Processing device, program, and method

Abstract

To provide a processing device, a program, and a method with which it is possible to achieve prompt convergence of a fault, even when an incident occurs during performing alteration work on a cloud environment.SOLUTION: Provided is a processing device comprising: a first processing unit that, upon receiving incident information from a monitoring device, performs processing to extract first alteration work that was performed at incident occurrence time; a second processing unit that, upon completing the extraction of the first alteration work, performs processing to extract, from the first alteration work, second alteration work associated with a host in which an incident has occurred; a third processing unit that, upon completing the extraction of the second alteration work, performs processing to confirm that the second alteration work is a verified work; and a fourth processing unit that, upon completing the confirmation that the second alteration work is a verified work, outputs escalation information that designates an escalation destination and that corresponds to the host in which an incident has occurred and includes alteration work information on the second alteration work.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a processing device, a program, and a method. [Background technology]

[0002] The system monitors the status of various devices that are installed in a remote data center or the like and that constitute a cloud infrastructure. For example, Patent Document 1 describes a technology in which a resource monitoring tool starts a test virtual machine on a computer system of a computer resource service and monitors various metrics that indicate the performance of the test virtual machine over time in order to monitor the performance of a computer resource service in real time.

[0003] As a result of monitoring the various devices that make up the cloud infrastructure, if a change in the state of the devices that could cause a problem (hereafter referred to as an "incident") is detected, an alert is sent to relevant parties such as operations staff, system administrators, system engineers, and users via email, telephone, etc. This type of information transmission mechanism is generally known as "escalation."

[0004] For example, Patent Document 2 discloses a server management system that generates an alert notification email with a sender according to the cause of the failure and filters it on the recipient side in order to enable a quick response to the failure. Patent Document 3 discloses a notification device that, when an incident occurs in a monitored system, determines the order of alert notifications based on the authority of multiple administrators, and notifies the alerts in order according to the notification order if the administrator who received the notification is unable to respond.

[0005] On the other hand, the various devices and software that make up the cloud infrastructure may undergo modification such as configuration changes and updates. These modifications are carried out after considering the impact of the modification in advance, calculating the risk level, and preparing a backout plan, and then obtaining approval. For this reason, the modification process, including advance verification, is controlled by release management. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2018-022520 A [Patent Document 2] International Publication No. 2008 / 065695 [Patent Document 3] JP 2005-250760 A Summary of the Invention [Problem to be solved by the invention]

[0007] However, even if the cause of the incident is due to ongoing change work, an alert is first sent to the relevant parties, such as the operations staff, system administrator, systems engineer, and users. Only after it is identified that the change work may be the cause is the person who carried out the change work contacted for confirmation. This means that it takes time for the worker to recognize the impact of the work after it starts to have an effect and to implement the backout plan that was prepared in advance, and during that time, the systems running on the cloud platform may continue to be affected. In particular, if the change work is work that has an impact on a wide area of ​​the cloud environment, the scope of the failure will be wider.

[0008] An object of the present invention is to provide a processing device, a program, and a method that can achieve rapid resolution of a failure even if an incident occurs while performing change work on a cloud environment. [Means for solving the problem]

[0009] A first aspect of the present disclosure is a method for manufacturing a semiconductor device comprising: a first processing unit that, when receiving incident information from a monitoring device, extracts at least one first change operation that is being performed at the time when the incident occurred, based on an incident occurrence time included in the incident information and change operation information managed by an information management unit; a second processing unit that, when the at least one first change operation is extracted by the first processing unit, performs a process of extracting a second change operation related to the incident-occurrence host from the at least one first change operation based on first host information that identifies the incident-occurrence host included in the incident information and all host information managed by the information management unit; a third processing unit that performs processing to confirm, when the second change operation is extracted by the second processing unit, that the second change operation is a verified operation that is performed according to a verified procedure and a predetermined procedure, based on change operation information of the second change operation and release information managed by the information management unit; a fourth processing unit that outputs, when the third processing unit confirms that the second change operation is a verified operation, escalation information specifying an escalation destination, the escalation information corresponding to the incident occurrence host and including change operation information of the second change operation; The processing device includes:

[0010] A second aspect of the present disclosure is Computer, a first processing unit that, when receiving incident information from a monitoring device, extracts at least one first change operation that is being performed at the time the incident occurred, based on an incident occurrence time included in the incident information and change operation information managed by an information management unit; a second processing unit that, when the at least one first change operation is extracted by the first processing unit, performs a process of extracting a second change operation related to the incident-occurrence host from the at least one first change operation, based on first host information that identifies the incident-occurrence host included in the incident information and all host information managed by the information management unit; a third processing unit that performs processing to confirm, when the second change operation is extracted by the second processing unit, that the second change operation is a verified operation that is performed according to a verified procedure and a predetermined procedure, based on change operation information of the second change operation and release information managed by the information management unit; and a fourth processing unit that outputs, when the third processing unit has confirmed that the second change operation is a verified operation, escalation information specifying an escalation destination, the escalation information corresponding to the incident occurrence host and including change operation information of the second change operation; This is a program that functions as a

[0011] A third aspect of the present disclosure is 1. A method for generating escalation information by a processing device, comprising: The processing device comprises: When receiving incident information from a monitoring device, a first process is performed to extract at least one first change operation that was being performed at the incident occurrence time based on an incident occurrence time included in the incident information and change operation information managed by an information management unit; performing a second process, when the at least one first change operation is extracted by the first process, of extracting a second change operation related to the incident-occurrence host from the at least one first change operation, based on first host information identifying the incident-occurrence host included in the incident information and all host information managed by the information management unit; performing a third process for confirming, when the second change operation is extracted by the second process, that the second change operation is a verified operation that is carried out according to a verified procedure and a predetermined procedure, based on change operation information of the second change operation and release information managed by the information management unit; a fourth process is performed when the third process has confirmed that the second change operation is a verified operation, the fourth process being escalation information that specifies an escalation destination, the escalation information corresponding to the incident occurrence host, and including change operation information of the second change operation. This is the method. Effect of the Invention

[0012] According to the present invention, even if an incident occurs while a change operation is being carried out on a cloud environment, the failure can be quickly resolved. [Brief description of the drawings]

[0013] [Figure 1] 1 is a block diagram showing an example of an overall configuration of an alert notification system according to an embodiment of the present invention. [Diagram 2] 11 is a schematic diagram showing an example of incident information received by a processing device; [Diagram 3] 13 is a diagram illustrating an example of a configuration of an escalation list. [Figure 4] 11 is a flowchart showing an example of the flow of an "escalation list creation process" by the processing device according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] An embodiment of the present invention will now be described in detail with reference to the drawings.

[0015] <Overall configuration of the alert notification system> First, an example of the overall configuration of an alert notification system according to an embodiment of the present invention will be described with reference to Fig. 1. As shown in Fig. 1, the alert notification system is configured to include a system group 10 including a plurality of monitored systems, a management system group 20 including various management systems, a related party terminal group 30 which are terminals of various related parties in the cloud infrastructure operation, a monitoring base 40 for monitoring the system group 10, and a processing device 50 which is an escalation list creation system that executes escalation list creation processing. At the monitoring base 40, an escalation system 400 that executes escalation, and a monitoring system 401 that monitors the monitored systems are disposed.

[0016] Each of the multiple monitored systems included in the system group 10 may be located in a geographically distributed location. Also, the terminals of various stakeholders in the cloud infrastructure operation included in the stakeholder terminal group 30 may be located in a remote location. Each system in the system group 10, each management system in the management system group 20, each stakeholder terminal in the stakeholder terminal group 30, the escalation system 400, the monitoring system 401, and the processing device 50 are connected via a network such as a WAN (Wide Area Network) and are capable of communicating with each other regardless of location. The processing device 50 cooperates with the monitoring system 401, the management system group 20, and the escalation system 400 to execute an escalation list creation process.

[0017] The management system group 20 includes an incident management system 200 that manages information on incidents that occur on the cloud platform, a change management system 201 that manages information on change work performed on the cloud platform, a configuration management system 202 that manages information on the various devices and networks that make up the cloud platform, a release management system 203 that manages a series of processes from planning to implementation, including verification for safe and accurate updates to various systems and software on the cloud platform, and an entrance management system 204 that manages information on entrance to locations such as data centers where equipment that makes up the cloud platform is installed.

[0018] Here, the operation of the alert notification system will be briefly described. The monitoring system 401 at the monitoring station 40 monitors each of the monitored systems in the system group 10, and when it detects an incident that cannot be handled automatically, it notifies the processing device 50 of the occurrence of the incident. The processing device 50 performs various checks and judgments based on the information held by each management system in the management system group 20, and executes an escalation list creation process for the monitored system in which the incident occurred (hereinafter referred to as the "incident-occurring host" or "host").

[0019] If a predetermined condition is met, such as when a change operation is being performed at the time of the incident and the change operation is an operation on the incident host, the processing device 50 updates the escalation list for the host held by the processing device 50 so that information on the change operation is included in the escalation information. The processing device 50 transmits the escalation list for the incident host as escalation information to the escalation system 400. The escalation system 400 executes escalation to send an alert notification to the group of related party terminals 30 based on the escalation information.

[0020] (Hardware configuration) The processing device 50 is an information processing device such as a computer, and includes a CPU (Central Processing Unit), a RAM (Random Access Memory) as a temporary storage area, a communication interface (I / F) for communicating with an external device, and a non-volatile storage unit. The CPU, RAM, communication I / F, and storage unit are connected to each other via a bus.

[0021] The storage unit is realized by a hard disk drive (HDD), a solid state drive (SSD), a flash memory, etc. The storage unit stores various programs, such as a program for executing the "escalation list creation process", and various data. The CPU reads out the programs from the storage unit and executes them using the RAM as a work area.

[0022] Each system in the system group 10, each management system in the management system group 20, each stakeholder terminal in the stakeholder terminal group 30, the escalation system 400, and the monitoring system 401 are also information processing devices such as computers, and like the processing device 50, are equipped with a CPU, RAM, a communication I / F, and a non-volatile memory unit.

[0023] Each of the related party terminal used by the related party and the monitoring system 401 used by the operation staff may include an operation input unit that accepts input of various information from a user, and a display unit that displays various information to the user. The operation input unit and the display unit are connected to a bus via an I / F. Examples of the operation input unit include a keyboard, a mouse, a remote control, a touch panel, etc. Examples of the display unit include a display, etc.

[0024] (Functional configuration of the processing device 50) The processing device 50 includes a notification receiving unit 500, a change management confirmation processing unit 501, a configuration management confirmation processing unit 502, a release management confirmation processing unit 503, a worker information acquiring unit 504, an escalation information transmitting unit 505, an escalation order determining unit 506, and an escalation list storage unit 507. The CPU of the processing device 50 executes a program for "escalation list creation processing", causing the information processing device constituting the processing device 50 to function as each of these units.

[0025] The notification receiving unit 500 receives notifications from the monitoring system 401. The monitoring system 401 constantly monitors each monitored system included in the system group 10. The monitoring system 401 includes a monitoring processing unit 401a, a notification processing unit 401b, and an automatic response execution unit 401c. When an incident occurs in any monitored system, the monitoring processing unit 401a detects the occurrence of the incident. The automatic response execution unit 401c refers to past incident information from the incident management system 200, and executes automatic response if automatic response is possible.

[0026] If the automatic handling execution unit 401c cannot handle the incident automatically, the notification processing unit 401b transmits incident information to the notification receiving unit 500 of the processing device 50 to notify the occurrence of the incident. For example, the incident information may include information such as the time of occurrence, a host name indicating the host where the incident occurred, and the alert content, as shown in FIG.

[0027] The change management confirmation processing unit 501 confirms the change work being performed at the time the incident occurred. The configuration management confirmation processing unit 502 confirms whether there is a relationship between the change work being performed and the host where the incident occurred. The release management confirmation processing unit 503 confirms whether the change work being performed has been verified and whether it has been performed according to a predetermined procedure. The worker information acquisition unit 504 acquires worker information for escalating the issue to a local worker.

[0028] The escalation list storage unit 507 stores an escalation list in a table for each monitored system, as shown in Fig. 3. The escalation list is a list of escalation destinations and details (escalation method and contact information). Each table has items such as priority, name, escalation method, phone number, email address, and information.

[0029] The escalation order determination unit 506 determines the escalation order based on the received incident information. That is, the escalation order determination unit 506 maintains or updates the table of incident-occurred hosts stored in the escalation list storage unit 507 based on the confirmation results of the change management confirmation processing unit 501, the configuration management confirmation processing unit 502, and the release management confirmation processing unit 503.

[0030] When a first condition described with reference to Fig. 4 is satisfied, the escalation order determination unit 506 updates the table by adding the change work information acquired from the change management system 201 to the "information" item of the table of the incident-occurred host stored in the escalation list storage unit 507, and generates an information transmission table (S6 in Fig. 4). When a second condition described with reference to Fig. 4 is satisfied, the escalation order determination unit 506 updates the table corresponding to the incident-occurred host stored in the escalation list storage unit 507 by adding a worker to the top of the list (priority 1), and generates an information transmission table (S8 in Fig. 4).

[0031] The escalation information transmission unit 505 transmits a table corresponding to the incident-occurred host stored in the escalation list storage unit 507 to the escalation system 400 as escalation information. The escalation system 400 executes escalation based on the escalation information. For example, if the incident-occurred host described in the incident information is system A, escalation starts from "AAAA" of priority "1" according to the table of system A shown in FIG.

[0032] <Escalation list creation process> Next, the "escalation list creation process" program will be described with reference to Fig. 4. This program is executed by the CPU of the processing device 50. This program is started when an incident is detected and the notification receiving unit 500 of the processing device 50 receives a notification of the occurrence of the incident and incident information from the monitoring system 401.

[0033] (Step S1) First, in step S1, the escalation order determination unit 506 makes an inquiry to the change management confirmation processing unit 501. The change management confirmation processing unit 501 confirms whether or not change work was performed at the time of occurrence based on the occurrence time information included in the incident information and the change work information held by the change management system 201, and provides the confirmation result to the escalation order determination unit 506. If change work was not performed at the time of occurrence, the process proceeds to step S2. On the other hand, if change work was performed at the time of occurrence, the process proceeds to step S3.

[0034] (Step S2) If no change work was performed at the time of occurrence in step S1, then in step S2, the escalation information transmission unit 505 transmits a table corresponding to the incident occurrence host stored in the escalation list memory unit 507 to the escalation system 400 as escalation list information.

[0035] (Step S3) If change work was performed at the time of occurrence in step S1, then in step S3, the escalation order determination unit 506 queries the configuration management confirmation processing unit 502. Based on the host name included in the incident information and the device and network information held by the configuration management system 202, the configuration management confirmation processing unit 502 confirms whether the change work performed at the time of occurrence is work related to the incident occurrence host, and provides the confirmation result to the escalation order determination unit 506. If it is not a related work, the process proceeds to step S4. On the other hand, if it is a related work, the process proceeds to step S5.

[0036] (Step S4) If it is determined in step S3 that the task is not related, then in step S4, the escalation information transmission unit 505 transmits a table corresponding to the incident-occurring host stored in the escalation list storage unit 507 to the escalation system 400 as escalation list information.

[0037] (Step S5) If it is determined in step S3 that the work is related, then in step S5, the escalation order determination unit 506 queries the release management confirmation processing unit 503. Based on the change work information held by the change management system 201 and the process management information of the change work held by the release management system 203, the release management confirmation processing unit 503 confirms that the work being performed has been verified in advance and is being performed according to a predetermined procedure, and provides the confirmation result to the escalation order determination unit 506. If the work being performed has been verified in advance and is being performed according to a predetermined procedure, there is no problem with the work itself, so there is no need to issue an alert to the worker. If confirmation is obtained, the process proceeds to step S6. On the other hand, if confirmation is not obtained, the process proceeds to step S7.

[0038] (Step S6) If confirmation is obtained in step S5, then in step S6, the escalation order determination unit 506 adds the change work information held by the change management system 201 to the "information" item of the table corresponding to the incident occurrence host held in the escalation list storage unit 507, updates the table, and generates an information transmission table. This makes it possible to communicate that change work is currently being carried out simultaneously when escalating.

[0039] (Step S7) If confirmation is not obtained in step S5, i.e., if the work has not been properly released, then in step S7, the worker information acquisition unit 504 acquires the name and contact information of the worker performing the corresponding change work from the entry management system 204.

[0040] (Step S8) Once the processing related to the acquisition in step S7 is completed, in step S8, the escalation order determination unit 506 updates the table corresponding to the incident occurrence host stored in the escalation list memory unit 507 by adding the worker to the top of the list (priority 1) and generates an information transmission table.

[0041] (Step S9) Next, in step S9, the escalation information transmission unit 505 transmits the table corresponding to the incident-occurred host stored in the escalation list storage unit 507 to the escalation system 400 as escalation list information, and ends the routine. If the table has been updated, the updated table is transmitted. The escalation system 400 performs escalation to relevant parties by telephone or e-mail based on the received escalation list information.

[0042] As described above, according to this embodiment, if an incident occurs during modification work on a cloud environment, escalation is promptly performed to a local worker, and a predetermined backout plan can be implemented, thereby realizing rapid resolution of the problem even in such a case. Even if there is no problem with the work itself, by adding modification work information to the escalation list information, it is possible to communicate that modification work is currently being performed simultaneously when escalation is performed.

[0043] <Modification> It is needless to say that the configurations of the processing device, program, and method described in the above embodiment are merely examples, and that the configurations may be changed without departing from the spirit of the present invention.

[0044] In the above-described embodiments, the functions realized by software when the CPU executes a program may be realized by hardware such as a semiconductor integrated circuit, or may be realized by a combination of hardware and software.

[0045] In the above embodiment, the various programs are pre-stored (installed) in the storage unit, but the present invention is not limited to this. The various programs may be provided in a form recorded on a recording medium such as a CD-ROM (Compact Disk Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), or a USB (Universal Serial Bus) memory. The various programs may be downloaded from an external device via a network.

[0046] <Other> Here, the correspondence between each component of the first aspect of the processing device of the present invention and each part of the embodiment will be described. The processing device 50, which is an escalation list creation system, includes a change management confirmation processing unit 501, a configuration management confirmation processing unit 502, a release management confirmation processing unit 503, and an escalation order determination unit 506. Here, the processing device 50, which is an escalation list creation system, is an example of a "processing device", and an example of a "processing device" is not limited to the processing device 50, which is an escalation list creation system.

[0047] When change management confirmation processing unit 501 receives incident information from a monitoring device, it performs processing to extract at least one first change task that was being performed at the time the incident occurred, based on the incident occurrence time included in the incident information and the change task information managed by the information management unit. Here, change management confirmation processing unit 501 is an example of a "first processing unit", and examples of the "first processing unit" are not limited to change management confirmation processing unit 501.

[0048] When the at least one first change operation is extracted by the change management confirmation processing unit 501, the configuration management confirmation processing unit 502 performs a process of extracting a second change operation related to the incident occurrence host from the at least one first change operation, based on first host information identifying the incident occurrence host included in the incident information and all host information managed by the information management unit. Here, the configuration management confirmation processing unit 502 is an example of a "second processing unit", and examples of the "second processing unit" are not limited to the configuration management confirmation processing unit 502.

[0049] When the second change work is extracted by the configuration management confirmation processing unit 502, the release management confirmation processing unit 503 performs a process of confirming that the second change work is a verified procedure and is a verified work that is performed according to a predetermined procedure, based on the change work information of the second change work and the release information managed by the information management unit. Here, the release management confirmation processing unit 503 is an example of a "third processing unit", and an example of the "third processing unit" is not limited to the release management confirmation processing unit 503.

[0050] When the release management confirmation processing unit 503 confirms that the second change work is a verified work, the escalation order determination unit 506 outputs escalation information specifying an escalation destination, which corresponds to the incident occurrence host and includes change work information of the second change work. Here, the escalation order determination unit 506 is an example of a "fourth processing unit", and an example of the "fourth processing unit" is not limited to the escalation order determination unit 506.

[0051] <Additional Notes> In addition, the following supplementary notes are disclosed in relation to the above-described embodiment. [Appendix 1] a first processing unit that, when receiving incident information from a monitoring device, extracts at least one first change operation that is being performed at the time when the incident occurred, based on an incident occurrence time included in the incident information and change operation information managed by an information management unit; a second processing unit that, when the at least one first change operation is extracted by the first processing unit, performs a process of extracting a second change operation related to the incident-occurrence host from the at least one first change operation based on first host information that identifies the incident-occurrence host included in the incident information and all host information managed by the information management unit; a third processing unit that performs processing to confirm, when the second change operation is extracted by the second processing unit, that the second change operation is a verified operation that is performed according to a verified procedure and a predetermined procedure, based on change operation information of the second change operation and release information managed by the information management unit; a fourth processing unit that outputs, when the third processing unit confirms that the second change operation is a verified operation, escalation information specifying an escalation destination, the escalation information corresponding to the incident occurrence host and including change operation information of the second change operation; A processing device comprising: [Appendix 2] The processing device according to claim 1, further comprising a fifth processing unit that, when the third processing unit does not confirm that the second change work is a verified work, acquires contact information of a worker who performed the second change work based on worker information managed by the information management unit, and outputs the escalation information to which the contact information of the worker who performed the second change work has been added to the escalation destination. [Appendix 3] The processing device according to claim 1 or 2, further comprising a sixth processing unit that performs processing of transmitting the escalation information to an escalation execution device that executes the escalation. [Appendix 4] The processing device according to any one of claims 1 to 3, wherein the escalation information is a table representing an escalation list that lists escalation destinations and escalation contents. [Appendix 5] The processing device according to claim 4, wherein change work information of the second change work is added to one item of a table representing the escalation list. [Appendix 6] The processing device described in Appendix 2, wherein the escalation information is a table representing an escalation list that lists escalation destinations and escalation contents, and the contact information of the worker performing the second change work is added as the top-level escalation destination of the escalation list. [Appendix 7] Computer, a first processing unit that, when receiving incident information from a monitoring device, extracts at least one first change operation that is being performed at the time the incident occurred, based on an incident occurrence time included in the incident information and change operation information managed by an information management unit; a second processing unit that, when the at least one first change operation is extracted by the first processing unit, performs a process of extracting a second change operation related to the incident-occurrence host from the at least one first change operation, based on first host information that identifies the incident-occurrence host included in the incident information and all host information managed by the information management unit; a third processing unit that performs processing to confirm, when the second change operation is extracted by the second processing unit, that the second change operation is a verified operation that is performed according to a verified procedure and a predetermined procedure, based on change operation information of the second change operation and release information managed by the information management unit; and a fourth processing unit that outputs, when the third processing unit has confirmed that the second change operation is a verified operation, escalation information specifying an escalation destination, the escalation information corresponding to the incident occurrence host and including change operation information of the second change operation; A program to function as a [Appendix 8] 1. A method for generating escalation information by a processing device, comprising: The processing device comprises: When receiving incident information from a monitoring device, a first process is performed to extract at least one first change operation that was being performed at the incident occurrence time based on an incident occurrence time included in the incident information and change operation information managed by an information management unit; performing a second process, when the at least one first change operation is extracted by the first process, of extracting a second change operation related to the incident-occurrence host from the at least one first change operation, based on first host information identifying the incident-occurrence host included in the incident information and all host information managed by the information management unit; performing a third process for confirming, when the second change operation is extracted by the second process, that the second change operation is a verified operation that is carried out according to a verified procedure and a predetermined procedure, based on change operation information of the second change operation and release information managed by the information management unit; a fourth process is performed when the third process has confirmed that the second change operation is a verified operation, the fourth process being escalation information that specifies an escalation destination, the escalation information corresponding to the incident occurrence host, and including change operation information of the second change operation. method. [Explanation of symbols]

[0052] 10 Systems 20 Management Systems 30 Terminals for related parties 40 Surveillance Post 50 Processing equipment 200 Incident Management System 201 Change Control System 202 Configuration Management System 203 Release Management System 204 Entrance Management System 400 Escalation System 401 Surveillance System 500 Notification Receiver 501 Change Management Verification Processing Section 502 Configuration management confirmation processing section 503 Release management confirmation processing section 504 Worker information acquisition unit 505 Escalation Information Transmission Unit 506 Escalation Order Judgment Unit 507 Escalation List Storage Unit

Claims

1. a first processing unit that, when receiving incident information from a monitoring device, extracts at least one first change operation that is being performed at the time the incident occurred, based on a time the incident occurred that is included in the incident information and change operation information managed by an information management unit; a second processing unit that, when the at least one first change operation is extracted by the first processing unit, performs a process of extracting a second change operation related to the incident-occurrence host from the at least one first change operation based on first host information that identifies the incident-occurrence host included in the incident information and all host information managed by the information management unit; a third processing unit that performs processing to confirm, when the second change operation is extracted by the second processing unit, that the second change operation is a verified operation that is performed according to a verified procedure and a predetermined procedure, based on change operation information of the second change operation and release information managed by the information management unit; a fourth processing unit that outputs, when the third processing unit confirms that the second change operation is a verified operation, escalation information specifying an escalation destination, the escalation information corresponding to the incident occurrence host and including change operation information of the second change operation; A processing device comprising:

2. 2. The processing device according to claim 1, further comprising a fifth processing unit that, when the third processing unit does not confirm that the second change work is a verified work, acquires contact information of the worker of the second change work based on worker information managed by the information management unit, and outputs the escalation information to which the contact information of the worker of the second change work has been added to the escalation destination.

3. The processing device according to claim 1 or 2, further comprising a sixth processing unit that performs processing for transmitting the escalation information to an escalation executing device that executes the escalation.

4. The processing device according to claim 1 , wherein the escalation information is a table representing an escalation list that lists escalation destinations and contents of escalation.

5. The processing device according to claim 4 , wherein the modification work information of the second modification work is added to one item of the table representing the escalation list.

6. the escalation information is a table representing an escalation list in which an escalation destination and a content of the escalation are listed; The processing device according to claim 2 , wherein a contact address of a worker of the second change work is added as a top-level escalation destination in the escalation list.

7. Computer, a first processing unit that, when receiving incident information from a monitoring device, extracts at least one first change operation that is being performed at the incident occurrence time based on an incident occurrence time included in the incident information and change operation information managed by an information management unit; a second processing unit that, when the at least one first change operation is extracted by the first processing unit, performs a process of extracting a second change operation related to the incident-occurrence host from the at least one first change operation, based on first host information that identifies the incident-occurrence host included in the incident information and all host information managed by the information management unit; a third processing unit that performs processing to confirm, when the second change operation is extracted by the second processing unit, that the second change operation is a verified operation that is performed according to a verified procedure and a predetermined procedure, based on change operation information of the second change operation and release information managed by the information management unit; and a fourth processing unit that outputs, when the third processing unit has confirmed that the second change operation is a verified operation, escalation information specifying an escalation destination, the escalation information corresponding to the incident occurrence host and including change operation information of the second change operation; A program to function as a

8. 1. A method for generating escalation information by a processing device, comprising: The processing device comprises: When receiving incident information from a monitoring device, a first process is performed to extract at least one first change operation that is being performed at the incident occurrence time based on an incident occurrence time included in the incident information and change operation information managed by an information management unit; performing a second process, when the at least one first change operation is extracted by the first process, to extract a second change operation related to the incident-occurrence host from the at least one first change operation, based on first host information identifying the incident-occurrence host included in the incident information and all host information managed by the information management unit; performing a third process for confirming, when the second change operation is extracted by the second process, that the second change operation is a verified operation that is implemented according to a verified procedure and a predetermined procedure, based on change operation information of the second change operation and release information managed by the information management unit; a fourth process is performed in which, when it is confirmed by the third process that the second change operation is a verified operation, the fourth process is performed to output escalation information that specifies an escalation destination, the escalation information corresponding to the incident occurrence host, and includes change operation information of the second change operation. method.

Images