Support method and monitoring system

Abstract

To provide a support method and a monitoring system which support failure coping of a customer system.SOLUTION: Upon detection of the generation of failure in a system, a monitoring server of a monitoring system creates a prompt on the basis of information on the failure and configuration information of the system. The monitoring server inputs the prompt into a large language model, so as to acquire answer information indicating coping information on the failure, which is generated by the large language model. The monitoring server implements processing on the basis of the answer information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an assistance method and a monitoring system. [Background technology]

[0002] 2. Description of the Related Art Conventionally, there are monitoring systems that monitor customer systems and, if any failure occurs in the customer systems, respond to the failure.

[0003] Fig. 19 is a diagram showing an example of a conventional monitoring system. As shown in Fig. 19, this monitoring system has a customer system 5, an automation processing unit 6, a monitoring server 7, and an ITSM (IT Service Management) server 8. A firewall 9 is disposed between the monitoring server 7 and the ITSM server 8 and the automation processing unit 6 to prevent unauthorized access, etc.

[0004] The customer system 5 is a system used by customers and is composed of multiple electronic devices. When the automation processing unit 6 receives a workaround execution command from an external monitoring server 7 via inbound communication, it executes a job corresponding to the corresponding workaround on the customer system. Although not shown in the figure, the customer system 5 may further include other customer systems in addition to the customer system 5.

[0005] The monitoring server 7 is a SaaS (Software as a Service) type monitoring server, and monitors the customer system 5 and other customer systems (not shown). Here, the monitoring server 7 will be explained using the customer system 5.

[0006] When the monitoring server 7 receives a notification of a failure from the customer system 5, the monitoring server 7 detects the failure in the customer system 5 and displays information about the failure on a display screen, etc. When the operator of the monitoring server 7 checks the information about the failure on a display screen, etc., the operator selects a workaround that corresponds to the failure content that has been prepared in advance and sends an instruction to execute the selected workaround to the automation processing unit 6.

[0007] The ITSM server 8 is a SaaS-type ITSM server that stores history information such as details of failures that have occurred in the customer system 5 and other customer systems (not shown), and workarounds selected for those failures. The operator of the monitoring server 7 may refer to the history information stored in the ITSM server 8 and select a workaround that corresponds to a new failure that has occurred in the customer system 5.

[0008] In addition, if a workaround for the problem had not been prepared in advance or had not been registered in the above-mentioned history information, the support staff would consider how to deal with the problem and deal with the problem manually. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-164457 [Patent Document 2] Japanese Patent Application Laid-Open No. 2014-32598 Summary of the Invention [Problem to be solved by the invention]

[0010] In the mechanism for responding to failures using the conventional monitoring system described above, if a workaround for the failure content is not prepared in advance or is not registered in the above-mentioned history information, etc., the support staff must consider how to respond and manually respond to the failure, which places a heavy burden on the support staff and leaves room for improvement.

[0011] In one aspect, the present invention aims to provide a support method and a monitoring system that can support troubleshooting of a customer system. [Means for solving the problem]

[0012] In a first proposal, the monitoring system includes a system and a monitoring server that monitors the system. When the monitoring server detects that a failure has occurred in the system, it creates a prompt based on information about the failure and system configuration information. The monitoring server inputs the prompt into a large-scale language model to obtain answer information that indicates information on how to deal with the failure, generated by the large-scale language model. The monitoring server executes processing based on the answer information. [Effects of the Invention]

[0013] We can help customers deal with system problems. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating an example of a monitoring system according to this embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of the data structure of the failure DB. [Figure 3] FIG. 3 is a diagram illustrating an example of prompt information. [Figure 4] FIG. 4 is a diagram illustrating an example of response information. [Figure 5] FIG. 5 is a diagram illustrating an example of the data structure of the workaround management table. [Figure 6] FIG. 6 is a diagram illustrating an example of the data structure of the customer system management table. [Figure 7] FIG. 7 is a diagram illustrating an example of the data structure of the response information table. [Figure 8] FIG. 8 is a functional block diagram showing the configuration of an automated processing apparatus according to this embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of the data structure of the processing table. [Figure 10] FIG. 10 is a functional block diagram showing the configuration of the monitoring server. [Figure 11] FIG. 11 is a functional block diagram showing the configuration of the ITSM server. [Figure 12] FIG. 12 is a functional block diagram showing the configuration of the generation server. [Figure 13] FIG. 13 is a flowchart showing the processing procedure of the automated processing apparatus according to this embodiment. [Figure 14] FIG. 14 is a flowchart showing the processing steps of the monitoring server and the ITSM server. [Figure 15] FIG. 15 is a flowchart showing the procedure of the failure handling process. [Figure 16] FIG. 16 is a diagram showing the configuration of the generation server and the generation AI server. [Figure 17] FIG. 17 is a diagram illustrating an example of a hardware configuration of a computer that realizes the same functions as the monitoring server of the embodiment. [Figure 18] FIG. 18 is a diagram illustrating an example of a hardware configuration of a computer that realizes the same functions as the ITSM server of the embodiment. [Figure 19] FIG. 19 is a diagram illustrating an example of a conventional monitoring system. DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, embodiments of the support method and monitoring system disclosed in the present application will be described in detail with reference to the accompanying drawings, although the present invention is not limited to these embodiments. [Example]

[0016] 1 is a diagram illustrating an example of a monitoring system according to the present embodiment. As shown in FIG. 1, the monitoring system includes a customer system 10, an automation processing device 20, a monitoring server 100, an ITSM server 200, and a generation server 300.

[0017] In this embodiment, the monitoring server 100, the ITSM server 200, and the generation server 300 are described as separate servers, but the monitoring server 100, the ITSM server 200, and the generation server 300 can also be realized as a single server. Also, the monitoring server 100 and the ITSM server 200 can be realized as a single server, or the ITSM server 200 and the generation server 300 can be realized as a single server. The monitoring server 100, the ITSM server 200, and the generation server 300 are each connected to a network 50.

[0018] The customer system 10 is connected to an automated processing device 20. The automated processing device 20 is connected to a network 50 via a firewall 30 to prevent unauthorized access from outside. For convenience of explanation, only the customer system 10 is shown in FIG. 1 , but other customer systems may also be included. For example, other customer systems are connected to the automated processing device 20, and the automated processing device 20 is connected to the firewall 30 and connected to the network 50 via the firewall 30.

[0019] The customer system 10 is a system used by a customer and is made up of a plurality of electronic devices. When a failure occurs in the customer system 10, the customer system 10 transmits failure information to the monitoring server 100.

[0020] For example, the fault information includes a fault code that uniquely identifies the content of the fault, a system identification number that uniquely identifies the customer system 10, a fault message that is output when the fault occurs, etc. The system identification number of the customer system 10 is assumed to be "sys1".

[0021] The monitoring server 100 monitors the customer system 10. When the monitoring server 100 receives fault information from the customer system 10, it displays the fault information on a display screen. An operator of the monitoring server 100 refers to the display screen to understand the fault information. The monitoring server 100 also sends an incident issuance request with the fault information set to the ITSM server 200.

[0022] The ITSM server 200 has a fault DB 241, a workaround management table 242, a customer system management table 243, and a response information table 244, and executes the following processes. The fault DB 241, the workaround management table 242, the customer system management table 243, and the response information table 244 will be described in detail later.

[0023] When the ITSM server 200 receives an incident issuance request, it issues an incident. Furthermore, based on the fault information set in the incident issuance request and the configuration information of the customer system 10, the ITSM server 200 creates prompt information for asking a generation AI (Artificial Intelligence) 360 how to deal with the fault that has occurred in the customer system 10. The ITSM server 200 transmits the prompt information to the generation server 300 to obtain answer information from the generation AI 360. The ITSM server 200 assigns the incident number included in the incident issuance request to the prompt information.

[0024] The ITSM server 200 executes various processes based on the response information. For example, the ITSM server 200 notifies the monitoring server 100 of the response information to request a response to the failure of the customer system 10, and updates the failure DB 241 based on the response information. The processes executed by the ITSM server 200 based on the response information will be described in detail later.

[0025] 2 is a diagram showing an example of the data structure of the fault DB 241. As shown in FIG. 2, the fault DB 241 stores an incident number, a fault code, a workaround, and a countermeasure flag.

[0026] The incident number is a number issued by the ITSM server 200. The fault code is information that uniquely identifies the fault set in the fault information. The workaround indicates how to deal with the fault identified by the fault code. For example, workarounds include checking the service status of the Windows server, checking long-running jobs, etc. Explanations of other workarounds are omitted.

[0027] The action flag is a flag that indicates whether or not a failure in the customer system has been addressed. If the failure has been addressed, the action flag is set to "ON." If the failure has not been addressed, the action flag is set to "OFF."

[0028] In the following explanation, a record identified by an incident number will be referred to as an "incident." For example, an incident identified by incident number "inc_1" corresponds to a record with a failure code of "error1100," a workaround of "Check Windows server service status," and a response flag of "OFF." In the following explanation, incidents with a response flag of "OFF" will be referred to as "unprocessed incidents" where appropriate.

[0029] Returning to the explanation of Figure 1, the generation server 300 has a generation AI 360. The generation AI 360 is ChatGPT or the like. When the generation server 300 receives prompt information from the ITSM server 200, it inputs the prompt information into the generation AI 360 to obtain answer information. The generation server 300 transmits the answer information to the ITSM server 200.

[0030] The automation processing device 20 accesses the fault DB 241 of the ITSM server 200 at predetermined time intervals via outbound communication.

[0031] The automation processing device 20 identifies unaddressed incidents whose handling flags are "OFF" from among the incidents in the fault DB 241, and executes jobs corresponding to the workarounds set for the identified incidents on the customer system 10. In the example shown in FIG. 2, the automation processing device 20 executes a job for the workaround "Check the service status of the Windows server" and a job for "Check long-running jobs" on the customer system 10. The automation processing device 20 notifies the ITSM server 200 of the processing results of "Check the service status of the Windows server" and "Check long-running jobs."

[0032] When the ITSM server 200 receives information as a processing result indicating that the workarounds "Check the service status of the Windows server" and "Check the long-running job" have been addressed, it updates the action flags in the fault DB 241 corresponding to the workarounds "Check the service status of the Windows server" and "Check the long-running job" from "OFF" to "ON."

[0033] Next, an example of prompt information created by the ITSM server 200 will be described. Fig. 3 is a diagram showing an example of prompt information. As shown in Fig. 3, prompt information 40 includes multiple instruction statements (1) to (6), a fault message 41, and configuration information 42. The ITSM server 200 assigns the incident number included in the incident issuance request to the prompt information.

[0034] For example, instruction (1) is "Please explain the content of the fault message in Japanese. Please output the fault message content as: XXXX." XXXX in instruction (1) is the content of the reply.

[0035] Instruction (2) is "Please explain the cause of the failure that you infer from the failure message. Please output the inferred cause as XXXX." XXXX in instruction (2) is the content of the response.

[0036] Instruction (3) is "Calculate the evaluation points of the solutions (workaround proposals, job proposals) for the fault message from the following perspectives i, ii, and iii, and present three solutions in descending order of evaluation points. Please present the solutions in correspondence with the evaluation points. Please output as Solution: XXXX." Point I: Short recovery time (the shorter the recovery time, the higher the score) Point II: Shorter work time (the shorter the time, the higher the evaluation score) Point iii: The probability of success is high (the higher the probability, the higher the evaluation score). The XXXX in the instruction (3) is the answer.

[0037] Instruction (4) is "Please provide the URL that is the basis for the solution. Please output the URL as: Basis URL: XXXX." The XXXX in instruction (4) is the answer.

[0038] Instruction (5) is "Please provide the publication date of the URL that is the basis for the solution. Please output the publication date: XXXX." XXXX in instruction (5) is the content of the response.

[0039] Instruction (6) is, "Please limit the output of instructions (1) to (3) to about 100 characters."

[0040] The fault message 41 is set to a fault message included in the fault information.

[0041] The configuration information 42 includes hardware configuration information and software configuration information of the customer system in which the failure occurred (for example, customer system 10). The hardware configuration information is information about the processor, memory, storage, motherboard, graphics card, power supply unit, input / output port, network interface card, etc. configured in the customer system 10. The software configuration information is information about the OS, various application software, device drivers, security software, programming runtime, etc. installed in the customer system.

[0042] It is assumed that the instructions (1) to (6) for the prompt information 40 created by the ITSM server 200 described in Figure 3 are set in advance. The ITSM server 200 sets the fault message included in the incident issuance request (fault information) received from the monitoring server 100 as a fault message 41 in the prompt information 40. The ITSM server 200 identifies the customer system in which the fault has occurred based on the system identification number included in the incident issuance request received from the monitoring server 100, and sets the configuration information of the identified customer system as configuration information 42 in the prompt information 40. For example, the configuration information of the customer system is stored in the customer system management table 243.

[0043] An example of prompt information has been described above. For example, the generation server 300 inputs the prompt information 40 into the generation AI 360, thereby generating answer information such as that shown in FIG.

[0044] 4 is a diagram showing an example of answer information. For example, answer information 45 shown in FIG. 4 includes the fault message content, the suspected cause, the countermeasure content, the basis URL, and the posting date. The generation server 300 sets the incident number set in the prompt information 40 in the answer information 45.

[0045] For example, the fault message content is set to "The fault message content is...." The probable cause is set to "The probable cause is...."

[0046] The countermeasure content contains information about countermeasures 1, 2, and 3. The workaround for countermeasure 1 is A1, the job is 1-A1, and the evaluation score for countermeasure 1 is 80 points. The workaround for countermeasure 2 is B1, the job is 1-B1, and the evaluation score for countermeasure 2 is 60 points. The workaround for countermeasure 3 is C1, the job is 1-C1, and the evaluation score for countermeasure 3 is 50 points.

[0047] The basis URLs for countermeasures 1, 2, and 3 are set in the basis URL. The basis URL for countermeasure 1 is "www.konkyo_1". ​​The basis URL for countermeasure 2 is "www.konkyo_2". The basis URL for countermeasure 3 is "www.konkyo_3".

[0048] The posting date is set to the posting date of the basis URL for countermeasures 1, 2, and 3. The posting date of the basis URL for countermeasure 1 is "April 1, 2023." The posting date of the basis URL for countermeasure 2 is "January 1, 2023." The posting date of the basis URL for countermeasure 3 is "August 1, 2023."

[0049] The above describes an example of answer information generated by the generation AI 360. When the ITSM server 200 acquires the answer information from the generation server 300, the ITSM server 200 registers the answer information in the answer information table 244.

[0050] Next, a detailed description will be given of the fault DB 241, the workaround management table 242, the customer system management table 243, and the response information table 244. The description of the fault DB 241 is the same as the description of the fault DB 241 described with reference to FIG.

[0051] The workaround management table 242 defines workarounds for dealing with failures identified by failure codes. FIG. 5 is a diagram showing an example of the data structure of the workaround management table. As shown in FIG. 5, this workaround management table 242 associates failure codes, workarounds, jobs, and setup dates. A failure code is information that uniquely identifies a failure. A workaround is the name of a workaround for dealing with a failure. A job is a group of multiple programs that are executed consecutively. A job also corresponds to a part that defines the execution order of multiple code components. The setup date is the date on which the corresponding record was set in the workaround management table 242.

[0052] For example, the workaround (workaround name) corresponding to the fault code "error1000" is "System Restart," the job for executing the corresponding workaround is "Job 1-1," and the date on which the record was set is "January 1, 2020."

[0053] The customer system management table 243 holds configuration information of the customer system. FIG. 6 is a diagram showing an example of the data structure of the customer system management table. As shown in FIG. 6, this customer system management table 243 has a system identification number, hardware configuration information, and software configuration information. The system identification number is a number that uniquely identifies the customer system. The hardware configuration information is information about the hardware configured in the customer system. The software configuration information is information about the software installed in the customer system.

[0054] For example, when setting configuration information in prompt information, the ITSM server 200 identifies the configuration information to be set in the prompt information by comparing the system identification number included in the incident issuance request (fault information) with the customer system management table 243.

[0055] The answer information table 244 holds answer information sent from the generation server 300. FIG. 7 is a diagram showing an example of the data structure of the answer information table. As shown in FIG. 7, the answer information table 244 includes an incident number, a failure content, a suspected cause, a priority, a workaround plan, a job plan, a basis URL, a posting date, and an evaluation score. The explanations for the incident number, the failure content, a suspected cause, a workaround plan, a job plan, a basis URL, a posting date, and an evaluation score are the same as those explained above. The priority is assigned in ascending order based on the highest evaluation score.

[0056] The details of the fault DB 241, the workaround management table 242, the customer system management table 243, and the response information table 244 have been explained above.

[0057] Next, a detailed description will be given of the processing that the ITSM server 200 performs after acquiring answer information from the generation server 300. When the ITSM server 200 acquires answer information from the generation server 300, the ITSM server 200 associates the answer information with the incident number and sets the content of the answer information in the answer information table 244. For example, based on the answer information 45 described in Fig. 4, the ITSM server 200 sets information in each item of the answer information table 244 (incident number, failure content, suspected cause, priority, workaround proposal, job proposal, basis URL, posting date, evaluation score) as shown in Fig. 7.

[0058] The ITSM server 200 refers to the response information table 244 and acquires the pair of the workaround plan and job plan with the highest priority (priority "1"). In the example shown in FIG. 7, the ITSM server 200 acquires the pair of workaround plan "A1" and job plan "1-A1". The ITSM server 200 acquires from the response information table 244 the fault content, suspected cause, rationale URL corresponding to the pair of the workaround plan and job plan with the highest priority, posting date, and evaluation score. The ITSM server 200 also acquires the fault code included in the incident issuance information. The ITSM server 200 generates each piece of acquired information as "handling information".

[0059] The ITSM server 200 determines, based on the handling information and the workaround management table 242, whether a workaround corresponding to the failure code in the handling information is registered in the workaround management table 242. If a workaround corresponding to the failure code in the handling information is not registered in the workaround management table 242, the ITSM server 200 executes a "first process." On the other hand, if a workaround corresponding to the failure code in the handling information is registered in the workaround management table 242, the ITSM server 200 executes a "second process."

[0060] First, we will explain the first process executed by the ITSM server 200. The ITSM server 200 requests approval by sending handling information to the support person's terminal device (not shown). The ITSM server 200 receives a response from the support person's terminal device, and if approval from the support person is obtained, sends the handling information to the monitoring server 100 and causes the display unit of the monitoring server 100 to display the handling information. The operator of the monitoring server 100 refers to the handling information for which approval from the support person has been obtained, sends a job for the handling information to the automated processing device 20, and causes the job to be executed.

[0061] Next, we will explain the second process executed by the ITSM server 200. The ITSM server 200 further determines whether the workaround corresponding to the failure code in the handling information and registered in the workaround management table 242 is the same as the workaround in the handling information. For example, if the handling information is "Failure code: error1100 Workaround: A1" and the workaround corresponding to the failure code "error1100" registered in the workaround management table 242 is "A2," this means that the workarounds are not the same.

[0062] In the following explanation, the workaround set in the handling information will be referred to as the "first workaround." Also, the workaround in the workaround management table 242 will be referred to as the "second workaround." The fault code corresponding to the first workaround and the fault code corresponding to the "second workaround" are the same.

[0063] If the first workaround and the second workaround are the same, the ITSM server 200 registers information about the incident in the fault DB 241. For example, when the ITSM server 200 acquires fault information, it generates a unique incident number. The ITSM server 200 compares the fault code set in the fault information with the workaround management table 242 to identify the workaround corresponding to the fault code.

[0064] The ITSM server 200 stores incidents (incident number, failure code of failure information, workaround, action flag) in the failure DB 241. <off>As described above, the automated processing device 20 refers to the fault DB 241 and automatically handles the fault.

[0065] On the other hand, if the first workaround and the second workaround are not the same, the ITSM server 200 executes the following process: The ITSM server 200 acquires the publication date of the first workaround from the handling information. The ITSM server 200 acquires the setting date of the second workaround from the workaround management table 242.

[0066] If the posting date is later than the set date, the ITSM server 200 executes the same process as the first process. If the posting date is later than the set date, the workaround in the handling information can be considered a newer countermeasure than the workaround in the workaround management table 242. The ITSM server 200 requests approval by sending handling information to the support person's terminal device (not shown). If approval from the support person is obtained, the ITSM server 200 sends the handling information to the monitoring server 100. The operator of the monitoring server 100 sends the job included in the handling information approved by the support person to the automation processing device 20, and has the job executed.

[0067] On the other hand, if the posting date is earlier than the set date, the ITSM server 200 ends the process and waits until it receives the next incident issuance request. If the posting date is earlier than the set date, the workaround in the handling information can be said to be an older countermeasure than the workaround in the workaround management table 242.

[0068] As described above, when the ITSM server 200 receives an incident issuance request from the monitoring server 100, the monitoring system generates prompt information and transmits the prompt information to the generation server 300, thereby acquiring answer information generated by the generation AI 360. The ITSM server 200 executes various processes based on the acquired answer information, thereby supporting troubleshooting of the customer system 10.

[0069] The monitoring server 100 may have the functions of the ITSM server 200 and the generation server 300, and may execute the above processes. That is, the monitoring server 100 may generate prompt information, input the prompt information to the generation AI 360, acquire answer information, and execute various processes based on the acquired answer information.

[0070] Next, an example of the configuration of the automated processing device 20 described in Fig. 1 will be described. Fig. 8 is a functional block diagram showing the configuration of the automated processing device according to this embodiment. As shown in Fig. 8, the automated processing device 20 has a communication unit 21, a storage unit 24, and a control unit 25.

[0071] The communication unit 21 transmits and receives information to and from the monitoring server 100 and the ITSM server 200 via the network 50. The communication unit 21 also transmits and receives information to and from the customer system 10. The communication unit 21 is realized by a NIC (Network Interface Card) or the like.

[0072] The storage unit 24 includes a processing table 24a. For example, the storage unit 24 is a storage device such as a memory.

[0073] The processing table 24a is a table for setting jobs corresponding to workarounds. Fig. 9 is a diagram showing an example of the data structure of the processing table. As shown in Fig. 9, the processing table 24a associates workarounds with jobs. The explanation regarding workarounds and jobs is the same as the explanation regarding workarounds and jobs above.

[0074] Returning to the description of Fig. 8, the control unit 25 includes an acquisition unit 25a and an execution unit 25b. The control unit 25 is, for example, a CPU (Central Processing Unit) or an MPU (Micro Processing Unit).

[0075] The acquisition unit 25a accesses the fault DB 241 of the ITSM server 200 at predetermined time intervals. When accessing the ITSM server 200, the acquisition unit 25a notifies the ITSM server 200 of the system identification number of the customer system that is the target of job execution. The acquisition unit 25a acquires workarounds for unaddressed incidents from among the incidents in the fault DB 241. The acquisition unit 25a may also acquire the incident number. The acquisition unit 25a outputs the acquired workarounds to the execution unit 25b.

[0076] The execution unit 25b compares the workaround acquired from the acquisition unit 25a with the processing table 24a, and identifies a job corresponding to the workaround. The execution unit 25b executes the identified job on the customer system 10. The execution unit 25b transmits the processing result to the ITSM server 200. The processing result includes the incident number and information on whether the execution of the job corresponding to the workaround was successful.

[0077] Here, if the execution of the job fails, the execution unit 25b may retry the execution of the job a predetermined number of times. If the execution of the job is not successful even after retrying the job a predetermined number of times, the execution unit 25b sets information to the effect that the execution of the job corresponding to the workaround has failed as a processing result and transmits the information to the ITSM server 200.

[0078] When the execution unit 25b receives a job included in handling information approved by a support staff member from the monitoring server 100, the execution unit 25b executes the job on the customer system 10. The execution unit 25b transmits the processing result to the monitoring server 100.

[0079] Next, an example of the configuration of the monitoring server 100 explained in Fig. 1 will be described. Fig. 10 is a functional block diagram showing the configuration of the monitoring server. As shown in Fig. 10, the monitoring server 100 has a communication unit 110, an input unit 120, a display unit 130, a storage unit 140, and a control unit 150.

[0080] The communication unit 110 transmits and receives information to and from the ITSM server 200, the automation processing device 20, and the customer system 10 via the network 50. The communication unit 110 is realized by a NIC or the like.

[0081] The input unit 120 is an input device that inputs various types of information to the monitoring server 100. The input unit 120 corresponds to a keyboard, a mouse, a touch panel, or the like.

[0082] The display unit 130 is a display device that displays information output from the control unit 150. The display unit 130 corresponds to a liquid crystal display, an organic EL (Electro Luminescence) display, a touch panel, etc. For example, the display unit 130 displays a customer.

[0083] The storage unit 140 holds various types of information for executing processes by the control unit 150. The storage unit 140 is a storage device such as a memory.

[0084] The control unit 150 includes an abnormality detection unit 151, a request unit 152, a display control unit 153, and a job execution unit 154. The control unit 150 is, for example, a CPU or an MPU.

[0085] The abnormality detection unit 151 monitors the customer system 10 and detects whether a failure has occurred. For example, when the abnormality detection unit 151 receives failure information from the customer system 10, it detects that a failure has occurred in the customer system 10 corresponding to the system identification number set in the failure information. The abnormality detection unit 151 outputs the received failure information to the request unit 152 and the display control unit 153.

[0086] The abnormality detection unit 151 may transmit data to the customer system 10 and, if there is no response from the destination customer system 10, detect an abnormality in the customer system 10. In this case, the abnormality detection unit 151 generates fault information that sets a fault code indicating no response and the system identification number of the customer system 10 in which the abnormality was detected, and outputs the generated fault information to the request unit 152 and the display control unit 153.

[0087] When the request unit 152 acquires fault information from the abnormality detection unit 151, the request unit 152 transmits an incident issuance request in which the fault information is set to the ITSM server 200.

[0088] The display control unit 153 displays various types of information on the display unit 130. For example, the display control unit 153 displays fault information on the display unit 130. When error information is received from the ITSM server 200, the display control unit 153 displays the error information on the display unit 130.

[0089] When the job execution unit 154 acquires a job included in handling information that has been approved by a support person from the ITSM server 200, it displays the handling information on the display unit 130. When the job execution unit 154 receives an execution command for the handling information via the input unit 120 or the like, it transmits the job of the handling information to the automation processing device 20 and causes the job to be executed.

[0090] Next, we will explain an example configuration of the ITSM server 200 explained in Fig. 1. Fig. 11 is a functional block diagram showing the configuration of the ITSM server. As shown in Fig. 11, this ITSM server 200 has a communication unit 210, an input unit 220, a display unit 230, a storage unit 240, and a control unit 250.

[0091] The communication unit 210 transmits and receives information to and from the monitoring server 100, the generation server 300, the automation processing device 20, and the customer system 10 via the network 50. The communication unit 110 is realized by an NIC or the like.

[0092] The input unit 220 is an input device that inputs various types of information to the ITSM server 200. The input unit 220 corresponds to a keyboard, a mouse, a touch panel, or the like.

[0093] The display unit 230 is a display device that displays information output from the control unit 150. The display unit 230 corresponds to a liquid crystal display, an organic EL display, a touch panel, etc. For example, the display unit 230 displays the customer.

[0094] The storage unit 240 includes a fault DB 241, a workaround management table 242, a customer system management table 243, and a response information table 244. The storage unit 240 is a storage device such as a memory.

[0095] The fault DB 241 stores information related to fault information. The data structure of the fault DB 241 corresponds to the data structure described in FIG.

[0096] The workaround management table 242 defines workarounds for dealing with failures identified by failure codes. The data structure of the workaround management table 242 corresponds to the data structure described in FIG.

[0097] The customer system management table 243 holds configuration information of the customer system. The data structure of the customer system management table 243 corresponds to the data structure described in FIG.

[0098] The response information table 244 holds the response information sent from the generation server 300. The data structure of the response information table 244 corresponds to the data structure described with reference to FIG.

[0099] The control unit 250 includes a receiving unit 251, a creating unit 252, a response information processing unit 253, and an access accepting unit 254. The control unit 250 is, for example, a CPU or an MPU.

[0100] The receiving unit 251 issues an incident number when it receives an incident issuance request from the monitoring server 100. The receiving unit 251 also outputs the fault information and incident number set in the incident issuance request to the creating unit 252.

[0101] The creation unit 252 creates prompt information and transmits the created prompt information to the generation server 300. For example, when creating the prompt information 40 described in FIG. 3, the creation unit 252 uses information that has been set in advance as instruction statements (1) to (6).

[0102] The creation unit 252 sets the fault message included in the fault information as a fault message 41 in the prompt information 40. The creation unit 252 identifies the customer system in which the fault occurred based on the system identification number included in the fault information, and sets the configuration information of the identified customer system as configuration information 42 in the prompt information 40. For example, the configuration information of the customer system is stored in the customer system management table 243.

[0103] The rest of the process by which the creation unit 252 creates prompt information is the same as that described with reference to FIG.

[0104] The answer information processing unit 253 receives answer information from the generation server 300, and registers the content of the received answer information in the answer information table 244. The answer information processing unit 253 generates handling information after registering the content of the answer information in the answer information table 244. The explanation regarding the handling information is the same as the explanation regarding the handling information above.

[0105] The answer information processing unit 253 executes a "first process" if a workaround corresponding to the failure code in the handling information is not registered in the workaround management table 242. The content of the first process executed by the answer information processing unit 253 is the same as the content of the first process described above.

[0106] On the other hand, the answer information processing unit 253 executes the "second process" when a workaround corresponding to the failure code in the handling information is registered in the workaround management table 242. The content of the second process executed by the answer information processing unit 253 is the same as the content of the second process described above.

[0107] The access receiving unit 254 receives access to the fault DB 241 from the automation processing device 20 and allows the access to the fault DB 241. For example, the acquiring unit 25a of the automation processing device 20 acquires, from the fault DB 241, a workaround for an unaddressed incident.

[0108] The access receiving unit 254 also receives a processing result for the workaround from the automation processing device 20. For example, the processing result includes an incident number and information on whether the job corresponding to the workaround was successfully executed.

[0109] If the processing result includes information indicating that the job was successfully executed, the access receiving unit 254 updates the action flag corresponding to the incident number included in the processing result to "ON."

[0110] On the other hand, if the processing result includes information indicating that the job execution failed, the access receiving unit 254 sends error information to the monitoring server 100. The error information includes a system identification number, an incident number corresponding to the workaround that failed to be dealt with, and the like.

[0111] Next, a configuration example of the generation server 300 explained in Fig. 1 will be described. Fig. 12 is a functional block diagram showing the configuration of the generation server. As shown in Fig. 12, this generation server 300 has a communication unit 310, a storage unit 340, and a control unit 350.

[0112] The communication unit 310 transmits and receives information to and from the ITSM server 200 via the network 50. The communication unit 310 is realized by a NIC (Network Interface Card) or the like.

[0113] The storage unit 340 has the generated AI 360. The storage unit 340 is a storage device such as a memory. The generated AI 360 is ChatGPT (ChatGPT data) or the like.

[0114] The control unit 350 includes a receiving unit 351, a generation AI executing unit 352, and a transmitting unit 353. The control unit 350 is, for example, a CPU or an MPU.

[0115] When the receiving unit 351 receives prompt information from the ITSM server 200 , it outputs the prompt information to the generation AI executing unit 352 .

[0116] The generation AI execution unit 352 is a processing unit that executes the generation AI 360. For example, the generation AI execution unit 352 inputs prompt information to the generation AI 360 and obtains answer information. The generation AI execution unit 352 outputs the answer information to the transmission unit 353.

[0117] The sending unit 353 assigns the incident number set in the prompt information to the answer information, and sends the answer information to the ITSM server 200.

[0118] Next, an example of the processing procedure of the automation processing device 20 shown in Fig. 1 will be described. Fig. 13 is a flowchart showing the processing procedure of the automation processing device according to this embodiment. As shown in Fig. 13, if a certain period of time has not elapsed (No in step S101), the acquisition unit 25a of the automation processing device 20 proceeds to step S101 again.

[0119] If a certain period of time has elapsed (Yes at Step S101), the acquiring unit 25a accesses the fault DB 241 of the ITSM server 200 and determines whether or not there is an unaddressed incident (Step S102). If there is no unaddressed incident (No at Step S103), the acquiring unit 25a proceeds to Step S108.

[0120] On the other hand, if there is an unaddressed incident (Yes at Step S103), the acquisition unit 25a acquires a workaround (Step S104). The execution unit 25b of the automation processing device 20a selects a job corresponding to the workaround based on the processing table 24a (Step S105).

[0121] The execution unit 25b executes the job for the customer system 10a (step S106), and transmits the job processing result to the ITSM server 200 (step S107).

[0122] If the automation processing device 20 continues the process (step S108, Yes), the process proceeds to step S101. If the automation processing device 20 does not continue the process (step S108, No), the process ends.

[0123] Next, a description will be given of the processing procedures of the monitoring server 100 and the ITSM server 200 shown in Fig. 1. Fig. 14 is a flowchart showing the processing procedures of the monitoring server and the ITSM server. If the monitoring server 100 does not detect any fault information (step S201, No), the monitoring server 100 proceeds to step S201 again.

[0124] On the other hand, if the monitoring server 100 detects fault information (Yes at step S201), it transmits an incident issuance request in which the fault information is set to the ITSM server 200 (step S202).

[0125] The ITSM server 200 receives the incident issuance request (step S203), and executes the failure response process (step S204).

[0126] Next, the procedure for the failure handling process shown in step S204 in Fig. 14 will be described. Fig. 15 is a flowchart showing the procedure for the failure handling process. As shown in Fig. 15, the creation unit 252 of the ITSM server 200 creates prompt information based on the failure information and configuration information (step S301). The creation unit 252 sends the prompt information to the generation server 300 (step S302).

[0127] The answer information processing unit 253 of the ITSM server 200 receives the answer information from the generation server 300 (step S303). The answer information processing unit 253 registers the answer information in the answer information table 244, and generates handling information (step S304).

[0128] The response information processing unit 253 determines, based on the handling information and the workaround management table 242, whether or not a workaround corresponding to the failure code in the handling information is registered in the workaround management table 242 (step S305).

[0129] If the answer information processing unit 253 is not registered (step S306, No), it executes the first process (step S307). On the other hand, if the answer information processing unit 253 is registered (step S306, Yes), it executes the second process (step S308).

[0130] Next, the effects of the monitoring system according to this embodiment will be described. In the monitoring system, when the ITSM server 200 receives an incident issuance request from the monitoring server 100, it generates prompt information and transmits the prompt information to the generation server 300, thereby obtaining answer information generated by the generation AI 360. The ITSM server 200 executes various processes based on the obtained answer information. This makes it possible to support troubleshooting of the customer system 10.

[0131] In the monitoring system, the ITSM server 200 executes the first process if a workaround corresponding to the failure code in the handling information is not registered in the workaround management table 242. As a result, even if a workaround for handling the failure has not been set in advance, the operator of the monitoring server 100 can, by operating the operator of the monitoring server 100, send a job for handling information that has been approved by a support person to the automated processing device 20, execute the job, and handle the failure.

[0132] In the monitoring system, the ITSM server 200 executes "second processing" if a workaround corresponding to the fault code in the handling information is registered in the workaround management table 242. Here, in the second processing, if the first workaround and the second workaround are not the same, the ITSM server 200 acquires the publication date of the first workaround and the setup date of the second workaround, and executes processing similar to the first processing if the publication date is later than the setup date. If the publication date is later than the setup date, the first workaround can be said to be a newer countermeasure than the workaround in the workaround management table 242, and therefore the latest workaround can be used to handle the fault.

[0133] In the monitoring system, when a failure occurs in a customer system, the ITSM server 200 acquires multiple pieces of answer information (multiple countermeasures) by further setting information requesting multiple candidate response information in the prompt information. This makes it possible to acquire multiple countermeasures that can be used to deal with the failure.

[0134] The above-described processing of the monitoring system is merely an example. Other processing 1 to 4 of the monitoring system will be described below.

[0135] First, other processing 1 of the monitoring system will be described. If a workaround corresponding to the fault code in the handling information is not registered in the workaround management table 242, the ITSM server 200 of the monitoring system executes a simulation using the job of the handling information in a test environment that is the same environment as the customer system 10, and determines whether an error or the like occurs. If no error or the like occurs, the ITSM server 200 transmits the job corresponding to the handling information to the automation processing device 20 and causes the job to be executed.

[0136] By having the monitoring system execute other process 1, it is possible to safely handle a failure in the customer system 10 without the approval of a support person.

[0137] Other processing 2 of the monitoring system will now be described. When a workaround corresponding to the failure code in the handling information is not registered in the workaround management table 242, the ITSM server 200 of the monitoring system may change processing depending on whether the workaround in the handling information is a low-risk workaround or a high-risk workaround. For example, the ITSM server 200 holds a table that defines low-risk workarounds and high-risk workarounds, and determines whether the risk of the workaround in the handling information is low based on this table.

[0138] If the risk of the workaround in the handling information is low, the ITSM server 200 transmits the handling information to the monitoring server 100 without sending the handling information to the terminal device of the support staff (without receiving approval), and causes the handling information to be displayed on the display unit of the monitoring server 100. The operator of the monitoring server 100 refers to the handling information (handling information with low risk), transmits a job for the handling information to the automated processing device 20, and causes the job to be executed.

[0139] On the other hand, if the risk of a workaround in the handling information is high, the ITSM server 200 transmits the handling information to the terminal device of the support person, receives a response from the terminal device of the support person, and if approval is obtained from the support person, transmits the handling information to the monitoring server 100 and displays the handling information on the display unit of the monitoring server 100. The operator of the monitoring server 100 refers to the handling information that has been approved by the support person, transmits a job for the handling information to the automated processing device 20, and causes the job to be executed.

[0140] As described above, for low-risk response information, the approval process by the support staff can be skipped and the failure can be handled quickly. For high-risk response information, the approval process by the support staff is carried out first, and then the failure can be handled safely.

[0141] Next, other processing 3 of the monitoring system will be described. The ITSM server 200 of the monitoring system sets the workaround plan and job with the highest evaluation score among the multiple workaround plans and job plans included in the response information as "handling information," sends it to the support staff's terminal device, and requests approval, but this is not limited to this.

[0142] The ITSM server 200 may set the top n workaround plans and job plans included in the response information as handling information, send it to the support person's terminal device, and request approval. The support person selects one workaround plan and one job plan from the multiple workaround plans and job plans, and responds to the ITSM server 200. In this case, the ITSM server 200 sends the workaround plan and job plan selected by the support person as handling information to the monitoring server 100, and displays the handling information on the display unit of the monitoring server 100. The operator of the monitoring server 100 refers to the handling information approved by the support person, sends a job for the handling information to the automation processing device 20, and executes the job.

[0143] This allows the workaround job selected by the support person from among a plurality of workaround plans and job plans to be executed on the customer system 10.

[0144] Furthermore, the ITSM server 200 may repeatedly execute a process of setting the top n workaround plans and job plans included in the response information as handling information and sending it to the support person's terminal device, and may update the evaluation points corresponding to the workaround plans and job plans selected by the support person depending on the number of times they are selected (adding a predetermined number to the evaluation value each time they are selected).The ITSM server 200 may also update the evaluation points corresponding to the workaround plans and job plans selected by the support person depending on whether the problem is solved as a result of executing the selected job plan (adding a predetermined value if the problem is solved, and subtracting a predetermined value if the problem is not solved).

[0145] Other processing 4 of the monitoring system will now be described. When executing the second processing, the ITSM server 200 of the monitoring system compares the posting date of the first workaround with the setting date of the second workaround, and if the posting date is later than the setting date, executes processing similar to the first processing, but the determination may also be made from a perspective other than the posting date and the setting date.

[0146] The monitoring server 100, ITSM server 200, and generation server 300 of the monitoring system shown in FIG. 1 may be configured as a single server (integrated monitoring server). The control unit of such an integrated monitoring server is a control unit that integrates the control unit 150 shown in FIG. 10, the control unit 250 shown in FIG. 11, and the control unit 350 shown in FIG. 12. The memory unit of such an integrated monitoring server holds the information stored in the memory unit 140 shown in FIG. 10, the memory unit 240 shown in FIG. 11, and the memory unit 350 shown in FIG. 12. In the above embodiment, the operator who references the handling information sends a job to the automation processing device 20. However, an administrator may change the settings so that the ITSM server 200 sends a job directly to the automation processing device 20.

[0147] In the above, the generation server 300 is configured to have the generation AI 360, but it is also possible to provide a generation AI server 600 instead of the generation server 300 having the generation AI, and to configure the generation server 300 and the generation AI server 600 to work together.

[0148] Figure 16 is a diagram showing the configuration of the generation server and the generation AI server. As shown in Figure 16, for example, the generation server 300 has a communication unit 310 and a control unit 350 (a receiving unit 351, a linking unit 352, and a transmitting unit 353). The generation AI server 600 has a communication unit 610 and a generation AI 620. The generation AI 620 corresponds to a server on which an external service such as ChatGPT or a generation AI runs. The communication unit 610 of the generation AI server 600 communicates with the generation server 300.

[0149] The collaboration unit 352 of the generation server 300 collaborates with the generation AI 660 of the generation AI server 600. For example, the collaboration unit 352 transmits prompt information to the generation AI 620 and receives answer information. The collaboration unit 352 outputs the received answer information to the transmission unit 353.

[0150] Next, an example of the hardware configuration of a computer that realizes the same functions as the monitoring server 100 and the ITSM server 200 shown in the above embodiment will be described. Fig. 17 is a diagram showing an example of the hardware configuration of a computer that realizes the same functions as the monitoring server of the embodiment.

[0151] 17, the computer 400 has a CPU 401 that executes various types of arithmetic processing, an input device 402 that accepts data input from a user, and a display 403. The computer 400 also has a communication device 404 that exchanges data with the customer system 10, the automation processing device 20, the ITSM server 200, etc. via a wired or wireless network, and an interface device 405. The computer 400 also has a RAM 406 that temporarily stores various types of information, and a hard disk device 407. The devices 401 to 407 are connected to a bus 408.

[0152] The hard disk device 407 stores an abnormality detection program 407a, a request program 407b, a display control program 407c, and a job execution program 407d. The CPU 401 reads out each of the programs 407a to 407d and loads them into the RAM 406.

[0153] The abnormality detection program 407a functions as an abnormality detection process 406a. The request program 407b functions as a request process 406b. The display control program 407c functions as a display control process 406c. The job execution program 407d functions as a job execution process 406d.

[0154] The processing of the abnormality detection process 406a corresponds to the processing of the abnormality detection unit 151. The processing of the request process 406b corresponds to the processing of the request unit 152. The processing of the display control process 406c corresponds to the processing of the display control unit 153. The processing of the job execution process 406d corresponds to the processing of the job execution unit 154.

[0155] It should be noted that each of the programs 407a to 407d does not necessarily have to be stored in the hard disk drive 407 from the beginning. For example, each of the programs may be stored in a "portable physical medium" such as a flexible disk (FD), CD-ROM, DVD, magneto-optical disk, or IC card that is inserted into the computer 400. Then, the computer 400 may read and execute each of the programs 407a to 407d.

[0156] Next, we move on to the description of Fig. 18. Fig. 18 is a diagram showing an example of the hardware configuration of a computer that realizes the same functions as the ITSM server of the embodiment.

[0157] 18, the computer 500 has a CPU 501 that executes various arithmetic processes, an input device 502 that accepts data input from a user, and a display 503. The computer 500 also has a communication device 504 that exchanges data with the customer system 10, the automation processing device 20, the monitoring server 100, the generation server 300, etc. via a wired or wireless network, and an interface device 505. The computer 500 also has a RAM 506 that temporarily stores various information, and a hard disk device 507. The devices 501 to 507 are connected to a bus 508.

[0158] The hard disk device 507 has a receiving program 507a, a creating program 507b, a response information processing program 507c, and an access receiving program 507d. The CPU 501 reads out each of the programs 507a to 507d and loads them into the RAM 506.

[0159] The receiving program 507a functions as the receiving process 506a. The creating program 507b functions as the creating process 506b. The answer information processing program 507c functions as the answer information processing process 506c. The access receiving program 507d functions as the access receiving process 506d.

[0160] The processing of the reception process 506a corresponds to the processing of the reception unit 251. The processing of the creation process 506b corresponds to the processing of the creation unit 252. The processing of the answer information processing process 506c corresponds to the processing of the answer information processing unit 253. The processing of the access reception process 506d corresponds to the processing of the access reception unit 254.

[0161] It should be noted that each of the programs 507a to 507d does not necessarily have to be stored in the hard disk drive 507 from the beginning. For example, each of the programs may be stored in a "portable physical medium" such as a flexible disk (FD), CD-ROM, DVD, magneto-optical disk, or IC card that is inserted into the computer 500. Then, the computer 500 may read and execute each of the programs 507a to 507d. [Explanation of symbols]

[0162] 10 Customer System 20 Automated Processing Equipment 30 Firewall 50 Network 100 monitoring servers 200 ITSM Servers 300 Generating Server< / off>

Claims

1. A method for supporting a monitoring system having a system and a monitoring server that monitors the system, comprising: When the monitoring server detects that a failure has occurred in the system, it creates a prompt based on information about the failure and configuration information of the system; the monitoring server inputs the prompt into a large-scale language model to obtain answer information indicating information for dealing with the failure, the answer information being generated by the large-scale language model; The monitoring server executes processing based on the response information. A support method characterized by including each process.

2. the monitoring server has a storage unit that registers a fault that may occur in the system and information on how to deal with the fault in association with each other; The support method described in claim 1, characterized in that if handling information corresponding to the same failure as the failure that occurred in the system is not registered in the memory unit, the monitoring server further executes a process of displaying the response information on a display unit after accepting approval of the response information.

3. the response information is either first response information or second response information that has a higher risk than the first response information, The support method described in claim 2, characterized in that if no handling information corresponding to the same failure as the failure that occurred in the system is registered in the memory unit and the response information corresponds to first handling information, the monitoring server further executes processing to display the response information on a display unit without requesting approval of the response information.

4. The support method described in claim 3, characterized in that the monitoring server further executes a process of sending an approval request for the response information to a specified terminal device if no handling information corresponding to the same failure as the failure that occurred in the system is registered in the memory unit and the response information corresponds to the second handling information.

5. The support method described in claim 2, characterized in that if the monitoring server does not have registered in the memory unit any response information corresponding to the same failure as the failure that occurred in the system, it further executes a process of executing a job corresponding to the response information in a test environment that reproduces the same environment as the system.

6. The support method described in claim 2, characterized in that the monitoring server further executes processing to display the response information on a display unit when third response information corresponding to the same failure as the failure that occurred in the system is registered in the memory unit, the third response information and the fourth response information indicated in the response information are identical, and the date related to the third response information is earlier than the date related to the fourth response information.

7. The support method described in claim 1, characterized in that when the monitoring server detects that a failure has occurred in the system, it obtains multiple pieces of answer information by further setting information in the prompt that requests multiple candidates of response information.

8. The support method according to claim 7, characterized in that the monitoring server further executes a process of displaying the plurality of pieces of answer information on a display unit, accepting a selection of any one of the plurality of pieces of answer information, and displaying the selected answer information on the display unit.

9. A monitoring system comprising: a system; and a monitoring server that monitors the system, The monitoring server When detecting that a failure has occurred in the system, creating a prompt based on information about the failure and configuration information of the system; inputting the prompt into a large-scale language model to obtain answer information indicating information for dealing with the fault, generated by the large-scale language model; Execute processing based on the response information A monitoring system comprising a control unit.

Images