JP2018156348A - Fault monitoring apparatus, fault monitoring system, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a fault monitoring apparatus capable of detecting a fault in an information processing system on the basis of a result of internal monitoring.SOLUTION: A fault monitoring apparatus 100 includes external monitoring means 10 for periodically accessing an information processing system 200 and time-sequentially accumulating successes and failures in response, internal monitoring means 20 for time-sequentially accumulating internal states of respective elements constituting the information processing system, and fault determination means 30 for determining a fault of the information processing system. The fault determination means includes means 32 for converting time-sequential information on the success and failure in response into external metrics data, means 34 for converting time-sequential information on the internal state into internal metrics data, means 35 for generating teacher data whose output is the value of the external metrics data and whose input is the value of the internal metrics data temporally corresponding to its value, a learning device 36 for machine learning a fault determination condition to be used in fault determination of the information processing system by using the teacher data, and a determination device 37 for setting the fault determination condition.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a failure monitoring device, a failure monitoring system, and a program.

  Conventionally, a failure monitoring system that remotely monitors a failure of an information processing system including a plurality of servers and modules via a network is known.

  For example, Patent Literature 1 learns in advance the relationship between components of an information processing system and message patterns output to a log, and collates the output message pattern with the learned message pattern during operation. Disclosed is a failure detection device capable of appropriately detecting a failure in an information processing system having different components.

  Here, remote monitoring of the information processing system includes external monitoring (for example, alive monitoring, service monitoring, etc.) that periodically accesses the information processing system from the outside and determines based on the response result, information processing There are two methods of internal monitoring (for example, resource monitoring and log monitoring) by acquiring and determining the internal state of each element constituting the system.

  According to internal monitoring, the internal state of each element constituting the information processing system (for example, the CPU usage rate, the free disk capacity, the number of processes, etc.) is grasped against a predetermined threshold value to grasp the state of each element. However, when viewed as the entire information processing system, whether or not it is operating normally cannot be uniquely determined from the state of each element. In this regard, according to the external monitoring, a failure occurring in the information processing system can be directly detected, but a load is generated in the information processing system with regular access.

  The present invention has been made in view of the above, and an object of the present invention is to provide a failure monitoring apparatus that can detect a failure in an information processing system based on a result of internal monitoring.

  As a result of intensive studies on the configuration of a failure monitoring apparatus that can detect a failure in an information processing system based on the results of internal monitoring, the inventors have conceived the following configuration and have reached the present invention.

  That is, according to the present invention, there is provided a failure monitoring apparatus for detecting a failure in an information processing system, which periodically accesses the information processing system and accumulates success or failure of the response in time series. Means, internal monitoring means for accumulating the internal state of each element constituting the information processing system in time series, failure determination means for determining a failure of the information processing system, the failure determination means, Means for converting time series information of success or failure of response to external metric data; means for converting time series information of the internal state to internal metric data; and outputting the value of the external metric data to the value in time. Means for generating teacher data having the corresponding value of the internal metric data as input, and for determining a failure of the information processing system using the teacher data A learning device for machine learning of failure determination conditions, a determination device in which the failure determination conditions are set, a determination device that receives the internal metrics data as an input, and outputs a determination result related to a failure of the information processing system; Are provided.

  As described above, according to the present invention, a failure monitoring apparatus capable of detecting a failure in an information processing system based on the result of internal monitoring is provided.

The block diagram of the failure monitoring apparatus of this embodiment. The functional block diagram of the failure monitoring apparatus of this embodiment. The figure which shows the monitoring scenario of this embodiment. The figure which shows the internal monitoring setting of this embodiment. The flowchart which shows the process which the failure monitoring apparatus of this embodiment performs. The figure which shows the external monitoring information of this embodiment. The flowchart which shows the process which the failure monitoring apparatus of this embodiment performs. The figure which shows the internal state information of this embodiment. The flowchart which shows the process which the failure monitoring apparatus of this embodiment performs. The figure which shows the external and internal metrics data of this embodiment. The figure which shows the determination engine (neural network) of this embodiment. The system block diagram of the failure monitoring system of this embodiment. The hardware block diagram of the failure monitoring apparatus (computer) of this embodiment.

  Hereinafter, although this invention is demonstrated with embodiment, this invention is not limited to embodiment mentioned later. In the drawings referred to below, the same reference numerals are used for common elements, and the description thereof is omitted as appropriate.

  FIG. 1 shows a schematic configuration of a failure monitoring apparatus 100 according to an embodiment of the present invention. The fault monitoring apparatus 100 of the present embodiment is an apparatus for remotely monitoring the state of the information processing system 200 composed of a plurality of servers and modules. The fault monitoring apparatus 100 and the information processing system 200 to be monitored are They are connected to each other via a network 50 referred to as a LAN, VAN or the like so as to be able to communicate with each other.

  As shown in FIG. 1, the fault monitoring apparatus 100 according to the present embodiment includes an external monitoring unit 10, an internal monitoring unit 20, and a fault determination unit 30.

  The external monitoring unit 10 is a unit that performs external monitoring on the information processing system 200, periodically executes access processing to the information processing system 200 via the network 50, and receives a response result. Here, examples of external monitoring include URL monitoring, PING monitoring, FTP monitoring, POP monitoring, SMTP monitoring, and port monitoring. The external monitoring unit 10 generates external monitoring information (described later) from the received response result and sends it to the failure determination unit 30.

  The internal monitoring unit 20 is a unit that performs internal monitoring on the information processing system 200, and collects the internal state of each element (server, module) constituting the information processing system 200 via the network 50. Here, the internal monitoring can include CPU monitoring, disk monitoring, process monitoring, log monitoring, etc., and the internal state includes CPU usage rate, disk free space, presence / absence of designated process, number of processes, The presence or absence of keywords that are output to the log file can be listed. The internal monitoring unit 20 generates internal state information (described later) from the collected internal state and sends it to the failure determination unit 30.

  The failure determination unit 30 is a unit that determines a failure in the information processing system 200 and learns failure determination conditions based on the external monitoring information received from the external monitoring unit 10 and the internal state information received from the internal monitoring unit 20. The failure of the information processing system 200 is determined based on the learned failure determination condition.

  The schematic configuration of the failure monitoring apparatus 100 according to this embodiment has been described above. Next, the functional configuration of each unit described above will be described with reference to FIG.

  The external monitoring unit 10 includes an external monitoring engine 12 and a storage unit 14. Here, a monitoring scenario to be described later is stored in the storage unit 14, and the external monitoring engine 12 periodically performs processing on the information processing system 200 to be monitored based on the monitoring scenario stored in the storage unit 14. The access process is executed, and a response from the information processing system 200 is received. Then, the external monitoring engine 12 generates external monitoring information based on the response result from the information processing system 200 and sends it to the failure determination means 30.

  FIG. 3 exemplarily shows a monitoring scenario 300 stored in the storage unit 14. The monitoring scenario 300 describes a combination of information necessary for access processing that simulates an access operation by a user and an expected response value in the order of execution, and stores a scenario number as shown in FIG. Field 301 for storing the processing number, field 303 for storing the communication protocol for accessing the monitoring target, field 304 for storing the monitoring target address, and access to the monitoring target It includes a field 305 for storing option information (user account, file name, etc.) necessary for the operation, and a field 306 for storing an expected response value at normal time.

  The internal monitoring unit 20 includes an internal monitoring engine 22 and a storage unit 24. Here, the storage unit 24 stores internal monitoring settings, which are a set of settings for performing internal monitoring. The internal monitoring engine 22 determines whether the monitoring target is based on the internal monitoring settings stored in the storage unit 24. Each element (server, module) constituting the information processing system 200 is accessed, and the internal state is collected. When the monitoring agent 202 is resident in the information processing system 200, the internal monitoring engine 22 collects the internal state from the monitoring agent 202. The internal monitoring unit 20 generates internal state information based on the collected various internal states and sends the internal state information to the failure determination unit 30.

  FIG. 4 exemplarily shows the internal monitoring setting 400 stored in the storage unit 24. As shown in FIG. 4, in the internal monitoring setting 400, “monitoring target”, “monitoring timing”, “waiting time”, “ Setting values of items such as “re-execution count”, “search character string”, and “output format” are described.

  The failure determination unit 30 includes an external monitoring information conversion engine 32, an internal state information conversion engine 34, a teacher data generation unit 35, a learning engine 36, a determination engine 37, and a storage unit 38. .

  The external monitoring information conversion engine 32 converts the external monitoring information received from the external monitoring means 10 into external metric data (described later) and accumulates it in the storage means 38.

  The internal state information conversion engine 34 converts the internal state information received from the internal monitoring unit 20 into internal metric data (described later) and accumulates it in the storage unit 38.

  The teacher data generation unit 35 generates teacher data based on the internal metric data and the external metric data stored in the storage unit 38 and stores the teacher data in the storage unit 38.

  The learning engine 36 is a learning device that performs supervised machine learning, and is preferably a multilayer neural network. The learning engine 36 learns the failure determination condition using the teacher data stored in the storage unit 38, and stores the learned failure determination condition in the storage unit 38.

  The determination engine 37 is a determiner having the same configuration as the learning engine 36. During operation, the failure determination condition read from the storage unit 38 is set in the determination engine 37, and the determination engine 37 receives internal metric data generated by the internal state information conversion engine 34 as an input, and Outputs the determination result related to the failure.

  The functional configuration of the failure monitoring apparatus 100 according to the present embodiment has been described above. In the present embodiment, the computer constituting the failure monitoring apparatus 100 functions as the above-described units by executing a predetermined program.

  Next, the contents of the processing executed by each functional unit described above will be described in order.

  First, the contents of processing executed by the external monitoring means 10 (external monitoring engine 12) will be described based on the flowchart shown in FIG.

  First, in step 101, one scenario is read from the monitoring scenario 300. Specifically, a plurality of records with the smallest scenario number are read from the records of the monitoring scenario 300 (see FIG. 3).

  In the subsequent step 102, access processing is executed for the information processing system 200 based on the information of the record to which the youngest processing number is assigned among the plurality of records read in the previous step 101. Specifically, according to the protocol stored in the field 302 of the corresponding record, if necessary, the option information stored in the field 305 is used to perform access processing with the address stored in the field 304 as the destination. Run.

  Thereafter, after waiting for a response from the information processing system 200 for a predetermined time, it is determined in a subsequent step 103 whether or not the response has been received. As a result, when a response is received (step 103, Yes), the process proceeds to step 104. When a response is not received (step 103, No), the process proceeds to step 108.

  In subsequent step 104, the success or failure of the response and the response time are accumulated in external monitoring information (described later) based on the response result received from the information processing system 200, and then the process proceeds to step 105. On the other hand, in the subsequent step 108, “timeout error” is also stored in the external monitoring information, and then the process proceeds to step 105.

  FIG. 6 exemplarily shows the external monitoring information 500. The external monitoring information 500 is a data structure for accumulating external monitoring execution results (response success / failure and response time) in time series, and is held in a temporary storage. As shown in FIG. 6, the external monitoring information 500 includes a field 501 for storing “scenario number”, a field 502 for storing “processing number”, and a field 503 for storing “success / failure”. , And a field 504 for storing “response time”.

  Here, in the previous step 104, a new record is added to the external monitoring information 500, and the “scenario number” and “process number” of the record related to the access process executed in the previous step 102 are the fields of the added record. Stored in 501 and 502. Also, the “response expected value” stored in the record related to the access process is compared with the received response result, and if both match, the success (successl) is stored in the field 503. (Fail) is stored in the field 503. Further, the time when the response is received is stored in the field 504 as the response time.

  Similarly, in the previous step 108, the “scenario number” and “process number” of the record related to the access process executed in the previous step 102 are stored in the fields 501 and 502, and “fail” is stored in the field 503. Store. Further, the time-out time is stored in the field 504 as the response time.

  In the subsequent step 105, it is determined whether or not there is a next process that is not executed among the processes constituting the scenario read in the previous step 101. As a result, when there is a next process (step 105, Yes), the process returns to step 102, and based on the record with the next smallest process number among the plurality of records read in the previous step 101. Then, the same processing as described above is executed. Thereafter, steps 102 to 105 are repeated until all the processes constituting the scenario read in the previous step 101 are executed.

  Thereafter, if it is determined in step 105 that there is no next process (No in step 105), the process proceeds to step 106, and the next scenario that is not executed among the scenarios described in the monitoring scenario 300 is performed. Judge whether there is. As a result, if there is a next scenario (step 106, Yes), the process returns to step 101 to read a plurality of records to which the next young scenario number is assigned. Thereafter, the processes in steps 101 to 106 are repeated until all the scenarios described in the monitoring scenario 300 are executed. Thereafter, when it is determined in step 106 that there is no next scenario (step 106, No), the process proceeds to step 107.

  In the subsequent step 107, the external monitoring information 500 is read from the temporary storage and sent to the failure determination means 30, and the process is terminated. The external monitoring engine 12 periodically executes the series of processes described above (for example, every 5 minutes).

  The contents of the processing executed by the external monitoring means 10 have been described above. Next, the contents of the processing executed by the internal monitoring means 20 (internal monitoring engine 22) will be described based on the flowchart shown in FIG.

  First, in step 201, the internal monitoring setting 400 (see FIG. 4) is read from the storage means 24.

  In the following step 202, an internal monitoring process for acquiring an internal state at a set monitoring timing is performed for each of a plurality of monitoring targets (modules) described in the internal monitoring setting 400.

  Thereafter, after waiting for a response from each module for a predetermined time, it is determined in a subsequent step 203 whether or not the internal state has been acquired. As a result, when the internal state has been acquired (step 203, Yes), the process proceeds to step 204. When the internal state has not been acquired (step 203, No), the process proceeds to step 206.

  In subsequent step 204, the internal state acquired from the monitoring target (module) is accumulated in internal state information (described later), and then the process proceeds to step 205. On the other hand, in the subsequent step 206, “timeout error” is also stored in the internal state information, and then the process proceeds to step 205.

  FIG. 8 exemplarily shows the internal state information 600. The internal state information 600 is a data structure for accumulating the internal state acquired by the internal monitoring process in time series, and is held in a temporary storage. As shown in FIG. 8, the internal state information 600 stores a field 601 for storing “monitoring target”, a field 602 for storing “type of internal state”, and a “value of internal state”. And a field 604 for storing “acquisition time”.

  Here, in the previous step 204, a new record is added to the internal state information 600, the monitoring target that is the execution destination of the internal monitoring process executed in the previous step 202 is stored in the field 601, and acquired from the monitoring target. The type of the internal state is stored in the field 602, the value of the internal state is stored in the field 603, and the time when the internal state is acquired is stored in the field 604. Similarly, in the previous step 206, the monitoring target that is the execution destination of the internal monitoring process executed in the previous step 202 is stored in the field 601, and the type of the internal state acquired from the monitoring target is stored in the field 602. A value (zero value, null value, NoData value, Error value, etc.) specified for each monitoring target, which means an error specified for each monitoring target, is stored in the field 603, and the time-out time is stored in the field 604.

  In subsequent step 205, the internal state information 600 is read from the temporary storage and sent to the failure determination means 30. Thereafter, the processes in steps 202 to 205 are repeatedly executed.

  On the other hand, when the monitoring agent 202 is resident in the information processing system 200, the internal monitoring unit 20 executes steps 207 to 209 in parallel with the above-described steps 202 to 205.

  First, in step 207, the internal state transmitted from the monitoring agent 202 is waited (step 207, No), and when the internal state is acquired from the monitoring agent 202 (step 207, Yes), the process proceeds to step 208.

  In subsequent step 208, the internal state acquired from the monitoring agent 202 is accumulated in the internal state information 600 in the same procedure as described above, and then the process proceeds to step 209.

  In the subsequent step 209, the internal state information 600 is read from the temporary storage and sent to the failure determination means 30. Thereafter, the processing of steps 207 to 209 is repeatedly executed.

  The contents of the processing executed by the internal monitoring means 20 have been described above. Next, the contents of the processing executed by the failure determination means 30 during machine learning will be described based on the flowchart shown in FIG.

  First, in step 301, the external monitoring information conversion engine 32 generates external metrics data by converting the values of each record of the external monitoring information 500 received from the external monitoring means 10 into numerical metrics. Specifically, the value (scenario number) of the field 501 of each record of the external monitoring information 500 is a ten digit, the integer having the value of the field 502 (processing number) as one digit is “metrics 1”, and the field The binary value (success: 1 / fail: 0) corresponding to the value 503 (success / failure) is defined as “metric 2”. Then, the value (response time) in the field 504 is associated with the above-described two metrics (“metric 1”, “metric 2”). Note that the above-described mapping to the number of digits is merely an example for explanation, and in practice, appropriate mapping is performed according to the number of scenarios and the number of processes.

  FIG. 10A exemplarily shows external metrics data 700 generated by the above-described procedure. As shown in FIG. 10A, in the external metrics data 700, “metrics 1” and “metrics 2” are associated with time (that is, response time of external monitoring).

  In the subsequent step 302, the internal state information conversion engine 34 converts the value of each record of the internal state information 600 received from the internal monitoring means 20 into numeric metrics, thereby generating internal metrics data. Specifically, the value (internal state value) of the field 603 of the N records (N is an integer equal to or greater than 1) with the same value (acquisition time) in the field 604 is set to “metrics 1” and “metrics”, respectively. 2 ”,“ Metric 3 ”,“ Metric 4 ”...“ Metric N ”, and the value (acquisition time) of the field 604 is associated with the N metrics.

  FIG. 10B exemplarily shows internal metrics data 800 generated by the above-described procedure. As shown in FIG. 10B, in the internal metrics data 800, N metrics are associated with time (that is, the acquisition time of the internal state).

  In the subsequent step 303, the teacher data generation means 35 generates teacher data having the value of one record included in the internal metrics data 800 as an input and the value of one record included in the external metrics data 700 as an output.

  Specifically, the time stored in each record of the external metric data 700 is compared with the time stored in each record of the internal metric data 800, and the most recent time is viewed from the time of one record of the external metric data 700. A record of the internal metrics data 800 in which the time is stored is selected, and a set of values of these two records is used as teacher data.

  In the present embodiment, as an alternative, M pieces of internal metrics data 800 (in a few seconds, for example) stored in the past in a predetermined period starting from the time of one record of external metrics data 700 ( M may be selected as an integer of 2 or more. In this case, an appropriate representative value (average value, median value, maximum value, minimum value, etc.) is calculated for each value of the N metrics included in each of the selected M records, and the external metrics data 700 is calculated. A set of one record value of N and the calculated N representative values is used as teacher data. In other words, in the present embodiment, a value of 1 included in the external metrics data 700 may be output and a value of internal metrics data corresponding to the value in time may be input.

In the subsequent step 304, the learning engine 36 performs machine learning using the teacher data generated in the previous step 303. FIG. 11 shows that the learning engine 36 configured as a multi-layer neural network performs machine learning using teacher data having a value of 1 in the internal metrics data 800 as an input and a value of 1 in the external metrics data 700 as an output. A state of being executed is schematically shown. In this case, the failure determination condition is acquired in the hidden layer of the neural network by executing machine learning. Here, the failure determination condition in the present embodiment means a set of information (1) to (4) below. The following (1) and (2) are design items that are artificially determined, and the optimum values (3) and (4) below are automatically generated by machine learning using the above-described teacher data. It will be.
(1) Network structure of neural network (2) Node activation function (3) Weight value (4) Bias value

  In the subsequent step 305, the learning engine 36 stores the acquired failure determination condition in the storage unit 38, and ends the process.

  The content of the processing executed by the failure determination unit 30 during machine learning has been described above. Next, the content of the processing executed by the failure determination unit 30 during operation will be described based on the flowchart shown in FIG. .

  At the time of operation, it is assumed that the failure determination condition acquired by learning is set for the determination engine 37 configured as the same multi-layer neural network as the learning engine 36.

  First, in step 401, the internal state information conversion engine 34 generates internal metric data based on the internal state information 600 received from the internal monitoring means 20 in the same procedure as in machine learning. Specifically, the value (internal state value) of the field 603 of N records having the same value (acquisition time) of the field 604 of each record of the received internal state information 600 is set to “metrics 1”, “Metric 2”, “Metric 3”, “Metric 4”... “Metric N”. During operation, it is not necessary to associate the value (acquisition time) of the field 604 with N metrics.

  In the subsequent step 402, the internal state information conversion engine 34 inputs the internal metrics data generated in the previous step 401 to the determination engine 37.

  In subsequent step 403, the determination engine 37 outputs a determination result, and the process is terminated. Here, in step 403, “metrics 1 (scenario number + processing number)” and “metrics 2 (success: 1 / fail: 0)” are output as determination results. If metric 2 = 1 is output in step 403, it is estimated that the information processing system 200 to be monitored is in a normal state. On the other hand, if metrics 2 = 0 is output in step 403, it is estimated that a failure has occurred in the information processing system 200 to be monitored.

  As described above, according to the present embodiment, during operation, it becomes possible to perform failure detection of the information processing system and comprehensive impact determination based only on the result of internal monitoring. Reduction of costs (monitoring system maintenance cost and access load on the monitoring target) can be expected. Further, in the present embodiment, since the failure determination condition is automatically learned, it is possible to save the troublesome work in the conventional internal monitoring (individual setting / adjustment of the threshold value related to the internal state of each monitoring target). It becomes like this.

  The fault monitoring apparatus 100 according to the present embodiment has been described above. In the present embodiment, each functional unit illustrated in FIG. 2 may be realized on one computer, or each functional unit may be an appropriate unit. Thus, it may be realized as a network system by being distributed to two or more computers on the network.

  FIG. 12 exemplarily shows a failure monitoring system 100 s configured as a network system having functions equivalent to those of the failure monitoring apparatus 100. The failure monitoring system 100 s is equivalent to the external monitoring system 10 s having the same function as the above-described external monitoring unit 10, the internal monitoring system 20 s having the same function as the above-described internal monitoring unit 20, and the above-described failure determination unit 30. The systems 10s, 20s, and 30s are connected to each other via a network 50 so that they can communicate with each other.

  Finally, based on FIG. 13, the hardware configuration of the computer constituting the fault monitoring apparatus 100 of the present embodiment or a network system having functions equivalent thereto will be described.

  As shown in FIG. 13, the computer constituting the fault monitoring apparatus 100 of this embodiment or a network system having the same function as this stores a processor 101 that controls the operation of the entire apparatus, a boot program, a firmware program, and the like. ROM 102 to be executed, RAM 103 to provide a program execution space, auxiliary storage device 104 for storing a program for causing the computer to function as each of the above-described functional units, an operating system (OS), and the like, and an external device are connected. An input / output interface 105 for connecting to the network 50, and a network interface 106 for connecting to the network 50.

  Note that each function of the above-described embodiment can be realized by a program described in C, C ++, C #, Java (registered trademark), etc., and the program of this embodiment includes a hard disk device, a CD-ROM, an MO, a DVD, and the like. It can be stored in a recording medium such as a flexible disk, EEPROM, EPROM and distributed, and can be transmitted via a network in a format that can be used by other devices.

  As described above, the present invention has been described with the embodiment. However, the present invention is not limited to the above-described embodiment, and as long as the operations and effects of the present invention are exhibited within the scope of embodiments that can be considered by those skilled in the art. It is included in the scope of the present invention.

DESCRIPTION OF SYMBOLS 10 ... External monitoring means 12 ... External monitoring engine 14 ... Storage means 20 ... Internal monitoring means 22 ... Internal monitoring engine 24 ... Storage means 30 ... Fault determination means 32 ... External monitoring information conversion engine 34 ... Internal state information conversion engine 35 ... Teacher Data generation means 36 ... learning engine 37 ... determination engine 38 ... storage means 50 ... network 100 ... failure monitoring device 10s ... external monitoring system 20s ... internal monitoring system 30s ... failure determination system 100s ... failure monitoring system 101 ... processor 102 ... ROM
103 ... RAM
104 ... auxiliary storage device 105 ... input / output interface 106 ... network interface 200 ... information processing system 202 ... monitoring agent 300 ... monitoring scenario 301, 302, 303, 304, 305, 306 ... field 400 ... internal monitoring setting 500 ... external monitoring Information 501, 502, 503, 504 ... Field 600 ... Internal state information 601, 602, 603, 604 ... Field 700 ... External metrics data 800 ... Internal metrics data

JP 2012-141802 A

Claims (8)

A failure monitoring device for detecting a failure in an information processing system,
External monitoring means for periodically accessing the information processing system and accumulating success or failure of the response in time series,
Internal monitoring means for accumulating in time series the internal state of each element constituting the information processing system;
Failure determination means for determining a failure of the information processing system;
Including
The failure determination means includes
Means for converting time series information of success or failure of the response into external metric data;
Means for converting the time series information of the internal state into internal metrics data;
Means for generating teacher data having the value of the external metrics data as an output and the value of the internal metrics data corresponding to the value in time as input;
A learning device for machine learning of a failure determination condition for determining a failure of the information processing system using the teacher data;
A determination unit in which the failure determination condition is set, the determination unit receiving the internal metrics data as an input, and outputting a determination result relating to the failure of the information processing system;
Fault monitoring device including The means for generating the teacher data includes:
Generating a teacher data in which a value of 1 of the external metrics data is output and a representative value of two or more values of the internal metrics data corresponding to the value in time is input;
The fault monitoring apparatus according to claim 1. The fault monitoring device
It has a monitoring scenario that describes the combination of access and response expected value that simulates the access operation by the user in the order of execution,
The external monitoring means includes
Sequentially executing each access to the information processing system, and determining success or failure of the response based on a comparison between a response result to the access and the expected response value related to the access;
The fault monitoring apparatus according to claim 1 or 2. A failure monitoring device for detecting a failure in an information processing system,
Internal monitoring means for accumulating in time series the internal state of each element constituting the information processing system;
Failure determination means for determining a failure of the information processing system;
Including
The failure determination means includes
Means for converting the internal state into internal metrics data;
A determination unit in which a failure determination condition acquired by machine learning using predetermined teacher data is set, the determination unit receiving the internal metrics data as an input and outputting a determination result related to the failure of the information processing system Including
The predetermined teacher data is
Teacher data that takes the value of the external metrics data as an output and receives the value of the internal metrics data corresponding to the value in time,
The external metrics data is
Time series information of metrics related to success or failure of response to access periodically executed for a given information processing system,
The internal metrics data is
Metric time series information relating to the internal state of each element constituting the predetermined information processing system,
Fault monitoring device. A failure monitoring system for detecting a failure in an information processing system,
External monitoring means for periodically accessing the information processing system and accumulating success or failure of the response in time series,
Internal monitoring means for accumulating in time series the internal state of each element constituting the information processing system;
Failure determination means for determining a failure of the information processing system;
Including
The failure determination means includes
Means for converting time series information of success or failure of the response into external metric data;
Means for converting the time series information of the internal state into internal metrics data;
Means for generating teacher data having the value of the external metrics data as an output and the value of the internal metrics data corresponding to the value in time as input;
A learning device for machine learning of a failure determination condition for determining a failure of the information processing system using the teacher data;
Fault monitoring system including A failure monitoring system for detecting a failure in an information processing system,
Internal monitoring means for accumulating in time series the internal state of each element constituting the information processing system;
Failure determination means for determining a failure of the information processing system;
Including
The failure determination means includes
Means for converting the internal state into internal metrics data;
A determination unit in which a failure determination condition acquired by machine learning using predetermined teacher data is set, the determination unit receiving the internal metrics data as an input and outputting a determination result related to the failure of the information processing system Including
The predetermined teacher data is
Teacher data that takes the value of the external metrics data as an output and receives the value of the internal metrics data corresponding to the value in time,
The external metrics data is
Time series information of metrics related to success or failure of response to access periodically executed for a given information processing system,
The internal metrics data is
Metric time series information relating to the internal state of each element constituting the predetermined information processing system,
Fault monitoring system. A computer for detecting failures in information processing systems
External monitoring means for periodically accessing the information processing system and accumulating success or failure of the response in time series,
Internal monitoring means for accumulating the internal state of each element constituting the information processing system in time series;
A failure determination means for determining a failure of the information processing system;
Is a program for functioning as
The failure determination means includes
Means for converting time series information of success or failure of the response into external metric data;
Means for converting the time series information of the internal state into internal metrics data;
Means for generating teacher data having the value of the external metrics data as an output and the value of the internal metrics data corresponding to the value in time as input;
A learning device for machine learning of a failure determination condition for determining a failure of the information processing system using the teacher data;
Including the program. A computer for detecting failures in information processing systems
Internal monitoring means for accumulating the internal state of each element constituting the information processing system in time series;
A failure determination means for determining a failure of the information processing system;
Is a program for functioning as
The failure determination means includes
Means for converting the internal state into internal metrics data;
A determination unit in which a failure determination condition acquired by machine learning using predetermined teacher data is set, the determination unit receiving the internal metrics data as an input and outputting a determination result related to the failure of the information processing system Including
The predetermined teacher data is
Teacher data that takes the value of the external metrics data as an output and receives the value of the internal metrics data corresponding to the value in time,
The external metrics data is
Time series information of metrics related to success or failure of response to access periodically executed for a given information processing system,
The internal metrics data is
Metric time series information relating to the internal state of each element constituting the predetermined information processing system,
program.