Server apparatus, user device, system, operation method, and program

Abstract

To provide a server apparatus, a user device, a system, an operation method, and a program which can provide autonomous and adaptive countermeasure to a problem.SOLUTION: The present invention is directed to a server apparatus and so on having an acquiring unit for acquiring an operation log of an apparatus or a system, an accumulation unit for accumulating device or system errors and countermeasures for the errors in association with each other, a detection unit for detecting an error from the acquired operation log, an extracting unit for extracting, based on the detected error, a countermeasure related to an error matched with the detected error accumulated in the accumulation unit, and an execution unit for executing the extracted countermeasure.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a server device, a user device, a system, an operation method, and a program that are capable of autonomously and adaptively dealing with malfunctions. [Background technology]

[0002] When a problem occurs in equipment or systems installed at a customer's site, it takes a considerable amount of time to obtain the necessary information and resolve the problem. For example, the following steps 1 to 8 are generally required. 1. An incident occurs at a customer's site and the dealer is contacted about the incident. 2. The retailer contacts the manufacturer. 3. Conduct a primary investigation into the incident on the manufacturer's side, and if there is insufficient information, identify the necessary debug logs and information. 4. Instruct your dealer to enable the necessary debug logs and obtain information. 5. Enable debug logging on the customer system and wait for the event to occur. 6. The customer reproduces the issue and reports the acquired logs to the manufacturer. 7. Analyze the logs obtained by the manufacturer. If a similar problem exists and has already been resolved, contact the retailer to discuss the solution. 8. The dealer applies the solution (countermeasure) to the customer's system.

[0003] Patent Document 1 discloses the following operation error processing device, etc. When an operation error occurs in the device, the device, etc., judges whether or not there is error history information similar to the error that occurred, based on recorded error history information. If similar error history information exists, the device, etc., judges whether or not there is recovery history information associated with the error history information. If there is recovery history information associated with the error history information, the device, etc., executes processing according to the event that triggered the normal recovery, based on the recovery history information. This makes it possible to attempt to recover the device, etc. to normal. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2013-171592 A Summary of the Invention [Problem to be solved by the invention]

[0005] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis has been carried out by the present inventors.

[0006] As described above, the invention disclosed in Patent Document 1 makes it possible to autonomously identify and attempt measures to return to normalcy when an operational error occurs by executing processing based on historical information according to matters that have previously resulted in a return to normalcy.

[0007] However, as disclosed in Patent Document 1, during normal operation, the information acquired when a malfunction occurs may not be sufficient to identify a countermeasure. In this case, it is difficult to acquire accurate and detailed information about an operation error in normal operation mode. For this reason, as described in 4. to 7. above, in order to investigate the target device or system, the device or system is operated in debug mode and a debug log is acquired. This makes it possible to grasp the details of the system's operation, and improves the possibility of taking countermeasures and returning to normal. On the other hand, enabling all debug logs may strain the device's processing resources and affect the processing speed. For this reason, it is necessary to take countermeasures such as enabling the necessary debug logs depending on the event that has occurred.

[0008] Therefore, in one aspect of the present invention, an object is to provide a server device, a user device, a system, an operation method, and a program that are capable of autonomously and adaptively dealing with malfunctions. [Means for solving the problem]

[0009] According to a first aspect of the present invention, there is provided a server device having an acquisition unit that acquires an operation log of a device or system, a storage unit that associates and stores errors in the device or system with countermeasures for the errors, a detection unit that detects errors from the acquired operation log, an extraction unit that extracts countermeasures for errors that match the detected error and are stored in the storage unit based on the detected error, and an execution unit that executes the extracted countermeasures.

[0010] According to a second aspect of the present invention, there is provided a user device having an acquisition unit that acquires an operation log, a detection unit that detects an error from the operation log, a transmission unit that transmits an error identifier that identifies the error to a server device that associates the error identifier with a countermeasure and stores the error identifier, a receiving unit that receives a countermeasure related to an error identifier that matches the detected error identifier and is extracted based on the error identifier and stored in the server device, and an execution unit that executes the countermeasure.

[0011] According to a third aspect of the present invention, there is provided a system comprising a user device and a server device, the system including: the server device having a storage unit that associates and stores an error identifier that identifies an error in the user device with a countermeasure for the error; and an extraction unit that receives the error identifier from the user device and, based on the error identifier, extracts and transmits a countermeasure for an error identifier that matches the detected error identifier and is stored in the storage unit; and the user device having an acquisition unit that acquires an operation log, a detection unit that detects errors from the operation log, a transmission unit that transmits an error identifier that identifies the detected error, a receiving unit that receives the countermeasure, and an execution unit that executes the countermeasure.

[0012] According to a fourth aspect of the present invention, there is provided an operating method for a server device having a storage unit that associates and stores device or system errors with countermeasures for the errors, the operating method including the steps of acquiring an operation log of the device or system, detecting an error from the acquired operation log, extracting a countermeasure for an error that matches the detected error and is stored in the storage unit based on the detected error, and executing the extracted countermeasure.

[0013] According to a fifth aspect of the present invention, there is provided a program for causing a computer to execute the steps of: acquiring an operation log of an apparatus or system; detecting an error from the acquired operation log; correlating an error in the apparatus or system with a countermeasure for the error based on the detected error, and extracting a countermeasure for an error that matches an error stored in a database; and executing the extracted countermeasure.

[0014] The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, an optical recording medium, etc. The present invention can also be embodied as a computer program product. Effect of the Invention

[0015] According to each aspect of the present invention, it is possible to provide a server device, a user device, a system, an operating method, and a program that are capable of autonomously and adaptively dealing with malfunctions. [Brief description of the drawings]

[0016] [Figure 1] FIG. 2 is a block diagram showing an example of a configuration of a server device according to an embodiment. [Diagram 2] 5 is a flowchart showing a process flow of the server device of the first embodiment. [Diagram 3]FIG. 2 is a block diagram showing an example of a hardware configuration of a server device according to the first embodiment. [Figure 4] FIG. 11 is a block diagram showing an example of a configuration of a user device according to a second embodiment. [Diagram 5] FIG. 11 is a diagram for explaining data transmitted and received by a user device of the second embodiment. [Figure 6] 10 is a flowchart showing a process flow of a user device according to the second embodiment. [Figure 7] FIG. 13 is a block diagram showing an example of the configuration of a system according to a third embodiment. [Figure 8] FIG. 11 is a sequence diagram illustrating an example of the operation of the third system. [Figure 9] 2 is a block diagram showing the configuration of a key telephone device and a defect information management server according to an embodiment of the present invention; [Figure 10] FIG. 2 is a diagram showing a table that is a part of a defect information database. [Figure 11] FIG. 11 is a diagram for explaining a process in another embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] First, an overview of one embodiment will be described. Note that the reference numerals in the drawings are given to each element for convenience as an example to aid in understanding, and the description of this overview is not intended to be limiting in any way.

[0018] 1 is a block diagram showing an example of the configuration of a server device according to an embodiment. The server device 10 according to the embodiment includes an acquisition unit 11, a storage unit 12, a detection unit 13, an extraction unit 14, and an execution unit 15.

[0019] The acquisition unit 11 acquires an operation log of a device or system. The storage unit 12 stores errors of the device or system in association with countermeasures for the errors. The detection unit 13 detects errors from the acquired operation log. The extraction unit 14 extracts countermeasures for errors that match the errors stored in the storage unit based on the detected errors. The execution unit 15 performs processing to execute the extracted countermeasures.

[0020] In this way, the server device of one embodiment can detect an error in a device or system, obtain a matching error from among the accumulated errors, and extract a countermeasure for the error that is associated and accumulated. The execution unit performs processing for executing the countermeasure, and the device or system can autonomously recover from a malfunction caused by the error.

[0021] [First embodiment] [Device configuration] An example of the configuration of the server device of the first embodiment is similar to the example of the configuration of the first embodiment, as shown in Fig. 1. As in the first embodiment, the server device 10 of the first embodiment includes an acquisition unit 11, a storage unit 12, a detection unit 13, an extraction unit 14, and an execution unit 15. A feature of this embodiment is that the execution unit 15 operates the device or system in a debug mode as a countermeasure to the error in response to a detected error, and the acquisition unit 11 acquires an operation log in the debug mode.

[0022] The acquisition unit 11 acquires an operation log of a device or a system. The term "device or system" includes either the device itself or a system of which the device itself is an element, or another device or another system. An "operation log" is information on the internal state of a target device or system that is provided in a manner that can be perceived by humans. Examples of operation logs include error codes and error messages when an error occurs in a system or device, and information based on a memory image dumped when a system or device goes down. "Acquisition" includes acquiring a log showing the device's own state, acquiring a log output by a remote device or system via a communication line, and the like.

[0023] The storage unit 12 stores device or system errors and countermeasures for the errors in association with each other. An "error" includes errors based on an error log issued by the device or system, as well as system malfunctions that are not logged in an error log but are identified from one or more operation logs. An "error countermeasure" describes a process to be executed to recover from an error state. For example, the execution of a command to restart a specific process, the execution of a script to terminate and upgrade a running software and then restart it, and the execution of a software module describing a process to output a warning to a display device of a terminal to prompt a hardware replacement in the event of a hardware failure may be given to each of the errors, such as an error code, and the errors may be stored in association with the countermeasures for the error.

[0024] The server device 10 of this embodiment may also have an input reception unit (not shown). This unit can update and add to the storage unit 12 using an input / output interface such as a keyboard, and may be capable of updating the storage unit 12 by interactively inputting, for example, errors and their countermeasures.

[0025] The detection unit 13 detects errors from the acquired operation logs. As described above, "detecting an error" includes not only detection from an error log, but also inferring an error state from a normal operation log. Errors may also be detected from operation logs before and after a certain operation log. For example, if specific software modules are running and one of the modules is forcibly terminated after a certain period of time has elapsed, it is possible to infer that an error has occurred due to a conflict between the two modules.

[0026] The detection unit 13 may also perform processing such as detecting an error when a predetermined number of repetitions occur in the operation log. In this case, the operation log in which repetition occurs is not limited to an error log. For example, when a specific key is pressed a predetermined number of times or more in succession, the detection unit 13 may perform processing such as detecting an error.

[0027] Based on the detected error, the extraction unit 14 extracts a countermeasure for the error that matches the error stored in the storage unit 12. The extraction unit 14 searches the storage unit 12 using the error detected by the detection unit 13 as a key, and if a record with a matching error is found, extracts a countermeasure associated with that error. The extracted countermeasure is sent to the execution unit 15.

[0028] When searching and extracting from within the storage unit 12, extraction may be performed using an error code, an error ID, or the like, which is an error identifier, as a key. Alternatively, a description of an error event in natural language may be directly sent as a query to the storage unit 12. For example, when a "system reset" occurs as an event, the description may be input as is, and language processing may be performed to obtain a record describing the most similar event, and a countermeasure may be extracted.

[0029] The execution unit 15 performs processing for executing the extracted countermeasure. For example, when the countermeasure is for an error in the server device 10 itself, the server device 10 itself executes the countermeasure. When the countermeasure is to execute a predetermined script, the execution unit 15 performs processing for passing the script of the countermeasure to an interpreter that processes the script. Also, for example, when a countermeasure is extracted for an error that has occurred in another device, the execution unit 15 executes processing such as transmitting the extracted countermeasure to the other device using a network interface.

[0030] The execution unit 15 may further perform processing for executing the device or the system in the debug mode. The execution of the debug mode does not have to be performed for the entire system, and may be performed in a manner in which a part of the device or the system is put into the debug mode in response to an error. The execution unit 15 may also perform control for increasing or decreasing the debug level. In this way, by selectively applying the debug mode or controlling the debug level, it is possible to optimize the processing resources of the device or the like used for debugging, and to reduce adverse effects such as a decrease in processing speed.

[0031] When the debug mode is entered, the acquisition unit 11 acquires an operation log in the debug mode. An error may be detected based on the acquired operation log, and a process of extracting a countermeasure based on the error may be executed.

[0032] [Explanation of operation] FIG. 2 is a flow chart for explaining the operation of the server device 10 of the first embodiment. As shown in this figure, when the server device 10 starts its operation, it acquires an operation log of the target device or system (step S21). Next, it detects an error from the acquired operation log (step S22). If no error is detected as a result (step S22, N), it returns to the process of acquiring the operation log (step S21). If an error is detected (step S22, Y), it extracts a countermeasure for the error that matches the detected error stored in the storage unit 12 based on the detected error (step S23). Next, it is determined whether or not to switch to the debug mode as a countermeasure (step S24). If it is switched to the debug mode (step S24, Y), it executes the process of acquiring the operation log again in the switched debug mode (step S21). If it is not switched to the debug mode (step S24, N), it executes the process of executing the countermeasure (step S25) and ends the series of processes.

[0033] [Hardware configuration] Next, a description will be given of the hardware configuration of the server device according to the first embodiment. Fig. 3 is a block diagram showing an example of the hardware configuration of the server device 10 according to the first embodiment.

[0034] The server device 10 constituting the server device can be configured by an information processing device (computer), and has the configuration exemplified in Fig. 3. For example, each server device 10 includes a CPU (Central Processing Unit) 301, a memory 302, an input / output interface 303, and a NIC (Network Interface Card) 304 as a communication means, which are mutually connected by an internal bus 305.

[0035] However, the configuration shown in Fig. 3 is not intended to limit the hardware configuration of each device constituting the server device. Each server device 10 may include hardware not shown, and may not include the input / output interface 303 as necessary. In addition, the number of CPUs and the like included in the server device 10 is not intended to be limited to the example shown in Fig. 3, and for example, each device may include multiple CPUs.

[0036] The memory 302 is a random access memory (RAM), a read only memory (ROM), or an auxiliary storage device (such as a hard disk).

[0037] The input / output interface 303 is a means for interfacing with a display device and an input device (not shown). The display device is, for example, a liquid crystal display, etc. The input device is, for example, a device that accepts user operations such as a keyboard and a mouse.

[0038] The functions of the server device 10 are realized by processing modules such as an acquisition program, a detection program, an extraction program, an execution program, and a collection of data (database) in which errors and countermeasures therefor stored in association with each other and stored in memory 302, etc.

[0039] The above processing modules are realized, for example, by CPU 301 executing a program stored in memory 302. The program can be updated by downloading it via a network or by using a storage medium storing the program. The above processing modules may be realized by a semiconductor chip. That is, it is only necessary to have some means for executing the functions performed by the above processing modules by some hardware and / or software.

[0040] [Hardware operation] When the server device 10 starts operating, an acquisition program is called from the memory 302 and is executed by the CPU 301. The program accesses and acquires a log output module of the server device 10 itself or of another device or system. The acquired data is stored in the memory 302.

[0041] Next, the detection program is called from memory 302 and is put into execution state by CPU 301. This program reads the operation log data stored in memory 302, and detects errors by referring to the data. For this purpose, the detection program may store and read a pattern file in memory 302 that describes the pattern of operation logs that are errors. As a result, if no error is detected, the acquisition program continues the process of acquiring the operation logs.

[0042] On the other hand, when an error is detected, the extraction program is called from memory 302 in response to a trigger issued by the detection program, and is put into execution by CPU 301. This program retrieves records relating to the relevant error from a database that stores errors and their countermeasures stored in memory 302, using a code or character string that identifies the detected error as a query. The contents of the countermeasure stored in the countermeasure field of the retrieved record are temporarily stored in memory 302.

[0043] Next, the execution program is called from memory 302 and is put into an execution state by CPU 301. The program first reads data describing a countermeasure temporarily stored in memory 302. Here, it is determined whether the content of the countermeasure is switching to debug mode or not. If the countermeasure does not include a description indicating switching to debug mode, the countermeasure is not switched to, and CPU 301 of the program executes the countermeasure or transmits data of the countermeasure via NIC 304 to execute the countermeasure. On the other hand, if a description indicating switching to debug mode is included, the program switches the operation mode to debug mode. The process of switching to debug mode may be limited to only some modules or mechanisms according to the detected error, rather than the entire device or system. After switching, the acquisition program again acquires the operation log in debug mode.

[0044] [Effect description] As described above, the server device 10 of this embodiment obtains the operation log of the target device or system and detects an error. It is possible to extract a countermeasure based on the detected error, and it is possible to autonomously recover the device or system from the error state by executing the extracted countermeasure. In addition, it is possible to grasp the state of the device or system in more detail and accurately by switching to debug mode, and to recover from the error. Furthermore, it is possible to apply the debug mode according to the detected error, and it is possible to execute adaptive processing with less adverse effect of slowing down the processing speed.

[0045] [Second embodiment] In the second embodiment, a user device that detects a malfunction and can execute a countermeasure will be described.

[0046] [Device configuration] 4 is a block diagram showing an example of the configuration of the user device 20 of the second embodiment. As shown in this diagram, the user device 20 of this embodiment comprises an acquisition unit 21, a detection unit 23, a transmission unit 26, a reception unit 27, and an execution unit 25. The acquisition unit 21, the detection unit 23, and the execution unit 25 have already been described in the above embodiments, so description thereof will be omitted. The user device 20 of this embodiment is characterized in that it has the transmission unit 26 and the reception unit 27.

[0047] The sending unit 26 sends the error identifier for identifying the error to a server device that stores the error identifier and its countermeasure in association with each other. An "error identifier" is a code that is a number, a character string, or a combination of these that is used to identify an error.

[0048] The receiving unit 27 receives countermeasures for an error identifier that is extracted based on the error identifier and that is stored in the server device and that matches the detected error identifier. FIG. 5 is a diagram for explaining an example of data stored in the server device, data transmitted by the transmitting unit 26, and data received by the receiving unit 27. Of these pieces of information, the data transmitted to the server device includes at least an "(error) identifier". An "operation log" and an "event" may also be added. At least an "(error) identifier" and a "countermeasure" are stored in the server device, and the "(error) identifier" transmitted by the transmitting unit 26 is compared with the "(error) identifier" stored in the server device, and the countermeasure for the matching "(error) identifier" is obtained and received by the receiving unit 27.

[0049] As in the first embodiment, the execution unit 25 may be configured to operate the user device in debug mode as a countermeasure to the error in response to the error, and the acquisition unit 21 may be configured to acquire an operation log in the debug mode.

[0050] [Explanation of operation] 6 is a flow chart for explaining the operation of the user device 20 in the second embodiment. As shown in this figure, first, an operation log is acquired (step S61). Next, an error is detected from the operation log (step S62). After that, an error identifier of the detected error is transmitted to a server device that associates the error identifier with a countermeasure and stores the error identifier (step S63). After transmission, the server device receives the countermeasure related to the error identifier that matches the detected error identifier and that is stored in the server device and extracted based on the error identifier (step S64). Then, the received countermeasure is executed (step S65).

[0051] [Effect description] According to the user device 20 of this embodiment, it is possible to obtain an operation log in the user device, detect an error, obtain a countermeasure for the detected error from an external server, and execute the countermeasure. Also, as in the first embodiment, it is possible to operate the user device in debug mode in response to a detected error and obtain a detailed operation log in the debug mode, thereby taking an appropriate countermeasure.

[0052] [Third embodiment] In the third embodiment, a system will be described that combines the user device and server device of the above embodiments.

[0053] [Device configuration] The system of the third embodiment includes a user device 30 and a server device 40. The user device 30 includes an acquisition unit 31, a detection unit 33, a transmission unit 36, a reception unit 37, and an execution unit 35. The above components have already been described in the above embodiments, so description thereof will be omitted.

[0054] The server device 40 includes a storage unit 42 and an extraction unit 44. The storage unit 42 is the same as in the above embodiment. The extraction unit 44 receives an error identifier from the user device 30, and extracts and transmits a countermeasure for an error identifier that matches the detected error identifier and is stored in the storage unit 42, based on the error identifier.

[0055] In response to the detected error, the execution unit 35 of the user device 30 may operate the user device 30 in a debug mode, and the acquisition unit 31 of the user device 30 may acquire an operation log in the debug mode. The mode switching to the debug mode may be performed by the server device 40.

[0056] The detection unit 33 may be disposed on the side of the server device 40. In this case, the transmission unit 36 ​​transmits the operation log acquired by the acquisition unit 31 instead of the detected error.

[0057] The storage unit 42 may be disposed in another server device outside the server device 40. In this case, the server device 40 transmits and receives errors and countermeasures for the errors through communication.

[0058] [Explanation of operation] 8 is a sequence diagram for explaining an example of the operation of the system of this embodiment. As shown in this diagram, first, an operation log is acquired on the user device 30 side (step S801). Next, an error is detected from the operation log (step S802). The detected error or error identifier is transmitted (step S803). The server device 40 side receives the error or error identifier, and based on the error or error identifier, extracts (step S804) and transmits (step S805) a countermeasure associated with an error identifier that matches the detected error identifier and is stored in the storage unit 42. Here, in this example, it is assumed that a countermeasure such as "switching a specific module to debug mode" is extracted.

[0059] The user device 30 receives the countermeasure and executes the countermeasure, such as switching to debug mode (step S806). After switching, a more detailed operation log is acquired (step S807), an error is detected (step S808), and the detected error or error identifier is transmitted (step S809). The server device 40 again extracts (step S810) and transmits (step S811) a countermeasure associated with an error identifier that matches the detected error identifier, which is stored in the storage unit 42, based on the error or error identifier. The user device 30 executes the countermeasure (step S812), and the system is restored.

[0060] [Effect description] According to the system of this embodiment, it is possible to acquire an operation log in the user device 30, detect an error, acquire a countermeasure for the detected error from an external server, and switch the operation to a debug mode corresponding to the error according to the error. In addition, by acquiring a more detailed operation log, it is possible to acquire and execute a countermeasure, thereby adaptively and autonomously recovering the target device or system.

[0061] [Example] In the embodiment, a key telephone device (corresponding to the user device 30) and a defect information management server (corresponding to the server device 40) will be described as an example.

[0062] [Configuration of the embodiment] Fig. 9 is a block diagram showing the configuration of the key telephone device and the defect information management server of this embodiment. As shown in Fig. 9, it is composed of a key telephone device 1010 and a defect information management server 1020. The key telephone device 1010 and the defect information management server 1020 communicate with each other through their respective communication units (1015, 1023).

[0063] The key telephone device 1010 has a key telephone device main processing unit 1011, a log storage memory 1012, a system setting data storage unit 1013, a solution execution unit 1014, a communication unit 1015, a log analysis unit 1016, and an error log information storage unit 1017. The error log information storage unit 1017 holds fault events and error logs that are output when the events occur. The information stored in the error log information storage unit 1017 is updated every time a new error log is added. It is assumed that the information is updated together with the software of the key telephone device 1010.

[0064] The defect information management server 1020 has a defect information database 1021, a defect information analysis unit 1022, and a communication unit 1023. Fig. 10 shows a table that is a part of the defect information database 1021. The defect information database 1021 may hold information on defects that have occurred in the past (event, task in which the defect occurred, previous operation, error log) and countermeasures for the defect events (debug log to be activated, solution).

[0065] [Explanation of operation] The key telephone device main processing unit 1011 stores logs in the log storage memory 1012 as needed. The log analysis unit 1016 compares the log stored in the log storage memory 1012 with the information of the error log stored in the error log information storage unit 1017, and when a matching error log is detected, it determines that a malfunction event has occurred and notifies the key telephone device main processing unit 1011. The key telephone device main processing unit 1011 acquires the log at the time of the malfunction event occurrence from the log storage memory 1012, acquires the system setting data from the system setting data storage unit 1013, and notifies the malfunction information management server 1020 through the communication unit 1015. The malfunction information management server 1020 receives the error log and the system setting data through the communication unit 1023. The malfunction information analysis unit 1022 compares the received information with the malfunction information database 1021, and searches for matching malfunction information. If matching fault information is found, the fault information analysis unit 1022 obtains a solution from the fault information database 1021 and notifies the key telephone device 1010 through the communication unit 1023. The key telephone device 1010 receives the solution through the communication unit 1015 and passes it to the solution execution unit 1014. The solution execution unit 1014 executes the received solution.

[0066] Here, the process of detecting a malfunction of the target device, the key telephone device 1010, is described. The key telephone device 1010 holds error log information that is output when a malfunction occurs in an error log information storage unit 1017. A log analysis unit 1016 monitors the log stored in the log storage memory 1012, and if the log information matches the error log information in the error log information storage unit 1017, it determines that a malfunction has occurred.

[0067] Next, extraction of solutions in the fault information management server 1020 will be described. The fault information management server 1020 compares the fault events, log information, and system setting data received from the key telephone device 1010 with the fault information stored in the fault information database 1021 to search for a match. If a match is found, it instructs the key telephone device 1010 to provide a solution or activate a debug log.

[0068] [Other Examples] As another embodiment, an example of a server (corresponding to the server device 40) and a PBX (Private Branch Exchange) (corresponding to the user device 30) will be described. The PBX periodically transmits logs to the server and compares them with information on malfunction events accumulated on the server side. If an event is predicted to occur based on a specific error log, the immediately preceding operation, settings, etc., even before the event occurs, the PBX can apply solutions such as enabling a debug log for investigation, upgrading the software, or changing settings. 1. The PBX periodically sends logs and system data settings to a server on the cloud 2. Analysis is performed on the server side and the data is compared with a database of defect events stored on the server side. 3. If a specific "log," "setting," or "operation" matches an event registered in the fault event database, the PBX is instructed to apply a solution or enable the debug log.

[0069] FIG. 11 shows a diagram for explaining the processing in another embodiment.

[0070] Example 1: Event: System reset, Log: Invalid status, Operation: DID (Direct Inward Dialing) incoming call, Settings: CFWD (Call Forward) setting from DID destination to outside line. Since the occurrence of Event 1 is expected, upgrade to Version 3.10.

[0071] Example 2: Event: System reset, Log: Invalid status, Operation: Continuous incoming calls, Settings: Calls forwarded to VM when no answer is received. Event 2 is expected to occur, so enable the debug log. (vmuaid 0 1)

[0072] Other possible methods for detecting malfunctions include the following: 1) Detecting invalid status transitions A list of status transitions that can occur as normal operation is maintained, and if a status transition that does not fit this list occurs, it is determined to be an abnormality. 2) Number of events occurring within a certain period of time In order to detect abnormal events such as repeated off-hook and on-hook switching 10 times per second, a threshold is set for the number of times the same event occurs within a certain period of time, and an abnormality is determined if the threshold is exceeded. 3) Heap memory exhaustion The software's heap memory is monitored, and if a certain level of abnormality is detected, it is determined to be an abnormality.

[0073] Some or all of the above embodiments can also be described as follows, but are not limited to the following. [Form 1] This is the same as the server device according to the first aspect described above. [Form 2] Preferably, the server device of aspect 1, wherein the execution unit operates the device or system in a debug mode as a countermeasure against the error in response to the error, and the acquisition unit acquires an operation log in the debug mode. [Form 3] The server device preferably according to aspect 1 or 2, wherein the detection unit detects an error from the operation log and an operation log preceding the operation log. [Form 4] The detection unit detects an error when a predetermined number of repetitions or more occur in the operation log. [Form 5] This is the same as the user device according to the second aspect described above. [Form 6] the execution unit operates the user device in a debug mode as a countermeasure against the error in response to the error, and the acquisition unit acquires an operation log in the debug mode; Preferably, the user device is of form 5. [Form 7] This is the same as the system relating to the third aspect described above. [Form 8] Preferably, the system according to aspect 7, wherein the execution unit operates the user device in a debug mode in response to the error, and the acquisition unit acquires an operation log in the debug mode. [Form 9] This is the same as the operation method according to the fourth aspect described above. [Form 10] This is as per the program related to the fifth perspective mentioned above. Incidentally, like mode 1, modes 9 and 10 can be expanded into modes 2 to 4.

[0074] The disclosures of the above cited patent documents and the like are incorporated herein by reference. Within the framework of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the framework of the entire disclosure of the present invention, various combinations and selections of the various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure including the scope of claims and the technical ideas. In particular, with regard to the numerical ranges described in this specification, any numerical value or subrange included in the range should be interpreted as being specifically described even if not otherwise specified. [Explanation of symbols]

[0075] 10: Server device 11: Acquisition part 12: Storage section 13: Detection section 14:Extraction part 15: Executive Team 20: User device 21: Acquisition Department 23: Detection unit 25: Executive Department 26: Transmitter 27: Receiving section 30: User device 31: Acquisition part 33: Detection unit 35: Executive Department 36: Transmitter 37: Receiving section 40: Server device 42: Storage section 44:Extraction part 301:CPU 302: Memory 303: Input / Output Interface 304:NIC 305: Internal bus 1010: Key telephone device 1011: Key telephone device main processing unit 1012: Log storage memory 1013: System setting data storage section 1014: Solution Execution Department 1015: Communications Department 1016: Log analysis section 1017: Error log information storage section 1020: Defect information management server 1021: Defect information database 1022: Defect information analysis department 1023: Communications Department

Claims

1. An acquisition unit for acquiring an operation log of a device or a system; A storage unit that stores an error in the device or system and a countermeasure for the error in association with each other; a detection unit for detecting an error from the acquired operation log; an extracting unit that extracts, based on the detected error, a countermeasure for an error that matches the detected error and is stored in the storage unit; an execution unit for executing the extracted countermeasure; A server device having the above configuration.

2. the execution unit, in response to the error, operates the device or system in a debug mode as a countermeasure to the error; The acquisition unit acquires an operation log in a debug mode. The server device of claim 1.

3. The detection unit detects an error from the operation log and an operation log preceding the operation log.

3. The server device according to claim 1 or 2.

4. The detection unit detects an error when a predetermined number of repetitions occur in the operation log.

3. The server device according to claim 1 or 2.

5. An acquisition unit that acquires an operation log; a detection unit for detecting an error from the operation log; a transmitting unit that transmits an error identifier for identifying the error to a server device that stores the error identifier and a countermeasure therefor in association with each other; a receiving unit that receives a countermeasure corresponding to an error identifier that is extracted based on the error identifier and that matches the detected error identifier and that is stored in the server device; An execution unit for executing the countermeasure; A user device having:

6. The execution unit, in response to the error, operates the user device in a debug mode as a countermeasure for the error; The acquisition unit acquires an operation log in a debug mode. The user device of claim 5.

7. A system including a user device and a server device, A storage unit that stores an error identifier that identifies an error in the user device and a countermeasure for the error in association with each other; an extraction unit that receives an error identifier from the user device, and extracts and transmits a countermeasure for an error identifier that matches the detected error identifier and is stored in the storage unit based on the error identifier; A server device having An acquisition unit that acquires an operation log; a detection unit for detecting an error from the operation log; a transmitter for transmitting an error identifier for identifying the detected error; A receiving unit for receiving the countermeasure; An execution unit for executing the countermeasure; a user device having A system including:

8. The execution unit operates the user device in a debug mode in response to the error; The acquisition unit acquires an operation log in a debug mode. The system of claim 7.

9. A method for operating a server device having a storage unit that associates and stores an error in a device or system with a countermeasure for the error, comprising the steps of: acquiring an operation log of the device or system; detecting an error from the acquired operation log; extracting, based on the detected error, a countermeasure for an error that matches the detected error and is stored in the storage unit; a step of executing the extracted countermeasure; The method of operation includes:

10. A process of acquiring an operation log of a device or system; A process of detecting an error from the acquired operation log; A process of extracting a countermeasure for an error that matches the detected error, the countermeasure being stored in a database in which the device or system error is associated with the countermeasure for the error, based on the detected error; A process for executing the extracted countermeasures; A program for causing a computer to execute the following.

Images