WO2009110326A1 - Error analysis device, error analysis method, and recording medium - Google Patents

Abstract

Provided is an error analysis method including steps of: successively receiving error degree information including a plurality of index values indicating an error degree of a device to be monitored together with an identifier of the error degree information; comparing the received error degree information to a predetermined judgment reference; classifying the error degree information into a corresponding type according to the comparison result; correlating each identifier of the error degree information with the corresponding type of the classified error degree information for output; receiving information indicating the true type for each of the identifiers of the error degree information; storing the identifiers of the respective error degree information while correlating them with the true types; receiving an input of a setting parameter used for updating the judgment reference; and updating the judgment reference according to the received respective error degree information, the information indicating the true types stored while being correlated with the identifiers of the respective error degree information, and the setting parameter.

Description

Fault analysis apparatus, fault analysis method, and recording medium

The present invention relates to a failure analysis device, a failure analysis method, and a recording medium, and more particularly, to a failure analysis device, a failure analysis method, and a recording medium that can detect and classify system failures without setting rules or thresholds.

FIG. 1 is a diagram showing an example of a failure analysis apparatus, which is disclosed in Japanese Patent No. 3581934.

As shown in FIG. 1, the failure analysis apparatus 100 includes an abnormal call volume monitoring unit 101 such as an operation measurement record (OM) transfer unit and a failure record transfer unit, a threshold determination unit 115, and a determination result display unit 116. Has been.

The failure analysis apparatus 100 configured as described above operates as follows.

The abnormal call volume monitoring unit 101 monitors the presence / absence of a log indicating the occurrence of an abnormality from the monitoring target devices 131 and 132, and if there is a log, the call volume that is the traffic volume per hour according to the type of abnormality. Count. The threshold determination unit 115 notifies the maintenance operator of the abnormality as a failure through the determination result display unit 116 when the call volume within a predetermined time exceeds a predetermined threshold.

With this operation, the failure analysis apparatus 100 shown in FIG. 1 can automatically detect a failure.

Fig. 2 is a diagram showing another example of a failure analysis device, and the documents "JING WU, JIAN-GUO ZHOU, PU-LIUYAN, MING WU," A STUDY ON NET WORK FAULT KNOWLEDGE ACQUISITION BASED ON SUPPORTVECTOR MACHINE ", Proceedings This is what is disclosed in of the Fourth International Conference on Machine Learning and Cybernetics, Guangzhou, 18-21 August 2005.

As shown in FIG. 2, the failure analysis apparatus 200 manages the monitoring target system 230 including the monitoring target apparatuses 231 to 234 in order to manage the abnormality level monitoring unit 201, the abnormality level storage unit 210, and the failure case registration unit. 211, a case storage unit 212, a pattern learning unit 213, a knowledge storage unit 214, a pattern determination unit 215, a determination result display unit 216, and a determination correction input unit 217.

The failure analysis apparatus 200 configured as described above collects the degree of abnormality, which is an index indicating the possibility of failure in units of devices and lines, from the monitoring results for the monitoring target devices 231 to 234.

FIG. 3 is a diagram showing the value of the degree of abnormality used in the failure analysis apparatus 200 shown in FIG.

As shown in FIG. 3, the degree of abnormality used in the failure analysis apparatus 200 shown in FIG. 2 includes values such as whether or not the link is down, an error rate, a congestion rate, a rejection rate, and a utilization rate.

The pattern determination unit 215 uses the knowledge information stored in the knowledge storage unit 214 to determine whether or not a failure has occurred in the combination of the obtained abnormalities, and the determination result display unit 216. Through this, the judgment result is presented to the maintenance operator.

Knowledge information stored in the knowledge storage unit 214 is generated by the following procedure.

First, the maintenance operator uses the failure case registration unit 211 to register past failure cases in the case storage unit 212.

The pattern learning unit 213 generates knowledge information from the combination of the failure case stored in the case storage unit 212 and the abnormality degree stored in the abnormality degree storage unit 210, and stores the knowledge information in the knowledge storage unit 214. Here, the failure case is information indicating when and where a failure has occurred. The pattern learning unit 213 generates knowledge information by pattern learning performed using a pattern classifier called Support Vector Machine (SVM).

This SVM is described in detail in “Hideki Aso, Koji Tsuda, Noboru Murata,“ Statistics of Pattern Recognition and Learning ”, Iwanami Shoten, pp.107-123, 2005. In general, in pattern learning, First, a one-dimensional class (pattern) is estimated from a multi-dimensional variable, the variable used as the multi-dimensional variable is called a feature, and a d-dimensional space with d features is called a feature space Rd. When the input variable is a feature variable x (∈Rd) in this feature space and the output variable is a class y (∈ {1, −1}), y changes when x exceeds a certain region in the feature space. The boundary of the region that causes such a change is called a hyperplane.

This hyperplane can be generated by pattern learning given output values yi for n input values xi (i = 1, 2,..., N). During pattern learning, a distance between input values having different output values y is called a margin.

The knowledge information obtained by the pattern learning means 213 is a threshold for detecting and classifying this fault, and in a feature space composed of combinations of abnormalities, it is a hyperplane for classifying a plurality of classes.

When the failure determination result shown to the maintenance operator by the determination result display unit 216 is not actually a failure, it is input to the case storage unit 212 using the determination correction input unit 217.

With such an operation, unlike the failure analysis device 100 shown in FIG. 1, the failure analysis device 200 shown in FIG. 2 can detect a failure without setting a threshold for failure detection and classification. it can.

However, since the failure analysis device described above does not reflect the failure detection sensitivity desired by the maintenance operator when generating the failure detection threshold from the case, the maintenance operator's policy mistakenly detects a normal state as a failure. Even if the policy is to reduce the number of oversights of faults, there is a problem that the generated threshold value may be a threshold value where there are many oversights of faults instead of few false detections.

The present invention has been made in view of the above-described problems, and provides a failure analysis apparatus, a failure analysis method, and a recording medium capable of performing failure detection or classification reflecting failure detection sensitivity desired by a maintenance operator. With the goal.

In order to achieve the above object, the present invention provides:
The abnormality degree information and the identification information of the abnormality degree information are sequentially received from the monitoring target apparatus that sequentially outputs the abnormality degree information including a plurality of index values indicating the abnormality degree of the monitoring target apparatus together with the identification information of the abnormality degree information. Anomaly information receiving means;
A type determination unit that compares each degree of abnormality information received by the degree of abnormality information reception unit with a predetermined determination criterion, and classifies each degree of abnormality information for each type based on a comparison result;
A determination result output means for associating and outputting identification information of each abnormality degree information and information indicating various types into which each abnormality degree information is classified;
Failure case registration means for receiving input of information indicating the true type for the identification information of each abnormality degree information,
A case storage unit that stores the identification information of each degree of abnormality information in association with the true type;
A detection sensitivity input means for receiving an input of a setting parameter for updating the determination criterion;
Based on each abnormality degree information received by the abnormality degree information receiving means, information indicating a true type stored in association with identification information of each abnormality degree information, and the setting parameter, the determination criterion And pattern learning means for updating.

A failure analysis method using an information processing apparatus,
The information processing apparatus sequentially outputs abnormality degree information including a plurality of index values indicating the degree of abnormality of the monitoring target apparatus together with identification information of the abnormality degree information from the monitoring target apparatus. Sequentially receiving identification information;
The information processing device compares the received abnormality degree information with a predetermined criterion, and classifies the abnormality degree information for each type based on a comparison result;
The information processing apparatus outputs the identification information of each degree of abnormality information and information indicating various types into which each degree of abnormality information is classified,
The information processing apparatus receiving an input of information indicating a true type for each identification information of the degree of abnormality information; and
The information processing apparatus storing the identification information of each abnormality degree information in association with the true type;
The information processing apparatus accepting an input of a setting parameter for updating the determination criterion;
The information processing apparatus determines the determination criterion based on each received abnormality level information, information indicating a true type stored in association with identification information of each abnormality level information, and the setting parameter. Updating.

Further, a recording medium on which a program for operating a computer is written,
In the computer,
The abnormality degree information and the identification information of the abnormality degree information are sequentially received from the monitoring target apparatus that sequentially outputs the abnormality degree information including a plurality of index values indicating the abnormality degree of the monitoring target apparatus together with the identification information of the abnormality degree information. Procedure and
Comparing each received degree of abnormality information with a predetermined criterion, and classifying each degree of abnormality information for each type based on the result of comparison;
A procedure for outputting the identification information of each degree of abnormality information and information indicating each type of classification of each degree of abnormality information in association with each other,
A procedure for accepting input of information indicating a true type for identification information of each degree of abnormality information;
A procedure for storing the identification information of each degree of abnormality information in association with the true type;
A procedure for receiving an input of a setting parameter for updating the determination criterion;
A procedure for updating the determination criterion based on each received abnormality degree information, information indicating a true type stored in association with identification information of each abnormality degree information, and the setting parameter is executed. The program to make it have been written.

The present invention can perform fault detection or classification reflecting the fault detection sensitivity desired by the maintenance operator.

It is a figure which shows an example of a failure analyzer. It is a figure which shows the other example of a failure analyzer. It is a figure which shows the value of the abnormality degree used with the failure analyzer shown in FIG. It is a block diagram which shows one Embodiment of the failure analysis apparatus of this invention. It is a figure which shows the table in the example storage part shown in FIG. 5 is a flowchart for explaining the operation of the failure analysis apparatus shown in FIG. 4. 5 is a flowchart for explaining the operation of the failure analysis apparatus shown in FIG. 4. 5 is a flowchart for explaining the operation of the failure analysis apparatus shown in FIG. 4. 5 is a flowchart for explaining the operation of the failure analysis apparatus shown in FIG. 4. FIG. 5 is a configuration diagram of a monitoring target for explaining an embodiment of the operation of the failure analysis apparatus shown in FIG. 4. It is a figure which shows the feature space for demonstrating one Example of operation | movement of the failure analyzer shown in FIG. It is a figure which shows the feature space for demonstrating one Example of operation | movement of the failure analyzer shown in FIG. It is a figure which shows the feature space for demonstrating one Example of operation | movement of the failure analyzer shown in FIG. It is a figure which shows the feature space for demonstrating the other Example of operation | movement of the failure analyzer shown in FIG. It is a figure which shows the feature space for demonstrating the other Example of operation | movement of the failure analyzer shown in FIG. It is a figure which shows the feature space for demonstrating the other Example of operation | movement of the failure analyzer shown in FIG.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 4 is a block diagram showing an embodiment of the failure analysis apparatus of the present invention.

In this embodiment, as shown in FIG. 4, a computer (a central processing unit, a processor, and a data processing unit is connected to a system 330 including monitoring target devices 331 to 334 and is an information processing device that operates under program control. 300).

The computer 300 includes a failure case registration unit 311, a case storage unit 312, an abnormality degree monitoring unit 301 that is an abnormality degree information receiving unit, an abnormality degree storage unit 310, a pattern learning unit 313, a knowledge storage unit 314, A pattern determination unit 315 that is a type determination unit, a determination result display unit 316 that is a determination result output unit, a determination correction input unit 317, a detection sensitivity input unit 318, and a detection sensitivity storage unit 319 are included.

The failure case registration unit 311 is connected to the case storage unit 312, the case storage unit 312 is connected to the failure case registration unit 311 and the pattern learning unit 313, and the detection sensitivity input unit 318 is connected to the detection sensitivity storage unit 319. The detection sensitivity storage unit 319 is connected to the detection sensitivity input unit 318 and the pattern learning unit 313. The pattern learning unit 313 includes the abnormality degree storage unit 310, the case storage unit 312, the detection sensitivity storage unit 319, and the knowledge storage unit. 314, the abnormality degree storage unit 310 is connected to the pattern learning unit 313 and the abnormality degree monitoring unit 301, respectively, and the knowledge storage unit 314 is connected to the pattern learning unit 313 and the pattern determination unit 315, respectively. The monitoring unit 301 is connected to the abnormality degree storage unit 310 and the pattern determination unit 315, and the pattern determination unit 315 Is connected to the knowledge storage section 314 and the abnormality monitoring unit 301 and the determination result display unit 316, respectively, the determination result display section 316 is connected to the pattern determining unit 315.

In this embodiment, the knowledge information, threshold value, boundary surface, and hyperplane indicate the same thing and correspond to the determination criteria of the present invention. The feature in this embodiment corresponds to the index value of the present invention. In this embodiment, the detection sensitivity input by the operator corresponds to the cost shown in the tables of FIGS. The detection sensitivity is a setting parameter for changing the threshold value (determination criterion), and is a cost set for each case described later. The detection sensitivity corresponds to the setting parameter of the present invention.

The components described above generally operate as follows.

The failure case registration unit 311 receives input of the failure occurrence time and location from a terminal (not shown) used by the maintenance operator who is an operator in the present invention. This pair of failure occurrence time and location is called an example. This may include the type of failure and the root cause location. The case is information in which the above-described failure occurrence time and place, or the time and place where the failure was normal, are associated with each other. Here, both the time and place stored as an example may have a spread like a period or a range. In addition, the cases include a failure case indicating a case where the failure is actually caused and a normal case indicating a case where the failure is actually normal. The failure case includes a failure occurrence time and place, and the normal case includes a normal time and place. The case may include a case type (corresponding to a class or a pattern. Also, corresponding to a true type in the present invention). The type of case is information indicating that the case is normal or information including the type of failure. In this case, the failure case includes a failure occurrence time and location, and the type of failure, and the normal case includes time and location where the case is normal and information indicating that the case is normal. Alternatively, the type of case may be configured as information independent of the case. In this embodiment, it is assumed that the types of cases are not included. Of course, the case type may be included in the case.

The failure case registration unit 311 may receive an input of the type of the case together with the case. The location may be an identifier for identifying each of the monitoring target devices 331 to 334, and may be any location that can identify the location where a failure has occurred, such as a line name or address. The failure occurrence time and location are included in the identification information of the abnormality level information of the present invention. In the present embodiment, the identification information of the abnormality degree information corresponds to a case. In addition, the identification information of abnormality degree information should just contain the information which can identify abnormality degree information, and should just contain the identifier etc. which are attached | subjected uniquely.

The case storage unit 312 receives a case from the failure case registration unit 311 or the determination correction input unit 317 described later, and stores the received case.

FIG. 5 is a diagram showing a table in the case storage unit 312 shown in FIG.

As shown in FIG. 5, the case storage unit 312 stores a case number, a time, a place, and a pattern in association with each other. The case number, time, and place are identification information of the degree of abnormality information, and the pattern is the type of case. Note that the case number, time, and location are not indispensable, and at least one piece of information that can identify the abnormality degree information is sufficient.

The abnormality level monitoring unit 301 acquires abnormality level information including the abnormality level from the monitoring target devices 331 to 334 in the monitoring target system 330. The abnormality degree monitoring unit 301 stores the obtained abnormality degree information in the abnormality degree storage unit 310. In addition, the abnormality degree monitoring unit 301 passes information indicating the time included in the abnormality degree information or information indicating the time when the abnormality degree monitoring unit 301 receives the abnormality degree information to the pattern determination unit 315.

The abnormality degree storage unit 310 stores the abnormality degree, time, place, and value included in the abnormality degree information received by the abnormality degree monitoring unit 301 in the past in association with each other. Further, for example, the degree of abnormality information that can be identified by time and place may be stored so as to be returned.

The pattern learning unit 313 corresponds to each case stored in the case storage unit 312 when the maintenance operator inputs the failure case registration unit 300 or the determination correction input unit 317 or periodically. The attached abnormality degree information is read from the abnormality degree storage unit 310. A feature space used by the pattern learning unit 313 is configured by each abnormality degree (feature) included in each read abnormality degree information. Also, the pattern learning unit 313 reads the detection sensitivity for each label (corresponding to the type of the present invention) such as the type of failure case and normality from the detection sensitivity storage unit 319 described later. Further, the pattern learning unit 313 generates a threshold (hyperplane) for detecting and classifying a fault based on the abnormality degree information read from the abnormality degree storage unit 310 and the detection sensitivity read from the detection sensitivity storage unit 319, Store in the knowledge storage unit 314.

Here, the document “Chih-ChungChang and Chih-Jen Lin, LIBSVM: a library for support vector machines, 2001.Software available at http://www.csie.ntu.edu.tw/~cjlin/libsvm” In the meantime, a specific example of pattern learning is shown, and a state of reflecting the failure detection sensitivity is illustrated.

The derivation of the hyperplane is realized by performing the optimization of Equation 1 under the constraint described in Equation 2 in the feature space Rd. Here, ξi, which is described as a slack variable in the literature “Hideki Aso, Koji Tsuda, Noboru Murata,“ Statistics of Pattern Recognition and Learning ”, Iwanami Shoten, pp.107-123, 2005, is the case i is a hyperplane. The hyperplane learned by ξi being weighted by the cost Cyi determined corresponding to the label yi of the case i reflects the ratio of the cost Cy between the labels. This cost Cyi is the detection sensitivity.

This example shows only two-class classification, but it can be realized in the same way even in multi-class classification such as multiple failure patterns.

　なお、上述した文献“Chih-ChungChang　and　Chih-Jen　Lin,　LIBSVM　:　a　library　for　support　vector　machines,　2001.Software　available　at　http://www.csie.ntu.edu.tw/~cjlin/libsvm”で提供されるＳＶＭでは、このＣｙｉを重みとして設定可能であるが、この文献に記載のような、従来のパターン学習を用いた障害検出システムでは、障害検出感度を可変とするためにこのＣｙｉを利用することには言及していない。

Provided in the above-mentioned document “Chih-ChungChang and Chih-Jen Lin, LIBSVM: a library for support vector machines, 2001.Software available at http://www.csie.ntu.edu.tw/~cjlin/libsvm” In this SVM, this Cyi can be set as a weight. However, in a fault detection system using conventional pattern learning as described in this document, this Cyi is used to make the fault detection sensitivity variable. It does not mention that.

The knowledge storage unit 314 stores the threshold value generated by the pattern learning unit 313.

The pattern determination unit 315 receives the abnormality level information from the abnormality level acquisition unit 301. Then, the pattern determination unit 315 reads out the threshold value stored in the knowledge storage unit 314 and indicates whether the abnormality level information received from the abnormality level acquisition unit 301 indicates a failure or a normal state. Determine. Further, when it is determined that there is a failure, it is determined what type of failure it is, and the identification information of the abnormality level information and the determination result are passed to the determination result display unit 316.

The determination result display unit 316 displays the determination result received from the pattern determination unit 315 (corresponding to the pattern, the type of case, and the type of the present invention) and the identification information (case) of the abnormality level information to the maintenance operator. To do.

When the determination result (corresponding to the pattern, type of case, and type of the present invention) presented by the determination result display unit 316 to the maintenance operator is incorrect, the determination correction input unit 317 The type of case considered to be correct (corresponding to the true type of the present invention) and the case are registered in the case storage unit 312. For example, in addition to time and place (case), the type of the case (true type) is added to the case storage unit 312 or the case stored in the case storage unit 312 is considered correct by the maintenance operator. You may modify the case.

The detection sensitivity input unit 318 receives detection sensitivity input from a terminal (not shown) used by the maintenance operator. An input may be received by associating this detection sensitivity with a true type.

The detection sensitivity storage unit 319 receives the detection sensitivity from the detection sensitivity input unit 318 and stores it. The detection sensitivity storage unit 319 may receive the true type together with the detection sensitivity, and store the received detection sensitivity and the true type in association with each other.

Next, the overall operation of this embodiment will be described in detail with reference to the flowcharts of FIGS.

6 to 9 are flowcharts for explaining the operation of the failure analysis apparatus 300 shown in FIG.

First, the abnormality level monitoring unit 301 acquires abnormality level information including the abnormality level from the monitoring target system 330 (step 401), and passes the acquired abnormality level information to the pattern determination unit 315.

The pattern determination unit 315 determines the type of case in the monitored system 330 from the abnormality level information received from the abnormality level monitoring unit 301 using the threshold value (hyperplane) included in the knowledge storage unit 314, and the determination result (example) And the identification information (example) of the abnormality level information are passed to the determination result display unit 316 (step 402).

Next, when the pattern determination unit 315 determines that there is a failure in step 402, the determination result display unit 316 displays the pattern (type) and abnormality level identification information received from the pattern determination unit 315. (Step 403).

Next, the maintenance operator inputs the failure occurrence time or normal time, location, and case type as the case and the true type to the failure case registration unit 311 or the determination correction unit 317. The failure case registration unit 311 or the determination correction unit 317 stores the input case in the case storage unit 312 (step 601). The maintenance operator sets detection sensitivity for each type in the detection sensitivity storage unit 319 (step 500), and inputs the set detection sensitivity for each type via the detection sensitivity input unit 318 (step 501). Here, a high detection sensitivity for normality has the same meaning as that it is difficult to detect all faults, and therefore the input information is the detection sensitivity for each type and the common detection sensitivity for each type. May be.

Next, the pattern learning unit 313 generates a threshold for performing failure determination by pattern learning (step 602). This step may be executed separately by an instruction from the maintenance operator.

In order to generate a threshold value for determining a failure from a case, the pattern learning unit 413 associates all cases included in the case storage unit 312 with the time or place included in the case from the situation storage unit 310. System information is acquired (steps 701 and 702).

The pattern learning unit 313 uses the feature vector composed of the degree of abnormality and the situation information included in each system information associated with each case obtained from the case storage unit 312 for each system information. The hyperplane for classifying the information into the pattern of the kind of information is learned (step 703), and the hyperplane is generated. At this time, the pattern learning unit 313 reads out each detection sensitivity stored in the detection sensitivity storage unit 319 and uses each detection sensitivity as a weight of the cost given to each case exceeding the hyperplane, Learn.

The pattern learning unit 313 stores the learned hyperplane in the knowledge storage unit 314, and the pattern determination unit 315 uses the hyperplane stored in the knowledge storage unit 314 to receive each abnormality received from the abnormality level monitoring unit 301. Patterns are classified for the degree of abnormality information (step 704).

Next, the effect of this embodiment will be described.

In this form, the maintenance operator thinks about the type of each fault and the overall detection sensitivity information, because each fault or normal labeled case in the feature space is given as a cost that exceeds the hyperplane. The threshold value represented by the hyperplane reflects the failure detection policy considered by the maintenance operator. Thereby, fault detection / classification with many false detections but few oversights can be performed, and conversely fault detection / classification with few false detections and many oversights can be performed.

Further, according to the present embodiment, when a hyperplane separating a plurality of types and places of obstacles is generated in the feature space, the detection sensitivity value is set based on the severity of each trouble inputted by the maintenance operator. By increasing the value and increasing the value, the cost exceeding the hyperplane for cases of other types of faults and normal cases is increased, so that more fault cases are included in the region where the generated hyperplane is determined to be a fault. become. In addition, it is easy to determine a failure by applying this hyperplane threshold to system monitoring data and using it for failure detection. Conversely, by reducing the cost as the inputted failure detection sensitivity value is reduced, it is difficult to determine a failure.

Hereinafter, the operation of the above-described failure analysis apparatus 300 will be described using a specific example.

FIG. 10 is a configuration diagram of a monitoring target for explaining an embodiment of the operation of the failure analysis apparatus 300 shown in FIG. 11 to 13 are diagrams showing a feature space for explaining an embodiment of the operation of the failure analysis apparatus 300 shown in FIG.

As shown in FIG. 10, in this embodiment, the monitoring target system 330 includes monitoring target devices 901 and 902, and communication is performed between them, and the management system 300 of the present invention The device 901 acquires the call loss rate 904 of communication with the monitoring target device 902 and the CPU usage rate 905 of the monitoring target device 902 from the monitoring target device 902 as the degree of abnormality. Shall be specified.

At this time, the maintenance operator registers the detection sensitivity from the detection sensitivity input unit 318, and a hyperplane in the feature space representing the detection threshold is generated from this information.

When the maintenance operator sets normality and failure as the same detection sensitivity value as indicated by a setting value 1010 in FIG. 11, the generated hyperplane 1003 has a failure case that exists on the normal region 1005 side. The ratio of exceeding the hyperplane 1003 and the ratio of normal cases existing on the obstacle region side exceeding the hyperplane 1003 are approximately the same.

If a fault is detected with the threshold value represented by the hyperplane 1003, some of the monitoring results near the hyperplane 1003 are determined to be normal, and some are determined to be abnormal.

Next, if the maintenance operator frequently detects faults that can be regarded as normal, such as the vicinity of the hyperplane 1003, it will be troublesome because it takes time to check the fault occurrence and so on. Assume that the sensitivity is lowered and it is determined that the detection is performed only when it is really serious, and the normal detection sensitivity is set high as indicated by a setting value 1110 in FIG.

At this time, the detection threshold value represented by the generated hyperplane 1103 can determine that all the data having characteristics near the hyperplane 1003 in FIG.

On the contrary, suppose that the maintenance operator wants to detect when a failure is suspected as much as possible, raises the detection sensitivity, and sets the failure detection sensitivity to a high value as shown by a setting value 1210 in FIG.

The detection threshold value represented by the hyperplane 1203 generated at this time is such that all data having features near the hyperplane 1203 in FIG. it can.

Next, another embodiment of the operation of the failure analysis apparatus 300 shown in FIG. 4 will be described.

FIGS. 14 to 16 are diagrams showing a feature space for explaining another embodiment of the operation of the failure analysis apparatus 300 shown in FIG.

In this embodiment, it is assumed that a system similar to that shown in FIG. 10 is monitored. Here, it is assumed that there are two types of failures that cause an increase in the CPU usage rate and the call loss rate.

If the maintenance operator sets a detection sensitivity such as the setting value 1310 in FIG. 14, the region determined as failure 1 is a region surrounded by the hyperplane 1303, and the region determined as failure 2 is the hyperplane. An area surrounded by 1304 is obtained.

Next, if the maintenance operator determines that failure 1 is a serious failure and sets this detection sensitivity as high as the set value 1410 in FIG. 15, the generated hyperplane 1403 is shown in FIG. The monitoring result near the boundary of the hyperplane 1303 is also determined as the failure 1, and the rate of overlooking this failure is reduced.

At this time, the detection sensitivity of other obstacles hardly changes.

Conversely, if the maintenance operator determines that failure 2 is an important failure and sets this detection sensitivity as high as the setting value 1510 in FIG. 16, the generated hyperplane 1504 is as shown in FIG. The monitoring result in the vicinity of the boundary of the hyperplane 1304 is also determined as the failure 2, and the rate of overlooking this failure is reduced.

Again, the detection sensitivity of other obstacles hardly changes.

According to the present invention, the present invention can be applied to applications such as monitoring a system including a computer, a network device, and a communication device, and detecting and classifying a failure.

In the present invention, the processing in the failure analyzer is recorded on a recording medium readable by the failure analyzer, in addition to the above-described dedicated hardware. The program recorded on the recording medium may be read by the failure analysis apparatus and executed. Recording media that can be read by the failure analysis device include IC cards, memory cards, transferable storage media such as floppy disks (registered trademark), magneto-optical disks, DVDs, and CDs, as well as built-in failure analysis devices. Refers to the HDD or the like. The program recorded on this recording medium is read by a control block, for example, and the same processing as described above is performed under the control of the control block.

Although the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

This application claims priority based on Japanese Patent Application No. 2008-058440 filed on Mar. 7, 2008, the entire disclosure of which is incorporated herein.

Claims (6)

The abnormality degree information and the identification information of the abnormality degree information are sequentially received from the monitoring target apparatus that sequentially outputs the abnormality degree information including a plurality of index values indicating the abnormality degree of the monitoring target apparatus together with the identification information of the abnormality degree information. Anomaly information receiving means;
A type determination unit that compares each degree of abnormality information received by the degree of abnormality information reception unit with a predetermined determination criterion, and classifies each degree of abnormality information for each type based on a comparison result;
A determination result output means for associating and outputting identification information of each abnormality degree information and information indicating various types into which each abnormality degree information is classified;
Failure case registration means for receiving input of information indicating the true type for the identification information of each abnormality degree information,
A case storage unit that stores the identification information of each degree of abnormality information in association with the true type;
A detection sensitivity input means for receiving an input of a setting parameter for updating the determination criterion;
Based on each abnormality degree information received by the abnormality degree information receiving means, information indicating a true type stored in association with identification information of each abnormality degree information, and the setting parameter, the determination criterion Failure analysis apparatus having pattern learning means for updating. The failure analysis apparatus according to claim 1,
The information indicating the true type is a failure analysis device which is information indicating whether the monitoring target device is normal or abnormal. The failure analysis apparatus according to claim 1,
The failure case registration unit is a failure analysis device that receives information indicating the true type from a terminal operated by an operator. The failure analysis apparatus according to claim 1,
The detection sensitivity input means is a failure analysis device that receives the detection sensitivity from a terminal operated by an operator. A failure analysis method using an information processing device,
The information processing apparatus sequentially outputs abnormality degree information including a plurality of index values indicating the degree of abnormality of the monitoring target apparatus together with identification information of the abnormality degree information from the monitoring target apparatus. Sequentially receiving identification information;
The information processing device compares the received abnormality degree information with a predetermined criterion, and classifies the abnormality degree information for each type based on a comparison result;
The information processing apparatus outputs the identification information of each degree of abnormality information and information indicating various types into which each degree of abnormality information is classified,
The information processing apparatus receiving an input of information indicating a true type for each identification information of the degree of abnormality information; and
The information processing apparatus storing the identification information of each abnormality degree information in association with the true type;
The information processing apparatus accepting an input of a setting parameter for updating the determination criterion;
The information processing apparatus determines the determination criterion based on each received abnormality level information, information indicating a true type stored in association with identification information of each abnormality level information, and the setting parameter. A failure analysis method comprising the steps of: A recording medium on which a program for operating a computer is written,
In the computer,
The abnormality degree information and the identification information of the abnormality degree information are sequentially received from the monitoring target apparatus that sequentially outputs the abnormality degree information including a plurality of index values indicating the abnormality degree of the monitoring target apparatus together with the identification information of the abnormality degree information. Procedure and
Comparing each received degree of abnormality information with a predetermined criterion, and classifying each degree of abnormality information for each type based on the result of comparison;
A procedure for outputting the identification information of each degree of abnormality information and information indicating each type of classification of each degree of abnormality information in association with each other,
A procedure for accepting input of information indicating a true type for identification information of each degree of abnormality information;
A procedure for storing the identification information of each degree of abnormality information in association with the true type;
A procedure for receiving an input of a setting parameter for updating the determination criterion;
A procedure for updating the determination criterion based on each received abnormality degree information, information indicating a true type stored in association with identification information of each abnormality degree information, and the setting parameter is executed. A recording medium on which a program is written.

Images