Information processing device, monitoring system, determination method, and determination program

Abstract

To provide an information processing device or the like, capable of determining an importance message of an error generation by excluding a message in accordance with a reactivation from a message to be collected.SOLUTION: An information processing device that is connected with a financial transaction device in a communication, and monitors the financial transaction device, includes: an acquisition part; a storage part; a specific part; and a determination part. The acquisition part acquires a state of the financial transaction device and a date and a time of the generation of a message from the message collected from the financial transaction device. The storage part previously stores a reactivation time band of the financial transaction device. The specific part specifies the number of generations of an error of the other financial transaction device in a time zone containing the date and the time of the generation of a designation message from the messages. The determination part determines whether or not the designation message is a message in accordance with the reactivation on the basis of the number of generation of the error of the other financial transaction device in the time zone containing the date and the time of the generation of the designation message and the reactivation time zone.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing device, a monitoring system, a determination method, and a determination program. [Background technology]

[0002] For example, monitoring systems that remotely monitor financial transaction devices such as ATMs (Automatic Teller Machines) of financial institutions are widely used. FIG. 14 is an explanatory diagram showing an example of a conventional monitoring system 200. The monitoring system 200 shown in FIG. 14 includes an ATM 201, a monitoring server 202, and a monitoring terminal 203. The ATM 201 is a monitored cash dispenser that deposits and dispenses bills and the like and is placed in a store such as a bank, a station, or a convenience store. The ATM 201 includes a main body monitoring unit 201A, a NW device 201B, and a security device 201C. The main body monitoring unit 201A monitors the status of the ATM 201, such as whether it is alive or dead, whether it is jammed, and the like, and notifies the monitoring server 202 of a message indicating the monitoring result. The NW device 201B is a device that monitors the status of a network that is connected to the ATM 201 by communication, and notifies the monitoring server 202 of a message indicating the monitoring result. The security device 201C is a device that monitors information relating to maintenance and security, such as the opening and closing of a maintenance door of the ATM 201, and notifies the monitoring server 202 of a message indicating the monitoring result.

[0003] The monitoring server 202 is a server that remotely monitors the status of the ATMs 201 based on messages received from the multiple ATMs 201. The monitoring terminal 203 is an operation terminal on the operator's side that communicates with the monitoring server 202 and displays on its screen messages of each ATM 201 notified by the monitoring server 202.

[0004] When the monitoring server 202 receives a message such as an error from the ATM 201, it refers to a filter definition that manages the importance and keywords of the received message to identify the importance of the received message. Furthermore, the monitoring server 202 determines whether or not to notify the monitoring terminal 203 of the received message based on the identified importance. The monitoring server 202 notifies the monitoring terminal 203 of the received message based on the result of the determination of the received message. Then, the monitoring terminal 203 displays the received message from the monitoring server 202 on a monitoring screen. As a result, the operator of the monitoring terminal 203 can recognize the occurrence of an error in the ATM 201 by looking at the monitoring screen. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2019-159474 A [Patent Document 2] JP 2017-123001 A [Patent Document 3] Patent Publication No. 2021-64277 [Patent Document 4] JP 2007-323198 A [Patent Document 5] JP 2021-128664 A Summary of the Invention [Problem to be solved by the invention]

[0006] The monitoring server 202 determines, based on the importance of a message, whether or not the message is a notification target for notification to the monitoring terminal 203. If the message is a notification target, the monitoring server 202 notifies the monitoring terminal 203 of the notification target message. If the message is not a notification target message, the monitoring server 202 does not notify the monitoring terminal 203 of the notification target message.

[0007] In the monitoring system 200, for example, the ATM 201 is restarted once a day in the middle of the night for system updates, etc. However, the number of ATMs 201 to be monitored exceeds approximately 10,000.

[0008] Furthermore, the NW device 201B notifies the monitoring server 202 of a message when, for example, a port of the NW device 201B itself fails physically or logically. However, even if the ATM 201 is restarted in a restart operation, the NW device 201B notifies the monitoring server 202 of a message indicating a monitoring result, since the restart generates a monitoring result indicating that there is a problem with the port connected to the NW device 201B. In other words, the NW device 201B in the ATM 201 notifies the monitoring server 202 of a message associated with the restart in response to the restart of the ATM 201, even though the ATM 201 is normal.

[0009] Moreover, when the ATMs 201 to be restarted are all restarted at the same time, the monitoring server 202 receives a large number of messages from the ATMs 201 at the same time. Therefore, the monitoring server 202 cannot distinguish, by the filter definition alone, whether the message is notified from the NW device 201B due to a failure occurrence or whether the message is indirectly notified by the restart of the ATMs 201. In other words, in the monitoring server 202, important messages such as actual failures and application failures are buried by the large number of messages related to the restart. Therefore, a method is required for the monitoring server 202 to identify important messages by excluding the large number of messages related to the restart.

[0010] In one aspect, an object of the present invention is to provide an information processing device or the like that can exclude messages associated with rebooting from collected messages and identify important messages related to the occurrence of an error. [Means for solving the problem]

[0011] In one embodiment, an information processing device is connected to a financial transaction device via communication and monitors the financial transaction device. The information processing device has an acquisition unit, a storage unit, an identification unit, and a discrimination unit. The acquisition unit acquires the state of the financial transaction device and the date and time of occurrence of the message from a message collected from the financial transaction device. The storage unit pre-stores a restart time zone of the financial transaction device. The identification unit identifies the number of occurrences of errors in other financial transaction devices in a time zone including the date and time of occurrence of a designated message among the messages. The discrimination unit discriminates whether the designated message is a message associated with a restart based on the number of occurrences of errors in the other financial transaction devices in a time zone including the date and time of occurrence of the designated message and the restart time zone. Effect of the Invention

[0012] One aspect is that it is possible to exclude messages related to reboots from the collected messages and identify important messages regarding error occurrences. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is an explanatory diagram showing an example of a monitoring system according to the present embodiment. [Diagram 2] FIG. 2 is an explanatory diagram showing an example of an ATM. [Diagram 3] FIG. 3 is an explanatory diagram illustrating an example of the monitoring server. [Figure 4] FIG. 4 is an explanatory diagram showing an example of the operation definition memory. [Diagram 5] FIG. 5 is an explanatory diagram illustrating an example of the message management table. [Figure 6] FIG. 6 is a flowchart showing an example of the processing operation of the monitoring server related to the determination processing. [Figure 7] FIG. 7 is a flowchart showing an example of the processing operation of the monitoring server related to the determination processing. [Figure 8] FIG. 8 is a flowchart showing an example of the processing operation of the monitoring server related to the registration processing. [Figure 9]FIG. 9 is a flowchart showing an example of the processing operation of the monitoring server related to the notification target confirmation processing. [Figure 10] FIG. 10 is a flowchart showing an example of a processing operation of the monitoring server related to the on-maintenance confirmation processing. [Figure 11] FIG. 11 is a flowchart showing an example of a processing operation of the monitoring server related to the other device status confirmation processing. [Figure 12] FIG. 12 is a flowchart showing an example of the processing operation of the monitoring server related to the restart time zone confirmation process. [Figure 13] FIG. 13 is an explanatory diagram illustrating an example of an information processing device that executes a discrimination program. [Figure 14] FIG. 14 is an explanatory diagram showing an example of a conventional monitoring system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the information processing device and the like disclosed in the present application will be described in detail with reference to the drawings. Note that the disclosed technology is not limited to the embodiment. In addition, the embodiments shown below may be appropriately combined as long as no contradiction occurs. EXAMPLES

[0015] Fig. 1 is an explanatory diagram showing an example of a monitoring system 1 according to the present embodiment. The monitoring system 1 shown in Fig. 1 includes an ATM 10 to be monitored, a monitoring server 20, and a monitoring terminal 30. It is assumed that the monitoring system 1 includes tens of thousands of ATMs 10.

[0016] The ATM 10 is a financial transaction device such as a monitored cash dispenser that deposits and dispenses bills and the like, and is located at an installation base 2 such as a bank, a train station, a convenience store, etc. The ATM 10 is of the Web type, with the main control application installed on a group of servers in a data center, and realizes message control, screen transitions, and various transactions between the ATM and the affiliated bank host.

[0017] The monitoring server 20 is an information processing device that communicates with multiple ATMs 10 and remotely monitors the status of the ATMs 10. The monitoring server 20 is assumed to be located, for example, in a data center 3. The monitoring terminal 30 is an operator's operation terminal that communicates with the monitoring server 20 and displays the monitoring results of the monitoring server 20 on a screen. The monitoring terminal 30 is assumed to be located, for example, in an operation base 4 such as a monitoring center. For ease of explanation, the monitoring server 20 and the monitoring terminal 30 are described as being one unit, but this is not limited to this and there may be multiple units.

[0018] FIG. 2 is an explanatory diagram showing an example of an ATM 10. The ATM 10 shown in FIG. 2 includes a main body monitoring unit 10A, a NW device 11, a security device 12, a communication IF (Interface) 13, a touch panel 14, a memory 15, an ATM mechanical mechanism 16, a mechanism control unit 17, and a processor 18. The main body monitoring unit 10A monitors the status of the ATM 10, such as the life / death status and the jamming of banknotes, and notifies the monitoring server 20 of a message indicating the monitoring result. The NW device 11 is a device that monitors the status of a network that is connected to the ATM 10 by communication, and notifies the monitoring server 20 of a message indicating the monitoring result. The security device 12 is a device that monitors information related to maintenance and security, such as the opening and closing of a maintenance door of the ATM 10, and notifies the monitoring server 20 of a message indicating the monitoring result.

[0019] A message is information including the date and time of occurrence, device information, and message content. The date and time of occurrence is the date and time when the event related to the message occurred. The device information is information that identifies the device that sent the message. The information that identifies the device is a character string including identification information that identifies the ATM 10, identification information that identifies the NW device 11, and identification information that identifies the security device 12. The message content is a character string such as a keyword that can identify the message content using a filter definition such as "NETWORD ERROR" or "ATM OPEN".

[0020] The communication IF 13 is an interface that connects to the monitoring server 20 and the network via communication. The touch panel 14 is an input / output interface that displays various information and inputs various commands. The memory 15 is a memory that stores various information related to the ATM 10. The ATM mechanical mechanism 16 is a mechanical mechanism used for depositing and withdrawing money in the ATM 10. The mechanism control unit 17 drives and controls the ATM mechanical mechanism 16. The processor 18 controls the entire ATM 10.

[0021] Fig. 3 is an explanatory diagram showing an example of the monitoring server 20. The monitoring server 20 shown in Fig. 3 has a communication IF 21, a storage unit 22, and a processor 23. The communication IF 21 is an interface that connects via communication with the ATM 10 and also connects via communication with the monitoring terminal 30. The storage unit 22 is a memory that stores information related to the monitoring server 20. The processor 23 controls the entire monitoring server 20.

[0022] The storage unit 22 stores various information such as the restart time period of the ATM 10 in advance. The storage unit 22 further includes an operation definition memory 221, a definition filter 222, and a message management table 223. The operation definition memory 221 is a memory for setting and storing operation definitions used in a discrimination process described later. The definition filter 222 is a memory for storing definitions such as message importance and keywords in messages from the ATM 10. The message management table 223 is a table for managing information related to messages from the ATM 10.

[0023] Fig. 4 is an explanatory diagram showing an example of the operation definition memory 221. The operation definition memory 221 shown in Fig. 4 has an ATM restart date and time, a monitoring time, the number of faulty devices, and a verification interval. The ATM restart date and time is a restart date and time including a day of the week and a restart time zone for the ATM 10 that are agreed upon in advance for customer operation. The ATM restart date and time is, for example, a restart time zone such as a day of the week and a time zone for restarting the ATM 10 for a system update or the like. The ATM restart date and time is information used for a restart time zone confirmation process shown in Fig. 12, which will be described later.

[0024] The monitoring time is a predetermined time set from the occurrence date and time, for example, to calculate a first confirmation time period and a second confirmation time period described later. The monitoring time is a predetermined time used in the maintenance confirmation process shown in Fig. 10 and the other device status confirmation process shown in Fig. 11, which will be described later. If the confirmation time period is the time period from the occurrence date and time up to 60 minutes before the occurrence date and time, the monitoring time is 60 minutes.

[0025] The number of faulty devices is a threshold value, for example 10, used in the determination process shown in FIG. 6, described later, for determining the number of errors occurring in the NW devices 11 of the ATMs 10 other than the ATM 10 of the designated message.

[0026] The verification interval is a timing interval for checking a received message from the ATM 10. The verification interval is, for example, one minute, used in the standby process of step S27 shown in Fig. 7. The ATM restart date and time, the monitoring time, the number of faulty devices, and the verification interval can be changed as appropriate.

[0027] Fig. 5 is an explanatory diagram showing an example of the message management table 223. The message management table 223 shown in Fig. 5 has a storage number 223A, an occurrence date and time 223B, device information 223C, a message 223D, a read flag 223E, a maintenance flag 223F, a NW device error count 223G, and a restart time zone flag 223H.

[0028] Storage number 223A is a number that identifies a storage area of ​​a table that stores information related to a message. Occurrence date and time 223B is an area that stores the date and time an error occurred in a message. Device information 223C is an area that stores device information in a message. Message 223D is an area that stores the message content in a message.

[0029] The read flag 223E is an area for storing a flag that identifies whether or not a message has been confirmed. The read flag 223E is set in the determination process shown in Fig. 7. If the message has been confirmed, the read flag 223E is "1", and if the message has not been confirmed, the read flag 223E is "0".

[0030] The under maintenance flag 223F is an area for storing a flag that identifies whether or not the message generation date and time is during maintenance. The under maintenance flag 223F is set by the under maintenance confirmation process shown in Fig. 10. If under maintenance, the under maintenance flag 223F is "1", and if not under maintenance, the under maintenance flag 223F is "0".

[0031] The number of NW equipment errors 223G is an area for storing the number of errors that have occurred in the NW equipment 11 of the ATM 10 other than the ATM 10 that has transmitted the designated message. The number of NW equipment errors 223G is set in the other equipment status confirmation process shown in FIG.

[0032] The restart time zone flag 223H is an area for storing a flag that identifies whether the date and time when the message occurred is within the restart time zone. The restart time zone flag 223H is set by the restart time zone confirmation process shown in Fig. 11. If it is within the restart time zone (within the time), the restart time zone flag 223H is "1", and if it is outside the restart time zone (outside the time), the restart time zone flag 223H is "0".

[0033] The processor 23 has, as functions, an acquisition unit 23A, a specification unit 23B, and a discrimination unit 23C. The acquisition unit 23A acquires the occurrence date and time, device information, and message contents from the messages collected from the ATM 10. The specification unit 23B specifies the number of NW device errors, which is the number of errors occurring related to the NW device 11 of another ATM 10 in a time period including the occurrence date and time of the specified message among the messages. The specification unit 23B specifies the number of NW device errors using the other device status confirmation process shown in FIG. 11. The discrimination unit 23C determines whether the specified message is a message associated with a restart based on the number of NW device errors in a time period including the occurrence date and time of the specified message and the restart time period. The messages include important messages of error occurrence that should be notified to the operator of the monitoring terminal 30, among messages from the main body monitoring unit 10A, the NW device 11, and the security device 12. Furthermore, the messages include, in addition to important messages, messages that do not require a new notification to the operator because the ATM 10 is undergoing maintenance work, and messages associated with a restart that do not require a notification to the operator. The reason why it is not necessary to notify the operator of a new message when the ATM 10 is undergoing maintenance work is that a maintenance worker has gone to the location where the ATM 10 is installed and is performing maintenance work, so a new notification is not necessary.

[0034] The determination unit 23C determines that the designated message is not a message associated with reboot when the number of NW equipment errors exceeds a predetermined threshold and the date and time of the designated message is outside the reboot time zone. The determination unit 23C determines that the designated message is a message associated with reboot when the number of NW equipment errors exceeds a predetermined threshold and the date and time of the designated message is within the reboot time zone. The determination unit 23C determines that the designated message is not a message associated with reboot when the ATM 10 is not under maintenance, the number of NW equipment errors exceeds a predetermined threshold, and the date and time of the designated message is outside the reboot time zone.

[0035] The identifying unit 23B identifies the occurrence date and time of the specified message, and calculates a second check time period from the identified occurrence date and time to a predetermined time before. The identifying unit 23B searches for messages that include a keyword related to an error occurrence in the NW equipment 11 of another ATM 10 whose occurrence date and time falls within the second check time period. Furthermore, the identifying unit 23B identifies the number of NW equipment errors by the number of messages related to the keyword.

[0036] When the monitoring terminal 30 receives a message from the monitoring server 20, it displays a monitoring result screen corresponding to the message. As a result, the operator of the monitoring terminal 30 looks at the monitoring result screen and requests an engineer or the like to investigate or solve the problem.

[0037] 6 and 7 are flow charts showing an example of the processing operation of the monitoring server 20 related to the discrimination process. The processor 23 in the monitoring server 20 sets the operation definition stored in the operation definition memory 221 (step S11). The processor 23 sets the ATM restart date and time, the monitoring time, the threshold value for the number of equipment failures, and the verification interval in the operation definition memory 221. After setting the operation definition, the processor 23 executes the registration process shown in FIG. 8 (step S12).

[0038] After executing the registration process, the processor 23 specifies an unspecified received message (step S13). The processor 23 refers to the read flag 223E of the message management table 223 and determines whether the read flag 223E of the specified received message has been confirmed (step S14). Note that the confirmed read flag 223E is "1".

[0039] If read flag 223E of the specified received message has not been confirmed (step S14: No), processor 23 determines that the message is unconfirmed and executes the notification target confirmation process shown in Fig. 9 for the unconfirmed message (step S15). After executing the notification target confirmation process, processor 23 determines whether the specified received message is a notification target (step S16).

[0040] If the specified received message is a notification target (step S16: Yes), the processor 23 determines the device of the specified received message (step S17). The processor 23 refers to the device information of the received message to determine the device that sent the specified message. The processor 23 determines whether the specified received message is a message of the NW device 11 built in the ATM 10 that sent the received message (step S18).

[0041] If the specified received message is a message from the NW device 11 built in the ATM 10 that sent the received message (step S18: Yes), the processor 23 executes the maintenance confirmation process shown in FIG. 10 (step S19).

[0042] After executing the maintenance confirmation process, the processor 23 refers to the maintenance flag 223F in the message management table 223 to determine whether the date and time of the received message was generated when the ATM 10 was under maintenance (step S20). If the maintenance flag 223F is "1", the processor 23 determines that the date and time of the message was generated when the ATM 10 was under maintenance, and if the maintenance flag 223F is "0", the processor 23 determines that the date and time of the message was generated when the ATM 10 was not under maintenance. If the date and time of the message was generated when the ATM 10 was not under maintenance (step S20: No), the processor 23 executes the other device status confirmation process shown in Fig. 11 (step S21).

[0043] After executing the other device status confirmation process, the processor 23 refers to the NW device error count 223G in the message management table 223, and determines whether the NW device error count is equal to or greater than a threshold (step S22). The threshold is a threshold for the number of faulty devices set in the operation definition memory 221. If the NW device error count is equal to or greater than the threshold (step S22: Yes), the processor 23 executes the restart time zone confirmation process shown in FIG. 12 (step S23).

[0044] After executing the restart time zone confirmation process, the processor 23 refers to the restart time zone flag 223H in the message management table 223, and determines whether the date and time of the specified received message is within the restart time zone (step S24). If the restart time zone flag 223H is "1", the processor 23 determines that the date and time of the message is within the restart time zone, and if the restart time zone flag 223H is "0", the processor 23 determines that the date and time of the message is outside the restart time zone.

[0045] If the date and time of the specified received message is within the restart time period (step S24: Yes), the processor 23 determines that the message is within the restart time period and completes confirmation of the received message (step S26). That is, the processor 23 sets the read flag 223E in the message management table 223 corresponding to the received message to "1" to mark the specified received message as having been confirmed.

[0046] Then, after completing the confirmation of the received message, processor 23 executes a standby process (step S27). The standby process is a process of waiting for a verification interval set in operation definition memory 221. After executing the standby process, processor 23 determines whether or not there is an end interrupt (step S28).

[0047] If there is an end interrupt (step S28: Yes), the processor 23 ends the processing operation shown in Fig. 7. If there is no end interrupt (step S28: No), the processor 23 determines whether there is an unspecified received message (step S29).

[0048] If there is an unspecified received message (step S29: Yes), the processor 23 proceeds to the process of step S13 shown in Fig. 6 in order to specify the unspecified received message. If there is no unspecified received message (step S29: No), the processor 23 proceeds to the registration process of step S12.

[0049] In FIG. 6, when the read flag 223E of the specified received message has been confirmed (step S14: Yes), the processor 23 proceeds to the process of step S26 to complete confirmation of the received message.

[0050] If the specified received message is not a notification target (step S16: No), the processor 23 determines that the message is not a notification target, and proceeds to the process of step S26 to complete confirmation of the received message. Messages that are not a notification target are messages that do not need to be notified to the monitoring terminal 30, such as a message that does not need to be notified to the operator because the ATM 10 is under maintenance, or a message associated with a restart that does not need to be notified to the operator.

[0051] If the specified received message is not a message from the NW device 11 built in the ATM 10 that sent the received message (step S18: No), the processor 23 determines that the specified received message is a message from a NW device 11 other than the ATM 10 that sent the received message. Then, the processor 23 executes a notification process to notify the monitoring terminal 30 of the message (step S25).

[0052] Furthermore, if the date and time when the received message was generated is during maintenance of the ATM 10 (step S20: Yes), the processor 23 proceeds to the process of step S26 to complete the confirmation of the received message.

[0053] If the number of network equipment errors is not equal to or greater than the threshold (step S22: No), the processor 23 proceeds to the process of step S25 to notify the monitoring terminal 30 of the received message.

[0054] If the generation date and time of the specified received message is not within the restart time period (step S24: No), the processor 23 determines that it is outside the restart time period and proceeds to the process of step S25 to notify the monitoring terminal 30 of the received message.

[0055] Fig. 8 is a flowchart showing an example of the processing operation of the monitoring server 20 related to the registration process. In Fig. 8, the processor 23 of the monitoring server 20 temporarily stores the received message (step S31). The processor 23 determines whether or not there is a new received message among the temporarily stored received messages (step S32).

[0056] If there is a new received message (step S32: Yes), the processor 23 specifies an unspecified received message (step S33). The processor 23 determines whether or not there is a storage number in the message management table 223 that identifies an empty storage area for storing the specified received message (step S34).

[0057] If there is a storage number of an empty storage area (step S34: Yes), the processor 23 determines a storage number to store the specified received message from the empty storage numbers (step S35). The processor 23 obtains the generation date and time from the specified received message and registers it in the storage area of ​​the generation date and time 223B in the message management table 223 (step S36). The processor 23 obtains the device information from the specified received message and registers it in the storage area of ​​the device information 223C in the message management table 223 (step S37). Furthermore, the processor 23 registers the message content of the specified received message in the storage area of ​​the message 223D in the message management table 223 (step S38). Furthermore, the processor 23 registers the specified received message as unconfirmed in the storage area of ​​the read flag 223E in the message management table 223 (step S39), and the operation of registering the specified received message in the message management table 223 is completed.

[0058] Then, the processor 23 determines whether or not there is an unspecified received message among the temporarily stored received messages (step S40). If there is an unspecified received message (step S40: Yes), the processor 23 proceeds to the process of step S33 to specify the unspecified received message.

[0059] If there is no unspecified received message (step S40: No), the processor 23 executes a waiting process for the verification interval (step S41). After executing the waiting process for the verification interval, the processor 23 determines whether or not there is an end interrupt (step S42).

[0060] If there is an end interrupt (step S42: Yes), the processor 23 ends the processing operation shown in Fig. 8. If there is no end interrupt (step S42: No), the processor 23 transitions to the processing of step S31 to temporarily store the received message.

[0061] If there is no new received message (step S32: No), the processor 23 proceeds to step S41 where a standby process for the verification interval is executed. If there is no storage number in the free storage area (step S34: No), the processor 23 proceeds to step S41 where a standby process for the verification interval is executed.

[0062] The processor 23 that executes the registration process can periodically and sequentially register the generation date and time, device information, message, and read flag for each newly received message in the message management table 223 .

[0063] Fig. 9 is a flowchart showing an example of the processing operation of the monitoring server 20 related to the notification target confirmation process. In Fig. 9, the processor 23 in the monitoring server 20 compares the filtering definition with the specified received message (step S51). The filtering definition is a filtering definition stored in the definition filter 222, and is a character string of a keyword related to the occurrence of an error in the message and a level of importance. The processor 23 determines whether the specified received message corresponds to the filtering definition (step S52).

[0064] If the specified received message corresponds to the filtering definition (step S52: Yes), the processor 23 sets the specified received message as a notification target (step S53) and ends the processing operation shown in Fig. 9. The notification target message is a message that the monitoring server 20 should notify the monitoring terminal 30 of.

[0065] Moreover, if the specified received message does not correspond to the filtering definition (step S52: No), the processor 23 sets the specified received message as not subject to notification (step S54), and ends the processing operation shown in Fig. 9. Messages not subject to notification are messages that do not need to be notified to the monitoring terminal 30.

[0066] The processor 23 that executes the notification target process compares the filtering definition with the message for each message, and if the message matches the filtering definition, the message is the notification target, and if the message does not match the filtering definition, the message is not the notification target. As a result, the monitoring server 20 can automatically recognize whether or not the specified message is the notification target.

[0067] Fig. 10 is a flow chart showing an example of the processing operation of the monitoring server 20 related to the under-maintenance confirmation process. In Fig. 10, the processor 23 in the monitoring server 20 initializes the under-maintenance flag 223F of the specified received message in the message management table 223 (step S61). The under-maintenance flag 223F is initialized, for example, to "0". The processor 23 acquires the occurrence date and time of the specified received message from the message management table 223 (step S62). The processor 23 calculates a first confirmation time period from the occurrence date and time to a first time before (step S63). The first time is the monitoring time in the operation definition memory 221.

[0068] The processor 23 determines whether or not the first confirmation time period includes a maintenance time period for the ATM 10 (step S64). The maintenance time period is registered at the time of maintenance work. If the first confirmation time period includes a maintenance time period for the ATM 10 (step S64: Yes), the processor 23 determines that the time period is within the maintenance time period. The processor 23 refers to the message 223D and the device information 223C in the message management table 223, and searches for keywords related to maintenance from the content of the specified received message (step S65). The keywords related to maintenance are, for example, character strings indicating identification information of the security device 12 or the like, or a maintenance door open, etc.

[0069] The processor 23 determines whether or not there is a keyword related to maintenance based on the search result (step S66). If there is a keyword related to maintenance (step S66: Yes), the processor 23 sets the under-maintenance flag 223F of the specified received message in the message management table 223 to under maintenance (step S67), and ends the processing operation shown in Fig. 10. The under-maintenance flag 223F of the under-maintenance message is "1".

[0070] If there is no keyword related to maintenance (step S66: No), the processor 23 sets the under-maintenance flag 223F of the specified received message in the message management table 223 to no maintenance (step S68), and ends the processing operation shown in Fig. 10. The under-maintenance flag 223F of no maintenance is "0".

[0071] If there is no maintenance time period for the ATM 10 within the first confirmation time period (step S64: No), the processor 23 proceeds to the processing operation of step S68 in which the processor 23 sets the under-maintenance flag 223F of the specified received message in the message management table 223 to no maintenance.

[0072] If the first confirmation time period includes a maintenance time period for ATM 10, processor 23 refers to message 223D and device information 223C in message management table 223 to search for keywords related to maintenance from the content of the specified received message. If a keyword related to maintenance is found, processor 23 sets under-maintenance flag 223F of the specified received message in message management table 223 to under maintenance. If a keyword related to maintenance is not found, processor 23 sets under-maintenance flag 223F of the specified received message in message management table 223 to no maintenance. As a result, monitoring server 20 can recognize whether or not the specified message is a message associated with maintenance work.

[0073] Although the maintenance time slot in step S64 is registered at the time of maintenance work, messages may be searched for using keywords related to maintenance, and the date and time of occurrence of a message containing a keyword related to maintenance may be set as the maintenance time slot, and this can be changed as appropriate.

[0074] Fig. 11 is a flow chart showing an example of the processing operation of the monitoring server 20 related to other device status confirmation processing. In Fig. 11, the processor 23 in the monitoring server 20 initializes the NW device error count 223G in the message management table 223 (step S71). The processor 23 acquires the occurrence date and time of the specified received message from the message management table 223 (step S72). The processor 23 calculates a second confirmation time period from the occurrence date and time to a second time before (step S73). The second time is the monitoring time in the operation definition memory 221.

[0075] The processor 23 registers the NW device 11 of the ATM 10 that has transmitted the specified received message as its own NW device (step S74). The processor 23 refers to the message management table 223 and determines whether or not there is an unspecified message of an occurrence date and time of another NW device 11 other than the own NW device 11 within the second confirmation time period (step S75).

[0076] If there is an unspecified message of the occurrence date and time of another NW device 11 within the second confirmation time period (step S75: Yes), the processor 23 specifies the unspecified message (step S76). The processor 23 searches for keywords related to the error of the other NW device 11 within the specified message (step S77).

[0077] The processor 23 determines whether or not the specified message contains a keyword related to an error of another NW device 11 (step S78). If the specified message contains a keyword related to an error of another NW device 11 (step S78: Yes), the processor 23 increments the number of NW equipment errors by +1 (step S79). After incrementing the number of NW equipment errors by +1, the processor 23 proceeds to processing in step S75 for determining whether or not there is a message with an unspecified occurrence date and time of another NW device 11 within the second confirmation time period.

[0078] If there is no message with an unspecified occurrence date and time of another NW device 11 within the second check time period (step S75: No), the processor 23 ends the processing operation shown in Fig. 11. If there is no keyword related to an error of another NW device 11 in the specified message (step S78: No), the processor 23 proceeds to the processing of step S75 for determining whether there is a message with an unspecified occurrence date and time of another NW device 11 within the second check time period.

[0079] The processor 23 that executes the other device status confirmation process specifies an unspecified message if there is an unspecified message with an occurrence date and time of another NW device 11 within the second confirmation time period. The processor 23 increments the number of NW equipment errors by +1 if the specified message contains a keyword related to an error of another NW device 11. As a result, the monitoring server 20 can count the number of NW equipment errors of the specified message of other NW devices 11 other than the own NW device 11.

[0080] Fig. 12 is a flowchart showing an example of the processing operation of the monitoring server 20 related to the restart time zone confirmation process. In Fig. 12, the processor 23 in the monitoring server 20 initializes the restart time zone flag 223H of the specified received message in the message management table 223 (step S81). The processor 23 obtains the occurrence date and time of the specified received message from the message management table 223 (step S82). The processor 23 determines whether the occurrence date and time is within the restart time zone (step S83).

[0081] If the occurrence date and time is within the restart time zone (step S83: Yes), the processor 23 determines that the occurrence date and time is within the time zone. The processor 23 sets the restart time zone flag 223H of the specified received message in the message management table 223 to within the time zone (step S84), and ends the processing operation shown in Fig. 12. The within-time restart time zone flag 223H is set to "1".

[0082] If the occurrence date and time is not within the restart time zone (step S83: No), the processor 23 determines that the occurrence date and time is outside the time zone. The processor 23 sets the restart time zone flag 223H of the specified received message in the message management table 223 to outside the time zone (step S85), and ends the processing operation shown in Fig. 12. Note that the outside restart time zone flag 223H is set to "0".

[0083] The processor 23 executing the restart time zone confirmation process determines whether the date and time of occurrence of the specified message is within the restart time zone, and if the date and time of occurrence is within the restart time zone, sets the restart time zone flag 223H of the specified message to "1." If the date and time of occurrence is outside the restart time zone, the processor 23 sets the restart time zone flag 223H of the specified message to "0." As a result, the monitoring server 20 can recognize whether the specified message is a message that involves a restart.

[0084] The monitoring server 20 of this embodiment identifies the number of NW equipment errors of other NW equipment 11 in a second confirmation time period including the occurrence date and time of the specified message among the messages. The monitoring server 20 determines whether the specified message is a message associated with rebooting based on the number of NW equipment errors and the reboot time period. If the number of NW equipment errors exceeds a predetermined threshold and the occurrence date and time of the specified message is outside the reboot time period, the monitoring server 20 determines that the specified message is not a message associated with rebooting but an important message. As a result, the monitoring server 20 excludes messages associated with rebooting from the collected messages, allowing the operator of the monitoring terminal 30 to identify the important message regarding the occurrence of an error.

[0085] When the number of network device errors exceeds a predetermined threshold and the date and time of the specified message is within the restart time zone, the monitoring server 20 determines that the specified message is a message associated with restart. As a result, the monitoring server 20 does not notify the monitoring terminal 30 of unnecessary messages associated with restart, so that the operator of the monitoring terminal 30 can avoid a situation where an important message is buried under messages associated with restart.

[0086] When the number of network device errors exceeds a predetermined threshold value while the device is not undergoing maintenance, and the date and time of the specified message is outside the restart time zone, the monitoring server 20 determines that the specified message is not a message associated with restart, but an important message regarding the occurrence of an error. As a result, the monitoring server 20 excludes messages associated with restart and maintenance work from the collected messages, allowing the operator of the monitoring terminal 30 to identify important messages regarding the occurrence of an error.

[0087] The monitoring server 20 identifies the occurrence date and time of the specified message, and calculates a second check time period from the identified occurrence date and time to a second time period before that. The monitoring server 20 searches for messages that include a keyword related to an error occurrence in another NW device 11 whose occurrence date and time falls within the second check time period. The monitoring server 20 identifies the number of NW equipment errors by the number of messages related to that keyword. As a result, the monitoring server 20 can identify the number of NW equipment errors.

[0088] Furthermore, the NW device 11 notifies the monitoring server 20 of a message when a port of the NW device 11 itself fails physically or logically. The NW device 11 also notifies the monitoring server 20 of a message when maintenance work is performed on the ATM 10 main body or the NW device 11 itself, for example, when a LAN cable connecting the ATM 10 and the NW device 11 is unplugged. Moreover, even when the ATM 10 is rebooted, the NW device 11 notifies the monitoring server 20 of a message indicating the monitoring result, since a monitoring result indicates that there is a problem with the port connected to the NW device 11.

[0089] When multiple ATMs 10 are rebooted simultaneously, the monitoring server 20 receives a large number of messages from each ATM 10 at the same time. However, the monitoring server 20 of this embodiment excludes messages related to reboots and maintenance work from the large number of messages to be notified, so that the operator of the monitoring terminal 30 can distinguish important messages such as actual failures and application failures.

[0090] For the sake of convenience, the monitoring server 20 is implemented by an information processing device. However, the monitoring server 20 may be implemented by a cloud service, and may be modified as appropriate.

[0091] Although an ATM 10 has been given as an example of a monitored object, the monitored object is not limited to this and may be any device used in a financial institution system, and may be changed as appropriate.

[0092] An example has been given of setting the same monitoring time as the first time for calculating the first confirmation time period and the second time for calculating the second confirmation time period, but this is not limited to this and different times may be set.

[0093] Furthermore, each component of each unit shown in the figure does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each unit is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

[0094] Furthermore, the various processing functions performed by each device may be executed in whole or in part on a CPU (Central Processing Unit) (or a microcomputer such as an MPU (Micro Processing Unit) or an MCU (Micro Controller Unit)). It goes without saying that the various processing functions may be executed in whole or in part on a program analyzed and executed by a CPU (or a microcomputer such as an MPU or an MCU), or on hardware using wired logic.

[0095] The various processes described in this embodiment can be realized by executing a program prepared in advance on an information processing device. Therefore, an example of an information processing device that executes a program having the same functions as those in the above embodiment will be described below. Fig. 13 is an explanatory diagram showing an example of an information processing device that executes a discrimination program.

[0096] 13 includes a communication unit 101, a hard disk drive (HDD) 102, a read only memory (ROM) 103, and a random access memory (RAM) 104. The information processing device 100 further includes a CPU 105 and a bus 106.

[0097] The information processing device 100 is a computer that is connected to a financial transaction device via communication and monitors the financial transaction device. The HDD 102 stores in advance the restart time period of the financial transaction device.

[0098] A discrimination program that performs the same functions as those of the above embodiment is stored in advance in the ROM 103. The discrimination program may be recorded in a recording medium that can be read by a drive (not shown) instead of the ROM 103. The recording medium may be, for example, a portable recording medium such as a CD-ROM, a DVD, a USB memory, or an SD card, or a semiconductor memory such as a flash memory. The discrimination programs are, as shown in FIG. 13, an acquisition program 103A, a specific program 103B, and a discrimination program 103C. The acquisition program 103A, the specific program 103B, and the discrimination program 103C may be appropriately integrated or distributed.

[0099] Then, CPU 105 reads out these programs 103A, 103B, and 103C from ROM 103, and develops and executes each of these read out programs on RAM 104. Then, CPU 105 executes each of programs 103A, 103B, and 103C on RAM 104, as shown in Fig. 13, thereby functioning as an acquisition process 104A, an identification process 104B, and a discrimination process 104C.

[0100] CPU 105 acquires the status of the financial transaction device and the date and time of the message from the messages collected from the financial transaction device. CPU 105 identifies the number of errors that occurred at other financial transaction devices in a time period including the date and time of the specified message from among the messages. CPU 105 determines whether the specified message is a message associated with a restart based on the number of errors that occurred at other financial transaction devices in a time period including the date and time of the specified message and the restart time period. As a result, it is possible to exclude messages associated with a restart from the collected messages and identify important messages related to error occurrence. [Explanation of symbols]

[0101] 1. Surveillance System 10 ATM 10A Main unit monitoring section 11 NW equipment 12 Security equipment 20 Monitoring Server 23 Processors 23A Acquisition Department 23B Specific part 23C Discrimination part 30 Monitoring terminal

Claims

1. An information processing device that is connected to a financial transaction device via communication and monitors the financial transaction device, an acquisition unit for acquiring a state of the financial transaction device and a generation date and time of the message from the message collected from the financial transaction device; a storage unit that stores in advance a restart time period for the financial transaction device; an identification unit that identifies the number of errors occurring in other financial transaction devices during a time period including the date and time of the occurrence of a specified message among the messages; a determination unit that determines whether the designated message is a message associated with a restart based on the number of errors that have occurred in the other financial transaction device during a time period including the date and time of the designated message and the restart time period; 13. An information processing device comprising:

2. The discrimination unit is 2. The information processing apparatus according to claim 1, wherein if the number of occurrences of the error exceeds a predetermined threshold and the date and time of occurrence of the specified message is outside the restart time period, the specified message is determined to be not a message associated with a restart.

3. The discrimination unit is 3. The information processing apparatus according to claim 1, further comprising: a step of: determining that a specified message is a message associated with a reboot when the number of occurrences of the error exceeds a predetermined threshold and the date and time of occurrence of the specified message is within the reboot time period.

4. The discrimination unit is 2. The information processing device according to claim 1, further comprising: a processor configured to determine that a specified message is not a message associated with a restart when the financial transaction device is not undergoing maintenance, the number of occurrences of the error exceeds a predetermined threshold, and the date and time of occurrence of the specified message is outside the restart time zone.

5. The identification unit is The information processing device according to claim 1, further comprising: identifying a date and time when the specified message occurred; calculating a confirmation time period from the identified date and time of occurrence to a predetermined time before the date and time of occurrence; searching for messages among the messages that contain a keyword related to the occurrence of an error at the other financial transaction device and whose date and time of occurrence fall within the confirmation time period; and identifying the number of occurrences of errors at the other financial transaction device based on the number of messages related to the keyword.

6. A monitoring system having a financial transaction device and an information processing device that is connected to a plurality of financial transaction devices via communication and monitors the financial transaction devices, The information processing device includes: an acquisition unit for acquiring a state of the financial transaction device and a generation date and time of the message from the message collected from the financial transaction device; a storage unit that stores in advance a restart time period for the financial transaction device; an identification unit that identifies the number of errors occurring in other financial transaction devices during a time period including the date and time of the occurrence of a specified message among the messages; a determination unit that determines whether the designated message is a message associated with a restart based on the number of errors that have occurred in the other financial transaction device during a time period including the date and time of the designated message and the restart time period; A monitoring system comprising:

7. an information processing device connected to a financial transaction device via communication and monitoring the financial transaction device, storing a restart time period of the financial transaction device in advance; acquiring a state of the financial transaction device and a generation date and time of the message from the message collected from the financial transaction device; Identifying the number of errors occurring in other financial transaction devices during a time period including the date and time of the occurrence of the specified message among the messages; Based on the number of errors occurring in the other financial transaction devices during a time period including the date and time of the occurrence of the specified message and the restart time period, it is determined whether the specified message is a message associated with a restart. A method for determining whether a particular

8. A processor of an information processing device that is connected to a financial transaction device via communication and monitors the financial transaction device, storing a restart time period of the financial transaction device in advance; acquiring a state of the financial transaction device and a generation date and time of the message from the message collected from the financial transaction device; Identifying the number of errors occurring in other financial transaction devices during a time period including the date and time of the occurrence of the specified message among the messages; Based on the number of errors occurring in the other financial transaction devices during a time period including the date and time of the occurrence of the specified message and the restart time period, it is determined whether the specified message is a message associated with a restart. A discrimination program that causes the processor to execute a process.

Images