information from the analysis unit 11 and, when the determination results of a plurality of conditions do not match, a monitoring failure warning indicating that the monitoring setting is not appropriate is displayed on the monitoring failure display unit 15. It has a function to be displayed on.

The monitoring failure verification unit 13 has a function of storing performance information used for determination in the analysis history storage unit 19.
Furthermore, when a monitoring failure warning occurs and the monitoring rule needs to be changed, the monitoring failure verification unit 13 is based on the history of performance information stored in the analysis history storage unit 19 by the condition generation unit 18. A function of changing the threshold value of the monitoring rule and displaying it on the monitoring rule update unit 16 is provided.

  The monitoring rule update unit 16 is activated when the monitoring failure warning occurs and the monitoring rule needs to be changed, and the monitoring rule update unit 16 updates the monitoring rule stored in the monitoring rule storage unit 12 by updating it. It has.

  Furthermore, the monitoring rule update unit 16 is based on a function that is presented to the administrator so that the monitoring rule whose threshold has been changed can be confirmed, and when the threshold needs to be changed, based on the operation input of the administrator. The monitoring threshold storage unit 12 has a function of changing the threshold value for the monitoring rule and storing the changed threshold value in the monitoring rule storage unit 12.

  The command issuing unit 17 has a function of issuing an action for solving a failure as a command to the agent device 20 according to a command based on an operation input by the administrator.

(Various functions of the condition generation unit 18)
The condition generation unit 18 described above is a case where a plurality of monitoring conditions include a main condition and one or more subconditions, and when the determination result of the main condition is different from the determination result of one subcondition, Based on the performance information history of the analysis history storage unit 19, the performance information related to one sub condition is calculated as a threshold value so that the determination result of the main condition and the determination result of the one sub condition are the same. The threshold value is generated as a new subcondition.

  In the case of a monitoring failure, the condition generation unit 18 corresponds to the one sub-condition with required setting change information (for example, AUTO shown in FIG. 2) indicating that the setting change of the one sub-condition is necessary. In addition, it has a function of writing in corresponding portions of the analysis history storage unit 19.

  Further, the condition generation unit 18 determines that the main condition is true based on the history of the performance information in the analysis history storage unit 19 when the state of the service execution environment 30 is a determination result that the main condition is true. If the performance information indicating the status of the service execution environment 30 is smaller than the sub-condition, the maximum value of the performance information is set. It has a function of calculating as a threshold value and generating this threshold value as a new subcondition.

  Furthermore, the condition generation unit 18 makes the main condition true based on the performance information history of the analysis history storage unit 19 when the state of the service execution environment 30 is a determination result that the main condition is true. If the performance information indicating the status of the service execution environment 30 is larger than the sub-condition, the minimum value of the performance information is set. It has a function of calculating as a threshold value and generating this threshold value as a new subcondition.

  In addition, the condition generation unit 18 determines that the main condition is false based on the history of the performance information in the analysis history storage unit 19 when the service execution environment 30 has a false determination result that does not satisfy the main condition. If the performance information indicating the status of the service execution environment 30 is smaller than this sub-condition, the minimum value of the performance information is set. It has a function of calculating as a threshold value and generating this threshold value as a new subcondition.

  The condition generation unit 18 determines that the main condition is false based on the history of the performance information in the analysis history storage unit 19 when the service execution environment 30 is determined to be false that does not satisfy the main condition. If the performance condition information indicating the status of the service execution environment 30 is greater than the secondary condition, the maximum value of the performance information is determined. It has a function of calculating as a value and generating this threshold value as a new subcondition.

  The monitoring rule update unit 16 has a function of writing the new sub-condition in the corresponding part of the analysis history storage unit 19 to update information and notifying the new sub-condition to the outside.

(Data structure of the analysis history storage unit 19)
Here, as shown in FIG. 2, the monitoring rule 12 a is composed of three subconditions and actions of “number”, “rule name”, and “main condition”. Here, although there are three subconditions, the number of subconditions is not limited to this, and an arbitrary number can be taken.
In the monitoring rule 12a shown in FIG. 2, the first line monitoring rule is an example of a rule for monitoring the response of the Web server in the three-layer system. The first line monitoring rule is “application response”. Has a main condition for determining a failure when “is greater than 5000 [ms]”.

  Furthermore, the monitoring rule in the first line is that sub-condition 1 (first sub-condition) for determining a failure as “when the load of the Web server is greater than 80%” or “when the number of sessions of the Web server is greater than 100”. ), “When the load of the AP server is greater than 70%” or “when the number of sessions of the AP server is greater than 150”, sub-condition 2 (second sub-condition) for determining a failure, When the load is larger than 60 [%] ”, the sub-condition 3 (third sub-condition) for determining a failure is provided.

As described above, the monitoring rule 12a includes a main condition indicating a failure state and a plurality of subconditions representing the state of the main condition from different angles.
Here, there are sub-conditions in which the threshold is numeric and AUTO (numeric), the former indicates a normal threshold, the latter indicates the threshold at that time, and in the state of a monitoring failure warning, The condition generation unit 18 automatically generates an appropriate threshold value from the accumulated information in the analysis history storage unit 19 and changes the number as the threshold value.
In the present embodiment, the subcondition is a simple condition or a plurality of simple conditions are combined by a logical sum.

(Overall operation description)
Next, the overall operation of the monitoring system 1 will be described with reference to FIGS. Here, FIG. 3 is a flowchart showing an example of an operation procedure in the monitoring system 1 of FIG.

  In the monitoring system 1 according to this embodiment, the overall monitoring operation is to monitor the service execution environment 30 via the agent device 20 in order to grasp the state of the service execution environment 30 to be monitored. Is managed by the manager device 10. The manager device 10 determines whether or not the state of the service execution environment 30 satisfies a plurality of monitoring conditions defined in the monitoring rule, and detects a difference in each determination under the plurality of monitoring conditions. Thus, a function of notifying the outside of a monitoring failure indicating that the monitoring setting related to each monitoring condition is inappropriate is provided.

  The overall operation procedure in the monitoring related to the service execution environment 30 is as follows. First, each performance information which is the state of the service execution environment 30 corresponding to each of the monitoring conditions used for each determination is obtained. The analysis history storage unit 19 performs a storage process as a history (step A23: analysis history storage processing step, analysis history storage processing function shown in FIG. 3).

  Subsequently, when each of the plurality of monitoring conditions has a different determination result, a threshold value at which each of the plurality of monitoring conditions has the same determination result based on the history of the performance information of the analysis history storage unit 19 is set. The condition generation unit 18 generates the calculated threshold value as a new monitoring condition for correcting the monitoring failure (step A41 to step A43 shown in FIG. 3: condition generation step, condition generation function).

  Furthermore, in the monitoring operation procedure according to the service execution environment 30, when generating the monitoring condition, the plurality of monitoring conditions include a main condition and one or more subconditions, and the determination result of the main condition is When the determination result of one sub condition is different, the determination result of the main condition and the determination result of the one sub condition are the same based on the history of the performance information of the analysis history storage unit 19 The performance information related to the one sub-condition is calculated as a threshold value, and the condition generation unit 18 generates the threshold value as a new sub-condition.

  Further, in the monitoring operation procedure according to the service execution environment 30, when generating a monitoring condition, required setting change information (for example, indicating that a setting change of the one sub-condition is necessary in the case of the monitoring failure) (AUTO shown in FIG. 2) is written in the corresponding portion of the analysis history storage unit 19 in association with the one sub-condition.

  Furthermore, in the monitoring operation procedure according to the service execution environment 30, when generating the monitoring condition, the analysis history accumulating unit 19 is used when the state of the service execution environment is a determination result that satisfies the main condition. Based on the history of the performance information, the sub-condition that is true for the main condition and has the required setting change information is extracted, and the performance information indicating the state of the service execution environment 30 is obtained from the sub-condition. If it is smaller, the maximum value of the performance information is calculated as a threshold value, and the condition generation unit 18 generates this threshold value as a new subcondition.

  Further, in the monitoring operation procedure related to the service execution environment 30, when the monitoring condition is generated, if the determination result that the state of the service execution environment 30 is true satisfies the main condition, the analysis history storage unit 19 Based on the history of performance information, the sub-condition that the main condition is true and the setting change information is taken out is extracted, and the performance information indicating the state of the service execution environment 30 is less than this sub-condition. If it is larger, the minimum value of the performance information is calculated as a threshold value, and the condition generation unit 18 generates this threshold value as a new subcondition.

  Furthermore, in the monitoring operation procedure according to the service execution environment 30, when generating the monitoring condition, if the determination result is that the state of the service execution environment 30 is false not satisfying the main condition, the analysis history storage unit 19 Based on the history of performance information, the sub-conditions for which the main condition is false and the required setting change information is taken out, and the performance information indicating the state of the service execution environment 30 is less than this sub-condition. If it is smaller, the minimum value of the performance information is calculated as a threshold value, and the condition generation unit 18 generates this threshold value as a new subcondition.

  Further, in the monitoring operation procedure according to the service execution environment 30, when generating the monitoring condition, the analysis history accumulation is performed when the state of the service execution environment 30 is a false determination result that does not satisfy the main condition. Based on the performance information history of the unit 19, a sub-condition having a false main condition and having the required setting change information is extracted, and the performance information indicating the state of the service execution environment 30 is the sub-condition. If it is greater than the threshold value, the maximum value of the performance information is calculated as a threshold value, and the condition generation unit 18 generates this threshold value as a new subcondition.

  Furthermore, in the monitoring operation procedure according to the service execution environment 30, after the monitoring condition is generated, a new subcondition is written in the corresponding part of the analysis history storage unit 19 to update the information. Is notified to the outside (step A51: monitoring rule updating step, monitoring rule updating function shown in FIG. 3).

(Detailed operation)
This will be described in detail below.
First, as shown in FIG. 3, the monitoring unit 21 of the agent device 20 collects performance information from the service execution environment 30 (step A01: performance information collection step, performance information collection function).

  Next, the monitoring unit 21 generates an event from the performance information and sends it to the manager device 10 (step A02: event information generation step, event information generation function).

  The analysis unit 11 of the manager device 10 waits for an event sent from the agent device 20 (step A11: event information reception step, event information reception function).

Next, the analysis unit 11 takes out one monitoring rule from the monitoring rule storage unit 12 (step A12: monitoring rule acquisition step, monitoring rule acquisition function).
The analysis unit 11 returns to Step A11 when there are no monitoring rules to be taken out, waits for the next event, and proceeds to Step A14 when the monitoring rules are taken out (Step A13).

  When the monitoring rule can be extracted, the analysis unit 11 determines whether the main condition of the monitoring rule is satisfied (step A14: main condition true / false determination step, main condition true / false determination function).

  The analysis unit 11 proceeds to step A16 when the main condition is satisfied, and proceeds to step A21 when the main condition is not satisfied (step A15). When the main condition is satisfied, the analysis unit 11 performs control so that the failure display unit 14 displays that there is a failure state (step A16: main condition failure display control step, main condition failure display control function). .

The monitoring failure verification unit 13 determines that the monitoring setting is in an inappropriate monitoring state when the determination result of the main condition is different from the determination result of the sub condition. Is taken as sub-condition i (step A21).
If all the subconditions are extracted from the monitoring rule, the monitoring failure verification unit 13 returns to step A12 to process the next monitoring rule, and proceeds to step A23 if the subcondition can be extracted (step A22). .

Next, the monitoring failure verification unit 13 stores the performance information of the main condition and the sub condition in the analysis history storage unit 19 (step A 23: analysis history storage processing step, analysis history storage processing function).
As a result, the analysis history storage unit 19 stores the performance information of the main condition and the sub condition.
Here, when the sub-condition i can be taken out in step A21, the monitoring failure verification unit 13 or the condition generation unit 18 determines whether the determination result of the main condition is different from the determination result of the sub-condition i (step A24: Main / sub condition difference determination step, main / sub condition difference determination function).

  The above-described monitoring failure verification unit 13 returns to step A21 to process the next subcondition when the determination result of the main condition and the determination result of the subcondition i match, and proceeds to step A31 when it does not match and monitors. A monitoring failure state in which the setting is not appropriate is performed (step A25).

  If the monitoring setting is in an inappropriate monitoring failure state, the monitoring failure display unit 15 displays the determination result of the main condition and the main condition and the determination result of the subcondition i and the subcondition i as a monitoring failure warning. (Step A31: monitoring failure warning display control step, main / sub condition and main / sub condition determination result display control step, monitoring failure warning display control function, main / sub condition and main / sub condition determination result display control function).

  Next, the condition generation unit 18 determines whether or not the main condition is satisfied. If the condition is satisfied, the process proceeds to step A42; otherwise, the process proceeds to step A43 (step A41: main condition true / false determination step, main condition true / false). False judgment function).

  When the main condition is satisfied (when the main condition is faulty), the condition generation unit 18 extracts all the true main conditions from the analysis history storage unit 19, and AUTO is specified as the sub-condition threshold value. If the condition is <(performance information <sub-condition's preset threshold: performance information is smaller than the preset threshold of the sub-condition), then the sub-condition with the maximum performance information as the new threshold i is generated (first condition correction step, first condition correction function), and the condition is> (performance information> sub-condition preset threshold: performance information is greater than sub-condition preset threshold) If so, the sub-condition i is generated with the minimum value of the performance information as a new threshold (second condition correction step, second condition correction function), and the process proceeds to step B51 (step A42).

  In this case, the condition generation unit 18 corrects so that the determination result of the main condition (failure in the main condition) and the determination result of one subcondition (failure in the one subcondition) are the same. (All condition true correction step, All condition true correction function).

  When the main condition is not satisfied (when there is no failure in the main condition), the condition generation unit 18 extracts all false main conditions from the analysis history storage unit 19, and AUTO is specified as the sub-condition threshold value. If the condition is <(performance information <sub-condition's preset threshold: performance information is smaller than the sub-condition's preset threshold), the minimum value of the performance information is set as the new threshold. Sub-condition i is generated (third condition correction step, third condition correction function), and the condition is> (performance information> sub-condition preset threshold value: performance information is the sub-condition preset threshold value If it is greater, a sub-condition i is generated with the maximum value of performance information as a new threshold (fourth condition correction step, fourth condition correction function), and the process proceeds to step B51 (step A43).

  In this case, the condition generation unit 18 corrects the determination result of the main condition (no failure in the main condition) and the determination result of one sub-condition (no failure in the one sub-condition) to be the same. (All condition false correction step, all condition false correction function).

  The monitoring rule update unit 16 presents the sub-condition i newly generated by the condition generation unit 18 to the administrator, and the administrator corrects the condition if necessary and is updated in the monitoring rule storage unit 12. The monitoring rule is updated, and the process returns to step A21 (step A51: monitoring rule update step, monitoring rule update function).

  As described above, the manager device 10 in the monitoring system 1 holds a plurality of conditions for determining the same state by different methods in the monitoring rules of the monitoring rule storage unit 12, and the monitoring failure verification unit 13 uses the plurality of conditions. By detecting the difference in judgment and alerting the administrator that the monitoring setting is not appropriate, and by allowing the administrator to correct the condition, the monitoring setting can be changed to match the actual environment. Threshold value that has an analysis history accumulation unit 19 that accumulates history, and when a plurality of conditions result in different determination results, the plurality of conditions have the same determination result from the performance information history of the analysis history accumulation unit 19 Is calculated and presented to the administrator as a threshold value for the monitoring condition, so that the administrator can assist in correcting the monitoring condition.

  Furthermore, the monitoring rule storage unit 12 holds a plurality of monitoring conditions that can instruct the monitoring rule to automatically change the threshold value, and the monitoring failure verification unit 13 detects the difference between the determination results of the plurality of monitoring conditions. If there is a difference, the manager is warned as a monitoring failure, and the condition for presenting an appropriate threshold value for the sub-condition based on the performance information accumulated in the analysis history accumulation unit 19 is presented to the administrator. It is possible to prompt correction.

  Here, as the determination history is accumulated in the analysis history accumulation unit 19, the learning progresses and the accuracy of the threshold value to be presented is improved. In addition, by distinguishing whether the failure really occurs or the monitoring setting is not appropriate, the administrator can improve the monitoring setting and present the change of the monitoring setting to the administrator. It is possible for the apparatus itself to evaluate whether or not the monitoring setting is appropriately made and to prompt the administrator to make a change.

Next, the effect of this embodiment will be described.
In this embodiment, when there is a difference between the determination result of the main condition and the sub condition at the time of monitoring, the condition is corrected as a monitoring failure state indicating that the monitoring setting is not appropriate. 19 is configured to present an appropriate threshold value for the sub-conditions to the administrator based on the performance information accumulated in 19, so as the information in the analysis history accumulation unit 19 continues to operate, learning progresses and presents The accuracy of the threshold to be improved is improved.

  In addition, although it is configured to correct the condition as a monitoring failure state indicating that the monitoring setting is not appropriate, an appropriate threshold value for the sub-condition is presented based on the performance information accumulated in the analysis history accumulation unit 19 There is something you can do. This is because the condition generation unit 18 that presents an appropriate threshold value of the sub-condition based on the performance information stored in the analysis history storage unit 19 is provided.

  Furthermore, the monitoring setting can be improved according to the actual environment. The reason is that learning progresses as the performance information stored in the analysis history storage unit 19 increases, the accuracy of the threshold value generated by the condition generation unit 18 increases, and the monitoring setting can be improved as the operation continues. Because.

  The above description has been made on the assumption that each means and each component as components in the block diagram shown in FIG. 1 is hardware composed of an electronic circuit block or the like, but some or all of the components are used as a monitoring device. It may be a software module configuration that indicates a state functionalized by a program that can be executed by the computer provided in the manager device 10 and the computer provided in the agent device 20.

  The computer included in the manager device 10 according to the hardware configuration in this case includes a processor as a control unit and a memory as a storage unit. This processor includes an analysis unit 11, a monitoring failure verification unit 13, a monitoring rule update unit 16, a command issue unit 17, and a condition generation unit 18. The memory includes an analysis history storage unit 19 and a monitoring rule storage unit 12.

  That is, the physical configuration is, for example, one or a plurality of processors and one or a plurality of memories, etc., but the software configuration by each component has a plurality of functions that the processor exhibits by controlling the program. It is expressed as an element.

  When the dynamic state in which the processor is executed by the program (the state in which each procedure constituting the program is executed) is functionally expressed, each component related to the execution part is configured in the processor. In a static state in which the program is not executed, the entire program (or each program part included in the configuration of each unit) that realizes the configuration of each unit is stored in a storage area such as a memory.

  Each unit (means) described above may be configured such that a computer functionalized by a program can be realized together with the function of the program, or a plurality of electronic circuits permanently functionalized by specific hardware You may comprise with the apparatus which consists of a block.

  In the above description, the operation content of each step described above, the constituent elements of each unit, and the functions thereof may be programmed (software program) and executed by a computer. The method described above can also be realized by a computer reading a program from a recording medium and executing it. That is, the structure which recorded the above-mentioned program on the information recording medium may be sufficient.

Regarding the above-described embodiment, the main points of the new technical contents are summarized as follows.
Note that a part or all of the above-described embodiments can be summarized as a novel technique, but the present invention is not necessarily limited to this.

[Appendix 1]
An agent device for grasping a status of a service execution environment to be monitored; and a manager device for managing a monitoring rule of the service execution environment, wherein the manager device has the status of the service execution environment An analysis unit that determines whether or not each of the plurality of monitoring conditions defined in the monitoring rule is satisfied, and monitoring setting related to each of the monitoring conditions by detecting a difference of each determination in each of the plurality of monitoring conditions Is a monitoring system that can notify of a monitoring failure indicating that the
The manager device is
An analysis history accumulating unit for accumulating each performance information as a history, which is the state of the service execution environment corresponding to each of the monitoring conditions used for each of the determinations;
When each of the plurality of monitoring conditions results in a different determination result, a threshold value is calculated based on the performance information history of the analysis history storage unit so that the plurality of monitoring conditions have the same determination result. And a condition generation unit that generates a threshold value as a new monitoring condition for correcting the monitoring failure.

[Appendix 2]
In the monitoring system according to attachment 1,
Each of the plurality of monitoring conditions includes a main condition and one or more sub-conditions,
When the condition generation unit is different from the determination result of the main condition and the determination result of one sub-condition, the determination result of the main condition and the 1 of the determination result based on the history of the performance information of the analysis history storage unit A function for calculating, as a threshold value, the performance information relating to the one sub-condition so that the determination results of the two sub-conditions are the same, and generating a threshold value as a new sub-condition A surveillance system characterized by

[Appendix 3]
In the monitoring system described in Appendix 2,
The condition generation unit associates the required setting change information indicating that it is necessary to change the setting of the one sub-condition in the case of the monitoring failure with the one sub-condition. A monitoring system characterized by having a function of writing to the computer.

[Appendix 4]
In the monitoring system according to attachment 3,
When the condition generation unit has a determination result that the condition of the service execution environment is true satisfying the main condition, the main condition is true based on the performance information history of the analysis history storage unit. If the sub-condition with the required setting change information is taken out and the performance information indicating the state of the service execution environment is smaller than the sub-condition, the maximum value of the performance information is used as a threshold value. A monitoring system having a function of calculating and generating this threshold value as a new subcondition.

[Appendix 5]
In the monitoring system described in appendix 4,
When the condition generation unit has a determination result that the condition of the service execution environment is true satisfying the main condition, the main condition is true based on the performance information history of the analysis history storage unit. If the sub-condition with the required setting change information is taken out and the performance information indicating the state of the service execution environment is larger than the sub-condition, the minimum value of the performance information is used as a threshold value. A monitoring system having a function of calculating and generating this threshold value as a new subcondition.

[Appendix 6]
In the monitoring system according to attachment 5,
When the condition generation unit has a determination result that the state of the service execution environment is false that does not satisfy the main condition, the main condition becomes false based on the performance information history of the analysis history storage unit. If the performance information indicating the status of the service execution environment is smaller than the sub-condition, the minimum value of the performance information is set as a threshold value. And a function of generating the threshold value as a new sub-condition.

[Appendix 7]
In the monitoring system according to attachment 6,
When the condition generation unit has a determination result that the state of the service execution environment is false that does not satisfy the main condition, the main condition becomes false based on the performance information history of the analysis history storage unit. If the performance condition information indicating the status of the service execution environment is larger than the secondary condition, the maximum value of the performance information is set as a threshold value. And a function of generating the threshold value as a new sub-condition.

[Appendix 8]
In the monitoring system according to attachment 7,
A monitoring system further comprising a monitoring rule update unit for writing the new sub-condition to a corresponding portion of the analysis history storage unit to update information and notifying the outside of the new sub-condition.

[Appendix 9]
A function for managing the monitoring rules of the service execution environment via an agent device for grasping the status of the service execution environment to be monitored, and a plurality of monitors in which the status of the service execution environment is defined in the monitoring rule Announces a monitoring failure indicating that the monitoring setting for each monitoring condition is inappropriate by detecting the difference between the function for determining whether the condition is satisfied and the determination of each of the plurality of monitoring conditions A monitoring device having a function to
An analysis history accumulating unit for accumulating each performance information as a history, which is the state of the service execution environment corresponding to each of the conditions used for each of the determinations;
When each of the plurality of monitoring conditions results in a different determination result, a threshold value is calculated based on the performance information history of the analysis history storage unit so that the plurality of monitoring conditions have the same determination result. A monitoring apparatus comprising: a condition generation unit that generates a threshold value as a new monitoring condition for correcting the monitoring failure.

[Appendix 10]
The monitoring rules of the service execution environment are managed via an agent device for grasping the status of the service execution environment to be monitored, and the status of the service execution environment satisfies a plurality of monitoring conditions defined in the monitoring rule Monitoring the service execution environment to notify the monitoring failure indicating that the monitoring setting for each of the monitoring conditions is inappropriate by detecting the difference in the determinations of the plurality of monitoring conditions A method,
The analysis history accumulating unit accumulates each performance information that is the state of the service execution environment corresponding to each monitoring condition used for each determination as a history,
When each of the plurality of monitoring conditions results in a different determination result, a threshold value is calculated based on the performance information history of the analysis history storage unit so that the plurality of monitoring conditions have the same determination result. A service execution environment monitoring method, characterized in that a condition generation unit generates a threshold value as a new monitoring condition for correcting the monitoring failure.

[Appendix 11]
In the service execution environment monitoring method according to attachment 10,
In generating the monitoring condition, when the plurality of monitoring conditions include a main condition and one or more subconditions, and the determination result of the main condition is different from the determination result of one subcondition, The performance information relating to the one sub-condition such that the determination result of the main condition and the determination result of the one sub-condition are the same based on the history of the performance information of the analysis history storage unit is a threshold. As a value and generate this threshold as a new sub-condition,
A service execution environment monitoring method.

[Appendix 12]
In the service execution environment monitoring method according to attachment 11,
When generating the monitoring condition, the analysis history storage unit corresponds to the one sub-condition with the required setting change information indicating that the setting change of the one sub-condition is necessary in the case of the monitoring failure. A method for monitoring a service execution environment, characterized by writing in a location.

[Appendix 13]
In the service execution environment monitoring method according to attachment 12,
In generating the monitoring condition, if the state of the service execution environment is a determination result that is true for the main condition, the main condition is true based on the history of the performance information in the analysis history storage unit. If the sub-condition to which the required change information is attached is extracted, and the performance information indicating the status of the service execution environment is smaller than the sub-condition, the maximum value of the performance information is set as a threshold. A method for monitoring a service execution environment, characterized in that the threshold value is calculated as a new subcondition.

[Appendix 14]
In the service execution environment monitoring method according to attachment 13,
In generating the monitoring condition, if the state of the service execution environment is a determination result that is true for the main condition, the main condition is true based on the history of the performance information in the analysis history storage unit. If the performance information indicating the status of the service execution environment is larger than the sub-condition, the minimum value of the performance information is thresholded. A service execution environment monitoring method, characterized in that it is calculated as a value and this threshold value is generated as a new subcondition.

[Appendix 15]
In the service execution environment monitoring method according to attachment 14,
When generating the monitoring condition, if the service execution environment state is a false determination result that does not satisfy the main condition, the main condition is false based on the history of the performance information in the analysis history storage unit. If the performance information indicating the status of the service execution environment is smaller than the sub-condition, the minimum value of the performance information is set. A service execution environment monitoring method, characterized in that it is calculated as a threshold value and this threshold value is generated as a new subcondition.

[Appendix 16]
In the service execution environment monitoring method according to attachment 15,
When generating the monitoring condition, when the state of the service execution environment is a false determination result that does not satisfy the main condition, the main condition is based on the performance information history of the analysis history storage unit. If the performance information indicating the status of the service execution environment is larger than the sub-condition, the maximum value of the performance information is set. Calculate as a threshold and generate this threshold as a new sub-condition,
A service execution environment monitoring method.

[Appendix 17]
In the service execution environment monitoring method according to attachment 16,
After the monitoring condition is generated, the new subcondition is written in the corresponding part of the analysis history storage unit to update the information, and the monitoring rule update unit notifies the new subcondition to the outside. The service execution environment monitoring method.

[Appendix 18]
The monitoring rules of the service execution environment are managed via an agent device for grasping the status of the service execution environment to be monitored, and the status of the service execution environment satisfies a plurality of conditions defined in the monitoring rule And a monitoring device that can notify a monitoring failure indicating that the monitoring setting for each of the conditions is inappropriate by detecting whether or not each of the plurality of conditions is different. Computer
An analysis history accumulation processing function for accumulating each performance information as a history, which is a state of the service execution environment corresponding to each of the conditions used for each determination;
If the plurality of conditions result in different determination results, a threshold is calculated based on the performance information history of the analysis history storage processing function so that the plurality of conditions have the same determination result. A condition generation function for generating a value as a new condition for correcting the monitoring failure;
A program for a monitoring device, characterized by causing

[Appendix 19]
In the monitoring apparatus program according to attachment 18,
The plurality of conditions includes a main condition and one or more sub-conditions,
In the condition generation function, when the determination result of the main condition is different from the determination result of one of the sub-conditions, the determination result of the main condition and the determination result of the analysis history accumulation processing function based on the history of the performance information The content of the function is to calculate the performance information related to the one subcondition so that the determination result of one subcondition is the same as a threshold value, and generate the threshold value as a new subcondition. , A program for a monitoring apparatus, which causes the computer to execute this.

[Appendix 20]
In the monitoring device program according to attachment 19,
In the condition generation function, the setting change information indicating that the setting change of the one sub-condition is necessary in the case of the monitoring failure is associated with the one sub-condition and the corresponding part of the analysis history accumulation processing function A program for a monitoring apparatus, which has the function of writing to the contents as a content and causes the computer to execute the function.

[Appendix 21]
In the monitoring device program according to attachment 20,
In the condition generation function, the main condition becomes true based on the history of the performance information of the analysis history accumulation processing function when the state of the service execution environment is a determination result that the main condition is true. If the performance condition information indicating the status of the service execution environment is smaller than the secondary condition, the maximum value of the performance information is set as a threshold value. A program for a monitoring apparatus, characterized in that a function for generating the threshold value as a new subcondition is included in the content and causing the computer to execute the function.

[Appendix 22]
In the monitoring device program according to attachment 21,
In the condition generation function, the main condition becomes true based on the history of the performance information of the analysis history accumulation processing function when the state of the service execution environment is a determination result that the main condition is true. If the performance information indicating the status of the service execution environment is greater than the sub-condition, the minimum value of the performance information is set as a threshold value. A program for a monitoring apparatus, characterized in that a function for generating the threshold value as a new subcondition is included in the content and causing the computer to execute the function.

[Appendix 23]
In the monitoring device program according to attachment 22,
In the condition generation function, when the state of the service execution environment is a determination result that is false not satisfying the main condition, the main condition is false based on the history of the performance information of the analysis history accumulation processing function. If the performance condition information indicating the status of the service execution environment is smaller than the secondary condition, the minimum value of the performance information is thresholded. A program for a monitoring apparatus, characterized in that a function for generating a threshold value as a new subcondition is calculated as a value, and causing the computer to execute the function.

[Appendix 24]
In the monitoring device program according to attachment 23,
In the condition generation function, when the state of the service execution environment is a determination result that is false not satisfying the main condition, the main condition is false based on the history of the performance information of the analysis history accumulation processing function. If the performance condition information indicating the status of the service execution environment is greater than the secondary condition, the maximum value of the performance information is determined. A program for a monitoring apparatus, characterized in that a function for generating a threshold value as a new subcondition is calculated as a value, and causing the computer to execute the function.

[Appendix 25]
In the monitoring device program according to attachment 24,
The new sub-condition is written in the corresponding part of the analysis history accumulation processing function to update the information, and the monitoring rule update function for notifying the new sub-condition to the outside is further executed by the computer. Monitoring device program.

  The present invention can be used in general monitoring systems.

1 Monitoring system 10 Manager device (monitoring device)
DESCRIPTION OF SYMBOLS 11 Analysis part 12 Monitoring rule storage part 13 Monitoring failure verification part 14 Fault display part 15 Monitoring failure display part 16 Monitoring rule update part 17 Command issuing part 18 Condition generation part 19 Analysis history storage part 20 Agent apparatus 21 Monitoring part 22 Control part 30 Service execution environment

Claims (10)

An agent device for grasping a status of a service execution environment to be monitored; and a manager device for managing a monitoring rule of the service execution environment, wherein the manager device has the status of the service execution environment An analysis unit that determines whether or not each of the plurality of monitoring conditions defined in the monitoring rule is satisfied, and monitoring setting related to each of the monitoring conditions by detecting a difference of each determination in each of the plurality of monitoring conditions Is a monitoring system that can notify of a monitoring failure indicating that the
The manager device is
An analysis history accumulating unit for accumulating each performance information as a history, which is the state of the service execution environment corresponding to each of the monitoring conditions used for each of the determinations;
When each of the plurality of monitoring conditions results in a different determination result, a threshold value is calculated based on the performance information history of the analysis history storage unit so that the plurality of monitoring conditions have the same determination result. And a condition generation unit that generates a threshold value as a new monitoring condition for correcting the monitoring failure. The monitoring system according to claim 1,
Each of the plurality of monitoring conditions includes a main condition and one or more sub-conditions,
When the condition generation unit is different from the determination result of the main condition and the determination result of one sub-condition, the determination result of the main condition and the 1 of the determination result based on the history of the performance information of the analysis history storage unit A function for calculating, as a threshold value, the performance information relating to the one sub-condition so that the determination results of the two sub-conditions are the same, and generating a threshold value as a new sub-condition A surveillance system characterized by The monitoring system according to claim 2,
The condition generation unit associates the required setting change information indicating that it is necessary to change the setting of the one sub-condition in the case of the monitoring failure with the one sub-condition. A monitoring system characterized by having a function of writing to the computer. The monitoring system according to claim 3,
When the condition generation unit has a determination result that the condition of the service execution environment is true satisfying the main condition, the main condition is true based on the performance information history of the analysis history storage unit. If the sub-condition with the required setting change information is taken out and the performance information indicating the state of the service execution environment is smaller than the sub-condition, the maximum value of the performance information is used as a threshold value. A monitoring system having a function of calculating and generating this threshold value as a new subcondition. The monitoring system according to claim 4, wherein
When the condition generation unit has a determination result that the condition of the service execution environment is true satisfying the main condition, the main condition is true based on the performance information history of the analysis history storage unit. If the sub-condition with the required setting change information is taken out and the performance information indicating the state of the service execution environment is larger than the sub-condition, the minimum value of the performance information is used as a threshold value. A monitoring system having a function of calculating and generating this threshold value as a new subcondition. The monitoring system according to claim 5, wherein
When the condition generation unit has a determination result that the state of the service execution environment is false that does not satisfy the main condition, the main condition becomes false based on the performance information history of the analysis history storage unit. If the performance information indicating the status of the service execution environment is smaller than the sub-condition, the minimum value of the performance information is set as a threshold value. And a function of generating the threshold value as a new sub-condition. The monitoring system according to claim 6, wherein
When the condition generation unit has a determination result that the state of the service execution environment is false that does not satisfy the main condition, the main condition becomes false based on the performance information history of the analysis history storage unit. If the performance condition information indicating the status of the service execution environment is larger than the secondary condition, the maximum value of the performance information is set as a threshold value. And a function of generating the threshold value as a new sub-condition. A function for managing the monitoring rules of the service execution environment via an agent device for grasping the status of the service execution environment to be monitored, and a plurality of monitors in which the status of the service execution environment is defined in the monitoring rule Announces a monitoring failure indicating that the monitoring setting for each monitoring condition is inappropriate by detecting the difference between the function for determining whether the condition is satisfied and the determination of each of the plurality of monitoring conditions A monitoring device having a function to
An analysis history accumulating unit for accumulating each performance information as a history, which is the state of the service execution environment corresponding to each of the conditions used for each of the determinations;
When each of the plurality of monitoring conditions results in a different determination result, a threshold value is calculated based on the performance information history of the analysis history storage unit so that the plurality of monitoring conditions have the same determination result. A monitoring apparatus comprising: a condition generation unit that generates a threshold value as a new monitoring condition for correcting the monitoring failure. The monitoring rules of the service execution environment are managed via an agent device for grasping the status of the service execution environment to be monitored, and the status of the service execution environment satisfies a plurality of monitoring conditions defined in the monitoring rule Monitoring the service execution environment to notify the monitoring failure indicating that the monitoring setting for each of the monitoring conditions is inappropriate by detecting the difference in the determinations of the plurality of monitoring conditions A method,
The analysis history accumulating unit accumulates each performance information that is the state of the service execution environment corresponding to each monitoring condition used for each determination as a history,
When each of the plurality of monitoring conditions results in a different determination result, a threshold value is calculated based on the performance information history of the analysis history storage unit so that the plurality of monitoring conditions have the same determination result. A service execution environment monitoring method, characterized in that a condition generation unit generates a threshold value as a new monitoring condition for correcting the monitoring failure. The monitoring rules of the service execution environment are managed via an agent device for grasping the status of the service execution environment to be monitored, and the status of the service execution environment satisfies a plurality of conditions defined in the monitoring rule And a monitoring device that can notify a monitoring failure indicating that the monitoring setting for each of the conditions is inappropriate by detecting whether or not each of the plurality of conditions is different. Computer
An analysis history accumulation processing function for accumulating each performance information as a history, which is a state of the service execution environment corresponding to each of the conditions used for each determination;
If the plurality of conditions result in different determination results, a threshold is calculated based on the performance information history of the analysis history storage processing function so that the plurality of conditions have the same determination result. A condition generation function for generating a value as a new condition for correcting the monitoring failure;
A program for a monitoring device, characterized by causing

Images