Support method and monitoring system

Abstract

To provide a support method and a monitoring system which support failure coping of a customer system while preventing a leak of company secret information.SOLUTION: A monitoring system includes a system and a monitoring server for monitoring the system. Upon detection of the generation of failure in the system, the monitoring server determines whether a predetermined keyword is included in information on the failure and configuration information on the system, which has information related to the information on the failure. When the predetermined keyword is included, the monitoring server performs de-identification on the predetermined keyword included in the information on the failure and the configuration information. The monitoring server inputs the information on the failure and the configuration information on which the de-identification has been performed into a large language model, so as to acquire answer information indicating coping information on the failure, which is generated by the large language model. The monitoring server implements processing on the basis of the answer information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an assistance method and a monitoring system. [Background technology]

[0002] 2. Description of the Related Art Conventionally, there are monitoring systems that monitor customer systems and, if any failure occurs in the customer systems, respond to the failure.

[0003] Fig. 24 is a diagram showing an example of a conventional monitoring system. As shown in Fig. 24, this monitoring system has a customer system 5, an automation processing unit 6, a monitoring server 7, and an ITSM (IT Service Management) server 8. A firewall 9 is placed between the monitoring server 7 and the ITSM server 8 and the automation processing unit 6 to prevent unauthorized access, etc.

[0004] The customer system 5 is a system used by customers and is composed of multiple electronic devices. When the automation processing unit 6 receives a workaround execution command from an external monitoring server 7 via inbound communication, it executes a job corresponding to the corresponding workaround on the customer system. Although not shown in the figure, the customer system 5 may further include other customer systems in addition to the customer system 5.

[0005] The monitoring server 7 is a SaaS (Software as a Service) type monitoring server, and monitors the customer system 5 and other customer systems (not shown). Here, the monitoring server 7 will be explained using the customer system 5.

[0006] When the monitoring server 7 receives a notification of a failure from the customer system 5, the monitoring server 7 detects the failure in the customer system 5 and displays information about the failure on a display screen, etc. When the operator of the monitoring server 7 checks the information about the failure on a display screen, etc., the operator selects a workaround corresponding to the content of the failure and sends an instruction to execute the selected workaround to the automation processing unit 6.

[0007] The ITSM server 8 is a SaaS-type ITSM server that stores history information such as details of failures that have occurred in the customer system 5 and other customer systems (not shown), and workarounds selected for those failures. The operator of the monitoring server 7 may refer to the history information stored in the ITSM server 8 and select a workaround that corresponds to a new failure that has occurred in the customer system 5.

[0008] In addition, if a workaround for the problem had not been prepared in advance or had not been registered in the above-mentioned history information, the support staff would consider how to deal with the problem and deal with the problem manually. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-164457 [Patent Document 2] Japanese Patent Application Laid-Open No. 2014-32598 Summary of the Invention [Problem to be solved by the invention]

[0010] In the above-mentioned conventional fault response mechanism for monitoring systems, the operator of the monitoring server 7 selects a workaround for the fault based on past experience in responding to faults, and there is a high degree of dependency on the operator. Furthermore, if external artificial intelligence (AI) or the like is used to ask questions about fault response, there is a risk of confidential information being leaked.

[0011] In one aspect, the present invention aims to provide a support method and a monitoring system that can support troubleshooting of a customer system while preventing leakage of confidential information. [Means for solving the problem]

[0012] In a first proposal, the monitoring system includes a system and a monitoring server that monitors the system. When the monitoring server detects that a failure has occurred in the system, it determines whether or not a predetermined keyword is included in the system's configuration information, which includes information about the failure and information related to the failure information. If the predetermined keyword is included, the monitoring server de-identifies the predetermined keyword included in the failure information and configuration information. The monitoring server inputs the de-identified failure information and configuration information into a large-scale language model, thereby obtaining answer information indicating information for dealing with the failure, which is generated by the large-scale language model. The monitoring server performs processing based on the answer information. [Effects of the Invention]

[0013] This makes it possible to prevent the leakage of confidential information and to assist in troubleshooting customer systems. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating an example of a monitoring system according to this embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of the data structure of the conversion table. [Figure 3] FIG. 3 is a diagram (1) for explaining the de-identification performed by the ITSM server. [Figure 4] FIG. 4 is a diagram (2) for explaining the de-identification performed by the ITSM server. [Figure 5] FIG. 5 is a diagram illustrating an example of the data structure of the failure DB. [Figure 6] FIG. 6 is a diagram illustrating an example of prompt information. [Figure 7] FIG. 7 is a diagram illustrating an example of the response information. [Figure 8] FIG. 8 is a diagram illustrating an example of the data structure of the workaround management table. [Figure 9] FIG. 9 is a diagram illustrating an example of the data structure of the customer system management table. [Figure 10] FIG. 10 is a diagram illustrating an example of the data structure of the response information table. [Figure 11] FIG. 11 is a functional block diagram showing the configuration of an automated processing apparatus according to this embodiment. [Figure 12] FIG. 12 is a diagram illustrating an example of the data structure of the processing table. [Figure 13] FIG. 13 is a functional block diagram showing the configuration of the monitoring server. [Figure 14] FIG. 14 is a functional block diagram showing the configuration of the ITSM server. [Figure 15] FIG. 15 is a functional block diagram showing the configuration of the generation server. [Figure 16] FIG. 16 is a flowchart showing the processing procedure of the automated processing apparatus according to this embodiment. [Figure 17] FIG. 17 is a flowchart showing the processing steps of the monitoring server and the ITSM server. [Figure 18] FIG. 18 is a flowchart showing the procedure of the failure handling process. [Figure 19] FIG. 19 is a diagram (1) for explaining other processes of the monitoring system. [Figure 20] FIG. 20 is a diagram (2) for explaining other processes of the monitoring system. [Figure 21] FIG. 21 is a diagram showing the configuration of the generation server and the generation AI server. [Figure 22] FIG. 22 is a diagram illustrating an example of a hardware configuration of a computer that realizes the same functions as the monitoring server of the embodiment. [Figure 23] FIG. 23 is a diagram illustrating an example of a hardware configuration of a computer that realizes the same functions as the ITSM server of the embodiment. [Figure 24] FIG. 24 is a diagram showing an example of a conventional monitoring system. DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, embodiments of the support method and monitoring system disclosed in the present application will be described in detail with reference to the accompanying drawings, although the present invention is not limited to these embodiments. [Example]

[0016] 1 is a diagram illustrating an example of a monitoring system according to the present embodiment. As shown in FIG. 1, the monitoring system includes a customer system 10, an automation processing device 20, a monitoring server 100, an ITSM server 200, and a generation server 300.

[0017] In this embodiment, the monitoring server 100, the ITSM server 200, and the generation server 300 are described as separate servers, but the monitoring server 100, the ITSM server 200, and the generation server 300 can also be realized as a single server. Also, the monitoring server 100 and the ITSM server 200 can be realized as a single server, or the ITSM server 200 and the generation server 300 can be realized as a single server. The monitoring server 100, the ITSM server 200, and the generation server 300 are each connected to a network 50.

[0018] The customer system 10 is connected to an automated processing device 20. The automated processing device 20 is connected to a network 50 via a firewall 30 to prevent unauthorized access from outside. For convenience of explanation, only the customer system 10 is shown in FIG. 1 , but other customer systems may also be included. For example, other customer systems are connected to the automated processing device 20, and the automated processing device 20 is connected to the firewall 30 and connected to the network 50 via the firewall 30.

[0019] The customer system 10 is a system used by a customer and is made up of a plurality of electronic devices. When a failure occurs in the customer system 10, the customer system 10 transmits failure information to the monitoring server 100.

[0020] For example, the fault information includes a fault code that uniquely identifies the content of the fault, a system identification number that uniquely identifies the customer system 10, a fault message that is output when the fault occurs, etc. The system identification number of the customer system 10 is assumed to be "sys1".

[0021] The monitoring server 100 monitors the customer system 10. When the monitoring server 100 receives fault information from the customer system 10, it displays the fault information on a display screen. An operator of the monitoring server 100 refers to the display screen to understand the fault information. The monitoring server 100 also sends an incident issuance request with the fault information set to the ITSM server 200.

[0022] The ITSM server 200 has a fault DB 241, a workaround management table 242, a customer system management table 243, a response information table 244, and a conversion table 245, and executes the following processes. The fault DB 241, the workaround management table 242, the customer system management table 243, the response information table 244, and the conversion table 245 will be described in detail later.

[0023] When the ITSM server 200 receives an incident issuance request, it issues an incident. Furthermore, based on the fault information set in the incident issuance request and the configuration information of the customer system 10, the ITSM server 200 creates prompt information for asking a generation AI (Artificial Intelligence) 360 how to deal with the fault that has occurred in the customer system 10. The ITSM server 200 transmits the prompt information to the generation server 300 to obtain answer information from the generation AI 360. The ITSM server 200 assigns the incident number included in the incident issuance request to the prompt information.

[0024] The ITSM server 200 executes various processes based on the response information. For example, the ITSM server 200 notifies the monitoring server 100 of the response information to request a response to the failure of the customer system 10, and updates the failure DB 241 based on the response information. The processes executed by the ITSM server 200 based on the response information will be described in detail later.

[0025] The configuration information and fault information of the customer system 10 include confidential information. Therefore, when creating prompt information, the ITSM server 200 de-identifies the confidential information using the conversion table 245. Furthermore, when the ITSM server 200 acquires answer information and the answer information includes de-identified information, the ITSM server 200 uses the conversion table 245 to convert the de-identified information back to the information before de-identification.

[0026] FIG. 2 is a diagram showing an example of the data structure of a conversion table. As shown in FIG. 2, the conversion table 245 associates an item number with a first keyword and a second keyword. The item number is a number that identifies a record in the conversion table 245. The first keyword is a keyword that corresponds to confidential information. The second keyword is a keyword after de-identification. For example, the first keyword "HOST-A" is converted into the second keyword "COM-A" by de-identification.

[0027] 3 and 4 are diagrams for explaining the de-identification performed by the ITSM server. First, Fig. 3 will be explained. Here, the configuration information is assumed to be configuration information 2-1. The fault message included in the fault information is assumed to be fault message 3-1.

[0028] The ITSM server 200 compares the configuration information 2-1 with the conversion table 245, and generates the configuration information 2-2 by de-identifying (converting) the first keywords included in the configuration information 2-1 into second keywords.

[0029] In the example shown in FIG. 3, the ITSM server 200 de-identifies "HOST-A" in configuration information 2-1 to "COM-A" based on the conversion table 245. The ITSM server 200 de-identifies "HOST-B" in configuration information 2-1 to "COM-B" based on the conversion table 245. The ITSM server 200 de-identifies "192.168.15.15" in configuration information 2-1 to "192.168.0.1" based on the conversion table 245. The ITSM server 200 de-identifies "192.168.15.25" in configuration information 2-1 to "192.168.0.2" based on the conversion table 245. As a result, configuration information 2-2 is generated.

[0030] Furthermore, the ITSM server 200 de-identifies "HOST-A[192.168.15.15]" in the fault message 3-1 to "COM-A[192.168.0.1]" based on the conversion table 245. This generates a fault message 3-2.

[0031] The ITSM server 200 generates prompt information 4-1 based on the de-identified configuration information 2-2 and fault message 3-2. The ITSM server 200 transmits the prompt information 4-1 to the generation server 300. The prompt information 4-1 does not include confidential information and is de-identified.

[0032] We will now move on to the explanation of Figure 4. The generation server 300 creates answer information 5-1 by inputting the prompt information 4-1 into the generation AI 360, and sends it to the ITSM server 200. The ITSM server 200 compares the answer information 5-1 with the conversion table 245, and converts the second keywords included in the answer information 5-1 into first keywords, thereby generating answer information 5-2.

[0033] The ITSM server 200 may attach the configuration information 2-2 to the prompt information 4-1 as a context (or external source information using a RAG such as a LangChain) and transmit the resulting information to the generation server 300.

[0034] As described above, when creating prompt information, the ITSM server 200 performs de-identification on confidential information using the conversion table 245. Furthermore, when the ITSM server 200 acquires answer information and the answer information contains de-identified information, it performs a process of converting the de-identified information to the information before de-identification using the conversion table 245. This makes it possible to prevent the leakage of confidential information while supporting troubleshooting of customer systems.

[0035] The above describes the de-identification process executed by the ITSM server 200. Returning to the explanation of Fig. 1, the ITSM server 200 will be described in more detail below. Note that it is assumed that the ITSM server 200 performs the above-mentioned de-identification.

[0036] The following describes the fault DB 241 of the ITSM server 200. Fig. 5 is a diagram showing an example of the data structure of the fault DB. As shown in Fig. 5, the fault DB 241 stores an incident number, a fault code, a workaround, and a countermeasure flag.

[0037] The incident number is a number issued by the ITSM server 200. The fault code is information that uniquely identifies the fault set in the fault information. The workaround indicates how to deal with the fault identified by the fault code. For example, workarounds include checking the service status of the Windows server, checking long-running jobs, etc. Explanations of other workarounds are omitted.

[0038] The action flag is a flag that indicates whether or not a fault has been addressed in the customer system. If the fault has been addressed, the action flag is set to "ON." If the fault has not been addressed, the action flag is set to "OFF."

[0039] In the following explanation, a record identified by an incident number will be referred to as an "incident." For example, an incident identified by incident number "inc_1" corresponds to a record with a failure code of "error1100," a workaround of "Check Windows server service status," and a response flag of "OFF." In the following explanation, incidents with a response flag of "OFF" will be referred to as "unprocessed incidents" where appropriate.

[0040] Returning to the explanation of Figure 1, the generation server 300 has a generation AI 360. The generation AI 360 is ChatGPT or the like. When the generation server 300 receives prompt information from the ITSM server 200, it inputs the prompt information into the generation AI 360 to obtain answer information. The generation server 300 transmits the answer information to the ITSM server 200.

[0041] The automation processing device 20 accesses the fault DB 241 of the ITSM server 200 at predetermined time intervals via outbound communication.

[0042] The automation processing device 20 identifies an unaddressed incident whose handling flag is "OFF" from among the incidents in the fault DB 241, and executes a job corresponding to the workaround set for the identified incident on the customer system 10. In the example shown in FIG. 5, the automation processing device 20 executes a job for the workaround "Check the service status of the Windows server" and a job for "Check long-running jobs" on the customer system 10. The automation processing device 20 notifies the ITSM server 200 of the processing results of "Check the service status of the Windows server" and "Check long-running jobs."

[0043] When the ITSM server 200 receives information as a processing result indicating that the workarounds "Check the service status of the Windows server" and "Check the long-running job" have been addressed, it updates the action flags in the fault DB 241 corresponding to the workarounds "Check the service status of the Windows server" and "Check the long-running job" from "OFF" to "ON."

[0044] Next, an example of prompt information created by the ITSM server 200 will be described. Fig. 6 is a diagram showing an example of prompt information. As shown in Fig. 6, prompt information 40 includes multiple instruction statements (1) to (6), a fault message 41, and configuration information 42. The ITSM server 200 assigns the incident number included in the incident issuance request to the prompt information.

[0045] For example, instruction (1) is "Please explain the content of the fault message in Japanese. Please output the fault message content as: XXXX." XXXX in instruction (1) is the content of the reply.

[0046] Instruction (2) is "Please explain the cause of the failure that you infer from the failure message. Please output the inferred cause as XXXX." XXXX in instruction (2) is the content of the response.

[0047] Instruction (3) is "Calculate the evaluation points of the solutions (workaround proposals, job proposals) for the fault message from the following perspectives i, ii, and iii, and present three solutions in descending order of evaluation points. Please present the solutions in correspondence with the evaluation points. Please output as Solution: XXXX." Point I: Short recovery time (the shorter the recovery time, the higher the score) Point II: Shorter work time (the shorter the time, the higher the evaluation score) Point iii: The probability of success is high (the higher the probability, the higher the evaluation score). The XXXX in the instruction (3) is the answer.

[0048] Instruction (4) is "Please provide the URL that is the basis for the solution. Please output the URL as: Basis URL: XXXX." The XXXX in instruction (4) is the answer.

[0049] Instruction (5) is "Please provide the publication date of the URL that is the basis for the solution. Please output the publication date as XXXX." XXXX in instruction (5) is the content of the response.

[0050] Instruction (6) is, "Please limit the output of instructions (1) to (3) to approximately 100 characters."

[0051] In the fault message 41, a fault message included in the fault information is set.

[0052] The configuration information 42 includes hardware configuration information and software configuration information of the customer system in which the failure occurred (for example, customer system 10). The hardware configuration information is information about the processor, memory, storage, motherboard, graphics card, power supply unit, input / output port, network interface card, etc. configured in the customer system 10. The software configuration information is information about the OS, various application software, device drivers, security software, programming runtime, etc. installed in the customer system.

[0053] It is assumed that the instructions (1) to (6) for the prompt information 40 created by the ITSM server 200 described in Figure 6 are set in advance. The ITSM server 200 sets the fault message included in the incident issuance request (fault information) received from the monitoring server 100 as a fault message 41 in the prompt information 40. The ITSM server 200 identifies the customer system in which the fault has occurred based on the system identification number included in the incident issuance request received from the monitoring server 100, and sets the configuration information of the identified customer system as configuration information 42 in the prompt information 40. For example, the configuration information of the customer system is stored in the customer system management table 243.

[0054] As explained in FIG. 3, the configuration information and the fault message are anonymized by the ITSM server 200, so the prompt information 40 does not include confidential information.

[0055] An example of prompt information has been described above. For example, the generation server 300 inputs the prompt information 40 into the generation IA 360, thereby generating answer information such as that shown in FIG.

[0056] 7 is a diagram showing an example of answer information. For example, the answer information 45 shown in FIG. 7 includes the fault message content, the suspected cause, the countermeasure content, the basis URL, and the posting date. The generation server 300 sets the incident number set in the prompt information 40 in the answer information 45.

[0057] For example, the fault message content is set to "The fault message content is...." The probable cause is set to "The probable cause is...."

[0058] The countermeasure content contains information about countermeasures 1, 2, and 3. The workaround for countermeasure 1 is A1, the job is 1-A1, and the evaluation score for countermeasure 1 is 80 points. The workaround for countermeasure 2 is B1, the job is 1-B1, and the evaluation score for countermeasure 2 is 60 points. The workaround for countermeasure 3 is C1, the job is 1-C1, and the evaluation score for countermeasure 3 is 50 points.

[0059] The basis URLs for countermeasures 1, 2, and 3 are set in the basis URL. The basis URL for countermeasure 1 is "www.konkyo_1". ​​The basis URL for countermeasure 2 is "www.konkyo_2". The basis URL for countermeasure 3 is "www.konkyo_3".

[0060] The posting date is set to the posting date of the basis URL for countermeasures 1, 2, and 3. The posting date of the basis URL for countermeasure 1 is "April 1, 2023." The posting date of the basis URL for countermeasure 2 is "January 1, 2023." The posting date of the basis URL for countermeasure 3 is "August 1, 2023."

[0061] The above describes an example of answer information generated by the generation AI 360. When the ITSM server 200 acquires the answer information from the generation server 300, it registers the answer information in the answer information table 244. Note that, as described in FIG. 4, if the answer information 45 includes de-identified information, the ITSM server 200 converts the de-identified information into confidential information based on the conversion table 245, and then registers the answer information in the answer information table 244.

[0062] Next, details will be described of the fault DB 241, the workaround management table 242, the customer system management table 243, and the response information table 244. The description of the fault DB 241 is the same as the description of the fault DB 241 described in FIG.

[0063] The workaround management table 242 defines workarounds for dealing with failures identified by failure codes. FIG. 8 is a diagram showing an example of the data structure of the workaround management table. As shown in FIG. 8, this workaround management table 242 associates failure codes, workarounds, jobs, and setup dates. A failure code is information that uniquely identifies a failure. A workaround is the name of a workaround for dealing with a failure. A job is a group of multiple programs that are executed consecutively. A job also corresponds to a part that defines the execution order of multiple code components. The setup date is the date on which the corresponding record was set in the workaround management table 242.

[0064] For example, the workaround (workaround name) corresponding to the fault code "error1000" is "System Restart," the job for executing the corresponding workaround is "Job 1-1," and the date on which the record was set is "January 1, 2020."

[0065] The customer system management table 243 holds configuration information of the customer system. FIG. 9 is a diagram showing an example of the data structure of the customer system management table. As shown in FIG. 9, this customer system management table 243 has a system identification number, hardware configuration information, and software configuration information. The system identification number is a number that uniquely identifies the customer system. The hardware configuration information is information about the hardware configured in the customer system. The software configuration information is information about the software installed in the customer system.

[0066] For example, when setting configuration information in prompt information, the ITSM server 200 identifies the configuration information to be set in the prompt information by comparing the system identification number included in the incident issuance request (fault information) with the customer system management table 243.

[0067] The answer information table 244 holds answer information sent from the generation server 300. FIG. 10 is a diagram showing an example of the data structure of the answer information table. As shown in FIG. 10, the answer information table 244 includes an incident number, a failure content, a suspected cause, a priority, a workaround plan, a job plan, a basis URL, a posting date, and an evaluation score. The explanations for the incident number, the failure content, a suspected cause, a workaround plan, a job plan, a basis URL, a posting date, and an evaluation score are the same as those explained above. The priority is assigned in ascending order based on the highest evaluation score.

[0068] The details of the fault DB 241, the workaround management table 242, the customer system management table 243, and the response information table 244 have been explained above.

[0069] Next, a detailed description will be given of the processing that the ITSM server 200 performs after acquiring answer information from the generation server 300. When the ITSM server 200 acquires answer information from the generation server 300, the ITSM server 200 associates the answer information with the incident number and sets the content of the answer information in the answer information table 244. For example, based on the answer information 45 described in Fig. 7, the ITSM server 200 sets information in each item of the answer information table 244 (incident number, failure content, suspected cause, priority, workaround proposal, job proposal, basis URL, posting date, evaluation score) as shown in Fig. 10.

[0070] The ITSM server 200 refers to the response information table 244 and acquires the pair of the workaround plan and job plan with the highest priority (priority "1"). In the example shown in FIG. 10, the ITSM server 200 acquires the pair of workaround plan "A1" and job plan "1-A1". The ITSM server 200 acquires from the response information table 244 the fault content, suspected cause, rationale URL corresponding to the pair of the workaround plan and job plan with the highest priority, posting date, and evaluation score. The ITSM server 200 also acquires the fault code included in the incident issuance information. The ITSM server 200 generates each piece of acquired information as "handling information".

[0071] The ITSM server 200 determines, based on the handling information and the workaround management table 242, whether a workaround corresponding to the failure code in the handling information is registered in the workaround management table 242. If a workaround corresponding to the failure code in the handling information is not registered in the workaround management table 242, the ITSM server 200 executes a "first process." On the other hand, if a workaround corresponding to the failure code in the handling information is registered in the workaround management table 242, the ITSM server 200 executes a "second process."

[0072] First, we will explain the first process executed by the ITSM server 200. The ITSM server 200 requests approval by sending handling information to the support person's terminal device (not shown). The ITSM server 200 receives a response from the support person's terminal device, and if approval from the support person is obtained, sends the handling information to the monitoring server 100 and causes the display unit of the monitoring server 100 to display the handling information. The operator of the monitoring server 100 refers to the handling information for which approval from the support person has been obtained, sends a job for the handling information to the automated processing device 20, and causes the job to be executed.

[0073] Next, we will explain the second process executed by the ITSM server 200. The ITSM server 200 further determines whether the workaround corresponding to the failure code in the handling information and registered in the workaround management table 242 is the same as the workaround in the handling information. For example, if the handling information is "Failure code: error1100 Workaround: A1" and the workaround corresponding to the failure code "error1100" registered in the workaround management table 242 is "A2," this means that the workarounds are not the same.

[0074] In the following explanation, the workaround set in the handling information will be referred to as the "first workaround." Also, the workaround in the workaround management table 242 will be referred to as the "second workaround." The fault code corresponding to the first workaround and the fault code corresponding to the "second workaround" are the same.

[0075] If the first workaround and the second workaround are the same, the ITSM server 200 registers information about the incident in the fault DB 241. For example, when the ITSM server 200 acquires fault information, it generates a unique incident number. The ITSM server 200 compares the fault code set in the fault information with the workaround management table 242 to identify the workaround corresponding to the fault code.

[0076] The ITSM server 200 stores incidents (incident number, failure code of failure information, workaround, action flag) in the failure DB 241. <off>As described above, the automated processing device 20 refers to the fault DB 241 and automatically handles the fault.

[0077] On the other hand, if the first workaround and the second workaround are not the same, the ITSM server 200 executes the following process: The ITSM server 200 acquires the publication date of the first workaround from the handling information. The ITSM server 200 acquires the setting date of the second workaround from the workaround management table 242.

[0078] If the posting date is later than the set date, the ITSM server 200 executes the same process as the first process. If the posting date is later than the set date, the workaround in the handling information can be considered a newer countermeasure than the workaround in the workaround management table 242. The ITSM server 200 requests approval by sending handling information to the support person's terminal device (not shown). If approval from the support person is obtained, the ITSM server 200 sends the handling information to the monitoring server 100. The operator of the monitoring server 100 sends the job included in the handling information approved by the support person to the automation processing device 20, and has the job executed.

[0079] On the other hand, if the posting date is earlier than the set date, the ITSM server 200 ends the process and waits until it receives the next incident issuance request. If the posting date is earlier than the set date, the workaround in the handling information can be said to be an older countermeasure than the workaround in the workaround management table 242.

[0080] As described above, when the ITSM server 200 receives an incident issuance request from the monitoring server 100, the monitoring system generates prompt information and transmits the prompt information to the generation server 300, thereby acquiring answer information generated by the generation AI 360. The ITSM server 200 executes various processes based on the acquired answer information, thereby supporting troubleshooting of the customer system 10.

[0081] The monitoring server 100 may have the functions of the ITSM server 200 and the generation server 300, and may execute the above processes. That is, the monitoring server 100 may generate prompt information, input the prompt information to the generation AI 360, acquire answer information, and execute various processes based on the acquired answer information.

[0082] Next, an example of the configuration of the automation processing device 20 described in Fig. 1 will be described. Fig. 11 is a functional block diagram showing the configuration of the automation processing device according to this embodiment. As shown in Fig. 11, the automation processing device 20 has a communication unit 21, a storage unit 24, and a control unit 25.

[0083] The communication unit 21 transmits and receives information to and from the monitoring server 100 and the ITSM server 200 via the network 50. The communication unit 21 also transmits and receives information to and from the customer system 10. The communication unit 21 is realized by a NIC (Network Interface Card) or the like.

[0084] The storage unit 24 includes a processing table 24a. For example, the storage unit 24 is a storage device such as a memory.

[0085] The processing table 24a is a table for setting jobs corresponding to workarounds. Fig. 12 is a diagram showing an example of the data structure of the processing table. As shown in Fig. 12, the processing table 24a associates workarounds with jobs. The explanation regarding workarounds and jobs is the same as the explanation regarding workarounds and jobs above.

[0086] Returning to the description of Fig. 11, the control unit 25 includes an acquisition unit 25a and an execution unit 25b. The control unit 25 is, for example, a CPU (Central Processing Unit) or an MPU (Micro Processing Unit).

[0087] The acquisition unit 25a accesses the fault DB 241 of the ITSM server 200 at predetermined time intervals. When accessing the ITSM server 200, the acquisition unit 25a notifies the ITSM server 200 of the system identification number of the customer system that is the target of job execution. The acquisition unit 25a acquires workarounds for unaddressed incidents from among the incidents in the fault DB 241. The acquisition unit 25a may also acquire the incident number. The acquisition unit 25a outputs the acquired workarounds to the execution unit 25b.

[0088] The execution unit 25b compares the workaround acquired from the acquisition unit 25a with the processing table 24a, and identifies a job corresponding to the workaround. The execution unit 25b executes the identified job on the customer system 10. The execution unit 25b transmits the processing result to the ITSM server 200. The processing result includes the incident number and information on whether the execution of the job corresponding to the workaround was successful.

[0089] Here, if the execution of the job fails, the execution unit 25b may retry the execution of the job a predetermined number of times. If the execution of the job is not successful even after retrying the job a predetermined number of times, the execution unit 25b sets information to the effect that the execution of the job corresponding to the workaround has failed as a processing result and transmits the information to the ITSM server 200.

[0090] When the execution unit 25b receives a job included in handling information approved by a support staff member from the monitoring server 100, the execution unit 25b executes the job on the customer system 10. The execution unit 25b transmits the processing result to the monitoring server 100.

[0091] Next, an example of the configuration of the monitoring server 100 explained in Fig. 1 will be described. Fig. 13 is a functional block diagram showing the configuration of the monitoring server. As shown in Fig. 13, the monitoring server 100 has a communication unit 110, an input unit 120, a display unit 130, a storage unit 140, and a control unit 150.

[0092] The communication unit 110 transmits and receives information to and from the ITSM server 200, the automation processing device 20, and the customer system 10 via the network 50. The communication unit 110 is realized by a NIC or the like.

[0093] The input unit 120 is an input device that inputs various types of information to the monitoring server 100. The input unit 120 corresponds to a keyboard, a mouse, a touch panel, or the like.

[0094] The display unit 130 is a display device that displays information output from the control unit 150. The display unit 130 corresponds to a liquid crystal display, an organic EL (Electro Luminescence) display, a touch panel, etc. For example, the display unit 130 displays a customer.

[0095] The storage unit 140 holds various types of information for executing processes by the control unit 150. The storage unit 140 is a storage device such as a memory.

[0096] The control unit 150 includes an abnormality detection unit 151, a request unit 152, a display control unit 153, and a job execution unit 154. The control unit 150 is, for example, a CPU or an MPU.

[0097] The abnormality detection unit 151 monitors the customer system 10 and detects whether a failure has occurred. For example, when the abnormality detection unit 151 receives failure information from the customer system 10, it detects that a failure has occurred in the customer system 10 corresponding to the system identification number set in the failure information. The abnormality detection unit 151 outputs the received failure information to the request unit 152 and the display control unit 153.

[0098] The abnormality detection unit 151 may transmit data to the customer system 10 and, if there is no response from the destination customer system 10, detect an abnormality in the customer system 10. In this case, the abnormality detection unit 151 generates fault information that sets a fault code indicating no response and the system identification number of the customer system 10 in which the abnormality was detected, and outputs the generated fault information to the request unit 152 and the display control unit 153.

[0099] When the request unit 152 acquires fault information from the abnormality detection unit 151, the request unit 152 transmits an incident issuance request in which the fault information is set to the ITSM server 200.

[0100] The display control unit 153 displays various types of information on the display unit 130. For example, the display control unit 153 displays fault information on the display unit 130. When error information is received from the ITSM server 200, the display control unit 153 displays the error information on the display unit 130.

[0101] When the job execution unit 154 acquires a job included in handling information that has been approved by a support person from the ITSM server 200, it displays the handling information on the display unit 130. When the job execution unit 154 receives an execution command for the handling information via the input unit 120 or the like, it transmits the job of the handling information to the automation processing device 20 and causes the job to be executed.

[0102] Next, we will explain an example configuration of the ITSM server 200 explained in Fig. 1. Fig. 14 is a functional block diagram showing the configuration of the ITSM server. As shown in Fig. 14, this ITSM server 200 has a communication unit 210, an input unit 220, a display unit 230, a storage unit 240, and a control unit 250.

[0103] The communication unit 210 transmits and receives information to and from the monitoring server 100, the generation server 300, the automation processing device 20, and the customer system 10 via the network 50. The communication unit 110 is realized by an NIC or the like.

[0104] The input unit 220 is an input device that inputs various types of information to the ITSM server 200. The input unit 220 corresponds to a keyboard, a mouse, a touch panel, or the like.

[0105] The display unit 230 is a display device that displays information output from the control unit 150. The display unit 230 corresponds to a liquid crystal display, an organic EL display, a touch panel, etc. For example, the display unit 230 displays the customer.

[0106] The storage unit 240 includes a fault DB 241, a workaround management table 242, a customer system management table 243, a response information table 244, and a conversion table 245. The storage unit 240 is a storage device such as a memory.

[0107] The fault DB 241 stores information related to fault information. The data structure of the fault DB 241 corresponds to the data structure described with reference to FIG.

[0108] The workaround management table 242 defines workarounds for dealing with failures identified by failure codes. The data structure of the workaround management table 242 corresponds to the data structure described in FIG.

[0109] The customer system management table 243 holds configuration information of the customer system. The data structure of the customer system management table 243 corresponds to the data structure described with reference to FIG.

[0110] The response information table 244 holds the response information sent from the generation server 300. The data structure of the response information table 244 corresponds to the data structure described with reference to FIG.

[0111] Conversion table 245 associates first keywords (keywords corresponding to confidential information) with second keywords (keywords after de-identification). The data structure of conversion table 245 corresponds to the data structure described in FIG.

[0112] The control unit 250 includes a receiving unit 251, a creating unit 252, a response information processing unit 253, an access accepting unit 254, and a converting unit 255. The control unit 250 is, for example, a CPU or an MPU.

[0113] When the receiving unit 251 receives an incident issuance request from the monitoring server 100, it issues an incident number.

[0114] The receiving unit 251 outputs the fault information set in the incident issuance request to the converting unit 255 and requests the converting unit 255 to perform the de-identification process.

[0115] When the conversion unit 255 receives the fault information, it compares the fault message included in the fault information with the conversion table 245, and converts the first keyword included in the fault message into a second keyword.

[0116] Based on the system identification information set in the failure information, the conversion unit 255 acquires the configuration information of the customer system 10 from the customer system management table 243. The conversion unit 255 compares the configuration information with the conversion table 245 and converts the first keyword included in the configuration information into a second keyword.

[0117] The conversion unit 255 outputs the failure information that has been de-identified as described above and the configuration information to the reception unit 251.

[0118] The receiving unit 251 outputs the failure information, configuration information, and incident number that have been de-identified by the converting unit 255 to the creating unit 252 .

[0119] The creation unit 252 creates prompt information and transmits the created prompt information to the generation server 300. For example, when creating the prompt information 40 described with reference to Fig. 6, the creation unit 252 uses information that has been set in advance as instruction statements (1) to (6).

[0120] The creation unit 252 sets the fault message included in the fault information as a fault message 41 in the prompt information 40. The creation unit 252 sets the configuration information of the customer system as configuration information 42 in the prompt information 40.

[0121] The rest of the process by which the creation unit 252 creates prompt information is the same as that described with reference to FIG.

[0122] When the answer information processing unit 253 receives answer information from the generation server 300, it outputs the answer information to the conversion unit 255 and requests that the de-identified keywords be converted into the original keywords (keywords for confidential information).

[0123] Upon receiving the answer information, the conversion unit 255 compares the answer information with the conversion table 245 and converts the second keywords included in the answer information into first keywords. The conversion unit 255 outputs the converted answer information to the answer information processing unit 253.

[0124] The answer information processing unit 253 registers the content of the answer information received from the conversion unit 255 in the answer information table 244. The answer information processing unit 253 generates handling information after registering the content of the answer information in the answer information table 244. The explanation regarding the handling information is the same as the explanation regarding the handling information described above.

[0125] The answer information processing unit 253 executes a "first process" if a workaround corresponding to the failure code in the handling information is not registered in the workaround management table 242. The content of the first process executed by the answer information processing unit 253 is the same as the content of the first process described above.

[0126] On the other hand, the answer information processing unit 253 executes the "second process" when a workaround corresponding to the failure code in the handling information is registered in the workaround management table 242. The content of the second process executed by the answer information processing unit 253 is the same as the content of the second process described above.

[0127] The access receiving unit 254 receives access to the fault DB 241 from the automation processing device 20 and allows the access to the fault DB 241. For example, the acquiring unit 25a of the automation processing device 20 acquires, from the fault DB 241, a workaround for an unaddressed incident.

[0128] The access receiving unit 254 also receives a processing result for the workaround from the automation processing device 20. For example, the processing result includes an incident number and information on whether the job corresponding to the workaround was successfully executed.

[0129] If the processing result includes information indicating that the job was successfully executed, the access receiving unit 254 updates the action flag corresponding to the incident number included in the processing result to "ON."

[0130] On the other hand, if the processing result includes information indicating that the job execution failed, the access receiving unit 254 sends error information to the monitoring server 100. The error information includes a system identification number, an incident number corresponding to the workaround that failed to be dealt with, and the like.

[0131] As described above, when the conversion unit 255 receives fault information from the receiving unit 251, the conversion unit 255 compares the fault message included in the fault information with the conversion table 245 and converts the first keyword included in the fault message into a second keyword. The conversion unit 255 acquires configuration information of the customer system 10 from the customer system management table 243 based on the system identification information set in the fault information. The conversion unit 255 compares the configuration information with the conversion table 245 and converts the first keyword included in the configuration information into a second keyword. The conversion unit 255 outputs the fault information and the configuration information that have been de-identified as described above to the receiving unit 251.

[0132] Furthermore, as described above, when the conversion unit 255 receives answer information, it compares the answer information with the conversion table 245 and converts the second keywords included in the answer information into first keywords. The conversion unit 255 outputs the converted answer information to the answer information processing unit 253.

[0133] Next, a configuration example of the generation server 300 explained in Fig. 1 will be described. Fig. 15 is a functional block diagram showing the configuration of the generation server. As shown in Fig. 15, this generation server 300 has a communication unit 310, a storage unit 340, and a control unit 350.

[0134] The communication unit 310 transmits and receives information to and from the ITSM server 200 via the network 50. The communication unit 310 is realized by a NIC (Network Interface Card) or the like.

[0135] The storage unit 340 has the generated AI 360. The storage unit 340 is a storage device such as a memory. The generated AI 360 is ChatGPT (ChatGPT data) or the like.

[0136] The control unit 350 includes a receiving unit 351, a generation AI executing unit 352, and a transmitting unit 353. The control unit 350 is, for example, a CPU or an MPU.

[0137] When the receiving unit 351 receives prompt information from the ITSM server 200 , it outputs the prompt information to the generation AI executing unit 352 .

[0138] The generation AI execution unit 352 is a processing unit that executes the generation AI 360. For example, the generation AI execution unit 352 inputs prompt information to the generation AI 360 and obtains answer information. The generation AI execution unit 352 outputs the answer information to the transmission unit 353.

[0139] The sending unit 353 assigns the incident number set in the prompt information to the answer information, and sends the answer information to the ITSM server 200.

[0140] Next, an example of the processing procedure of the automation processing device 20 shown in Fig. 1 will be described. Fig. 16 is a flowchart showing the processing procedure of the automation processing device according to this embodiment. As shown in Fig. 16, if a certain period of time has not elapsed (No in step S101), the acquisition unit 25a of the automation processing device 20 proceeds to step S101 again.

[0141] If a certain period of time has elapsed (Yes at Step S101), the acquiring unit 25a accesses the fault DB 241 of the ITSM server 200 and determines whether or not there is an unaddressed incident (Step S102). If there is no unaddressed incident (No at Step S103), the acquiring unit 25a proceeds to Step S108.

[0142] On the other hand, if there is an unaddressed incident (Yes at Step S103), the acquisition unit 25a acquires a workaround (Step S104). The execution unit 25b of the automation processing device 20a selects a job corresponding to the workaround based on the processing table 24a (Step S105).

[0143] The execution unit 25b executes the job for the customer system 10a (step S106), and transmits the job processing result to the ITSM server 200 (step S107).

[0144] If the automation processing device 20 continues the process (step S108, Yes), the process proceeds to step S101. If the automation processing device 20 does not continue the process (step S108, No), the process ends.

[0145] Next, a description will be given of the processing procedures of the monitoring server 100 and the ITSM server 200 shown in Fig. 1. Fig. 17 is a flowchart showing the processing procedures of the monitoring server and the ITSM server. If the monitoring server 100 does not detect any fault information (step S201, No), the monitoring server 100 proceeds to step S201 again.

[0146] On the other hand, if the monitoring server 100 detects fault information (Yes at step S201), it transmits an incident issuance request in which the fault information is set to the ITSM server 200 (step S202).

[0147] The ITSM server 200 receives the incident issuance request (step S203), and executes the failure response process (step S204).

[0148] Next, the procedure for the failure handling process shown in step S204 in Fig. 17 will be described. Fig. 18 is a flowchart showing the procedure for the failure handling process. As shown in Fig. 18, the conversion unit 255 of the ITSM server 200 performs de-identification on the failure information and configuration information based on the conversion table 245 (step S301).

[0149] The creation unit 252 of the ITSM server 200 creates prompt information based on the failure information and configuration information (step S302), and transmits the prompt information to the generation server 300 (step S303).

[0150] The answer information processing unit 253 of the ITSM server 200 receives the answer information from the generation server 300 (step S304). The conversion unit 255 converts the de-identified keywords included in the answer information back to the original keywords based on the conversion table 245 (step S305). The answer information processing unit 253 registers the answer information in the answer information table 244 and generates handling information (step S306).

[0151] The response information processing unit 253 determines, based on the handling information and the workaround management table 242, whether or not a workaround corresponding to the failure code in the handling information is registered in the workaround management table 242 (step S307).

[0152] If the answer information processing unit 253 is not registered (step S308, No), it executes the first process (step S309). On the other hand, if the answer information processing unit 253 is registered (step S308, Yes), it executes the second process (step S310).

[0153] Next, the effects of the monitoring system according to this embodiment will be described. In the monitoring system, when creating prompt information, the ITSM server 200 uses the conversion table 245 to de-identify confidential information. Furthermore, when the ITSM server 200 acquires answer information and the answer information contains de-identified information, it uses the conversion table 245 to convert the de-identified information back to the information before de-identification. This makes it possible to prevent the leakage of confidential information while supporting troubleshooting of customer systems.

[0154] The above-described processing of the monitoring system is merely an example. Other processing 1 to 5 of the monitoring system will be described below.

[0155] First, other processing 1 of the monitoring system will be described. If a workaround corresponding to the fault code in the handling information is not registered in the workaround management table 242, the ITSM server 200 of the monitoring system executes a simulation using the job of the handling information in a test environment that is the same environment as the customer system 10, and determines whether an error or the like occurs. If no error or the like occurs, the ITSM server 200 transmits the job in the handling information to the automation processing device 20 and causes the job to be executed.

[0156] By having the monitoring system execute other process 1, it is possible to safely handle a failure in the customer system 10 without the approval of a support person.

[0157] Other processing 2 of the monitoring system will now be described. When a workaround corresponding to the failure code in the handling information is not registered in the workaround management table 242, the ITSM server 200 of the monitoring system may change processing depending on whether the workaround in the handling information is a low-risk workaround or a high-risk workaround. For example, the ITSM server 200 holds a table that defines low-risk workarounds and high-risk workarounds, and determines whether the risk of the workaround in the handling information is low based on this table.

[0158] If the risk of the workaround in the handling information is low, the ITSM server 200 transmits the handling information to the monitoring server 100 without sending the handling information to the terminal device of the support staff (without receiving approval), and causes the handling information to be displayed on the display unit of the monitoring server 100. The operator of the monitoring server 100 refers to the handling information (handling information with low risk), transmits a job for the handling information to the automated processing device 20, and causes the job to be executed.

[0159] On the other hand, if the risk of a workaround in the handling information is high, the ITSM server 200 transmits the handling information to the terminal device of the support person, receives a response from the terminal device of the support person, and if approval is obtained from the support person, transmits the handling information to the monitoring server 100 and displays the handling information on the display unit of the monitoring server 100. The operator of the monitoring server 100 refers to the handling information that has been approved by the support person, transmits a job for the handling information to the automated processing device 20, and causes the job to be executed.

[0160] As described above, for low-risk response information, the approval process by the support staff can be skipped and the failure can be handled quickly. For high-risk response information, the approval process by the support staff must be carried out first, and then the failure can be handled safely.

[0161] Next, other processing 3 of the monitoring system will be described. The ITSM server 200 of the monitoring system sets the workaround plan and job plan with the highest evaluation score among the multiple workaround plans and job plans included in the response information as "handling information," sends it to the support staff's terminal device, and requests approval, but this is not limiting.

[0162] The ITSM server 200 may set the top n workaround plans and job plans included in the response information as handling information, send it to the support person's terminal device, and request approval. The support person selects one workaround plan and one job plan from the multiple workaround plans and job plans, and responds to the ITSM server 200. In this case, the ITSM server 200 sends the workaround plan and job plan selected by the support person as handling information to the monitoring server 100, and displays the handling information on the display unit of the monitoring server 100. The operator of the monitoring server 100 refers to the handling information approved by the support person, sends a job for the handling information to the automation processing device 20, and executes the job.

[0163] This allows the workaround job selected by the support person from among a plurality of workaround plans and job plans to be executed on the customer system 10.

[0164] Furthermore, the ITSM server 200 may repeatedly execute a process of setting the top n workaround plans and job plans included in the response information as handling information and sending it to the support person's terminal device, and may update the evaluation points corresponding to the workaround plans and job plans selected by the support person depending on the number of times they are selected (adding a predetermined number to the evaluation value each time they are selected).The ITSM server 200 may also update the evaluation points corresponding to the workaround plans and job plans selected by the support person depending on whether the problem is solved as a result of executing the selected job plan (adding a predetermined value if the problem is solved, and subtracting a predetermined value if the problem is not solved).

[0165] Other processing 4 of the monitoring system will now be described. When executing the second processing, the ITSM server 200 of the monitoring system compares the posting date of the first workaround with the setting date of the second workaround, and if the posting date is later than the setting date, executes processing similar to the first processing, but the determination may also be made from a perspective other than the posting date and the setting date.

[0166] The monitoring server 100, ITSM server 200, and generation server 300 of the monitoring system shown in FIG. 1 may be configured as a single server (integrated monitoring server). The control unit of such an integrated monitoring server is a control unit that integrates the control unit 150 shown in FIG. 13, the control unit 250 shown in FIG. 14, and the control unit 350 shown in FIG. 15. The memory unit of such an integrated monitoring server holds the information stored in the memory unit 140 shown in FIG. 13, the memory unit 240 shown in FIG. 14, and the memory unit 340 shown in FIG. 15. In the above embodiment, the operator who references the handling information sends a job to the automation processing device 20. However, an administrator may change the settings so that the ITSM server 200 sends a job directly to the automation processing device 20.

[0167] Other processing 5 of the monitoring system will now be described. As described with reference to Figures 3 and 4, the ITSM server 200 of the monitoring system performs de-identification processing using a conversion table 245 prepared in advance, but this is not limited to this. For example, even if the conversion table 245 is not prepared in advance, the ITSM server 200 (conversion unit 255) may search for a keyword of a predetermined pattern (hereinafter referred to as a third keyword) using a regular expression (a regular expression for the device name of the customer system 10, a regular expression for an IP address, etc.) and de-identify the searched third keyword as a keyword for confidential information. The ITSM server 200 converts the third keyword into a fourth keyword prepared in advance and adds the relationship between the third keyword and the fourth keyword to the conversion table 245a. The ITSM server 200 may also dynamically generate the fourth keyword.

[0168] 19 is a diagram (1) for explaining other processing of the monitoring system. For example, the ITSM server 200 scans the fault message 6-1, extracts "HOST-C" corresponding to the regular expression of the device as a third keyword, and de-identifies the third keyword as a prepared fourth keyword "COM-C." The ITSM server 200 registers the relationship between the third keyword and the fourth keyword in the conversion table 245a.

[0169] The ITSM server 200 scans the fault message 6-1, extracts "192.168.17.17" corresponding to the regular expression of the IP address as the third keyword, and de-identifies this third keyword as the prepared fourth keyword "192.168.0.3." The ITSM server 200 registers the relationship between the third keyword and the fourth keyword in the conversion table 245a.

[0170] The ITSM server 200 executes the above process to generate a fault message 6-2. In Fig. 19, the de-identification process was explained using a fault message, but de-identification is also performed in a similar manner for configuration information, etc. Furthermore, when the ITSM server 200 receives answer information from the generation server 300, it executes a process of converting the fourth keyword included in the answer information into the third keyword using the conversion table 245a.

[0171] By having the ITSM server 200 execute the above process, it is possible to de-identify keywords of confidential information contained in configuration information and fault messages, even if the conversion table 245 is not prepared in advance.

[0172] When a single fault message contains multiple IP addresses, if these multiple IP addresses are converted into the same numeric string (fourth keyword), it may be impossible to distinguish which IP address is represented by the multiple fourth keywords (same numeric string) included in the answer information obtained from the generation server 300, which could result in a decrease in the accuracy of the answer information. For this reason, when a fault message contains multiple IP addresses, the ITSM server 200 converts each IP address into a distinguishable fourth keyword.

[0173] FIG. 20 is a diagram (2) for explaining other processing of the monitoring system. For example, the ITSM server 200 extracts "120.26.19.19" and "120.26.20.20," which correspond to regular expressions for IP addresses, as third keywords from the fault message 7-1. The ITSM server 200 converts "120.26.19.19" to the fourth keyword "SRC=120.26.0.19" and converts "120.26.20.20" to the fourth keyword "DST=123.123.0.20." This makes it possible to distinguish which IP address is being expressed, improving the accuracy of the response information.

[0174] In the above, the generation server 300 is configured to have the generation AI 360, but it is also possible to provide a generation AI server 600 instead of the generation server 300 having the generation AI, and to configure the generation server 300 and the generation AI server 600 to work together.

[0175] Figure 21 is a diagram showing the configuration of a generation server and a generation AI server. As shown in Figure 21, for example, the generation server 300 has a communication unit 310 and a control unit 350 (a receiving unit 351, a linking unit 352, and a transmitting unit 353). The generation AI server 600 has a communication unit 610 and a generation AI 620. The generation AI 620 corresponds to a server on which an external service such as ChatGPT or a generation AI runs. The communication unit 610 of the generation AI server 600 communicates with the generation server 300.

[0176] The collaboration unit 352 of the generation server 300 collaborates with the generation AI 660 of the generation AI server 600. For example, the collaboration unit 352 transmits prompt information to the generation AI 620 and receives answer information. The collaboration unit 352 outputs the received answer information to the transmission unit 353.

[0177] Next, an example of the hardware configuration of a computer that realizes the same functions as the monitoring server 100 and the ITSM server 200 shown in the above-described embodiments will be described. Fig. 22 is a diagram showing an example of the hardware configuration of a computer that realizes the same functions as the monitoring server of the embodiment.

[0178] 22, the computer 400 has a CPU 401 that executes various types of arithmetic processing, an input device 402 that accepts data input from a user, and a display 403. The computer 400 also has a communication device 404 that exchanges data with the customer system 10, the automation processing device 20, the ITSM server 200, etc. via a wired or wireless network, and an interface device 405. The computer 400 also has a RAM 406 that temporarily stores various types of information, and a hard disk device 407. The devices 401 to 407 are connected to a bus 408.

[0179] The hard disk device 407 stores an abnormality detection program 407a, a request program 407b, a display control program 407c, and a job execution program 407d. The CPU 401 reads out each of the programs 407a to 407d and loads them into the RAM 406.

[0180] The abnormality detection program 407a functions as an abnormality detection process 406a. The request program 407b functions as a request process 406b. The display control program 407c functions as a display control process 406c. The job execution program 407d functions as a job execution process 406d.

[0181] The processing of the abnormality detection process 406a corresponds to the processing of the abnormality detection unit 151. The processing of the request process 406b corresponds to the processing of the request unit 152. The processing of the display control process 406c corresponds to the processing of the display control unit 153. The processing of the job execution process 406d corresponds to the processing of the job execution unit 154.

[0182] It should be noted that each of the programs 407a to 407d does not necessarily have to be stored in the hard disk drive 407 from the beginning. For example, each of the programs may be stored in a "portable physical medium" such as a flexible disk (FD), CD-ROM, DVD, magneto-optical disk, or IC card that is inserted into the computer 400. Then, the computer 400 may read and execute each of the programs 407a to 407d.

[0183] Next, we move on to the description of Fig. 23. Fig. 23 is a diagram showing an example of the hardware configuration of a computer that realizes the same functions as the ITSM server of the embodiment.

[0184] 23, the computer 500 has a CPU 501 that executes various types of arithmetic processing, an input device 502 that accepts data input from a user, and a display 503. The computer 500 also has a communication device 504 that exchanges data with the customer system 10, the automation processing device 20, the monitoring server 100, the generation server 300, etc. via a wired or wireless network, and an interface device 505. The computer 500 also has a RAM 506 that temporarily stores various types of information, and a hard disk device 507. The devices 501 to 507 are connected to a bus 508.

[0185] The hard disk device 507 has a receiving program 507a, a creating program 507b, a response information processing program 507c, an access receiving program 507d, and a converting program 507e. The CPU 501 reads out each of the programs 507a to 507e and loads them into the RAM 506.

[0186] The receiving program 507a functions as a receiving process 506a. The registration program 507b functions as a registration process 506b. The answer information processing program 507c functions as a answer information processing process 506c. The access receiving program 507d functions as an access receiving process 506d. The conversion program 507e functions as a conversion process 506e.

[0187] The processing of the reception process 506a corresponds to the processing of the reception unit 251. The processing of the creation process 506b corresponds to the processing of the creation unit 252. The processing of the answer information processing process 506c corresponds to the processing of the answer information processing unit 253. The processing of the access reception process 506d corresponds to the processing of the access reception unit 254. The processing of the conversion process 506e corresponds to the processing of the conversion unit 255.

[0188] It should be noted that each of the programs 507a to 507e does not necessarily have to be stored in the hard disk drive 507 from the beginning. For example, each of the programs may be stored in a "portable physical medium" such as a flexible disk (FD), CD-ROM, DVD, magneto-optical disk, or IC card that is inserted into the computer 500. Then, the computer 500 may read and execute each of the programs 507a to 507e. [Explanation of symbols]

[0189] 10a, 10b, 10c Customer System 20a, 20b, 20c Automated processing equipment 30a, 30b, 30c Firewall 50 Network 100 monitoring servers 200 ITSM Servers< / off>

Claims

1. A method for supporting a monitoring system having a system and a monitoring server that monitors the system, comprising: When the monitoring server detects that a failure has occurred in the system, it determines whether or not a predetermined keyword is included in configuration information of the system that includes information about the failure and information related to the information about the failure; the monitoring server performs de-identification on the predetermined keyword included in the fault information and the configuration information when the predetermined keyword is included; the monitoring server inputs the de-identified fault information and the configuration information into a large-scale language model, thereby obtaining response information indicating handling information for the fault, which is generated by the large-scale language model; The monitoring server executes processing based on the response information. A support method characterized by:

2. the monitoring server has a table that associates predetermined keywords with keywords before de-identification and keywords after de-identification, 2. The support method according to claim 1, wherein the monitoring server performs the de-identification based on the table.

3. The support method described in claim 2, characterized in that, if the answer information contains a keyword after de-identification, the monitoring server further performs a process of converting the keyword after de-identification contained in the answer information to the keyword before de-identification based on the answer information and the table.

4. The support method described in claim 2, characterized in that the monitoring server further executes a process of extracting keywords related to devices and IP addresses of the system from the fault information and the configuration information, converting the extracted keywords into other keywords, associating the keywords before conversion with the keywords after conversion, and registering them in the table.

5. A monitoring system comprising: a system; and a monitoring server that monitors the system, The monitoring server When detecting that a failure has occurred in the system, determining whether or not a predetermined keyword is included in configuration information of the system that includes information about the failure and information related to the information about the failure; the monitoring server performs de-identification on the predetermined keyword included in the fault information and the configuration information when the predetermined keyword is included; the monitoring server inputs the de-identified fault information and the configuration information into a large-scale language model, thereby obtaining response information indicating handling information for the fault, which is generated by the large-scale language model; The monitoring server executes processing based on the response information. A monitoring system comprising a control unit.

Images