Information processing apparatus, visualization method and visualization program

Abstract

To visualize health and reserve capacity of a system.SOLUTION: An information processing apparatus has: an extraction unit that extracts an actual measurement value of a resource used by a function included in a system from a log file acquired from the system; a calculation unit that calculates a score of the function on the basis of the actual measurement value of the resource used by the function and an upper limit value of the resource available by the function; and a score display unit that generates and displays information visualizing the score of the function.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an information processing device, a visualization method, and a visualization program. [Background technology]

[0002] In order to investigate the cause of a problem and to confirm the system's extended availability, it is necessary to know the system's health and spare capacity. For example, since the load and status of a system change depending on the settings of various devices related to the system and the operating status of the system, users visually check the log data obtained from the system to judge whether the system is good or bad. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2020-064674 [Patent Document 2] Japanese Patent Application Laid-Open No. 2002-32274 Summary of the Invention [Problem to be solved by the invention]

[0004] However, as the scale of the system increases, the amount of log data becomes enormous, making it unrealistic for users to visually check the log data themselves.

[0005] For this reason, there is a need to visualize the health and reserve capacity of the system.

[0006] In one aspect, an object of the present invention is to provide an information processing device, a visualization method, and a visualization program that can visualize the health and spare capacity of a system. [Means for solving the problem]

[0007] An information processing device according to one aspect has an extraction unit that extracts actual measured values ​​of resources used by functions included in the system from a log file obtained from the system, a calculation unit that calculates a score for the function based on the actual measured values ​​of the resources used by the function and the upper limit value of the resources that can be used by the function, and a score display unit that generates and displays information that visualizes the score of the function.

[0008] In one aspect of the visualization method, a computer extracts actual measured values ​​of resources used by functions included in the system from a log file obtained from the system, calculates a score for the function based on the actual measured values ​​of the resources and the upper limit of the resources available to the function, and generates and displays information that visualizes the score of the function.

[0009] One aspect of the visualization program causes a computer to extract actual measured values ​​of resources used by functions included in the system from a log file obtained from the system, calculate a score for the function based on the actual measured values ​​of the resources and the upper limit of the resources available to the function, and generate and display information that visualizes the score of the function. [Effects of the Invention]

[0010] According to one embodiment, the health and spare capacity of a system can be visualized. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a diagram illustrating an example of the configuration of a system according to a first embodiment. [Figure 2] 1 is a functional block diagram showing a configuration of an information processing device according to a first embodiment. [Figure 3] FIG. 10 is a diagram illustrating an example of a data structure of a function-specific specification table; [Figure 4] FIG. 10 illustrates an example of the data structure of a function-specific measured resource table. [Figure 5] FIG. 10 is a diagram illustrating an example of a data structure of a score table. [Figure 6] FIG. 10 is a diagram illustrating an example of graph information. [Figure 7] 4 is a flowchart showing a processing flow of the information processing apparatus of the first embodiment. [Figure 8] FIG. 2 is a diagram illustrating an example of a hardware configuration. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the information processing device, visualization method, and visualization program disclosed in the present application will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to these embodiments. Furthermore, the same elements are given the same reference numerals, redundant descriptions are omitted as appropriate, and the embodiments can be combined as appropriate within a consistent range.

[0013] (First embodiment) (Configuration of System 1) An example of the configuration of a system according to this embodiment will be described. Fig. 1 is a diagram showing an example of the configuration of a system according to this embodiment. As shown in Fig. 1, this system 1 includes a plant 5, a CI (Collaborative Information) server 10, and an information processing device 100. The plant 5 and the CI server 10 are connected to each other via a network N or the like.

[0014] The network N may be any of various communication networks such as a dedicated line, the Internet, or an LTE (Long Term Evolution) network.

[0015] The plant 5 is an example of various plants that use petroleum, petrochemical, chemical, gas, etc., and includes factories and the like equipped with various facilities for obtaining products. For example, the plant 5 is constructed using a distributed control system (DCS) (not shown) and performs operation control of facilities, field devices, sensors, etc.

[0016] The CI server 10 is an example of an information processing device that is connected to various devices and systems in the plant 5 and manages them in an integrated manner. The CI server 10 has a log collection function, and by using this log collection function, repeatedly executes a process of transmitting collected log files to the information processing device 100 at regular intervals.

[0017] The information processing device 100 is a device that visualizes the health and spare capacity of the entire system 1 based on the log file acquired from the CI server 10.

[0018] (Functional configuration of information processing device 100) An example of the configuration of the information processing device 100 shown in Fig. 1 will be described. Fig. 2 is a functional block diagram showing the configuration of the information processing device according to this embodiment. As shown in Fig. 2, the information processing device 100 includes a communication unit 110, an input unit 120, a display unit 130, a storage unit 140, and a control unit 150.

[0019] The communication unit 110 executes data communication with the CI server 10. For example, the CI server 10 transmits log files at regular intervals.

[0020] The input unit 120 inputs various types of information to the control unit 150 of the information processing device 100. The input unit 120 is a keyboard, a mouse, a touch panel, etc. A user may operate the input unit 120 to input the function-specific spec table 141, definition information 143, etc.

[0021] The display unit 130 displays information output from the control unit 150 of the information processing device 100. For example, the display unit 130 displays graph information of scores, which will be described later.

[0022] The storage unit 140 stores a function-specific spec table 141, a log file table 142, definition information 143, a function-specific measured resource table 144, and a score table 145. The storage unit 140 is realized by a memory, a hard disk, or the like.

[0023] The function-specific spec table 141 is a table that holds spec information for each function. Fig. 3 is a diagram showing an example of the data structure of the function-specific spec table. As shown in Fig. 3, this function-specific spec table 141 associates function types with spec information.

[0024] The function type indicates the type of function. For convenience, Figure 3 shows function A, function B, and function C. Examples of functions include an OPC UA (Open Platform Communications Unified Architecture) function and an alarm sending / receiving function.

[0025] The specification information indicates the upper limit of resources used by the corresponding function. For example, the resources include Windows resources and CI server resources. Windows resources include CPU, memory, disk access, communication, etc. CI server resources include CPU kernel, CPU user, message sending / receiving, message failed, number of queues, etc.

[0026] The log file table 142 stores multiple log files sent from the CI server 10 at regular intervals. In the following explanation, multiple log files will be collectively referred to simply as log files. The log files record the actual measured values ​​of the above resources over a certain period of time. The log files also record information about the occurrence of events (including errors, etc.).

[0027] The definition information 143 is information that defines how information should be extracted from which log file stored in the log file table 142 in order to obtain information about a corresponding resource or information about the occurrence of an event. The definition information 143 includes resource regular expressions for extracting resources, event regular expressions for extracting events, etc.

[0028] The function-specific actual measurement resource table 144 stores information about actual measurement values ​​of resources for each function extracted from log files and events that have occurred in relation to the functions. FIG. 4 is a diagram showing an example of the data structure of the function-specific actual measurement resource table. As shown in FIG. 4, in this function-specific actual measurement resource table 144, function types, actual measurement value information, and event information are associated with each other. The function type indicates the type of function. For convenience, functions A, B, and C are shown in FIG. 4. The actual measurement value information is information about the actual measurement values ​​of each resource used by the corresponding function. The event information is information about the content and occurrence frequency of events that have occurred in relation to the function (event occurrence frequency). Note that, although the case where the actual measurement value information and event information are stored separately is shown here, the event information may also be included as part of the actual measurement value information.

[0029] The score table 145 stores score information for each function. For example, the score is information that quantifies the system's spare capacity, and a higher score indicates greater spare capacity. FIG. 5 is a diagram showing an example of the data structure of the score table. As shown in FIG. 5, this score table 145 associates function types with score information. The function type indicates the type of function. For convenience, FIG. 5 shows function A, function B, and function C. The score information is information that indicates the chronological score array of the corresponding function. A specific explanation of the scores will be given later.

[0030] Next, the explanation will move on to the control unit 150 in Fig. 2. The control unit 150 is a processing unit that controls the entire information processing device 100, and is realized by, for example, a processor. The control unit 150 has an acquisition unit 151, an extraction unit 152, a calculation unit 153, and a score display unit 154.

[0031] The acquisition unit 151 acquires a log file from the CI server 10 via the communication unit 110. The acquisition unit 151 stores the acquired log file in the log file table 142. The acquisition unit 151 repeatedly executes the above process every time it acquires a log file.

[0032] The extraction unit 152 periodically extracts actual measurement value information and event information for each function from the log files stored in the log file table 142 based on the definition information 143. For example, the extraction unit 152 compares a regular expression for a certain resource set in the definition information 143 with the log file to extract the actual measurement value for each function from the log file. The extraction unit 152 compares a regular expression for a certain event set in the definition information 143 with the log file to extract the content and occurrence frequency of an event related to each function from the log file.

[0033] The extracting unit 152 stores the actual measurement value information and event information of each function extracted at regular intervals in the function-specific actual measurement resource table 144. For example, the extracting unit 152 updates the previous actual measurement value information and event information with the latest actual measurement value information and event information. Note that the extracting unit 152 may accumulate the actual measurement value information and event information for each regular interval in the function-specific actual measurement resource table 144.

[0034] The calculation unit 153 periodically calculates the score of each function based on the function-specific spec table 141 and the function-specific measured resource table 144. The following describes an example of a process in which the calculation unit 153 calculates the score of function A at a certain timing T1.

[0035] The calculation unit 153 acquires the specification information of the function A from the function-specific specification table 141. As described above, the specification information includes the upper limit resource (upper limit of each resource) used by the function. The calculation unit 153 acquires the actual measurement value information and event information of the function A at the timing T1 from the function-specific actual measurement resource table 144.

[0036] For the sake of convenience, the following description will be given assuming that the resources used by function A are a CPU and memory. The calculation unit 153 calculates a score related to the CPU based on the difference between the upper limit of the CPU used by function A (for example, a CPU usage rate of 50%) and the actual measured value of the CPU by function A (for example, an actual CPU usage rate of 5%). The score increases as the difference increases, and decreases as the difference decreases. The score according to the difference is defined in advance.

[0037] The calculation unit 153 calculates a memory-related score based on the difference between the upper limit of the memory used by function A (for example, 50% memory usage) and the actual measured value of the memory by function A (for example, 10% actual memory usage). The larger the difference, the larger the score becomes, and the smaller the difference, the smaller the score becomes.

[0038] Furthermore, the calculation unit 153 determines whether the event information of the function A satisfies the following condition. Condition: The event information of function A includes a predetermined event content, and the occurrence frequency of the predetermined event content is equal to or greater than a threshold value.

[0039] If the above condition is not satisfied, the calculation unit 153 calculates the average value of the score related to the CPU and the score related to the memory as the score of the function A.

[0040] On the other hand, if the above condition is met, the calculation unit 153 calculates the score of function A by subtracting a predetermined value from the average value of the CPU-related score and the memory-related score.

[0041] The calculation unit 153 performs the above process to calculate the score of function A at timing T1. From subsequent timing T2 onwards, the calculation unit 153 also performs the above process to calculate the score of function A from timing T2 onwards. As a result, score information (a chronological score array) of function A is generated.

[0042] The calculation unit 153 also performs the same process for the function B and the function C as for the function A, thereby generating score information for the function B and the score information for the function C.

[0043] The calculation unit 153 registers the score information of each function in the score table 145 .

[0044] The score display unit 154 generates graph information of the scores of each function based on the score information of each function stored in the score table 145, and displays it on the display unit .

[0045] Fig. 6 is a diagram showing an example of graph information. As shown in Fig. 6, the horizontal axis of graph information G1 corresponds to time, and the vertical axis corresponds to score. For example, line l1 shows the relationship between time and score for function A. Line l2 shows the relationship between time and score for function B. Line l3 shows the relationship between time and score for function C.

[0046] Although the extraction unit 152, the calculation unit 153, and the score display unit 154 have been described as executing the above processes at regular intervals, they may execute the above processes at various intervals. For example, the extraction unit 152, the calculation unit 153, and the score display unit 154 may execute the above processes at a first interval (short interval), a second interval (medium interval), or a third interval (long interval). However, the relationship between the lengths of the intervals is set as first interval < second interval < third interval.

[0047] For example, for each first period, the extraction unit 152 extracts the actual measurement value information and event information for each function, the calculation unit 153 generates score information for each function, and the score display unit 154 generates score information.

[0048] For each second period, the extraction unit 152 extracts the actual measurement value information and event information for each function, the calculation unit 153 generates score information for each function, and the score display unit 154 generates score information.

[0049] For each third period, the extraction unit 152 extracts the actual measurement value information and event information for each function, the calculation unit 153 generates score information for each function, and the score display unit 154 generates score information.

[0050] Furthermore, the score display unit 154 may display the graph information generated in the first cycle, the graph information generated in the second cycle, and the graph information generated in the third cycle on the display unit 130 so that they can be compared.

[0051] (Processing flow) Next, an example of the processing flow of the information processing device 100 according to this embodiment will be described. Fig. 7 is a flowchart showing the processing flow of the information processing device according to this embodiment. As shown in Fig. 7, the acquisition unit 151 of the information processing device 100 acquires a log file from the CI server 10 and stores it in the log file table 142 (step S101).

[0052] The extraction unit 152 of the information processing device 100 extracts the actual measurement value information and event information of each function from the log file based on the definition information 143, and stores the extraction results in the function-specific actual measurement resource table 144 (step S102).

[0053] The calculation unit 153 of the information processing device 100 calculates score information for each function based on the function-specific spec table 141 and the function-specific measured resource table 144, and stores the score information in the score table 145 (step S103).

[0054] The score display unit 154 of the information processing device 100 generates graph information based on the score table 145, and displays the graph information on the display unit 130 (step S104).

[0055] (effect) Next, the effects of the information processing device 100 according to this embodiment will be described. The information processing device 100 extracts actual measured values ​​of resources used by functions from log files acquired from the system (CI server 10), calculates a score for the function based on the actual measured values ​​of the resources used by the function and the upper limit of the resources available to the function, and generates and displays information that visualizes the function score. This makes it possible to visualize the health and spare capacity of the system. Furthermore, by visualizing the health and spare capacity, it is possible to efficiently investigate the cause of trouble when it occurs and check the scalable availability of the system.

[0056] The information processing device 100 extracts actual measured values ​​of resources from the log file based on definition information that defines regular expressions for resources. The information processing device 100 also extracts the content and occurrence frequency of events from the log file based on regular expressions for events in the definition information. This allows appropriate extraction of information used for score calculation from the log file.

[0057] The information processing apparatus 100 assigns a higher score to a function as the difference between the actual measured value of the resource used by the function and the upper limit of the resource that can be used by the function increases, thereby enabling the spare capacity of the function to be appropriately quantified.

[0058] The information processing device 100 repeatedly executes the process of calculating the scores of the functions at regular intervals to generate time-series scores for the functions, thereby generating time-series score information for the functions.

[0059] The information processing device 100 generates a graph showing the relationship between time and score for each function, thereby making it possible to display the health and spare capacity of the system in a graph.

[0060] (Hardware) Next, an example of the hardware configuration of the information processing device 100 will be described. Fig. 8 is a diagram illustrating an example of the hardware configuration. As shown in Fig. 8, the information processing device 100 has a communication device 6a, an HDD (Hard Disk Drive) 6b, a memory 6c, and a processor 6d. The components shown in Fig. 8 are connected to each other via a bus or the like.

[0061] The communication device 6a communicates with the CI server 10, etc. The HDD 6b stores the programs and DBs that operate the functions shown in FIG.

[0062] The processor 6d reads out a program that executes the same processes as those of the processing units shown in Fig. 2 from the HDD 6b or the like and loads it into the memory 6c, thereby operating a process that executes each function described in Fig. 2 or the like. For example, this process executes the same functions as those of the processing units included in the information processing device 100. Specifically, the processor 6d executes a process that executes the same processes as those of the acquisition unit 151, extraction unit 152, calculation unit 153, score display unit 154, etc.

[0063] In this way, the information processing device 100 operates as an information processing device that executes an information providing method by reading and executing a program. The information processing device 100 can also realize functions similar to those of the above-described embodiment by reading the program from a recording medium using a medium reading device and executing the read program. Note that the program in these other embodiments is not limited to being executed by the information processing device 100. For example, the present invention can also be applied in the same way to cases where another computer or server executes the program, or where these execute the program in cooperation with each other.

[0064] This program can be distributed via a network such as the Internet. In addition, this program can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, a magneto-optical disk (MO), or a digital versatile disk (DVD), and can be executed by being read from the recording medium by a computer.

[0065] (others) Some examples of combinations of the disclosed technical features are set out below.

[0066] (1) an extracting unit that extracts actual measured values ​​of resources used by functions included in a system from a log file acquired from the system; a calculation unit that calculates a score for the function based on an actual measurement value of the resource used by the function and an upper limit value of the resource that can be used by the function; a score display unit that generates and displays information that visualizes the scores of the functions; An information processing device having the above.

[0067] (2) The information processing device according to (1), further comprising an acquisition unit that acquires a log file transmitted from the system at regular intervals.

[0068] (3) The information processing device according to (1) or (2), wherein the extraction unit extracts the actual measured value of the resource from the log file based on definition information that defines a regular expression of the resource.

[0069] (4) The information processing device described in (3), wherein the definition information further defines a regular expression for the event, and the extraction unit further extracts the content and occurrence frequency of the event from the log file based on the regular expression for the event.

[0070] (5) The information processing device according to (4), wherein the calculation unit further uses the content of the event and the occurrence frequency to calculate the score of the function.

[0071] (6) An information processing device described in any one of (1) to (5), wherein the calculation unit increases the score of the function the greater the difference between the actual measured value of the resource used by the function and the upper limit value of the resource available to the function.

[0072] (7) The information processing device according to any one of (1) to (6), wherein the calculation unit repeatedly executes a process of calculating the score of the function at regular intervals to generate a time-series score for the function.

[0073] (8) The information processing device according to (7), wherein the score display unit generates a graph showing the relationship between time and score for each function.

[0074] (9) The computer extracting actual measured values ​​of resources used by functions included in the system from a log file acquired from the system; calculating a score for the function based on the actual measured value of the resource and an upper limit value of the resource that can be used by the function; Generate and display visualized information on the scores of the above functions A visualization method to perform the process.

[0075] (10) To the computer, extracting actual measured values ​​of resources used by functions included in the system from a log file acquired from the system; calculating a score for the function based on the actual measured value of the resource and an upper limit value of the resource that can be used by the function; Generate and display visualized information on the scores of the above functions A visualization program that performs the processing. [Explanation of symbols]

[0076] 1 System 5 Plant 10 CI Server 100 Information processing device 110 Communications Department 120 Input section 130 Display section 140 Storage section 141 Functional Specification Table 142 Log File Table 143 Definition information 144 Functional Measured Resource Table 145 Score Table 150 control section 151 Acquisition Department 152 Extraction part 153 Calculation Unit 154 Score display

Claims

1. an extracting unit that extracts actual measured values ​​of resources used by functions included in the system from a log file acquired from the system; a calculation unit that calculates a score for the function based on an actual measurement value of the resource used by the function and an upper limit value of the resource that can be used by the function; a score display unit that generates and displays information that visualizes the scores of the functions; An information processing device having the above.

2. The information processing apparatus according to claim 1 , further comprising an acquisition unit that acquires a log file transmitted from the system at regular intervals.

3. The information processing apparatus according to claim 1 , wherein the extraction unit extracts the actual measured values ​​of the resources from the log file based on definition information that defines regular expressions of the resources.

4. The information processing apparatus according to claim 3 , wherein the definition information further defines a regular expression of the event, and the extracting unit further extracts the content and occurrence frequency of the event from the log file based on the regular expression of the event.

5. The information processing device according to claim 4 , wherein the calculation unit calculates the score of the function by further using the content of the event and the occurrence frequency.

6. The information processing apparatus according to claim 1 , wherein the calculation unit increases the score of the function as the difference between an actual measurement value of the resource used by the function and an upper limit value of the resource available to the function increases.

7. The information processing apparatus according to claim 1 , wherein the calculation unit repeatedly executes a process of calculating the scores of the functions at regular intervals to generate time-series scores for the functions.

8. The information processing device according to claim 7 , wherein the score display unit generates a graph showing the relationship between time and score for each function.

9. The computer extracting actual measured values ​​of resources used by functions included in the system from a log file acquired from the system; calculating a score for the function based on the actual measured value of the resource and an upper limit value of the resource that can be used by the function; Generate and display visualized information on the scores of the above functions A visualization method to perform the process.

10. On the computer, extracting actual measured values ​​of resources used by functions included in the system from a log file acquired from the system; calculating a score for the function based on the actual measured value of the resource and an upper limit value of the resource that can be used by the function; Generate and display visualized information on the scores of the above functions A visualization program that performs the processing.

Images