JP2024141095A - Event management program, event management method, and information processing device - Google Patents

Abstract

To easily grasp the ease with which an operation handler can handle an event.SOLUTION: An information processing device 10 acquires new event information 5 indicating attributes and the date and time of occurrence of a new event which has occurred in a computer system 1a, 1b, 1c. The information processing device 10 identifies, on the basis of past event information 11a indicating the attributes and the dates and times of occurrences of past events handled by operation handlers 2 to 4, a first past event that has common attributes with the new event from among the past events. The information processing device 10 calculates a difference between the date and time of the occurrence of the first past event and the date and time of the occurrence of the new event. The information processing device 10 calculates, on the basis of the difference, a degree of ease with which an operation handler can handle the new event.SELECTED DRAWING: Figure 1

Description

The present invention relates to an event management program, an event management method, and an information processing device.

The operating status of computer systems in operation is monitored by operations personnel. In system monitoring, for example, multiple operations personnel check a large number of events occurring from multiple systems.

As a technology to support system monitoring, for example, an alert display device has been proposed that uses easily configurable filter conditions to select and display on a screen the necessary alerts that change depending on the situation and purpose. A network operation management system has also been provided that makes it possible to identify the cause of a malfunction caused by a combination of multiple events and how to deal with it. An event response support device has also been proposed that supports users to respond more quickly and accurately to events that occur in equipment, etc. A monitoring device that can reduce the burden of monitoring alerts has also been proposed. A personnel allocation device that can ensure stable operation of information systems has also been proposed. In addition, a trouble information analysis program has also been proposed that can appropriately determine the difficulty of avoiding a trouble based on the various causes of the trouble described in each trouble case information.

JP 2015-87987 A JP 2012-234381 A JP 2014-130499 A JP 2020-144954 A JP 2020-113022 A JP 2007-199809 A

Events that occur in a system are a mixture of easy and difficult to deal with. For this reason, it may be possible to predefine the difficulty of dealing with each event individually. In this case, operations personnel can refer to the predefined difficulty of dealing with the event that has occurred to understand how easy it is to deal with that event.

However, the ease with which an event can be dealt with varies from person to person; what may be difficult for one operations staff member is easy for another. Also, even for the same operations staff, the difficulty of dealing with an event can increase if the staff member has not dealt with it for a long time. For this reason, simply presenting operations staff with a predefined level of difficulty for each event will prevent them from correctly understanding the ease with which they can deal with the event that has occurred.

In one aspect, the present invention aims to make it easier for operators to understand how easily they can handle an event.

In one proposal, an event management program is provided that causes a computer to perform the following processes.
The computer acquires new event information indicating the occurrence date and attribute of a new event that has occurred in a computer system. The computer identifies a first past event having attributes common to the new event among past events based on past event information indicating the occurrence date and attribute of a past event handled by an operations staff. The computer calculates the difference between the occurrence date and time of the first past event and the occurrence date and time of the new event. The computer then calculates the ease with which the operations staff can handle the new event based on the difference.

According to one aspect, it is possible to easily understand the ease with which an operations staff member can handle an event.

FIG. 2 illustrates an example of an event management method according to the first embodiment; FIG. 1 illustrates an example of a monitoring system. FIG. 2 illustrates an example of hardware of an operation management server. FIG. 13 illustrates an example of a case in which it is difficult to appropriately determine an operations person who will handle an event. FIG. 2 is a diagram illustrating an example of an event source in a cloud system. FIG. 2 is a diagram illustrating an example of an event monitoring function in the monitoring system. FIG. 13 is a diagram illustrating an example of a date and time coefficient table. FIG. 13 is a diagram illustrating an example of a source coefficient table. FIG. 13 illustrates an example of an event table. 13 is a flowchart illustrating an example of a procedure for a monitoring process. 13 is a flowchart illustrating an example of a procedure for a handleability calculation process. 13 is a flowchart illustrating an example of a procedure for a treatment performance evaluation value calculation process. 13 is a flowchart illustrating an example of a procedure for a source evaluation value calculation process. FIG. 13 is a diagram illustrating an example of an event details screen. 13 is a flowchart illustrating an example of a procedure for a date and time coefficient feedback process.

Hereinafter, the present embodiment will be described with reference to the drawings. Note that each embodiment can be implemented in combination with a plurality of other embodiments as long as no contradiction occurs.
First Embodiment
The first embodiment is an event management method that makes it possible to easily grasp the ease with which an operation person can handle an event.

FIG. 1 is a diagram showing an example of an event management method according to a first embodiment. FIG. 1 shows an information processing device 10 that realizes the event management method. The information processing device 10 can implement the event management method by, for example, executing an event management program.

The information processing device 10 has a memory unit 11 and a processing unit 12. The memory unit 11 is, for example, a memory or storage device that the information processing device 10 has. The processing unit 12 is, for example, a processor or an arithmetic circuit that the information processing device 10 has.

The storage unit 11 stores past event information 11a, a first coefficient 11b, and a second coefficient.
The past event information 11a is information indicating past events that occurred in the past in computer systems 1a, 1b, 1c (hereinafter sometimes simply referred to as systems) and were handled by operators 2 to 4. For example, the past event information 11a includes the date and time of the occurrence of the past event, attributes of the event (the system from which the event occurred, the type of software from which the event occurred, the message), and the name of the person who handled the event. The system from which the event occurred and the type of software from which the event occurred are attributes related to the source. The message is an attribute related to the cause of the event, the reason for the event, and the phenomenon that occurred. Instead of a message, for example, an error code may be used.

The first coefficient 11b is information indicating the ability of each of the operations personnel 2 to 4 to handle events. The second coefficient 11c is information indicating a value according to the degree of similarity of the attributes related to the source of a new event and a past event. For example, the second coefficient 11c is set to a value corresponding to the case where the source system and software type are the same, and the case where only the system is the same.

The processing unit 12 acquires new event information 5 indicating a new event that has occurred in the computer systems 1a, 1b, and 1c. The new event information 5 includes the date and time when the event occurred, the system that caused the event, the type of software that caused the event, and a message indicating the content of the event. For each of the operations personnel 2 to 4, the processing unit 12 identifies a first past event that has a common attribute with the new event from among the past events handled by that operations personnel based on the past event information 11a. The first past event that has a common attribute is, for example, a past event with the same message and caused by the same software as the new event. The processing unit 12 can also identify a past event that has a common system with the new event as the first past event.

The processing unit 12 calculates the difference between the occurrence date and time of the first past event and the occurrence date and time of the new event. The processing unit 12 then calculates the ease with which the operations staff can handle the new event based on the calculated difference. For example, the processing unit 12 sets a lower value for the ease of handling as the difference increases.

The processing unit 12 displays the ease of handling information 6, which indicates the calculated ease of handling, on the monitors of the terminals used by the operations personnel 2 to 4. The ease of handling information 6 indicates the priority of the operations personnel 2 to 4 in handling new events. The higher the ease of handling of an operations personnel, the higher the priority of handling. By referring to the ease of handling information 6, the operations personnel 2 to 4 can easily grasp their own ease of handling new events and who is suitable to handle them.

Moreover, the ease of handling will be lower the longer it has been since a past event with attributes in common with the new event was handled. This means that the ease of handling will reflect forgetting over time of dealing with similar events.

The processing unit 12 can calculate the ease of handling based on the first coefficient 11b, which indicates the ability of the operations staff 2 to 4 to handle events. For example, the processing unit 12 determines the ease of handling as the value of the first coefficient (a real number between 0 and 1) for each of the operations staff 2 to 4, raised to the power of the difference between the occurrence dates and times as the base. The greater the value of the first coefficient, the higher the ease of handling. This allows for a degree of ease of handling that reflects the level of ability to handle events in general to be obtained for each of the operations staff 2 to 4.

The processing unit 12 can also calculate the ease of handling based on the second coefficient 11c, which has a higher value as the similarity of the attributes related to the origin of the new event and the past event increases, and the first coefficient 11b. For example, the processing unit 12 calculates a power value with the value of the first coefficient for each of the operations staff 2 to 4 as the base and the difference in the occurrence date and time as the exponent. The processing unit 12 multiplies the power value calculated for each of the operations staff 2 to 4 by the value of the second coefficient according to the similarity of the attributes of the origin of the past event and the new event handled by that operations staff, and determines the multiplication result as the ease of handling. In this way, the processing unit 12 calculates the ease of handling using the similarity of the attributes of the origin between the events, so that the ease of handling can be increased for operations staff who have experience of handling past events with a high degree of similarity of the attributes of the origin.

1, "person in charge A" has dealt with the same event as the new event shown in the new event information 5. Therefore, the ease of handling for "person in charge A" is calculated based on the past event that "person in charge A" dealt with (the first event in the past event information 11a). In other words, the ease of handling for "person in charge A" is calculated by taking the value "a1" of the first coefficient for "person in charge A" as the base and exponent "n1=T4-T1", which is the power value "a1 ⁿ¹ ".

"Person in charge B" has dealt with an event that originated from the same system as the new event shown in the new event information 5. Therefore, the ease of handling for "person in charge B" is calculated based on the past event that "person in charge B" dealt with (the second event in the past event information 11a). Note that the value of the second coefficient is "0.1" when the originating systems are the same. Therefore, the value of the first coefficient "a2" for "person in charge B" is used as the base, and the difference in occurrence date and time "n2=T4-T2" is used as the exponent. The result of multiplying this value by the value of the second coefficient " ^0.1 " is "a2 ⁿ² ×0.1", which is the ease of handling for "person in charge B".

"Person in charge C" has no experience in dealing with either the same event as the new event or an event that has the same source attribute as the new event. Therefore, the handling ease of "Person in charge C" is "0".
When a plurality of first past events are identified for a certain operations staff, the processing unit 12 calculates an evaluation value of each of the identified first past events based on the difference. The processing unit 12 then determines the sum of the evaluation values for each of the first past events as the degree of ease of handling. As a result, the more operations staff have handled the same event as the new event or the more events with the same source attribute as the new event, the higher the degree of ease of handling.

In addition, when there are multiple operators 2 to 4 as shown in FIG. 1, the processing unit 12 executes, for each operator, the process of identifying the first past event, the process of calculating the difference, and the process of calculating the ease of handling based on the first coefficient for each operator. At this time, the processing unit 12 may update the value of the first coefficient 11b for each operator based on who handled the new event. For example, the processing unit 12 updates the value of the first coefficient 11b based on whether the new event was handled by a first operator who is determined to be appropriate to handle the event based on the ease of handling, or whether the new event was handled by a second operator other than the first operator. This dynamically updates the value of the first coefficient 11b, improving the accuracy of the ease of handling.

Second Embodiment
The second embodiment is a monitoring system that supports monitoring of the operational status of a service by an operations person of a company that provides the service using a cloud computing system (hereinafter, referred to as a cloud system).

Figure 2 is a diagram showing an example of a monitoring system. Cloud system 200 is composed of multiple servers 210, 220, and 230. Each of the servers 210, 220, and 230 is connected to a network 20. To network 20, an operation management server 100 and terminals 31 to 33 are further connected. The operation management server 100 is a computer for monitoring services operated on cloud system 200. Terminals 31 to 33 are computers used by operators 41 to 43 who use the operation management server 100 to check events that have occurred and deal with those events.

Figure 3 is a diagram showing an example of hardware of an operation management server. The operation management server 100 is controlled as a whole by a processor 101. A memory 102 and multiple peripheral devices are connected to the processor 101 via a bus 109. The processor 101 may be a multiprocessor. The processor 101 is, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or a DSP (Digital Signal Processor). At least some of the functions realized by the processor 101 executing a program may be realized by an electronic circuit such as an ASIC (Application Specific Integrated Circuit) or a PLD (Programmable Logic Device).

The memory 102 is used as the main storage device of the operation management server 100. The memory 102 temporarily stores at least a portion of the OS (Operating System) programs and application programs to be executed by the processor 101. The memory 102 also stores various data used for processing by the processor 101. For example, a volatile semiconductor storage device such as a RAM (Random Access Memory) is used as the memory 102.

Peripheral devices connected to the bus 109 include a storage device 103, a GPU (Graphics Processing Unit) 104, an input interface 105, an optical drive device 106, a device connection interface 107, and a network interface 108.

The storage device 103 electrically or magnetically writes and reads data to the built-in recording medium. The storage device 103 is used as an auxiliary storage device for the operation management server 100. The storage device 103 stores the OS program, application programs, and various data. Note that, for example, a HDD (Hard Disk Drive) or an SSD (Solid State Drive) can be used as the storage device 103.

The GPU 104 is a computing device that performs image processing. The GPU 104 is an example of a graphics controller. The monitor 21 is connected to the GPU 104. The GPU 104 displays an image on the screen of the monitor 21 in accordance with an instruction from the processor 101. The monitor 21 may be a display device using an organic EL (Electro Luminescence) display device or a liquid crystal display device.

The input interface 105 is connected to a keyboard 22 and a mouse 23. The input interface 105 transmits signals sent from the keyboard 22 and the mouse 23 to the processor 101. Note that the mouse 23 is an example of a pointing device, and other pointing devices can also be used. Examples of other pointing devices include a touch panel, a tablet, a touch pad, and a trackball.

The optical drive device 106 uses laser light or the like to read data recorded on the optical disc 24 or write data to the optical disc 24. The optical disc 24 is a portable recording medium on which data is recorded so that it can be read by the reflection of light. Optical discs 24 include DVDs (Digital Versatile Discs), DVD-RAMs, CD-ROMs (Compact Disc Read Only Memory), and CD-Rs (Recordable)/RWs (ReWritable).

The device connection interface 107 is a communication interface for connecting peripheral devices to the operation management server 100. For example, a memory device 25 or a memory reader/writer 26 can be connected to the device connection interface 107. The memory device 25 is a recording medium equipped with a communication function with the device connection interface 107. The memory reader/writer 26 is a device that writes data to the memory card 27 or reads data from the memory card 27. The memory card 27 is a card-type recording medium.

The network interface 108 is connected to the network 20. The network interface 108 transmits and receives data to and from other computers or communication devices via the network 20. The network interface 108 is a wired communication interface that is connected by a cable to a wired communication device such as a switch or a router. The network interface 108 may also be a wireless communication interface that is connected by radio waves to a wireless communication device such as a base station or an access point.

The operation management server 100 can realize the processing functions of the second embodiment by using the hardware described above. Note that the information processing device 10 shown in the first embodiment can also be realized by using the same hardware as the operation management server 100 shown in FIG. 3.

The operation management server 100 realizes the processing function of the second embodiment by executing a program recorded on, for example, a computer-readable recording medium. The program describing the processing content to be executed by the operation management server 100 can be recorded on various recording media. For example, the program to be executed by the operation management server 100 can be stored in the storage device 103. The processor 101 loads at least a part of the program in the storage device 103 into the memory 102 and executes the program. The program to be executed by the operation management server 100 can also be recorded on a portable recording medium such as the optical disk 24, the memory device 25, or the memory card 27. The program stored on the portable recording medium becomes executable after being installed on the storage device 103 under the control of, for example, the processor 101. The processor 101 can also read and execute the program directly from the portable recording medium.

The above-described monitoring system allows the operations personnel 41-43 to monitor the operational status of services on the cloud system 200. In system monitoring, the operations personnel 41-43 share the work of checking the large number of events generated by the multiple servers 210, 220, and 230.

Hereinafter, with reference to FIG. 4, a description will be given of the difficulty in appropriately determining which operator should handle an event when a system is monitored by a plurality of operators 41 to 43. FIG.
Fig. 4 is a diagram showing an example of a case where it is difficult to appropriately determine an operations person to handle an event. In the example of Fig. 4, a case is assumed where an event occurs in the server 210. When an event occurs, the server 210 outputs an alert 51 indicating the occurrence of the event. The alert 51 includes, for example, the type of application (hereinafter, referred to as an app) that has generated the event, a message indicating a new event, and the like.

Some events that occur are easy to deal with, while others are difficult to deal with. Therefore, the difficulty of dealing with each event can be predefined individually. For example, for each type of event that occurs in each of multiple applications running on server 210, a difficulty level is predefined according to the event message template or specific words in the event message. In this case, operations personnel 41-43 can determine the difficulty of a new event based on the event information shown in alert 51.

In the example of Fig. 4, the difficulty level is determined to be "medium." However, the difficulty level of dealing with an event varies depending on the operations staff; for example, what may be difficult for one staff member is easy for another.
For example, assume that operations staff 41 is a veteran with long work experience, operations staff 42 is a mid-level staff with some experience, and operations staff 43 is a new staff with little experience. In this case, operations staff 41 can easily handle new events. On the other hand, operations staff 42 has experience dealing with events similar to the new event, but it has been some time since that experience. In that case, operations staff 42 may have partially forgotten the handling methods used in the past, and it may take time to handle the event. Operations staff 43 lacks experience and knowledge and is unable to handle new events.

Even if the difficulty level of an event is set to "medium," the actual difficulty level will vary depending on the operator. Furthermore, even for the same operator, the difficulty level will be higher if the event has not been handled for a long time. For this reason, the conventional method based on a fixed, predefined level of difficulty cannot be used to set the difficulty level of an event appropriately.

If the number of events that occur is small, it is possible for an experienced operator to select an operator to handle each new event. However, in a system that provides services to many users, a large number of events occur. It is difficult to manually sort through a large number of events.

When monitoring a large number of events, a monitoring system can apply predefined filtering definitions to prevent events that do not require action from being displayed. However, even if the number of events to be addressed can be narrowed down by filtering, the larger the system, the greater the number of types of events that occur. And the more types of events there are, the more difficult it becomes for each operations staff member to correctly judge the difficulty of dealing with a new event.

Figure 5 is a diagram showing an example of the source of an event in a cloud system. For example, a VM (Virtual Machine) 240a is constructed on a server 240 operated on-premise. Services are provided by applications 241 to 243 running on the VM 240a. In this case, it is possible for a single operator 40 to monitor the entire system.

In contrast, with the development of virtualization technologies such as public clouds and containers, cloud system 200 often provides services by making full use of virtualization technologies. For example, VM 201a is constructed in cloud system 200. Containers 204-206 are then constructed on VM 201a, and apps 201-203 used to realize the service are executed in containers 204-206, respectively.

In a cloud system 200 that makes full use of such virtualization technology, events can occur from a wide variety of sources. For example, events occurring during the operation of cloud services, events occurring during VM operation, events occurring during container operation, events occurring during application operation, etc. In this way, when events occur from a wide variety of sources, the methods of dealing with each event also vary, making it difficult for a single operations staff member to handle them all.

Therefore, for example, it is conceivable to assign an operator to deal with each type of event source. In the example of FIG. 5, operator 41 mainly monitors apps 201-203, operator 42 mainly monitors the execution environment (VMs, containers, etc.), and operator 43 mainly monitors services. In this way, in cloud system 200, operators 41-43 who mainly deal with each event source are assigned to each event source. In this case, it is required that the terminals 31-33 of operators 41-43 are displayed with different events as targets for action by each operator 41-43.

If the event sources for which each of the operators 41-43 is primarily responsible are fixed, the assignment destination of new events can be easily determined by presetting the correspondence between the operators 41-43 and the event sources in the operation management server 100. However, even if a new event originates from a certain event source, there are cases where it is more appropriate for an operator other than the operator who primarily handles events from that event source to handle the event. For example, even if a new event occurs in app 201, if the cause of the event exists in container 204, it is appropriate for the event to be handled by operator 42, who primarily monitors the execution environment.

As such, it is difficult to correctly determine the appropriate operations staff to handle the event based on the type of event source alone. Therefore, the operations management server 100 determines the appropriate operations staff to handle the event based on the type of event source and the message.

In addition, a wide variety of event messages are generated from each event source. Furthermore, the content of the messages may change due to version upgrades of the event source. For this reason, it is difficult to pre-assign appropriate operational personnel for all messages of events that may occur.

Here, the operation management server 100 can accumulate information on events that each of the operators 41 to 43 has dealt with in the past. In this case, it is conceivable that the operator who dealt with the new event and the past event (the same event) with the same software and message as the event source is determined to be the appropriate operator for the new event. However, unless the newly occurring event is the same event as the event that occurred in the past, it is difficult for the operation management server 100 to clearly determine which operator should be in charge based only on the type of event source and the message. Therefore, the operation management server 100 dynamically calculates the ease of handling for each of the operators 41 to 43 for the newly occurring new event. Also, even if an event occurs that is the same as an event that a certain operator dealt with in the past, if that operator has not dealt with the same event as the event for a long period of time, the difficulty of handling increases (the ease of handling decreases). Therefore, the operation management server 100 calculates the ease of handling for the new event and the same event according to the elapsed time from the date and time of handling for each of the operators 41 to 43.

For example, the operation management server 100 calculates the ease of handling for each operation staff member for new events and filters them. The operation management server 100 uses the "date and time coefficient" and the "origin coefficient" to calculate the ease of handling.

The date and time coefficient is a value set for each operations staff member, and is a numerical representation of the operations staff member's ability to handle events in general. The date and time coefficient is used to calculate a handling performance evaluation value. For example, when the date and time coefficient of a certain staff member is a and the difference in occurrence date and time between an event that the staff member has handled and a newly occurring identical event is n, the handling performance evaluation value of the staff member is a ⁿ . The handling performance evaluation value is used to increase the ease of handling depending on how much time has passed since the operations staff member handled an event identical to the occurring event in the past.

The origin coefficient is a value set for each degree of identity of the event origin. For example, an origin coefficient is set when the system and type of the event origin are the same, and an origin coefficient is set when the system and type of the event origin are the same but the type is different. The origin coefficient is used to calculate the origin evaluation value. For example, the value obtained by multiplying the response performance evaluation value "a ⁿ " of an operations staff member for a new event by the origin coefficient becomes the origin evaluation value. The origin evaluation value is used to increase the ease of handling when there is a high degree of identity between an event that an operations staff member has handled in the past and a new event.

Figure 6 is a diagram showing an example of an event monitoring function in a monitoring system. Server 210 has OS 211, applications 212 and 213, and agent 214. Agent 214 acquires an event message indicating an event that has occurred in OS 211, application 212, or application 213 from the source of the event. Agent 214 then sends an alert including the acquired event message to operation management server 100.

The server 220 has an OS 221, applications 222 and 223, and an agent 224. The agent 224 acquires an event message indicating an event that has occurred in the OS 221, application 222, or application 223 from the source of the event. The agent 224 then transmits an alert including the acquired event message to the operation management server 100.

Server 230 has OS 231, apps 232 and 233, and agent 234. Agent 234 acquires an event message indicating an event that has occurred in OS 231, app 232, or app 233 from the source of the event. Agent 234 then transmits an alert including the acquired event message to operation management server 100.

The alerts sent by agents 214, 224, and 234 include, for example, the date and time of the event occurrence, the name of the system from which the event occurred, the type of software from which the event occurred, and the event message. Agents 214, 224, and 234 may also filter messages. For example, agents 214, 224, and 234 do not send an alert even if a message that does not require action occurs, but only send an alert when a message that requires action occurs.

The operation management server 100 has a memory unit 110, an event acquisition unit 120, a handling ease calculation unit 130, an event handling management unit 140, and a coefficient management unit 150. The memory unit 110 has a date and time coefficient table 111, an origin coefficient table 112, and an event table 113. The date and time coefficient table 111 is a data table for managing date and time coefficients for each operation staff 41-43. The origin coefficient table 112 is a data table for managing origin coefficients for each level of origin identity. The event table 113 is a data table that shows the correspondence between an event that has occurred and the staff who handled that event.

The event acquisition unit 120 acquires alerts including event messages from the agents 214, 224, and 234 of the servers 210, 220, and 230, respectively. The event acquisition unit 120 sends the acquired alerts to the ease of handling calculation unit 130.

The ease of handling calculation unit 130 calculates the ease of handling for each operation staff member for the event based on the information of the event indicated in the acquired alert. The ease of handling calculation unit 130 calculates the ease of handling by, for example, referring to the date and time coefficient table 111 and the source coefficient table 112. The ease of handling calculation unit 130 sends the calculated ease of handling to the event handling management unit 140.

The event handling management unit 140 transmits data of the event details screen, including information about the new event, to the terminals 31 to 33. The event handling management unit 140 also receives a notification from the terminals 31 to 33 indicating that handling of the event has been completed, and updates the event table 113 based on the notification. The event handling management unit 140 also transmits information indicating the event for which handling has been completed to the coefficient management unit 150.

The coefficient management unit 150 updates the date and time coefficient of each operator in the date and time coefficient table 111 based on the information indicating the event for which handling has been completed.
Note that the lines connecting the functional elements shown in Fig. 6 indicate a part of the communication paths, and communication paths other than those shown in the figure can also be set. Furthermore, the functions of the functional elements shown in Fig. 6 can be realized, for example, by having the processor 101 execute a program module corresponding to the functional element.

The contents of each data table stored in the storage unit 110 will be specifically described below with reference to FIGS.
7 is a diagram showing an example of a date and time coefficient table. A record for each manager is registered in the date and time coefficient table 111. Each record includes fields for manager and value. The manager's name is set in the manager field. The value field is set to a value indicating the manager's date and time coefficient.

Figure 8 is a diagram showing an example of an origin coefficient table. In the origin coefficient table 112, records are registered for each degree of origin identity. Each record includes fields for coefficient name and value. In the coefficient name field, an identification name of the origin coefficient corresponding to the degree of origin identity is set. For example, the coefficient name "origin coefficient 1" is an origin coefficient that is applied when the system and type of the origin of the event are the same. Also, the coefficient name "origin coefficient 2" is an origin coefficient that is applied when the system of the origin of the event is the same but the type is different. In the value field, the value of the origin coefficient is set.

Figure 9 is a diagram showing an example of an event table. The event table 113 has a record registered for each event that occurs. Each record has fields for date/time, system, type, person in charge, and message. The date/time field is set to the date and time when the event occurred. The system field is set to the name of the system from which the event occurred. The type field is set to the type of software from which the event occurred. Types include "app," "container," and "host." "Host" refers to the host OS. The person in charge field is set to the name of the person in charge who handled the event. The message field is set to the message of the event.

The information in the system, type, and message fields set in the event table 113 indicates the attributes of the corresponding event. System and type are attributes related to the sender. Message is an attribute related to the reason or cause of the event.

The operation management server 100 can use this data to dynamically calculate the degree of ease with which each of the operations personnel 41-43 can deal with an event, and prompt the appropriate operations personnel to take action.

10 is a flow chart showing an example of a procedure for a monitoring process. The process shown in FIG. 10 will be described below in order of step number.
[Step S101] The event acquiring unit 120 acquires information about a new event from any of the servers. For example, when the event acquiring unit 120 acquires an alert from any of the servers, the event acquiring unit 120 extracts event information from the alert.

[Step S102] The management ease calculation unit 130 executes a management ease calculation process. The management ease calculation process will be described in detail later (see FIG. 11). As a result of the management ease calculation process, the management ease of each of the operations personnel 41 to 43 is obtained.

[Step S103] The event handling management unit 140 causes each of the terminals 31 to 33 to display an event details screen including the ease of handling for the operations personnel 41 to 43. For example, the event handling management unit 140 transmits data showing the event details screen to the terminals 31 to 33. The event details screen is then displayed on each of the terminals 31 to 33. At this time, the event handling management unit 140 registers a record corresponding to the new event in the event table 113. At the time of registration, the field for the person in charge name of the record is blank.

[Step S104] The event handling management unit 140 accepts input of the name of the person in charge of handling the event. For example, the operations personnel 41-43 decide whether or not to handle the event themselves based on the event details screen displayed on the terminals 31-33. The operations personnel who will handle the event input their own name as the person in charge of handling the event into the terminal they are using. The terminal sends the name of the person in charge of handling the event to the operation management server 100. The event handling management unit 140 sets the person in charge name field of the new event in the event table 113 with the person in charge name sent from the terminal.

[Step S105] The event handling management unit 140 accepts input of information indicating that the event has been handled. For example, when the operations staff member in charge of handling the event has completed the handling, he/she inputs information to the terminal he/she uses indicating that the event has been handled. The terminal that receives the input transmits information indicating that the event has been handled to the operations management server 100.

[Step S106] The coefficient management unit 150 executes a date and time coefficient feedback process, the details of which will be described later with reference to FIG.
In this way, the operation management server 100 can display an event details screen including the ease of handling. Furthermore, when handling is completed, the date and time coefficient is updated to the latest state by the date and time coefficient feedback process.

Next, the handling ease degree calculation process will be specifically described.
11 is a flowchart showing an example of a procedure for a measureability calculation process. The process shown in FIG. 11 will be described below in order of step numbers.

[Step S111] The management ease calculation unit 130 selects an unselected operations staff member.
[Step S112] The handling ease calculation section 130 narrows down handled events (past events) to events that the selected operations staff handled in the past.

[Step S113] The handling ease calculation section 130 executes the processes of steps S114 to S118 for each of the narrowed-down past events.
[Step S114] The ease of handling calculation unit 130 judges whether the past event being processed is the same event as the new event. An identical event is an event with the same source type and message. If it is the same event, the ease of handling calculation unit 130 advances the process to step S115. If it is not the same event, the ease of handling calculation unit 130 advances the process to step S116.

[Step S115] The management ease calculation unit 130 performs a management performance evaluation value calculation process. The management performance evaluation value calculation process will be described in detail later (see FIG. 12). After that, the management ease calculation unit 130 proceeds to step S118.

[Step S116] The manageability calculation unit 130 determines whether the system from which the new event originated is the same as the system from which the past event is being processed. If the systems are the same, the manageability calculation unit 130 proceeds to step S117. If the systems are different, the manageability calculation unit 130 proceeds to step S119.

[Step S117] The manageability calculation unit 130 performs a source evaluation value calculation process, the details of which will be described later with reference to FIG.
[Step S118] The management ease calculation unit 130 adds the evaluation value (the management performance evaluation value or the source evaluation value) to the management ease of the selected operations staff.

[Step S119] When the process of steps S114 to S118 is completed for all narrowed-down events, the handling ease calculation section 130 advances the process to step S120.
[Step S120] The management ease calculation unit 130 judges whether or not there is an unselected operator. If there is an unselected operator, the management ease calculation unit 130 proceeds to step S111. If all operators have been selected, the management ease calculation unit 130 ends the management ease calculation process.

In this way, the sum of the handling performance evaluation value or the event source evaluation value calculated for each past event handled by the operations staff is the handling easiness degree of that operations staff.
Next, the treatment performance evaluation value calculation process will be described in detail.

12 is a flowchart showing an example of a procedure for calculating a treatment result evaluation value. The process shown in FIG. 12 will be described below in order of step number.
[Step S131] The management ease calculation unit 130 calculates the difference between the occurrence date and time of a past event and a new event processed by the operation staff of the calculation target. For example, the management ease calculation unit 130 calculates the difference between the occurrence date and time of a past event and a new event in months (number of months). For example, if the occurrence date and time of the past event was one month ago, the difference is "1".

[Step S132] The manageability calculation unit 130 determines a date and time coefficient for each past event based on the difference in the occurrence dates and times. For example, the manageability calculation unit 130 acquires the date and time coefficient for the operations staff to be calculated from the date and time coefficient table 111. Then, the manageability calculation unit 130 sets the acquired date and time coefficient as a and the difference in the occurrence dates and times as n, and determines the date and time coefficient for each past event as "a ⁿ ".

[Step S133] The countermeasure ease calculation unit 130 determines the countermeasure performance evaluation value based on the past event-specific date and time coefficient. For example, the countermeasure ease calculation unit 130 sets the past event-specific date and time coefficient as the countermeasure performance evaluation value. Note that the countermeasure ease calculation unit 130 may set the countermeasure performance evaluation value to a value obtained by multiplying the past event-specific date and time coefficient by a predetermined real number.

In this manner, the treatment performance evaluation value is calculated.
Next, the source evaluation value calculation process will be described in detail.
13 is a flowchart showing an example of a procedure for calculating an origin evaluation value. The process shown in FIG. 13 will be described below in order of step number.

[Step S141] The manageability calculation unit 130 calculates the difference (n) between the occurrence dates and times of a past event and a new event processed by the operation staff to be calculated.
[Step S142] The manageability calculation section 130 determines a past event-specific date and time coefficient (a ⁿ ) based on the difference in the occurrence dates and times.

[Step S143] The manageability calculation unit 130 determines the source coefficient (b) according to the identity between the past event and the new event (same system and type, or same system but different type). For example, the manageability calculation unit 130 obtains the value of the source coefficient corresponding to the identity of the events from the source coefficient table 112.

[Step S144] The manageability calculation unit 130 determines a source evaluation value from the past event date and time coefficient and the source coefficient. For example, the manageability calculation unit 130 sets the source evaluation value (a ⁿ ×b) to “past event date and time coefficient × source coefficient.”

In this way, the source evaluation value is calculated. The past event date and time coefficient is also used in the calculation of the source evaluation value, and the larger the difference in the occurrence dates and times, the smaller the source evaluation value becomes.
11 to 13, the ease of handling for each of the operations personnel 41 to 43 for a new event is calculated. An example of calculating the ease of handling is shown below. It is assumed that the past events handled by each of the operations personnel 41 to 43 are as shown in the event table 113 shown in FIG. 9. The date and time coefficients for each of the operations personnel 41 to 43 are as set in the date and time coefficient table 111 shown in FIG. 7, and the source coefficients according to the identity of the events are as set in the source coefficient table 112 shown in FIG. 8.

<First example of calculation of ease of handling>
Assume that a new event with the message "CPU usage exceeded the threshold" occurs in "application" of "system A" at "2022/08/01 12:00".

On "2022/08/01", "Person in Charge A" deals with the same past event as the new event. The difference in the occurrence date and time between this past event and the new event is "0". Note that although various types of applications are executed on the servers 210, 220, and 230, if the contents of the event messages are the same, it is assumed that the source of those events is the same application (software).

The date and time coefficient for "Person in charge A" is "0.9". In this case, the handling performance evaluation value is "0.9 ⁰ = 1". In addition, the source evaluation value for "Person in charge A" is "0". Therefore, the handling ease of "Person in charge A" is "1 + 0 = 1".

"Person in charge B" has no experience of dealing with the same event, and the handling experience evaluation value of "Person in charge B" is "0". On the other hand, "Person in charge B" deals with a past event of "host" of "system A" on "2022/07/01". The difference in the occurrence date and time between this past event and the new event is "1", and the date and time coefficient of "Person in charge B" is "0.8". Therefore, the date and time coefficient for past events is "0.8 ¹ = 0.8". In addition, the identity of the origin of the past event and the new event handled by "Person in charge B" is only the system, and the origin coefficient is "0.1". As a result, the origin evaluation value of "Person in charge B" is "0.8 x 0.1 = 0.08". And the handling ease of "Person in charge B" is "0 + 0.08 = 0.08".

The "person in charge C" has a handling performance evaluation value and an origin evaluation value of "0", and the handling ease is also "0".
As a result of the above, the person with the highest degree of ease of handling in the first example of calculation of ease of handling is "person in charge A." In other words, it is determined that "person in charge A" should handle the problem.

<Second example of calculation of ease of handling>
Assume that a new event with the message "An unknown error has occurred" occurs on "host" of "system B" at "2022/08/15 00:00".

"Person in charge A" has no experience of dealing with the same event, and the handling experience evaluation value of "Person in charge A" is "0". On the other hand, "Person in charge A" deals with a past event of "application" of "system B" at "2022/06/01 00:00". The difference in the occurrence date and time between this past event and the new event is "2", and the date and time coefficient of "Person in charge A" is "0.9". Therefore, the date and time coefficient for each past event is "0.9 ² = 0.81". In addition, the identity of the origin of the past event and the new event handled by "Person in charge A" is only the system, and the origin coefficient is "0.1". As a result, the origin evaluation value of "Person in charge A" is "0.81 x 0.1 = 0.081". And the handling ease of "Person in charge A" is "0 + 0.081 = 0.081".

"Person in charge B" has a handling performance evaluation value and an origin evaluation value of "0", and the handling ease level is also "0".
The "person in charge C" has no experience of dealing with the same event, and the handling experience evaluation value of "person in charge C" is "0". On the other hand, the "person in charge C" has dealt with past events of the "host" or "container" of "system B" at "2022/02/01 00:00", "2022/04/01 00:00", and "2022/07/01 00:00". The difference in the occurrence date and time between the past event that occurred at "2022/02/01 00:00" and the new event is "6". The difference in the occurrence date and time between the past event that occurred at "2022/04/01 00:00" and the new event is "4". The difference in the occurrence date and time between the past event that occurred at "2022/07/01 00:00" and the new event is "1". The occurrence source coefficient applied to each past event dealt with by the "person in charge C" is all "0.1". Therefore, the source evaluation value is " ^0.96 x 0.1 + ^0.94 x 0.1 + 0.91 ^x 0.1 = 0.0531441 + 0.06561 + 0.09 = 0.2087541." And the handling ease of "person in charge C" is "0 + 0.2087541 = 0.2087541."

As a result of the above, in the second example of ease of handling calculation, the person with the highest ease of handling is "Person in Charge C," and the person with the next highest ease of handling is "Person in Charge A." In other words, it is determined that "Person in Charge C" is the best person to handle the problem, and then "Person in Charge A" is the next best person to handle the problem.

The operation management server 100 causes the terminals 31 to 33 used by the operations personnel 41 to 43 to display an event details screen including the ease of handling for each of the operations personnel 41 to 43. This allows the operations personnel 41 to 43 to easily recognize the appropriate person to handle a new event that requires handling.

Figure 14 is a diagram showing an example of an event details screen. The event details screen 60 includes a number display section 61, an importance display section 62, a status display section 63, a system display section 64, a type display section 65, a display name display section 66, a date and time display section 67, a memo display section 68, a message display section 69, and a candidate responder display section 70.

The number display section 61 displays the identification number of the new event. The importance display section 62 sets the importance of the new event. The importance is set, for example, according to the source of the event. The operation management server 100 may also set the importance by analyzing the contents of the event. The status display section 63 sets the handling status of the new event. For example, if no operations staff has confirmed the event, the handling status will be "unconfirmed". After one of the operations staff has dealt with the event, the status will be "handled". The system display section 64 displays the name of the system from which the event occurred. The type display section 65 displays the type of the event source.

The display name display section 66 displays the name of the device that notified the terminal of the event information. For example, the display name display section 66 displays the name of the operation management server 100. The date and time display section 67 displays the date and time when the event occurred. The memo display section 68 displays a memo entered by one of the operators. For example, if the operator with the highest ease of handling judges that it is more appropriate for another operator to handle the event, he or she enters a message requesting that the other operator handle the event in the memo display section 68. The entered message is displayed in the memo display section 68 of the event details screen 60 on the terminal of the other operator. The message display section 69 displays a character string indicating the event message.

The candidate responder display section 70 displays the ease of handling an event for each operations staff member. In the example of FIG. 14, the candidate responder display section 70 has columns for priority, staff member, and ease of handling. The priority column shows the order of each of the operations staff members 41 to 43 when they are arranged in descending order by ease of handling. The staff member column shows the name of each of the operations staff members 41 to 43. The ease of handling column shows the ease of handling for each of the operations staff members 41 to 43.

By referring to the event details screen 60, each of the operations personnel 41 to 43 can immediately grasp the degree of ease of handling for each person who will handle a new event. Each of the operations personnel 41 to 43 can then easily determine the appropriate person to handle the event. This reduces the frequency of communication between the operations personnel to determine who will handle the event, and shortens the time from the occurrence of an event to handling it.

For example, the operations staff with the highest priority will check the details of the event and deal with it if it is possible. After considering the matter, the operations staff with the highest priority may decide that it would be easier for another operations staff to deal with the event. In that case, for example, the operations staff with the highest priority can request that another operations staff deal with the event.

When any of the operators deals with a new event, the ability of each of the operators 41 to 43 to deal with the event changes. This change in ability is then fed back to the date and time coefficients of each of the operators 41 to 43. The date and time coefficient feedback process is described in detail below.

15 is a flowchart showing an example of a procedure for date and time coefficient feedback processing. The processing shown in FIG. 15 will be described below in order of step number.
[Step S151] The coefficient management unit 150 selects an unselected operator.

[Step S152] The coefficient management unit 150 determines whether the selected operations staff member is the operations staff member who has marked the new event as dealt with. If the selected operations staff member is the operations staff member who has marked the new event as dealt with, the coefficient management unit 150 proceeds to step S153. If the selected operations staff member is not the operations staff member who has marked the new event as dealt with, the coefficient management unit 150 proceeds to step S156.

[Step S153] The coefficient management unit 150 determines whether the selected operations staff member is the staff member with the highest ease of handling the new event. If the selected operations staff member is the staff member with the highest ease of handling, the coefficient management unit 150 proceeds to step S158. If the selected operations staff member is not the staff member with the highest ease of handling, the coefficient management unit 150 proceeds to step S154.

[Step S154] The coefficient management unit 150 determines whether the date and time coefficient of the selected manager is less than 0.9. If the date and time coefficient is less than 0.9, the coefficient management unit 150 proceeds to step S155. If the date and time coefficient is 0.9 or greater, the coefficient management unit 150 proceeds to step S158.

[Step S155] The coefficient management unit 150 increases the date and time coefficient of the selected operator. For example, the coefficient management unit 150 multiplies the current date and time coefficient by "1.1" to set the new date and time coefficient. The coefficient management unit 150 can set a maximum value for the date and time coefficient. If the result of calculating the date and time coefficient after increasing it exceeds the maximum value, the coefficient management unit 150 sets the maximum value as the new date and time coefficient. The maximum value of the date and time coefficient is, for example, "0.9". After the coefficient management unit 150 increases the date and time coefficient, the process proceeds to step S158.

[Step S156] The coefficient management unit 150 determines whether the selected operations staff member is the staff member with the highest ease of handling the new event. If the selected operations staff member is the staff member with the highest ease of handling, the coefficient management unit 150 proceeds to step S157. If the selected operations staff member is not the staff member with the highest ease of handling, the coefficient management unit 150 proceeds to step S158.

[Step S157] The coefficient management unit 150 decreases the date and time coefficient of the selected operator. For example, the coefficient management unit 150 multiplies the current date and time coefficient by "0.9" to set the new date and time coefficient.

[Step S158] The coefficient management unit 150 determines whether there are any unselected operators. If there are any unselected operators, the coefficient management unit 150 proceeds to step S151. If all operators have been selected, the coefficient management unit 150 ends the date and time coefficient feedback process.

In this way, the status of each operator in handling events is reflected in the date and time coefficient. Then, by calculating the ease of handling a new event for each operator based on the date and time coefficient for each operator, the ease of handling can be calculated accurately.

An example of calculation of the date and time coefficient by the date and time coefficient feedback process will be described below.
<First Date and Time Coefficient Calculation Example>
Assume that the person who handles the event shown in the above-mentioned "First handling ease calculation example" is "Person in charge A." The handling ease of "Person in charge A" is the highest, and the person who handles the event is also "Person in charge A." Therefore, the date and time coefficient is not changed.

<Second Date and Time Coefficient Calculation Example>
Let us assume that the person who handles the event shown in the above-mentioned "First handling ease calculation example" is "Person in charge B". In this case, "Person in charge B" is not the operations person with the highest handling ease. Therefore, the date and time coefficient of "Person in charge A" with the highest handling ease decreases to "0.9 x 0.9 = 0.81". On the other hand, the date and time coefficient of "Person in charge B" increases to "0.8 x 1.1 = 0.88".

In this way, if an operator with the highest priority (highest ease of handling) handles the issue, there is no change in the date and time coefficient for each operator. On the other hand, if an operator other than the operator with the highest priority handles the issue, the date and time coefficient for the operator who handled the issue increases, and the date and time coefficient for the operator with the highest priority decreases.

As a result, if a similar event occurs in the future, it will be easier for the operations staff who handled it to deal with it. In other words, although this event was not the highest priority, the operations staff judged it appropriate to deal with it, and the operations staff who handled it are likely to have accumulated knowledge and experience in dealing with events. The degree to which this knowledge and experience has been accumulated is reflected in the date and time coefficient for that operations staff.

On the other hand, an operator with the highest priority who does not take action may have outdated knowledge on how to deal with events and may not be up to date with the latest technology. It is also possible that the operator with the highest priority does not take action in order to allow other operators who lack experience to gain more experience. In this way, if an operator other than the operator with the highest priority takes action due to various reasons such as technological advances or management policies, such circumstances can be reflected in the priority of action by decreasing the date and time coefficient of the operator with the highest priority.

Other embodiments
In the second embodiment, the operation management server 100 is provided separately from the cloud system 200, but the functions of the operation management server 100 may be implemented within the cloud system 200. For example, one of the virtual machines within the cloud system 200 may be operated as the operation management server 100.

In the second embodiment, the ease of handling is calculated so that the easier it is to handle an event, the higher the value. However, the operation management server 100 may calculate the difficulty of handling instead of the ease of handling. The difficulty of handling is, for example, an index whose value increases the more difficult it is to handle an event. When the difficulty of handling is calculated for each operator, the operation management server 100 assigns a higher priority to operators with lower difficulty of handling.

Although the above is an example of an embodiment, the configuration of each part shown in the embodiment can be replaced with other parts having similar functions. In addition, any other components or processes may be added. Furthermore, any two or more configurations (features) of the above-mentioned embodiments may be combined.

Reference Signs List 1a, 1b, 1c Computer system 2 to 4 Operation staff 5 New event information 6 Handling ease information 10 Information processing device 11 Storage unit 11a Past event information 11b First coefficient 11c Second coefficient 12 Processing unit

Claims (10)

Acquire new event information indicating the date and time of occurrence and attributes of a new event that has occurred in the computer system;
Identifying a first past event having a common attribute with the new event among the past events based on past event information indicating an occurrence date and attribute of the past event handled by the operations staff;
calculating a difference between an occurrence date and time of the first past event and an occurrence date and time of the new event;
Calculating the ease of handling the new event by the operations staff based on the difference;
An event management program that causes a computer to execute a process. In the process of calculating the ease of handling, the greater the difference is, the lower the ease of handling is set to.
The event management program of claim 1. In the process of calculating the ease of handling, the ease of handling is calculated based on a first coefficient indicating an ability of the operations staff to handle the event.
The event management program of claim 1. In the process of calculating the degree of ease of handling, the degree of ease of handling is calculated based on a second coefficient, the second coefficient being a higher value as the similarity of attributes related to the origins of the new event and the past event becomes higher, and the first coefficient.
4. The event management program according to claim 3. When there are a plurality of operators, the process of identifying the first past event, the process of calculating the difference, and the process of calculating the ease of handling based on the first coefficient for each operator are executed for each operator;
updating a value of the first coefficient for each of the operators based on whether a first operator who is determined to be appropriate for handling the new event based on the handling ease has handled the new event or a second operator other than the first operator has handled the new event;
4. The event management program according to claim 3. In the process of identifying the first past event, the past event having the same message and generated by the same software as the new event is identified as the first past event.
The event management program of claim 1. In the process of identifying the first past event, the past event that has a common source system with the new event is identified as the first past event.
The event management program of claim 1. In the process of calculating the ease of handling, when a plurality of the first past events are identified, an evaluation value of the first past event is calculated for each of the first past events based on the difference, and the sum of the evaluation values for the first past events is set as the ease of handling.
The event management program of claim 1. Acquire new event information indicating the date and time of occurrence and attributes of a new event that has occurred in the computer system;
Identifying a first past event having a common attribute with the new event among the past events based on past event information indicating an occurrence date and attribute of the past event handled by the operations staff;
calculating a difference between an occurrence date and time of the first past event and an occurrence date and time of the new event;
Calculating the ease of handling the new event by the operations staff based on the difference;
An event management method in which processing is performed by a computer. a processing unit that acquires new event information indicating an occurrence date/time and attributes of a new event that has occurred in a computer system, identifies a first past event having attributes common to the new event among the past events based on past event information indicating the occurrence date/time and attributes of a past event handled by an operations staff, calculates a difference between the occurrence date/time of the first past event and the occurrence date/time of the new event, and calculates a degree of ease of handling of the new event by the operations staff based on the difference;
An information processing device having the above configuration.

Images