JP4506520B2 - Management server, message extraction method, and program - Google Patents

Description

  The present invention relates to an operation management server of a computer system, a computer system including the server, a message extraction method for operation management, and a program to be executed by the operation management server. In particular, the computer system is integrated and efficient. Related to providing an integrated operation management environment to be managed.

  Computer systems in recent enterprises are composed of a plurality of hardware and software in a complicated manner and operate in a complex manner. On the other hand, since the importance of computer systems is increasing due to corporate activities, it is required to have higher reliability than before and to recover quickly when a failure occurs. Therefore, it is necessary to manage the computer system in an integrated and efficient manner, and generally software that performs integrated operation management is used.

  For example, Patent Literature 1 describes a system resource monitoring unit that creates a notification message when the remaining amount of storage capacity of a database falls below a reference amount, and a system error that monitors a log and creates a notification message when an abnormality is detected An information management server is disclosed that includes a monitoring unit and an unauthorized intrusion monitoring unit that compares a running process group with a normal process group and creates a notification message when an abnormality is detected. These notification messages are automatically transmitted to the system management server by the e-mail function, so that the malfunction of the information management server can be grasped.

  In addition, the notification message generated by the information management server referred to in Patent Document 1 is filtered and classified according to business and purpose, so that the notification message can be monitored efficiently and quickly when a failure occurs. A technology that enables a smooth response is known.

Japanese Patent Laid-Open No. 11-45195

  However, when the classification and importance determination of messages generated by individual components in the computer system to be monitored are performed using the above-described filter, it is necessary to consider the message processing capability on the management server side. In general, the larger the size of a computer system, the greater the number of filters. In addition, since the message format differs for each component of the computer system, in most cases, it is necessary to prepare individual filters for each message. When designing and building a computer system, and taking into account changes in the message content and increased message volume due to system expansion and hardware / software version upgrades after the start of operation, messages can be processed in large quantities without delay. The proposal of a method is desired.

  Furthermore, when the above-described filter is used, there is a problem in that the message processing performance is affected by what number of filters matches a frequently occurring message. For example, when a filter corresponding to a message with a high occurrence frequency is set at the end in the order of use, collation processing with the previous filter is useless, and the efficiency is remarkably deteriorated. In particular, when the number of filters is large, it is extremely difficult to set the use order of the filters.

  In order to process a large number of messages at high speed, a measure to improve the performance of a machine that processes messages by increasing the number of CPUs can be considered. However, the amount of messages generated varies greatly depending on the state of the computer system, and is easy. An increase can be an over-investment.

  The present invention has been made in view of the above-described circumstances, and the object of the present invention is to increase machine hardware in a large-scale computer system or a computer system with a large amount and type of messages. An operation management server that can optimize message processing using the above-described filter without relying on, a computer system including the server, a message extraction method for operation management, and the operation management server To provide a program.

According to the first aspect of the present invention, a filter that is connected to a computer system to be monitored and a terminal device, and includes a plurality of filters that define filter conditions for extracting messages to be output to the terminal device. A management server that uses a group in a predetermined order of use, and outputs a message extracted by any one of the filters output from each component of the computer system to the terminal device; It may be held for each filter each the number of received messages that conform to filter the number of received messages held in each of the filter is greater than a predetermined value, the number of the received message compared to the filter small again filter more, the tube, characterized in that, rearranging the order of use of the filter so that the order of use is above Server, and, said management server, a computer system including a terminal device are provided.

  Further, according to the second aspect of the present invention, the order of use of the filters is rearranged so that the filters corresponding to the frequently occurring messages are used in the higher order, and the messages are displayed according to the order of use of the rearranged filters. A message extraction method for performing extraction is provided.

  Further, according to the third aspect of the present invention that each processing unit provided in the management server described above can be realized by a computer program, a computer program to be executed by a computer constituting the management server described above is provided.

  According to the present invention, a management server that requires a large number of filters can process a message with as little calculation as possible. The reason is that a configuration in which the filter usage order is dynamically rearranged so that the filter with high power is used in the higher order is used.

  Next, the best mode for carrying out the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing a configuration of a computer system according to the first embodiment of the present invention configured from a plurality of hardware and software. Referring to FIG. 1, the computer system includes an integrated operation management server 1, an integrated operation terminal 2, message monitoring means 3, and components 31 to 36 of the computer system 4 to be monitored. In the lower part of FIG. 1, a plurality of components of a computer system to be monitored, hardware such as a server 31, a network 32, and a storage (storage device) 33, software such as an operation system 34, middleware 35, and an application 36 are displayed. Is shown with a figure.

  The integrated operation management server 1 is a management server configured as a dedicated machine that centrally manages messages in the computer system. The integrated operation management server 1 includes a message reception unit 11, a message search unit 12, a message notification unit 13, a schedule unit 14, a filter counter table 15, a filter condition table 16, a filter setting reception unit 17, and a filter order rearrangement unit 18. ing.

  The message accepting unit 11 performs processing for accepting a message generated in each of the components 31 to 36 from the message monitoring unit 3. The message search unit 12 is defined as a filter condition in the message using the filter condition table 16 that defines the filter condition in order to determine whether or not the received message is a message to be notified to the integrated operation terminal 2. A process of searching for a predetermined character string is performed. The message notification unit 13 performs a process of notifying the integrated operation terminal 2 of the message output from the message search unit 12.

  The filter condition table 16 is a table that stores the type, classification, and filter condition of each filter set from the integrated operation terminal 2. FIG. 2 is a diagram illustrating an example of the filter condition table 16. Referring to FIG. 2, in this computer system, two types of filters, an exclusion filter and a normal filter (extraction filter), can be set. In this embodiment, since the message search unit 12 sequentially reads out the filter conditions from the filter condition table 16, the storage order in the filter condition table 16 is the filter use order as it is.

  Here, the exclusion filter and the normal filter (extraction filter) will be described. The exclusion filter is a filter for excluding from the output target to the integrated operation terminal 2 when the received message includes a character string defined in the filter condition. On the other hand, the normal filter is a filter for extracting the received message as an output target to the integrated operation terminal 2 when a character string defined in the filter condition is included in the received message. In the example of FIG. 2, classification information is attached to the normal filter (extraction filter) so that the influence range of the message can be easily identified.

  The filter condition table 16 in FIG. 2 has a configuration in which a normal filter (extraction filter) is stored after the exclusion filter. This is because in the present embodiment, a message regarding the occurrence of a failure is emphasized. In the example of FIG. 2, filter conditions are defined such that an unimportant message such as a system disclosure message or a normal termination notification message is hit as an exclusion filter, and a normal filter (extraction filter) is notified of the occurrence of a system abnormality or failure. A filter condition is defined so that the message is hit. By placing an exclusion filter at the top in this way, messages that are not important (do not match any of the normal filters (extraction filters)) and that occur frequently are excluded first (useless with less computation) Can be excluded.)

  The filter counter table 15 is a table that stores the number of received messages that conform to each past filter condition for all the filters defined in the filter condition table 16. FIG. 3 is a diagram illustrating an example of the filter counter table 15. Referring to FIG. 3, for each filter defined in the filter condition table 16, the number of messages retrieved as matching the filter condition can be held.

  The schedule unit 14 manages a schedule (time) for rearranging the filter use order in the message search unit 12, that is, sorting the filter condition table 16.

  The filter setting reception unit 17 communicates with the filter setting unit 21 of the integrated operation terminal 2 to perform processing for receiving the filter setting and updating the filter condition table 16.

Filter order recombinant 18, recombination processes use order of the filter in the message searching unit 12, i.e., to control the sorting of the filter condition table 16.

  The integrated operation terminal 2 is a management terminal device for a system administrator of the computer system to monitor messages. The integrated operation terminal 2 includes a filter setting unit 21 that accesses the integrated operation management server 1 to request a new definition / change / deletion of a filter, and a message display unit 22 that displays a message received from the integrated operation management server 1. ing.

  The message monitoring unit 3 monitors hardware such as a server 31, a network 32, and a storage (storage device) 33, and software such as an operation system 34, middleware 35, and an application 36, and reduces system resources, system failures, network failures, A message about other abnormality is transmitted to the integrated operation management server 1 in a predetermined format. The message monitoring means 3 can be configured by a monitoring program or the like that is resident in the memory of the computer system 4.

  Next, the operation of this embodiment will be described in detail with reference to the drawings. First, a process for discriminating messages issued from each component of the computer system 4 and displaying important ones (related to system abnormalities and failures) on the integrated operation terminal 2 will be described.

  FIG. 4 is a flowchart showing the flow of message search processing from when the integrated operation management server 1 receives a message until it transmits the message to the integrated operation terminal 2. Referring to FIG. 4, first, the message monitoring unit 3 monitors messages generated by the respective components 31 to 36 of the computer system 4 and transmits them to the message receiving unit 11 of the integrated operation management server 1 (step A1). ).

  When the message reception unit 11 that has received a message from the message monitoring unit 3 passes the received message to the message search unit 12, the message search unit 12 sequentially reads and receives the filter conditions set in the filter condition table 16 from the top. It is searched whether the character string prescribed | regulated to the read filter conditions is contained in the message (step A2, A3).

  As described above, since the normal condition filter (extraction filter) is stored after the exclusion filter in the filter condition table 16 in FIG. 2, the message search unit 12 performs a search using the exclusion filter first, Next, a search using a normal filter is performed.

  As a result of the search in step A3, if the received message does not match all the filter conditions set in the filter condition table 16, the message search unit 12 ends the process and waits for the next message to be generated (in step A4). No).

  On the other hand, if the received message matches any of the filter conditions set in the filter condition table 16, the message search unit 12 increments the count of the filter in the filter counter table 15 (step A5).

  Furthermore, when the filter condition that matches the received message is that of the normal filter (extraction filter) (No in step A6), the message search unit 12 adds the classification information defined in the filter condition table 16 to the message. Attached and transmitted to the message notification unit 13 to display the message and classification on the message display unit 22 of the integrated operation terminal 2 (steps A7 and A8).

  In step A6, if the filter condition that matches the received message is that of the exclusion filter, the message search unit 12 ends the process and waits for the next message to be generated (Yes in step A6).

  Subsequently, a filter rearrangement process in the integrated operation management server 1 will be described. FIG. 5 is a flowchart showing the flow of the rearrangement (sort) processing of the filter use order (filter condition table 16) periodically performed in the integrated operation management server 1. Referring to FIG. 5, first, the schedule unit 14 indicates that the message search unit 12 starts reordering processing of the filter use order based on a preset schedule such as the elapse of a predetermined time or the elapse of a predetermined number of days. Notification is made (step B1).

  The message search unit 12 that has received the notification temporarily interrupts the message search and instructs the filter order rearrangement unit 18 to perform the rearrangement (step B2). The filter order rearrangement unit 18 that has received the instruction changes the storage order of the filter conditions in the filter condition table 16 based on the number of counters of each filter stored in the filter counter table 15 and the normal filter (extraction filter). Are rearranged separately in descending order of the number of counters (step B3).

  For example, in the example of the filter counter table in FIG. 3, the value of the exclusion filter 1 (including the filter condition: to start) is 4, and the value of the exclusion filter 2 (including the filter condition: to normal end) is 2. It is. Therefore, the order of exclusion filters in the filter condition table 16 is not changed.

  On the other hand, in the normal filter of FIG. 3, the value of the normal filter 1 (including filter condition: ~ abnormal termination occurrence) is 10, and the value of the normal filter 2 (including filter condition: ~ disk failure occurrence) is 15, normal. The value of filter 3 (including filter condition: ~ OS failure occurred) is 5, the value of normal filter 4 (including filter condition: ~ exceeding threshold) is 20, and normal filter 5 (filter condition: ~ network failure) The value of (including occurrence) is 0. Therefore, the order of the normal filters (extraction filters) in the filter condition table 16 is sorted in descending order based on the respective values, so that the normal filter 4, the normal filter 2, the normal filter 1, the normal filter 3, and the normal filter 5 are sorted. Sorted in order.

  When the rearrangement process is completed as described above, the message search unit 12 resets the counter of each filter stored in the filter counter table 15 to 0 and restarts the message search (steps B4 and B5).

  The storage order of the filter conditions rearranged in step B3 is in accordance with the frequency of message generation within a predetermined time, and is set at the top of the filter condition table in the restarted message search process. Since the filter has a high possibility of matching a frequently occurring message, the search efficiency is remarkably improved.

  Note that the schedule unit 14 starts the filter reordering process based on a preset schedule such as the elapse of a predetermined time or the elapse of a predetermined number of days, but additionally registers the filter conditions in the filter condition table 16. It is also possible that the rearrangement process of the filter condition table 16 is started by another trigger, such as when a predetermined number has been made.

  Next, the filter update process will be described. FIG. 6 is a flowchart showing the flow of processing when the filter condition table 16 is updated from the integrated operation terminal 2. Referring to FIG. 6, first, the system administrator registers contents to be set as a normal filter (extraction filter) and an exclusion filter from the filter setting unit 21 of the integrated operation terminal 2 (steps C1 and C2). The setting contents after completion of registration are sent to the filter setting reception unit 17 of the integrated operation management server 1 and reflected in the filter condition table 16 (step C3).

  The embodiment of the present invention has been described above. As is apparent from the principle of the present invention, the technical scope of the present invention is not limited to the above-described embodiment, and corresponds to a message having a high occurrence frequency. As long as the filters are used in a higher order, the order of use of the filters is changed, and a plurality of filters are sequentially used to determine the importance of the message. Needless to say, it is possible to make modifications and substitutions. For example, in the above-described embodiment, the filter condition table and the filter counter table are used. However, a message counter field may be provided in the filter condition table, and sorting may be performed based on the value of the field.

  In the above-described embodiment, the entire filter condition table is used as a sorting target. From the viewpoint of speeding up the reordering process, only filters whose filter counter value exceeds a predetermined threshold are sorted as reordering targets. Alternatively, it is possible to replace the filter counter whose value is relatively higher with a process such as replacing other filter conditions on the upper side of the table.

  Further, depending on the computer system, the above-described exclusion filter may be omitted, and the filter condition description method may be enhanced as appropriate. In addition, other items useful for the system administrator may be added to the filter condition table and displayed on the integrated management terminal.

It is a block diagram showing the composition of the computer system concerning a 1st embodiment of the present invention. It is a figure showing an example of the filter condition table. It is a figure showing an example of the filter counter table. It is a flowchart showing the flow of the message search process of the 1st Embodiment of this invention. It is a flowchart showing the flow of the sort process of the filter condition table of the 1st Embodiment of this invention. It is a flowchart showing the flow of the update process of the filter condition table of the 1st Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Integrated operation management server 2 Integrated operation terminal 3 Message monitoring means 4 Computer system 11 Message reception part 12 Message search part 13 Message notification part 14 Schedule part 15 Filter counter table 16 Filter condition table 17 Filter setting reception part 18 Filter order rearrangement part 21 Filter setting part 22 Message display part
31 server 32 network 33 storage (storage device)
34 Operation System 35 Middleware 36 Application (Application Program)

Claims (22)

A filter group that is connected to a computer system to be monitored and a terminal device and includes a filter that defines a filter condition for extracting a message to be output to the terminal device is used in a predetermined order of use. A management server that outputs to the terminal device a message extracted by any one of the messages output from a component;
Means for holding the number of received messages that conform to the filter condition for each filter, respectively, filter the number of received messages held in each of the filter is greater than a predetermined value, the number of the received message compared to the filter Less than Sai filters, the order of use has means for rearranging the order of use of the filter so as to be ahead, and
Management server characterized by A management server that is connected to a computer system to be monitored and a terminal device, and outputs messages of a predetermined classification among messages output from each component of the computer system to the terminal device,
A message receiving unit that receives a message output from each component of the computer system;
A message search comprising a filter group that determines a message classification according to whether or not the message meets a predetermined filter condition, and using the filters included in the filter group in a predetermined usage order to determine the message classification And
A message notification unit for transmitting messages of a predetermined classification to the terminal device;
For each filter included in the filter group, a filter counter that counts the number of received messages that match the filter condition;
A filter order rearrangement unit that rearranges the order of use of the filter group in the message search unit in order of increasing filter counter value for at least the filter counter value greater than a predetermined value;
Management server characterized by And a schedule unit for initializing the value of the filter counter at predetermined time intervals.
The management server according to claim 1, wherein: In addition, a filter setting receiving unit that receives the setting of the filter from the terminal device,
The management server according to any one of claims 1 to 3. The filter group includes an exclusion filter that is excluded from an output target to the terminal device when the received message meets a predetermined filter condition, and a filter to the terminal device when the received message meets a predetermined filter condition. It is composed of at least two types of filters, an extraction filter that is determined as an output target,
The management server according to any one of claims 1 to 4, wherein: The message search unit uses a filter group belonging to the exclusion filter and confirms whether the message is not an output target to the terminal device, and then uses the filter group belonging to the extraction filter in a predetermined order. Extracting a message to be output to the terminal device;
The management server according to claim 5. The filter order rearrangement unit separately rearranges the use order of filters belonging to the exclusion filter and the use order of filters belonging to the extraction filter;
The management server according to claim 5 or 6, characterized by the above.   A management server according to any one of claims 1 to 7, a monitoring unit that monitors each component of a computer system to be monitored and transmits a message to the management server, and a terminal device are connected. Computer system with integrated operation management function. Received from each component of the computer system using a filter group that is connected to the computer system to be monitored and the terminal device and includes a filter group that defines a filter condition for extracting a message to be output to the terminal device. A method for extracting a message to be output to the terminal device in a management server that outputs the message extracted by any one of the filters to the terminal device,
Collating the filter conditions with the received message according to a predetermined order of use and extracting messages that match the filter conditions;
Holds the number of received messages that conform to the filter condition for each filter, the filter number of received messages held in each of the filter is greater than a predetermined value, the number of the received message compared to the filter small Reordering the use order of the filters so that the use order comes before the filter.
A message extraction method characterized by the above. A method for extracting a message to be output to the terminal device in a management server connected to a monitoring target computer system and a terminal device and receiving a message output from each component of the computer system,
A message receiving step in which the management server receives a message output from each component of the computer system;
The management server uses a filter included in a filter group that determines a message classification according to whether or not the message meets a predetermined filter condition in a predetermined use order, determines a message classification, and the filter A message search process for managing the number of received messages that meet the conditions for each filter;
The management server repeats a message transmission step of transmitting a message of a predetermined classification to the terminal device,
The filter in the message search step is performed in the descending order of the number of received messages that meet the filter condition, with respect to a filter in which the management server has at least a predetermined number of received messages that meet the filter condition at a predetermined time interval. Including a filter order rearrangement step for rearranging the use order of the group,
A message extraction method characterized by the above. Further, the management server includes a step of initializing the number of received messages that meet the filter condition managed for each filter at a predetermined time interval.
The method for extracting a message according to claim 9 or 10. Furthermore, the management server includes a filter setting step for receiving setting of the filter from the terminal device,
The message extraction method according to claim 9, wherein the message is extracted. The filter group includes an exclusion filter that is excluded from an output target to the terminal device when the received message meets a predetermined filter condition, and a filter to the terminal device when the received message meets a predetermined filter condition. It is composed of at least two types of filters, an extraction filter to be output,
The message extracting method according to any one of claims 9 to 12. After using the filter group belonging to the exclusion filter and confirming that the message is not an object to be output to the terminal device, the filter group belonging to the extraction filter is used in a predetermined order and the message to be output to the terminal device Extracting,
The message extracting method according to claim 13. The filter order rearrangement step is performed by separately rearranging the usage order of the filter belonging to the exclusion filter and the usage order of the filter belonging to the extraction filter,
The message extracting method according to claim 13 or 14, characterized in that: Received from each component of the computer system using a filter group that is connected to the computer system to be monitored and the terminal device and includes a filter group that defines a filter condition for extracting a message to be output to the terminal device. An operation management program for causing a management server that outputs a predetermined message to the terminal device to execute a message extracted by any one of the filters among messages,
A process of matching the filter condition with the received message according to a predetermined order of use and extracting a message that matches the filter condition;
Holds the number of received messages that conform to the filter condition for each filter, the filter number of received messages held in each of the filter is greater than a predetermined value, the number of the received message compared to the filter small A process of rearranging the use order of the filters so that the use order comes before the filter;
An operation management program for causing the management server to execute. An operation management program that is connected to a computer system to be monitored and a terminal device, and that is executed by a management server that receives a message received from each component of the computer system,
Receiving a message output from each component of the computer system;
A process of determining the message classification using filters included in a filter group that determines a message classification depending on whether the message meets a predetermined filter condition in a predetermined order of use;
For the filter that discriminates the message, a process of adding the number of received messages stored and held for each filter;
The process of transmitting the extracted message to the terminal device is repeatedly executed by the management server,
Further, when determining the messages in the descending order of the number of received messages to be stored and held for each filter, at least for a filter in which the number of received messages to be stored and held for each filter is larger than a predetermined value at a predetermined time interval An operation management program that causes the management server to execute processing for rearranging the order of use of the filter group.   The operation management program according to claim 16 or 17, further causing the management server to execute processing for initializing the number of adaptations managed for each filter at a predetermined time interval.   The operation management program according to any one of claims 16 to 18, further causing the management server to execute a process of accepting the setting of the filter from the terminal device. The filter group includes an exclusion filter that is excluded from an output target to the terminal device when the received message meets a predetermined filter condition, and a filter to the terminal device when the received message meets a predetermined filter condition. It is composed of at least two types of filters, an extraction filter to be output,
The operation management program according to any one of claims 16 to 19. The filter group belonging to the exclusion filter is used to perform the process of excluding messages that are not to be output to the terminal device, and then the filter group belonging to the extraction filter is used in a predetermined order to the terminal device. Extracting messages to be output,
The operation management program according to claim 20, wherein: Reordering the use order of filters belonging to the exclusion filter and the use order of filters belonging to the extraction filter separately;
The operation management program according to claim 20 or 21, wherein:

Images