Method for monitoring an end-device environment with at least two end devices by means of a monitoring system, computer program product, computer-readable storage medium and monitoring system

Abstract

The invention relates to a method for monitoring an end-device environment (12) with at least two end devices (14, 16) by means of a monitoring system (10), comprising the steps of: capturing at least one first event (24) of a first end device (14) by means of the first end device (14); capturing at least one second event (26), independent of the first event (24), of a second end device (16) by means of the second end device (16); transferring the first event (24) and transferring the second event (26) independently of the first event (24) to at least one receiving device (18) of the monitoring system (10); aggregating the first event (24) and the second event (26) by means of an electronic computing device (20) of the monitoring system (10); and transmitting the aggregated events (24, 26) to a display device (22) of the monitoring system (10).Furthermore, the invention relates to a computer program product, a computer-readable storage medium and a monitoring system (10).

Description

[0001] The invention relates to a method for monitoring an end-device environment with at least two end devices by means of a monitoring system according to claim 1. The invention further relates to a computer program product, a computer-readable storage medium and a monitoring system.

[0002] Processes involving multiple endpoints and subsystems are difficult to analyze and optimize due to their distributed nature. Modern computer systems are interconnected via networks to perform their primary functions. Secondary functions, such as monitoring, help keep these primary functions operational and optimized.

[0003] Distributed systems, especially industrial systems that require protection, or systems spanning multiple network environments, may be disconnected from the network for security reasons. Some systems, such as autonomous robotic systems, may need to be shut down for extended periods due to their primary physical functions.

[0004] Since not all systems can or should be connected at all times, it is a challenge to track and gain insights into the processes taking place in the separate parts of the system.

[0005] Interrupted connectivity or bandwidth limitations prevent the use of a centralized solution for continuous monitoring and tracking of processes within the distributed system.

[0006] The object of the present invention is to create a method, a computer program product, a computer-readable storage medium and a monitoring system by means of which improved monitoring of terminal devices within a terminal device environment can be achieved.

[0007] This problem is solved by a method, a computer program product, a computer-readable storage medium, and a monitoring system according to the independent claims. Advantageous embodiments are specified in the dependent claims.

[0008] One aspect of the invention relates to a method for monitoring an end-device environment with at least two end devices by means of a monitoring system. At least one first event of a first end device is detected by means of the first end device. At least one second event, independent of the first event, of a second end device is detected by means of the second end device. The first event is transferred to a receiving device of the monitoring system, and the second event is also transferred to the receiving device of the monitoring system, independently of the first event. The first and second events are aggregated by means of an electronic computing device of the monitoring system. The aggregated events are then transmitted to a display device of the monitoring system.

[0009] In particular, the aggregated events are displayed on the display device, especially in a joint display.

[0010] In particular, the invention describes a method for tracking events or tasks in a distributed system of end devices without using a central tracking server. A "divide and conquer" approach is used, in which the tracking data from each subsystem or process is collected separately and in a self-contained manner, and is derived from the corresponding events. These events of the subsystems, especially the end devices, are subsequently collected via any communication channel, particularly offline, i.e., using a data-driven approach, a message-driven approach, or even by manual data collection. Once the corresponding events have been collected, they are aggregated to create a comprehensive view of the events in the entire distributed system or its parts.

[0011] The data associated with the events are used for partitioning the collected and merged events, as required for visualization, analysis and further processing.

[0012] This makes it possible to reliably collect events even in offline systems, separate systems, or unreachable systems, and to analyze them for further processing within the system.

[0013] In a particularly advantageous implementation, at least two events are aggregated for a Gantt chart. The Gantt chart allows for a reliable representation of corresponding temporal progress or events. To ensure a consistent view, the relevant events are grouped into a so-called "float line" based on these events. For example, context lines are initially sorted in ascending order based on the earliest timestamp of the events within a context. This allows users of the monitoring system to easily view the relevant events and perform corresponding analyses.

[0014] It is further advantageous if at least two end devices are operated in offline mode. Specifically, this offline mode refers to a mode in which the end devices do not have an active, and especially not a consistent or continuous, connection to the electronic computing device or the monitoring system. In other words, the end devices are not directly and permanently reachable by the monitoring system. The offline mode of the end devices can therefore involve, in particular, separate systems, distributed systems, or systems that are otherwise unreachable. This allows the procedure to be carried out, especially with end devices located in a secure environment.

[0015] It has proven advantageous to collect a large number of events from each endpoint device using that device itself, and then transfer this collection to the receiving system. Specifically, this requires that each endpoint device has a dedicated storage device. The numerous events are then collected within this storage device. If a transfer option is available, such as a manual transfer option, the storage can be accessed and the collected events transferred to the monitoring system. This enables long-term offline monitoring of the endpoint environment.

[0016] It has also proven advantageous to record at least a start and end time of an event. In particular, this allows for the recording of corresponding timestamps. This makes it possible, for example, to reliably record the event's duration and aggregate it later. This, in turn, enables appropriate analyses of the event.

[0017] It has proven advantageous to capture at least one attribute of the event along with the event itself. In particular, relevant attributes can be appended when events are opened or closed. When an area is closed, attributes with the same key as when the area was opened overwrite the value of the attribute. For example, an error reason for the event or the start of the event, such as a successfully completed process step, can be stored as an attribute. This enables reliable event analysis.

[0018] It is also advantageous if at least some context of the event is captured along with the event itself. This context can be provided, for example, by saving relevant parameter values ​​from the end device. Furthermore, other context-related information can also be saved, such as which process was running on the end device when the event occurred. This allows for a better and more reliable evaluation and analysis of the event afterward, using the transferred event data.

[0019] It has also proven advantageous to record at least one name for the event. Specifically, this name should be easily readable by a person. In other words, the event name can indicate which event, and from which device, it was performed or recorded. This facilitates subsequent analysis by a person.

[0020] It has also proven advantageous to capture at least one process dependency of the event along with the event itself. For example, in manufacturing machines, the corresponding production of a component can be recorded as a process dependency. For instance, a corresponding ID of the product to be manufactured can be stored as a process dependency. This allows for a reliable assignment of the event to a process step, enabling improved subsequent analysis.

[0021] Furthermore, it has proven advantageous to transform the events from each end device into a predefined data format for the monitoring system. Particularly when different end devices are used, it is necessary to implement a common data format, especially if the monitoring system is to aggregate and display the data together. Specifically, it is therefore necessary that the events recorded by the end devices be converted into a predefined data format and then transmitted to the monitoring system. The monitoring system can then use the data formats to aggregate the events and present them appropriately to a user.

[0022] Another advantageous implementation involves deploying the end devices as locally distributed devices. In other words, the end devices are configured independently of one another. They can be part of the end device environment but located in different places. This makes the method highly versatile.

[0023] The presented method is, in particular, a computer-implemented method. Therefore, a further aspect of the invention relates to a computer program product with program code means which, when the program code means are executed by the electronic computing device, cause a method according to the preceding aspect to be carried out.

[0024] Furthermore, the invention therefore also relates to a computer-readable storage medium with at least one computer program product according to the preceding aspect.

[0025] Furthermore, the invention also relates to a monitoring system for monitoring an end-device environment comprising at least two end devices, at least one receiving device, one display device, and one electronic computing device, wherein the monitoring system is configured to carry out a method according to the preceding aspect. In particular, the method is carried out by means of the monitoring system.

[0026] Advantageous embodiments of the process are to be regarded as advantageous embodiments of the computer program product, the computer-readable storage medium, and the monitoring system. The monitoring system possesses tangible features to enable the execution of the corresponding process steps.

[0027] A computing unit / electronic computing device can be understood, in particular, as a data processing device containing a processing circuit. The computing unit can therefore process data to perform arithmetic operations. This may also include operations to perform indexed access to a data structure, such as a lookup table (LUT).

[0028] The computing unit may, in particular, contain one or more computers, one or more microcontrollers, and / or one or more integrated circuits, for example, one or more application-specific integrated circuits (ASICs), one or more field-programmable gate arrays (FPGAs), and / or one or more systems on a chip (SoCs). The computing unit may also contain one or more processors, for example, one or more microprocessors, one or more central processing units (CPUs), one or more graphics processing units (GPUs), and / or one or more signal processors, in particular one or more digital signal processors (DSPs). The computing unit may also include a physical or virtual array of computers or other units of the aforementioned type.

[0029] In various embodiments, the computing unit includes one or more hardware and / or software interfaces and / or one or more storage units.

[0030] A storage unit can be volatile data storage, for example as dynamic random access memory (DRAM) or static random access memory (SRAM), or as non-volatile data storage, for example as read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory or flash EEPROM, ferroelectric random access memory (FRAM), or magnetoresistive random access memory.It can be designed as MRAM (magnetoresistive random access memory) or as phase-change random access memory, PCRAM (phase-change random access memory).

[0031] For use cases or application situations that may arise during the procedure and are not explicitly described here, it may be provided that, according to the procedure, an error message and / or a request for user feedback is issued and / or a default setting and / or a predetermined initial state is set.

[0032] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identities are included.

[0033] Further features of the invention will become apparent from the claims, the figures, and the description of the figures. The features and combinations of features mentioned above in the description, as well as the features and combinations of features mentioned below in the description of the figures and / or shown in the figures, may be encompassed by the invention not only in the combinations specified, but also in other combinations. In particular, the invention may also encompass embodiments and combinations of features that do not have all the features of an originally formulated claim. Furthermore, the invention may encompass embodiments and combinations of features that go beyond or deviate from the combinations of features set out in the cross-references to the claims.

[0034] This shows: Fig. 1 A schematic block diagram according to one embodiment of the method.

[0035] The invention is explained in more detail below with reference to specific embodiments and associated schematic drawings. In the figures, identical or functionally equivalent elements may be designated with the same reference numerals. The description of identical or functionally equivalent elements is not necessarily repeated with respect to different figures.

[0036] Fig. Figure 1 shows a schematic block diagram according to an embodiment of a monitoring system 10. The monitoring system 10 is designed to monitor an end-device environment 12. In the following embodiment, the end-device environment 12 comprises at least two end devices 14, 16, in particular a first end device 14 and a second end device 16. The monitoring system 10 comprises at least one receiving device 18, one electronic computing device 20, and one display device 22.

[0037] According to one embodiment of the procedure, the terminal environment 12 is monitored by means of the monitoring system 10. For this purpose, at least one first event 24 of the first terminal 14 is recorded by the first terminal 14. At least one second event 26, which is independent of the first event 24 in terms of time and content, is recorded by the second terminal 16. The first event 24 and the second event 26 are transferred to the at least one receiving device 18 of the monitoring system 10. The first event 24 and the second event 26 are aggregated by means of the electronic computing device 20 and the aggregated events 24 and 26 are transmitted to the display device 22.

[0038] In particular, the Fig. 1, that at least two events 24, 26 are aggregated for a Gantt chart 28. In the following embodiment, a third event 30 and a fourth event 32 are also shown.

[0039] Furthermore, it is shown in particular that at least two end devices 14 and 16 are operated in an offline mode. The two end devices 14 and 16 are provided as locally distributed end devices 14 and 16.

[0040] It may also be provided that a multitude of events 24, 26 of a respective terminal device 14, 16 are collected by means of the respective terminal device 14, 16 and the multitude of events 24, 26 are transferred together to the receiving device 18.

[0041] Furthermore, it may be provided that at least a start time and an end time of an event 24, 26 are recorded with the event 24, 26. Furthermore, an attribute of an event 24, 26 can be recorded with the event 14, 16. Additionally, a context of the event 24, 26 can be recorded with the event 24, 26. Furthermore, a name of the event 24, 26 can also be recorded with the event. It may also be provided that at least a process dependency of the event 24, 26 is recorded with the event 24, 26. In particular, it may also be provided that the events 24, 26 are transformed by a respective end device 14, 16 into a predefined data format for the monitoring system 10.

[0042] Furthermore, it may be provided that events 24 and 26 are aggregated depending on a decision parameter.

[0043] In particular, this describes the Fig. 1. A method for tracking tasks or events 24, 26 in a distributed system of end devices 14, 16 without using a central tracking server. A "divide and conquer" approach is used, in which the events 24, 26 are collected separately from each end device 14, 16 or process and are built from its own events 24, 26. These subsystem events 24, 26 are subsequently collected via any communication channel, in particular, for example, a file-based approach, messaging, or manual data collection. Once the events 24, 26 have been collected, they are aggregated to create an overall view of the entire distributed system, in particular the end device environment 12, or its parts.

[0044] The data associated with events 24 and 26 are used for partitioning the collected and merged events 24 and 26, as required for visualization, analysis, and further processing.

[0045] The events 24, 26, which were collected from unconnected but distributed processes, are visualized in a uniform manner using the Gantt chart 28.

[0046] A distributed system without centralized connectivity, in particular the end-device environment 12, is composed primarily of technical systems, e.g., devices, computers, virtual computers as end devices 14, 16, in which processes run. Each end device 14, 16 is to be considered an independent, isolated subsystem.

[0047] Events 24 and 26 are collections of individual events gathered within a process of an endpoint 14 or 16. These are then collected as a single event. A process participating in a distributed system captures its own information and writes the events to a data store, i.e., a file or storage space. Events 24 and 26 are composed of a list of individual events, each with its own identifier, start time, end time, and a list of attributes, as well as an optional context, specifically a string file, used for grouping events 24 and 26. Optional properties include a name (especially a human-readable name), a process dependency, or similar information. The timestamp, for example, can be...The event is stored in the form of a UTC time zone stamp and is generated by a clock on the terminal device 14, 16 or processor by creating a corresponding event 24, 26. Generating an event 24, 26 primarily requires an identification and an opening timestamp. Additional values ​​can be specified. When an event 24, 26 is closed, the closing timestamp is set.

[0048] Attributes can be attached when opening or closing events 24 and 26. When closing an event 24 or 26, attributes with the same key as those set when opening the event 24 or 26 override the attribute's value.

[0049] In particular, in the case of a large number of events 24, 26, these are stored together and then transmitted together to the receiving device 18, in particular in a chained fashion.

[0050] Events 24 and 26 are then visualized in Gantt chart 28. To obtain a consistent view, events 24 and 26 are grouped into so-called swim lines, which are based primarily on the contexts of events 24 and 26. These contextual swim lines are initially sorted in ascending order based on the earliest timestamp of all events 24 and 26 within a context. Events 24 and 26 within a contextual swim line are also grouped according to their start time.

[0051] The Fig. Figure 1 shows, in particular on the Gantt chart 28, a corresponding possible representation of events 24 and 26. In particular, the Fig.1. Events 24 and 26 are collected offline in a uniform format and stored independently of the architecture of the technical system or its connectivity and network architecture. Events 24 and 26 are physically transferred, in any manner, including offline transfers, to the location where they are processed and visualized. Events 24 and 26 are retrieved from external systems and converted into the same format used for offline event capture. Events 24 and 26 are combined into a single, unified event, specifically the Gantt chart 28, thus enabling a unified view of the distributed but partially decoupled system and its processes. These are then visualized accordingly in the Gantt chart 28, as already mentioned.

Claims

[1] Method for monitoring a terminal environment (12) with at least two terminals (14, 16) by means of a monitoring system (10), comprising the steps: - detecting at least one first event (24) of a first terminal (14) by means of the first terminal (14); - detecting at least one second event (26), independent of the first event (24), of a second terminal (16) by means of the second terminal (16); - transferring the first event (24) and transferring the second event (26) independently of the first event (24) to at least one receiving device (18) of the monitoring system (10); - aggregating the first event (24) and the second event (26) by means of an electronic computing device (20) of the monitoring system (10); and - transmitting the aggregated events (24, 26) to a display device (22) of the monitoring system (10). [2] Method according to claim 1, characterized by that the at least two events (24, 26) are aggregated for a Gantt chart (28). [3] Method according to claim 1 or 2, characterized by that the at least two terminals (14, 16) are operated in an offline mode. [4] Method according to one of the preceding claims, characterized by that a plurality of events (24, 26) of a respective terminal (14, 16) are collected by means of the respective terminal (14, 16) and the plurality of events (24, 26) are transferred together to the receiving device (18). [5] Method according to one of the preceding claims, characterized by that at least one start time and one end time of an event (24, 26) are recorded with the event (24, 26). [6] Method according to one of the preceding claims, characterized by that at least one attribute of the event (24, 26) is recorded with the event (24, 26). [7] Method according to one of the preceding claims, characterized by that at least one context of the event (24, 26) is recorded with the event (24, 26). [8] Method according to one of the preceding claims, characterized by that at least one name of the event (24, 26) is recorded with the event (24, 26). [9] Method according to one of the preceding claims, characterized by that at least one process dependency of the event (24, 26) is detected with the event (24, 26). [10] Method according to one of the preceding claims, characterized by that the events (24, 26) are aggregated depending on a decision parameter. [11] Method according to one of the preceding claims, characterized by that the events (24, 26) are transformed by a respective terminal (14, 16) into a predetermined data format for the monitoring system (10). [12] Method according to one of the preceding claims, characterized by that the terminals (14, 16) are provided as locally distributed terminals (14, 16). [13] Computer program product with program code means which cause an electronic computing device (20) to carry out a method according to one of claims 1 to 12 when the program code means are processed by the electronic computing device (20). [14] A computer-readable storage medium comprising at least one computer program product according to claim 13. [15] Monitoring system (10) for monitoring a terminal environment (12) with at least two terminals (14, 16), with at least one receiving device (18), a display device (22) and with an electronic computing device (20), wherein the monitoring system (10) is designed to carry out a method according to one of claims 1 to 12.

Images