Computer system and fault investigation support method for it system

Abstract

To provide a system for performing the fault investigation of an IT system using an LLM (Large Language Model).SOLUTION: A computer system is connected to an IT system and a text generation system composed of a plurality of elements, and holds element information for managing observation data acquired from the elements, relation information for managing relationships between the elements, and scope information defining a scope representing a scope of an investigation object. When a failure of the IT system occurs, the computer system selects a scope, specifies an element to be investigated based on the scope and relation information, acquires observation data of the specified element from the element information, generates a prompt for instructing the acquisition of knowledge about the failure of the IT system including the viewpoint of analysis in the failure investigation, the element, and the observation data as text, inputs the prompt to the text generation system, and acquires a response text including the knowledge.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a system and method for supporting the investigation of a fault in an IT system. [Background technology]

[0002] When an IT system consisting of multiple elements that performs a specific service experiences a shutdown or processing delay due to a failure, economic losses occur. Therefore, operations managers are required to restore the IT system as quickly as possible. The most time-consuming part of the recovery process is the investigation of the failure, and operations managers refer to a wide variety of information to identify the details and cause of the failure. The information that operations managers refer to includes configuration information and observation data.

[0003] Configuration information is information used to manage the elements that make up an IT system and the relationships between elements. Elements are called Configuration Items, and include, for example, hardware such as servers and storage, software such as operating systems, middleware, and applications, and services realized by hardware and software. Each type of element has its own unique attributes. For example, a server has attributes such as CPU information, memory capacity, and number of power supplies. Below, the elements that make up an IT system are referred to as CIs. Information about the relationships between elements is information that shows the connections between elements, such as between a server and the operating system running on it.

[0004] Observation data includes event information, performance information, logs, etc. that record events and states that have occurred in a CI. When an event related to a failure occurs in a CI, the details of that event are recorded as observation data.

[0005] When investigating a problem, the operations manager narrows down the elements related to the location of the problem by tracing the connections between elements based on configuration information, and also identifies the scope of impact and cause of the problem based on observation data.

[0006] When generating programs and rules for automating the investigation of IT system failures, the number of variations becomes enormous, resulting in extremely high development costs. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] US Patent Application Publication No. 2022 / 0292415 Summary of the Invention [Problem to be solved by the invention]

[0008] In recent years, natural language processing technology has been attracting attention. In particular, LLM (Large Language Model), which can handle natural language, is attracting attention as a technology that can replace human work.

[0009] LLM is a natural language processing model built using large amounts of text data and can perform a variety of language processing tasks. LLM accepts prompts containing task content, such as questions written in natural language, understands the meaning of the task content, and generates and outputs a text response. For example, if text containing work content and target data is input into LLM, the content and results of the work using that data can be obtained as a response. Because LLM processes text after understanding its meaning, it can process appropriately even if there are fluctuations in the data and text. Therefore, LLM can be used to assist in troubleshooting general-purpose IT systems.

[0010] Prior art that applies natural language processing technology to troubleshooting is, for example, Patent Document 1. Patent Document 1 discloses a technology for creating a procedure manual for automating troubleshooting from past troubleshooting records written in natural language. However, the technology described in Patent Document 1 is for creating a procedure manual for automating troubleshooting, and cannot be applied directly to troubleshooting investigations.

[0011] An object of the present invention is to provide a system and method for implementing fault investigation of an IT system using LLM. [Means for solving the problem]

[0012] A representative example of the invention disclosed in this application is as follows. That is, a computer system is connected to an IT system that executes services and that has a processor, a storage device connected to the processor, and a network interface connected to the processor, and that is composed of multiple elements, and to a text generation system that uses a natural language processing model to generate answer text in accordance with prompts that instruct the execution of language processing tasks, and that holds element information for managing observation data acquired from the IT system, relation information for managing the relationships between the elements, and scope information that defines a scope that represents the range of an investigation in an investigation of a fault in the IT system, and the scope information stores data that corresponds the scope to an analytical perspective in an investigation of a fault in the IT system, and when a fault in the IT system occurs, the computer system refers to the scope information to select the scope, identifies the element to be investigated based on the relation information and the selected scope, acquires the observation data related to the identified element from the element information, generates a first prompt that includes the perspective corresponding to the selected scope, the identified element, and the acquired observation data as text, and instructs the output of knowledge about the fault in the IT system, and inputs the first prompt into the text generation system, and acquires the answer text including the knowledge from the text generation system. [Effects of the Invention]

[0013] According to the present invention, it is possible to realize a fault investigation of an IT system using a natural language processing model (LLM). Problems, configurations, and effects other than those described above will become clear from the following description of the embodiment. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating an overview of the present invention. [Figure 2] FIG. 1 illustrates an example of a system configuration according to a first embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of a hardware configuration of a management computer of the first embodiment. [Figure 4] FIG. 10 is a diagram illustrating an example of a data structure of LLM service information according to the first embodiment. [Figure 5] FIG. 2 is a diagram illustrating an example of a data structure of user information according to the first embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a data structure of CI information according to the first embodiment. [Figure 7] FIG. 10 is a diagram illustrating an example of a data structure of CI relationship information according to the first embodiment. [Figure 8] FIG. 4 is a diagram illustrating an example of a data structure of scope information according to the first embodiment. [Figure 9] FIG. 10 is a diagram illustrating an example of a data structure of roll order information according to the first embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of a data structure of observation data conversion method information according to the first embodiment. [Figure 11] FIG. 10 is a diagram illustrating an example of a data structure of investigation result information according to the first embodiment. [Figure 12] FIG. 4 is a diagram illustrating an example of a data structure of user operation history information according to the first embodiment. [Figure 13] 10 is a flowchart illustrating an example of a failure investigation process executed by the management computer of the first embodiment. [Figure 14] 10 is a flowchart illustrating an example of a common data generation process executed by the management computer of the first embodiment. [Figure 15] 10 is a flowchart illustrating an example of a role processing order decision process executed by the management computer of the first embodiment. [Figure 16] 10 is a flowchart illustrating an example of an individual failure investigation process executed by the management computer of the first embodiment. [Figure 17] 10 is a flowchart illustrating an example of an observation data text generation process executed by the management computer of the first embodiment. [Figure 18] 10 is a flowchart illustrating an example of a knowledge data generation process executed by the management computer of the first embodiment. [Figure 19] 10 is a flowchart illustrating an example of an information presentation process executed by the management computer of the first embodiment. [Figure 20] FIG. 10 is a diagram showing an example of a screen presented by a management computer according to the first embodiment. [Figure 21] 10 is a flowchart illustrating an example of a feedback process executed by the management computer of the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0015] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention should not be construed as being limited to the description of the embodiments shown below. Those skilled in the art will readily understand that the specific configuration can be changed without departing from the spirit or intent of the present invention.

[0016] In the configuration of the invention described below, the same or similar configurations or functions are denoted by the same reference numerals, and redundant explanations will be omitted.

[0017] In this specification, the terms "first," "second," "third," etc. are used to identify components and do not necessarily limit the number or order. [Example]

[0018] Generally, incident investigations are carried out by a team. The team is made up of members with various roles, and to make the investigation more efficient, each member divides up the responsibilities and works together with the other members to carry out the investigation. Roles include, for example, incident commander, investigator, and service desk staff.

[0019] Members assigned as incident commanders are responsible for responding to incidents, and perform tasks such as creating a system for responding to incidents, assigning tasks to each member, and making regular reports to relevant departments. Members assigned as investigators receive instructions from the incident commander and investigate their respective areas of responsibility, such as areas related to the database including storage, the applications consisting of the OS / middleware, and the network as a whole. Members assigned as service desk personnel respond to inquiries from users of the IT system about the status of the IT system, the expected time for recovery, and other information that is currently known.

[0020] An outline of the present invention will be described below. Fig. 1 is a diagram for explaining an outline of the present invention. First, information used in the present invention will be described.

[0021] The CI information 132 and the CI relation information 133 are information that is generally held in the operation management of an IT system. The CI information 132 stores attributes and observation data (attribute values) of the CIs that constitute the IT system. The CI relation information 133 stores data for managing the relationships between CIs.

[0022] The scope information 134 and the observation data conversion method information 136 are characteristic information of the present invention. The scope information 134 stores data associating roles, the scope of the investigation, and the viewpoint of the fault investigation. The scope and the viewpoint of the fault investigation are written in natural language, which is much easier to write than the rules and programs for the fault investigation. The observation data conversion method information 136 is information for managing the method for converting the observation data into text that can be interpreted by the LLM. Note that the LLM may be used to convert the observation data. In this case, there is no need to develop a conversion algorithm.

[0023] The fault investigation support program 120 performs fault investigation in the following procedure.

[0024] First, the problem investigation support program 120 refers to the CI relations based on the scope defined in the scope information 134, and identifies the CI to be investigated.

[0025] Next, the failure investigation support program 120 refers to the observation data conversion method information 136 and converts the observation data of the identified CI into observation data text that can be interpreted by the LLM.

[0026] Next, the fault investigation support program 120 generates a prompt including a list of identified CIs, observation data text, and the perspective defined in the scope information 134. The perspective represents the content of the analysis in the fault investigation, which is the task to be executed by the LLM. In this embodiment, a prompt is generated that instructs the analysis of the observation data based on the investigation perspective and the generation of finding data (Findings) including the results of the analysis. The fault investigation support program 120 inputs the prompt into the LLM and obtains the finding data from the LLM. Note that finding data from other fault investigations may also be included in the prompt.

[0027] The failure investigation support program 120 presents knowledge data to the members who are investigating the failure. The members refer to the knowledge data to identify the cause of the failure.

[0028] According to the present invention, it is possible to automatically investigate faults in various IT systems while keeping development costs down.

[0029] Fig. 2 is a diagram illustrating an example of the configuration of a system according to the first embodiment. Fig. 3 is a diagram illustrating an example of the hardware configuration of the management computer 100 according to the first embodiment.

[0030] The system is made up of a management computer 100, a managed system 103, and a text generation system 104. The management computer 100, the managed system 103, and the text generation system 104 are connected to one another via a network 105 such as a LAN.

[0031] The managed system 103 is a system on which an IT system operates. The managed system 103 includes a cluster 110 made up of a plurality of nodes (computers) 112, and a storage 111. Although not shown, one or more IT systems operate in one cluster 110. In this embodiment, the management computer 100 is assumed to be communicably connected to the cluster 110. The cluster 110 can allocate volumes provided by the storage 111 to the nodes 112. Data of the IT system is stored in the volumes.

[0032] The configuration of the managed system 103 on which the IT system runs is an example and is not limiting. For example, the node 112 may be a virtual computer. The IT system may also run on a cloud system.

[0033] The text generation system 104 is a system that provides a service using the LLM. The management computer 100 may hold the LLM. The management computer 100 may also be connected to a plurality of text generation systems 104.

[0034] The management computer 100 supports the investigation of faults in IT systems. As shown in Fig. 3, the management computer 100 has a CPU 301, memory 302, HDD 303, and network interface 304. The hardware elements are connected via a bus 305. A display 102 is also connected to the management computer 100. Input devices such as a keyboard and mouse (not shown) are also connected to the management computer 100.

[0035] The HDD 303 of the management computer 100 stores the fault investigation support program 120, LLM service information 130, user information 131, CI information 132, CI relation information 133, scope information 134, role order information 135, observation data conversion method information 136, investigation result information 137, and user operation history information 138. The CPU 301 loads the fault investigation support program 120 into the memory 302 and executes it. The CPU 301 loads various types of information into the memory 302 as necessary.

[0036] FIG. 4 is a diagram illustrating an example of the data structure of the LLM service information 130 according to the first embodiment.

[0037] The LLM service information 130 stores information about available LLMs. The LLM service information 130 stores entries each including an LLM name 401 and a URL 402. There is one entry for each LLM.

[0038] The LLM name 401 is a field that stores the name of the LLM. The URL 402 is a field that stores the URL for accessing the text generation system 104 that provides services using the LLM. The management computer 100 can use the LLM by accessing the text generation system 104 based on the URL.

[0039] FIG. 5 is a diagram illustrating an example of the data structure of the user information 131 according to the first embodiment.

[0040] The user information 131 stores information about the role of a user (member) who is an administrator of the IT system. The user information 131 stores entries including a user name 501, a system name 502, a role 503, and a default 504. One entry exists for each pair of a user and a role.

[0041] User name 501 is a field for storing a user name. System name 502 is a field for storing the name of an IT system for which the user has administrative authority. Role 503 is a field for storing a role assigned to the user.

[0042] Default 504 is a field that stores information indicating whether the role corresponding to the entry is the default role of the user. If the role corresponding to the entry is the default role of the user, "Y" is stored, and if the role corresponding to the entry is not the default role of the user, "N" is stored.

[0043] A single user may be assigned multiple roles, and may also manage multiple IT systems.

[0044] FIG. 6 is a diagram showing an example of the data structure of the CI information 132 according to the first embodiment.

[0045] The CI information 132 stores information about CIs that constitute an IT system. CIs include, for example, computing resources such as physical servers and virtual servers, services provided by the IT system, microservices that constitute the services, pods and clusters that are the operating entities of the microservices, and nodes that constitute the clusters.

[0046] The CI information 132 stores entries including a CIID 601, a system name 602, a class name 603, an instance name 604, an attribute name 605, and an attribute value 606. There is one entry for each combination of an IT system and a CI.

[0047] CIID 601 is a field that stores the identifier of a CI. System name 602 is a field that stores the name of the IT system that includes the CI. Class name 603 is a field that stores the type of CI. Instance name 604 is a field that stores the name of the CI. Attribute name 605 is a field that stores the name of an attribute that can be obtained from a CI. Attribute value 606 is a field that stores the value of the attribute (observation data) obtained from the CI.

[0048] The attribute values ​​of a CI are, for example, the type and execution date and time of an event such as a batch job, and a performance value. The attribute values ​​are acquired by a monitoring program that monitors the IT system, and are stored in the attribute value 606 as time-series data including the time and the attribute value. The "()" in the attribute value 606 in FIG. 6 indicates the data type. Note that the observation data may be managed as separate information.

[0049] FIG. 7 is a diagram illustrating an example of the data structure of the CI relationship information 133 according to the first embodiment.

[0050] The CI relation information 133 stores information about logical connection relationships between CIs. The CI relation information 133 stores entries including a system name 701 and a relation 702. One entry exists for one IT system.

[0051] The system name 701 is a field that stores the name of the IT system. The relation 702 is a field that stores data that indicates the logical connection relationship between the CIs that make up the IT system. In FIG. 7, the relationship is expressed as a graph, but in reality, information about pairs of CIs that have a connection relationship is stored. Note that the relationship may also have an attribute value for the connection relationship between the CIs. For example, in the case of a pair of CIs that are connected by a physical wire, the link speed may be stored as an attribute value.

[0052] FIG. 8 is a diagram illustrating an example of the data structure of the scope information 134 according to the first embodiment.

[0053] The scope information 134 stores information about the scope and viewpoint of a fault. The scope information 134 stores entries including a role 801, a scope 802, and a viewpoint 803. One entry exists for each combination of role and scope.

[0054] Role 801 is a field for storing a role. Scope 802 is a field for storing information that defines the scope of the investigation. Viewpoint 803 is a field for storing the view point of the problem investigation (task).

[0055] The information defining the scope of the CI to be investigated may be, for example, a rule describing the type of CI, or a natural language describing the characteristics of the CI. When a rule is set in the scope 802, the fault investigation support program 120 identifies the CI to be investigated by executing internal processing. When a natural language is set in the scope 802, the fault investigation support program 120 identifies the CI to be investigated using LLM. The viewpoint 803 stores a natural language that represents the viewpoint of the fault investigation.

[0056] The following information may be considered to define the scope of the CI to be investigated: (Example 1) Among CIs whose CI class is Service, there is one that is a database, and the CIs that can be reached by tracing the relationships downward from that CI. (Example 2) CI related to database

[0057] In this embodiment, a scope and a viewpoint are set for a role, but this is not limiting. If a role is not specifically set, data in which a viewpoint is associated with a scope may be used.

[0058] FIG. 9 is a diagram illustrating an example of the data structure of the roll order information 135 according to the first embodiment.

[0059] The role order information 135 stores information about the order of roles that perform fault investigation. The role order information 135 stores entries that include a system name 901 and a role order 902. One entry exists for one IT system.

[0060] System name 901 is a field that stores the name of the IT system. Role order 902 is a field that stores information that defines the order of roles that will perform fault investigation. In Fig. 9, the role order is represented as a directed graph. In this directed graph, the role that is the source indicates that fault investigation will be performed before the role that is the destination.

[0061] It is not necessary to define a role order for each IT system. For example, a common role order may be defined for all IT systems.

[0062] FIG. 10 is a diagram illustrating an example of the data structure of the observation data conversion method information 136 according to the first embodiment.

[0063] The observation data conversion method information 136 stores information on a method for converting observation data into text. The observation data conversion method information 136 stores entries including a class name 1001, an attribute name 1002, a generation method 1003, a supplementary input 1004, and a mask 1005. There is one entry for each pair of a class name and an attribute name.

[0064] The class name 1001 is a field that stores the type of CI. "ANY" indicates all types of CI. The attribute name 1002 is a field that stores the name of an attribute that can be acquired from a CI.

[0065] Generation method 1003 is a field that stores information about a method for converting observed data into text. The generation method 1003 stores the type of script or LLM. Supplementary input 1004 is a field that stores instructions to the LLM when generating observed data text using the LLM. Mask 1005 is a field that stores attribute values ​​to be concealed when generating observed data text using the LLM. By concealing attribute values, it is possible to generate observed data text while ensuring security.

[0066] An event conversion script that converts observed data related to an event into text is stored in the generation method 1003 of the first entry in Fig. 10. The event conversion script converts attribute values ​​included in the observed data into character strings.

[0067] The type of LLM to be used is stored in the generation method 1003 of the second entry in Fig. 10. In this case, the fault investigation support program 120 inputs a prompt to the general-purpose LLM instructing a summary of the Pod state, including detailed information about the Kubernetes Pod (detailed information about the Pod obtained using an API or command), and obtains text containing the summary of the Pod state.

[0068] By using LLM to generate text from observational data, the development cost of algorithms for generating text from observational data can be reduced.

[0069] FIG. 11 is a diagram illustrating an example of the data structure of the investigation result information 137 according to the first embodiment.

[0070] The investigation result information 137 is information for managing the progress and results of a fault investigation. The investigation result information 137 stores entries including a system name 1101, a user name 1102, a role 1103, a scope 1104, a viewpoint 1105, a CI relation text 1106, an observation data catalog text 1107, an observation data text 1108, input knowledge data 1109, output knowledge data 1110, and a time 1111.

[0071] The system name 1101 is a field for storing the name of the IT system for which the fault investigation was performed. The user name 1102 is a field for storing the name of the user who performed the fault investigation. Note that "System" means that the fault investigation support program 120 performed the fault investigation.

[0072] Role 1103 is a field for storing a role. Scope 1104 is a field for storing a scope. Viewpoint 1105 is a field for storing a viewpoint.

[0073] The CI relation text 1106 is a field that stores the text of the CI relation. The observation data catalog text 1107 is a field that stores the text of the catalog of the observation data (attribute values) of the CI being investigated. The observation data text 1108 is a field that stores the text of the observation data.

[0074] Input knowledge data 1109 is a field for storing knowledge data to be included in the prompt. Output knowledge data 1110 is a field for storing knowledge data acquired from the LLM. Time 1111 is a field for storing the time when the knowledge data was acquired from the LLM.

[0075] FIG. 12 is a diagram illustrating an example of the data structure of the user operation history information 138 according to the first embodiment.

[0076] The user operation history information 138 stores the contents of the user's input. The user operation history information 138 stores entries including a system name 1201, a user name 1202, an operation type 1203, an operation content 1204, and a time 1205. There is one entry for each operation performed by the user.

[0077] System name 1201 is a field that stores the name of the target IT system. User name 1202 is a field that stores the name of the user who performed the operation. Operation type 1203 is a field that stores the type of operation. Operation content 1204 is a field that stores details of the operation content. Time 1205 is a field that stores the time when the operation was performed.

[0078] The processing executed by the management computer 100 will now be described.

[0079] 13 is a flowchart illustrating an example of the fault investigation processing executed by the management computer 100 of Example 1. In the fault investigation processing, the fault investigation support program 120 acquires information related to the fault in the IT system to be investigated, that is, knowledge.

[0080] The management computer 100 starts fault investigation processing when it receives an execution instruction from a user, when it is called from an API that has been made public, or when a specific event occurs. At this time, the name of the IT system to be investigated is input to the management computer 100. The specific event is, for example, an event corresponding to a fault, or an event indicating a decline in service level, such as an increase in the request error rate or an increase in the request response time.

[0081] The fault investigation support program 120 executes a common data generation process to generate common data for the IT system to be investigated (S101). The common data includes data related to the configuration of the IT system and a catalog of observation data that can be obtained from the CI. Details of the common data generation process will be described later. Hereinafter, the IT system to be investigated will be referred to as the target IT system.

[0082] Next, the fault investigation support program 120 executes a role order determination process (S102). The role order determination process will be described in detail later.

[0083] Next, the failure investigation support program 120 determines whether or not the processing has been completed for all roles (S103).

[0084] If it is determined that processing has not been completed for all roles, the failure investigation support program 120 selects one role from among the unprocessed roles (S104).

[0085] Next, the failure investigation support program 120 executes the individual failure investigation process based on the selected role (S105), after which the failure investigation support program 120 returns to S103.

[0086] If it is determined in S103 that the processing has been completed for all roles, the fault investigation support program 120 ends the fault investigation processing.

[0087] 14 is a flowchart illustrating an example of the common data generation process executed by the management computer 100 of the example 1. In the common data generation process, the name of the IT system is passed as an argument.

[0088] The problem investigation support program 120 generates a CI relationship text (S201). Specifically, the following processing is executed.

[0089] (S201-1) The fault investigation support program 120 refers to the CI relation information 133 and acquires the information stored in the relation 702 of the entry corresponding to the target IT system. The fault investigation support program 120 also refers to the CI information 132 and acquires the information stored in the entry corresponding to the target IT system.

[0090] (S202-2) The failure investigation support program 120 generates a CI relation text based on the acquired information. For example, the CI relation text is generated in the following manner.

[0091] (Step 1) The fault investigation support program 120 generates text representing each CI that constitutes the target IT system based on the information acquired from the CI information 132. For example, the text (character string) "CIID001:Batch Job:nightly-batch" is generated from the first entry in Figure 6.

[0092] (Step 2) The fault investigation support program 120 generates text that expresses the connection relationships between CIs that have a connection relationship as a tree structure based on the information acquired from the CI relation information 133. The connections between CIs can be expressed by indentation. For example, in the case of the CI relationship shown in Figure 7, the following text is generated:

[0093] CIID001:Batch Job:nightly-batch -CIID002:Service:purchase-service - CIID003:Micro Service:Web-Service - CIID005:Pod:httpd-pod - CIID006:Cluster:production-cluster - CIID007:Node:node01 (Omitted below) - CIID004:Micro Service:database-service - CIID006:Cluster:production-cluster (already mentioned)

[0094] Another method of describing CI relationships is to arrange the parent CI and child CI of each relationship side by side as shown below.

[0095] CIID001:Batch Job:nightly-batch -DIID002:Service:purchase-service

[0096] The above is the description of the processing in step S201. Next, the fault investigation support program 120 generates an observation data catalog text (S202).

[0097] Specifically, the fault investigation support program 120 generates the observation data catalog text based on the attribute name 605 of the entry acquired from the CI information 132 .

[0098] For example, for the CI in the first entry in Figure 6, the following text is written in the observation data catalog text: Here, only attributes whose attribute values ​​of the CI are time-series data are extracted.

[0099] CIID001:Batch Job:nightly-batch - event - Number of running jobs

[0100] Next, the problem investigation support program 120 stores the CI relation text and the observation data catalog text in the work area of ​​the memory 302 (S203), and then ends the common data generation process.

[0101] 15 is a flowchart illustrating an example of the role processing order determination process executed by the management computer 100 of the example 1. In the role processing order determination process, the name of the IT system is passed as an argument.

[0102] The failure investigation support program 120 initializes the role list (S301), that is, an empty role list is generated.

[0103] The failure investigation support program 120 acquires role order data (directed graph) of the target IT system from the role order information 135 (S302).

[0104] The fault investigation support program 120 registers the roles in the role list based on the role processing order data (S303), and then ends the role processing order determination process.

[0105] Specifically, the fault investigation support program 120 scans the edges of the directed graph starting from the root node of the directed graph, and registers roles corresponding to the nodes in the role list in the order of scanning.

[0106] 16 is a flowchart illustrating an example of individual failure investigation processing executed by the management computer 100 of Example 1. In the individual failure investigation processing, the name and role of the IT system are passed as arguments.

[0107] The failure investigation support program 120 generates a scope list (S401).

[0108] Specifically, the fault investigation support program 120 refers to the scope information 134 and searches for an entry in which the role selected in the role 801 is stored. The fault investigation support program 120 registers the scope 802 of the searched entry in the scope list.

[0109] The fault investigation support program 120 determines whether or not the processing has been completed for all the scopes of the selected role (S402). If it is determined that the processing has been completed for all the scopes of the selected role, the fault investigation support program 120 ends the individual fault investigation processing.

[0110] If it is determined that processing has not been completed for all scopes of the selected role, the failure investigation support program 120 selects one scope from the scope list (S403).

[0111] At this time, the fault investigation support program 120 deletes the selected scope from the scope list. Also, the fault investigation support program 120 updates the investigation result information 137. Specifically, the fault investigation support program 120 adds an entry to the investigation result information 137, sets the name of the target IT system in the system name 1101, sets "System" in the user name 1102, sets the role selected in S104 in the role 1103, and sets the selected scope in the scope 1104. Also, the fault investigation support program 120 sets the CI relation text and observation data catalog text generated in the common data generation process in the CI relation text 1106 and observation data catalog text 1107 of the added entry.

[0112] The fault investigation support program 120 identifies the CIs to be investigated from among the CIs of the target IT system based on the selected scope (S404). There are two possible identification methods:

[0113] (Method 1) The fault investigation support program 120 identifies the CIs to be investigated using the LLM. Specifically, the fault investigation support program 120 generates a prompt including the CI relation text generated in the common data generation process, text corresponding to the scope, and an instruction statement instructing extraction of the CIs to be investigated based on the scope, and inputs the prompt into the LLM to obtain a list of the CIs to be investigated.

[0114] (Method 2) The fault investigation support program 120 identifies the CI to be investigated based on rules. For example, if the scope is Service, the fault investigation support program 120 extracts CIs that include Service in their class name or instance name. Also, if tags can be assigned to CIs, the scope is defined as a list of tags, and the fault investigation support program 120 extracts CIs that have the corresponding tags.

[0115] Next, the failure investigation support program 120 executes an observation data text generation process (S405). The observation data text generation process will be described in detail later.

[0116] Next, the failure investigation support program 120 executes knowledge data generation processing (S406), and then returns to S402. Details of the knowledge data generation processing will be described later.

[0117] 17 is a flowchart illustrating an example of the observation data text generation process executed by the management computer 100 of Example 1. In the observation data text generation process, the name of the IT system is passed as an argument.

[0118] The fault investigation support program 120 determines whether processing has been completed for all CIs to be investigated (S501). If it is determined that processing has been completed for all CIs to be investigated, the fault investigation support program 120 ends the observation data text generation processing.

[0119] If it is determined that processing has not been completed for all the CIs under investigation, the fault investigation support program 120 selects one CI from among the CIs under investigation (S502).

[0120] Next, the failure investigation support program 120 generates an observation data list for the selected CI (S503).

[0121] Specifically, the fault investigation support program 120 references the CI information 132 and generates an observation data list based on the attribute name 605 of the entry corresponding to the selected CI. Note that the fault investigation support program 120 may also generate the observation data list based on the observation data catalog text.

[0122] Next, the fault investigation support program 120 determines whether or not processing has been completed for all the observation data (S504). If it is determined that processing has been completed for all the observation data, the fault investigation support program 120 returns to S501.

[0123] If it is determined that processing has not been completed for all of the observation data, the fault investigation support program 120 selects one piece of observation data from the observation data list (S505). At this time, the fault investigation support program 120 deletes the selected piece of observation data from the observation data list.

[0124] Next, the failure investigation support program 120 generates observation data text for the selected observation data (S506), and then returns to S504. Specifically, the following processing is executed.

[0125] (S506-1) The fault investigation support program 120 refers to the observation data conversion method information 136 and searches for an entry whose class name 1001 matches the class name of the selected CI and whose attribute name 1002 matches the attribute name of the selected observation data.

[0126] (S506-2) The failure investigation support program 120 refers to the CI information 132 and acquires the attribute value 606 of the row in which the attribute name 605 of the entry corresponding to the selected CI matches the selected observation data.

[0127] (S506-3) The fault investigation support program 120 converts the acquired observation data into text based on the identified observation data conversion method. In the case of a conversion method using LLM, the fault investigation support program 120 generates a prompt including the observation data or data obtained by statistically processing the observation data (average value, maximum value, average value of the previous day or week, etc.) and instructions, and inputs this into the LLM to acquire the observation data text.

[0128] (S506-4) The failure investigation support program 120 sets the generated observation data text in the observation data text 1108 of the entry added to the investigation result information 137 in S403.

[0129] 18 is a flowchart illustrating an example of knowledge data generation processing executed by the management computer 100 of Example 1. In the knowledge data generation processing, the name, role, and scope of the IT system are passed as arguments.

[0130] The problem investigation support program 120 identifies a viewpoint corresponding to a combination of a role and a scope (S601).

[0131] Specifically, the fault investigation support program 120 refers to the scope information 134 and searches for an entry whose combination of role 801 and scope 802 values ​​matches the selected combination of role and scope. The fault investigation support program 120 acquires the viewpoint 803 of the searched entry and sets it as the viewpoint 1105 of the entry added to the investigation result information 137 in S403.

[0132] Next, the failure investigation support program 120 generates a prompt (S602). Specifically, the following processing is executed.

[0133] (S602-1) The fault investigation support program 120 acquires the entry added to the investigation result information 137 in S403. Note that the fault investigation support program 120 may refer to the investigation result information 137 and acquire knowledge data obtained by individual fault investigation processing of the same IT system.

[0134] (S602-2) The fault investigation support program 120 generates a prompt that includes CI relation text and observation data text and has a viewpoint as the content of the analysis. In this embodiment, a prompt that instructs the output of knowledge for each CI is generated. For example, a method can be considered in which a prompt is generated that includes CI relation text and observation data text of observation data related to the CI for each CI. Another method can be considered in which a prompt is generated that includes the output of knowledge for each CI as a task instruction.

[0135] If knowledge data has been acquired in S602-1, the knowledge data may be included in the prompt. In this case, the failure investigation support program 120 sets the knowledge data in the input knowledge data 1109 of the entry added to the investigation result information 137 in S403.

[0136] Next, the failure investigation support program 120 inputs the generated prompt into the LLM and obtains a response (text) from the LLM (S603).

[0137] Next, the failure investigation support program 120 registers the obtained answer as knowledge data in the investigation result information 137 (S604).

[0138] Specifically, the failure investigation support program 120 sets the answer in the output knowledge data 1110 of the entry added to the investigation result information 137 in S403, and also sets the time 1111 as the statute of limitations for obtaining the answer.

[0139] Next, a method for presenting the results of the fault investigation processing will be explained. Fig. 19 is a flowchart illustrating an example of the information presentation processing executed by the management computer 100 of the first embodiment. Fig. 20 is a diagram showing an example of a screen presented by the management computer 100 of the first embodiment.

[0140] When the management computer 100 receives a login operation from a user, it presents the screen 2000 (S701).

[0141] Here, a description will be given of the screen 2000. The screen 2000 includes selection fields 2001 and 2002, and display fields 2003, 2004, 2005, 2006, and 2007.

[0142] Selection field 2001 is a field for selecting an IT system for checking knowledge data. In selection field 2001, selectable IT systems are displayed as a dropout list. Selection field 2002 is a field for selecting a role. In selection field 2002, selectable roles are displayed as a dropout list.

[0143] The display field 2003 is a field for displaying information about the user performing the operation. For example, the display field 2003 displays the user name and default role.

[0144] Display field 2004 is a field that displays the time series of knowledge data of the IT system. In display field 2004, an icon 2010 that represents knowledge data on a time axis is displayed. This indicates that the knowledge data was acquired at the time corresponding to the starting point of the speech bubble of icon 2010. Furthermore, a rectangle 2011 in display field 2004 indicates the period of the knowledge data to be referenced.

[0145] A display field 2005 displays CIs of an IT system and relationships between the CIs. A dotted line 2020 indicates a scope. An icon 2021 indicates knowledge data and is displayed near the corresponding CI.

[0146] Display field 2006 is a field for displaying knowledge data. Display field 2006 displays box 2030 for displaying knowledge data. Box 2030 includes button 2031. Button 2031 is a button for displaying observation data text used to generate the knowledge data corresponding to box 2030. When button 2031 is operated, the observation data text is displayed in a dialog box or the like.

[0147] The display field 2007 is a field for the user to interact with the management computer 100. When the user inputs a message (question) as a user comment 2040, the management computer 100 generates a reply and displays it as a system reply 2041.

[0148] In S701, user information is displayed in the display field 2003, and the user's default role is set in the selection field 2002. Returning to the description of FIG.

[0149] First, the user sets the name of the IT system in the selection field 2001. The fault investigation support program 120 acquires the name of the IT system via the screen 200 and identifies the role of the user (S702).

[0150] Specifically, the fault investigation support program 120 refers to the user information 131, searches for an entry in which the name of the login user is set in the user name 501, and acquires the role 503 of that entry. The fault investigation support program 120 displays the acquired role in the selection field 2002. Note that if multiple entries are found, the default role is displayed preferentially.

[0151] The user sets a role in the selection field 2002. The failure investigation support program 120 acquires the role of the IT system via the screen 200 (S703).

[0152] Next, the fault investigation support program 120 displays the CI relations of the IT system (S704).

[0153] Specifically, the fault investigation support program 120 refers to the CI relation information 133 and displays the CI relation in the display field 2005 based on the relation 702 of the entry corresponding to the selected IT system.

[0154] Next, the failure investigation support program 120 identifies the scope of the investigation of the failure of the IT system and displays the CIs to be investigated (S705). Specifically, the following processing is executed.

[0155] (S705-1) The failure investigation support program 120 refers to the scope information 134 and acquires the scope 802 of the entry corresponding to the selected role.

[0156] (S705-2) The fault investigation support program 120 refers to the investigation result information 137 and searches for an entry whose combination of values ​​of the system name 1101, role 1103, and scope 1104 matches the combination of the name of the selected IT system, the selected role, and the specified scope. The fault investigation support program 120 acquires the CI relationship text from the CI relationship text 1106 of the searched entry.

[0157] (S705-3) The failure investigation support program 120 identifies a CI to be investigated based on the CI relation text. If there are multiple scopes, a CI to be investigated is identified for each scope.

[0158] (S705-4) The failure investigation support program 120 highlights the identified CIs in the display field 2005. In FIG. 20, a frame enclosing the CIs is displayed.

[0159] Next, the failure investigation support program 120 displays the knowledge data (S706).

[0160] Specifically, the fault investigation support program 120 acquires the output knowledge data 1110 and the time 1111 of the entry searched for from the investigation result information 137 in S705, and displays an icon representing the knowledge data in display fields 2004 and 2005. The fault investigation support program 120 also displays the knowledge data in display field 2006. Note that the fault investigation support program 120 may display only the knowledge data acquired during the period specified in display field 2004 or the knowledge data of the CI selected in display field 2005 in display field 2006.

[0161] The user can refer to the screen 2000 and perform operations as necessary. Fig. 21 is a flowchart illustrating an example of the feedback processing executed by the management computer 100 of the first example.

[0162] When the management computer 100 receives an operation from the user, it starts the feedback process described below. The operation includes changing the IT system, role, or scope, and inputting a message in the display field 2007.

[0163] The failure investigation support program 120 determines whether the operation is a change to any of the IT system, role, or scope (S801).

[0164] If the operation is a change to any of the IT system, role, or scope, the fault investigation support program 120 executes information presentation processing (S802) and terminates the feedback processing. Note that the processing content differs depending on the information to be changed. In the case of a change to the IT system, the processing from S701 to S706 is executed. In the case of a change to the role, the processing from S703 to S706 is executed. In the case of a change to the scope, the processing from S704 to S706 is executed.

[0165] If the operation is not a change to any of the IT system, role, or scope, the fault investigation support program 120 interprets the content of the message (S803). The LLM is used to interpret the content of the message. In this embodiment, the message is classified into inputting a comment about the CI, conducting additional fault investigation, and updating the viewpoint.

[0166] The fault investigation support program 120 determines whether the message is a comment input related to the CI (S804).

[0167] If it is determined that the message is a comment input related to a CI, the failure investigation support program 120 identifies the target CI (S805).

[0168] Specifically, the fault investigation support program 120 extracts the identification information (for example, the instance name) of the CI from the message.

[0169] Next, the failure investigation support program 120 registers the comment in the investigation result information 137 (S806), and ends the feedback process.

[0170] Specifically, the fault investigation support program 120 registers a comment in the output knowledge data 1110 of the entry searched for from the investigation result information 137 in S705. At this time, the fault investigation support program 120 may generate a prompt instructing a duplication check, including the knowledge data to be stored in the output knowledge data 1110 and the comment, and input the prompt to the LLM. This makes it possible to suppress the recording of duplicate information and record useful information.

[0171] If it is determined that the message is not a comment input related to CI, the fault investigation support program 120 determines whether the message is a request to perform additional fault investigation (S807).

[0172] If it is determined that the message is for the implementation of additional fault investigation, the fault investigation support program 120 acquires a viewpoint from the message (S808).

[0173] Next, the failure investigation support program 120 generates a prompt (S809). Specifically, the following processing is executed.

[0174] (S809-1) The failure investigation support program 120 acquires the CI relation text and the observation data text from the entry searched for in the investigation result information 137 in S705.

[0175] (S809-2) The failure investigation support program 120 generates a prompt that includes the acquired CI relation text and observation data text and indicates the viewpoint acquired from the message.

[0176] Next, the failure investigation support program 120 inputs the generated prompt into the LLM and obtains a response (text) from the LLM (S810).

[0177] Next, the failure investigation support program 120 registers the obtained answer as knowledge data in the investigation result information 137 (S811), and then ends the feedback process.

[0178] Specifically, the fault investigation support program 120 adds a new entry to the investigation result information 137. The fault investigation support program 120 sets the values ​​of the entry searched from the investigation result information 137 in S705 to the values ​​of the corresponding fields of the added entry in the system name 1101, scope 1104, CI relation text 1106, observation data catalog text 1107, observation data text 1108, and input knowledge data 1109. The fault investigation support program 120 sets the name and role of the user who instructed the implementation of the additional fault investigation in the user name 1102 and role 1103 of the added entry. The fault investigation support program 120 sets the perspective acquired in S808 in the perspective 1105 of the added entry. In addition, the fault investigation support program 120 sets the answer in the output knowledge data 1110 of the added entry, and sets the time when the answer was acquired in the time 1111.

[0179] If it is determined that the message is not about implementing additional fault investigation, the fault investigation support program 120 determines that the message is about updating a viewpoint. If the user obtains useful knowledge as a result of the additional fault investigation, the user adds a viewpoint.

[0180] First, the failure investigation support program 120 acquires the viewpoint used in the additional failure investigation from the investigation result information 137 (S812).

[0181] Next, the failure investigation support program 120 adds the viewpoint to the scope information 134 (S813), and then ends the feedback processing.

[0182] Specifically, the fault investigation support program 120 searches for an entry whose pair of role 801 and scope 802 values ​​matches the pair of role and scope values ​​in the additional fault investigation, and adds the viewpoint to the viewpoint 803 of the searched entry.

[0183] The operation history is recorded in user operation history information 138.

[0184] According to this embodiment, it is possible to realize automation of fault investigation using LLM without setting complicated rules and developing programs that execute advanced processing. Also, by summarizing viewpoints by role, it is possible to improve the browsability of fault investigation. Furthermore, it is possible to add viewpoints through dialogue in natural language, which improves the accuracy of fault investigation.

[0185] The present invention also functions effectively even if no roles are set. In this case, the following changes should be made:

[0186] The management computer 100 does not hold the role order information 135. The user information 131 does not include the role 503. The scope information 134 does not include the role 801. The investigation result information 137 does not include the role 1103.

[0187] In the fault investigation process, the processes of S102 and S103 are not executed. In this case, S105 is executed after the process of S102, and then the process ends.

[0188] A selection field 2002 on the screen 2000 allows the user to select a scope instead of a role. In the information presentation process, the scope is identified in S702, and the name and scope of the IT system are acquired in S703.

[0189] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments are provided to explain the present invention in detail, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, some of the configurations of each embodiment can be added to, deleted from, or replaced with other configurations.

[0190] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The present invention can also be realized by software program code that implements the functions of the embodiments. In this case, a storage medium on which the program code is recorded is provided to a computer, and a processor included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium implements the functions of the above-described embodiments, and the program code itself and the storage medium on which it is stored constitute the present invention. Examples of storage media for providing such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, solid-state drives (SSDs), optical disks, magneto-optical disks, CD-Rs, magnetic tapes, non-volatile memory cards, and ROMs.

[0191] Furthermore, the program code that realizes the functions described in this embodiment can be implemented in a wide range of program or script languages, such as assembler, C / C++, perl, Shell, PHP, Python, and Java (registered trademark).

[0192] Furthermore, the program code of the software that realizes the functions of the embodiments may be distributed via a network and stored in a storage means such as a computer's hard disk or memory, or in a storage medium such as a CD-RW or CD-R, and the processor of the computer may read and execute the program code stored in the storage means or storage medium.

[0193] In the above-described embodiment, the control lines and information lines are those that are considered necessary for the explanation, and not all control lines and information lines are necessarily shown in the product. All components may be interconnected. [Explanation of symbols]

[0194] 100 Management computer 102 Display 103 Managed Systems 104 Text Generation System 105 Network 110 clusters 111 Storage 112 nodes 120 Disability Research Support Program 130 LLM Service Information 131 User Information 132 CI Information 133 CI Relationship Information 134 Scope Information 135 Roll Order Information 136 Observation data conversion method information 137 Survey Results Information 138 User operation history information 301 CPU 302 memory 303 HDD 304 Network Interface 305 Bus 2000 screens

Claims

1. 1. A computer system comprising: a processor, a storage device connected to the processor, and a network interface connected to the processor; an IT system configured with a plurality of elements and configured to execute a service, and a text generation system configured to use a natural language processing model to generate answer text in accordance with a prompt that instructs the execution of a language processing task; retaining element information for managing observation data acquired from the IT system, relation information for managing the relationships between the elements, and scope information defining a scope representing the range of investigation in a fault investigation of the IT system; The scope information stores data associating the scope with an analytical viewpoint in a fault investigation of the IT system, The computer system When a failure occurs in the IT system, the scope information is referenced, the scope is selected, and Identifying the element to be investigated based on the relation information and the selected scope; obtaining the observation data related to the identified element from the element information; generating a first prompt including, as text, the viewpoint corresponding to the selected scope, the identified element, and the acquired observation data, and instructing output of findings related to a fault in the IT system; and inputting the first prompt into the text generation system; A computer system characterized in that the answer text including the knowledge is obtained from the text generation system.

2. 2. The computer system of claim 1, the data includes a role that is an administrative authority of the IT system; the computer system holds user information for managing the roles assigned to users; When automatically investigating the troubles in the IT system, the first prompts are generated for all the roles and input into the text generation system; A computer system characterized in that, when investigating a fault in the IT system in accordance with an instruction from a user, the first prompt is generated for the role assigned to the user and input to the text generation system.

3. 3. The computer system according to claim 2, When automatically investigating a fault in the IT system, determining the order of the roles; A computer system characterized in that the first prompt is generated and input in accordance with the determined order of the roles.

4. 3. The computer system according to claim 2, providing an interface for presenting said findings; A computer system characterized in that, when an instruction to present the knowledge is received from a user, the computer system presents the knowledge acquired using the first prompt of the role assigned to the user.

5. 2. The computer system of claim 1, If the knowledge is stored, the computer system generates the first prompt including the knowledge.

6. 2. The computer system of claim 1, The scope included in the data is text data, The computer system generating a second prompt including the scope text and the relation information, the second prompt instructing the user to identify the element to be examined; a computer system for inputting the second prompt into the text generation system and obtaining the answer text including the element being investigated;

7. 2. The computer system of claim 1, generating a third prompt including the observation data associated with the identified element and directing generation of text for the observation data; a computer system for inputting the third prompt into the text generation system and obtaining the response text including the text of the observation data;

8. 8. The computer system of claim 7, a computer system that generates the third prompt after masking a portion of the values ​​included in the observation data;

9. A method for supporting IT system fault investigation executed by a computer system, comprising: The computer system a processor, a storage device connected to the processor, and a network interface connected to the processor; an IT system configured with a plurality of elements and configured to execute a service, and a text generation system configured to use a natural language processing model to generate answer text in accordance with a prompt that instructs the execution of a language processing task; retaining element information for managing observation data acquired from the plurality of elements of the IT system, relation information for managing the relationships between the elements, and scope information defining a scope representing the range of investigation in a fault investigation of the IT system; The scope information stores data associating the scope with an analytical viewpoint in a fault investigation of the IT system, The method for supporting investigation of a fault in an IT system comprises: a first step in which, when a failure occurs in the IT system, the computer system refers to the scope information and selects the scope; a second step in which the computer system identifies the element to be investigated based on the relation information and the selected scope; a third step in which the computer system acquires the observation data related to the identified element from the element information; a fourth step in which the computer system generates a first prompt that includes, as text, the viewpoint corresponding to the selected scope, the identified element, and the acquired observation data, and instructs output of findings related to the failure of the IT system, and inputs the first prompt to the text generation system; a fifth step in which the computer system acquires the answer text including the findings from the text generation system.

10. 10. The IT system fault investigation support method according to claim 9, the data includes a role that is an administrative authority of the IT system; the computer system holds user information for managing the roles assigned to users; The fourth step includes: a sixth step of the computer system generating the first prompt for all of the roles when automatically investigating the IT system's faults; A method for supporting the investigation of faults in an IT system, characterized in that it includes a seventh step in which, when a fault investigation of the IT system is conducted in accordance with instructions from a user, the computer system generates the first prompt for the role assigned to the user.

11. 11. The IT system fault investigation support method according to claim 10, The sixth step includes: a step in which the computer system determines the order of the rolls; a step in which the computer system generates the first prompt in accordance with the determined order of the roles and inputs the first prompt into the text generation system.

12. 11. The IT system fault investigation support method according to claim 10, the computer system providing an interface for presenting the findings; A method for supporting fault investigation in an IT system, characterized by including a step in which, when an instruction to present the knowledge is received from a user, the computer system presents the knowledge obtained using the first prompt of the role assigned to the user.

13. 10. The IT system fault investigation support method according to claim 9, The scope included in the data is text data, The fourth step includes: generating a second prompt including the text representing the scope and the relation information, the second prompt instructing the user to identify the element to be investigated; a step in which the computer system inputs the second prompt into the text generation system and obtains the answer text including the element to be investigated.

14. 10. The IT system fault investigation support method according to claim 9, The third step includes: an eighth step of generating a third prompt by the computer system, the third prompt including the observation data associated with the identified element and instructing generation of text for the observation data; a ninth step in which the computer system inputs the third prompt into the text generation system and obtains the answer text including the text of the observation data.

15. 15. The IT system fault investigation support method according to claim 14, The method for supporting fault investigation in an IT system, wherein the eighth step includes a step in which the computer system generates the third prompt after masking part of the values ​​contained in the observation data.

Images