Computer system and fault handling support method

Abstract

To completely acquire and analyze information on events necessary for grasping a state of an IT system in which a fault has occurred.SOLUTION: A computer system is connected to an IT system and a text generation system that generates a text according to a prompt, and holds event log information for managing event logs of events that have occurred in the IT system and scope information for managing a scope that is a condition for acquiring event logs of events related to a designated event. The computer system receives a fault handling request including information on a target event related to a fault, generates related event information by collecting the event logs from the event log information on the basis of a plurality of scopes, generates a prompt for an instruction to analyze a state of the IT system using a plurality of pieces of related event information and generate an analysis text indicating an analysis result, and transmits the prompt to the text generation system.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a system and method for supporting troubleshooting of an IT system. [Background technology]

[0002] When dealing with IT system failures, operational information such as logs of events that occurred in the IT system, IT system configuration information, and performance value information is analyzed to understand the status of the IT system, and then the cause of the failure is identified and addressed.In addition, when identifying the cause and addressing the problem, manuals and system specifications, etc. are referred to as necessary.

[0003] In order to understand the status of an IT system, it is necessary to extract and analyze not only the operational information at the time the failure was confirmed, but also information that may be related to the failure from operational information obtained before that time.There are several prior art technologies that can extract information that may be related to the failure from a huge amount of information.

[0004] Patent Document 1 discloses an automated or semi-automated system and method for analyzing event data, which clusters events with the same content or location of occurrence, extracts one or more templates from each cluster, extracts one or more regular expressions from each cluster, and groups events with similar regular expressions.

[0005] Recently, a method has been proposed that uses the advanced natural language processing capabilities of LLM (Large Language Model) to generate text that shows the status of an IT system by inputting information such as the timestamps, messages, and origins of multiple events. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] U.S. Patent Application Publication No. 2019 / 0286500 Summary of the Invention [Problem to be solved by the invention]

[0007] In Patent Document 1, to analyze event data, events are clustered, one or more templates are extracted from each cluster, one or more regular expressions are extracted from each cluster, and events having similar regular expressions are grouped together.

[0008] There are various possible definitions for the conditions for acquiring event logs (event data) related to events that indicate a failure, such as events with similar messages, events that occur in close temporal proximity, and events that occur on the same node or adjacent nodes by referencing configuration information.

[0009] If the event log acquisition conditions are different, the group of extracted event logs will also be different, and the analysis results will also change.If the extracted group of event logs does not include an event log that indicates the cause of a failure, the status of the IT system cannot be accurately understood from the information obtained from the analysis, and appropriate troubleshooting will not be possible.For example, if a related event that is a direct or indirect cause of a given event occurred three hours before the event occurred, if the acquisition conditions are set to a time range from the event occurrence to one hour before, the event log of the related event will not be acquired.

[0010] The present invention provides a system and method for acquiring and analyzing all relevant event information required to understand the state of an IT system in which a failure has occurred. [Means for solving the problem]

[0011] A representative example of the invention disclosed in the present application is as follows: That is, a computer system is connected to an IT system including a processor, a storage device connected to the processor, and a network interface connected to the processor and configured with a plurality of nodes, and a text generation system that uses a natural language processing model to generate answer text in accordance with a prompt that instructs the execution of a language processing task, and holds event log information for managing an event log of events that occur in the IT system and scope information for managing scopes that are acquisition conditions for the event log of events related to a specified event, the scope information stores definition information for a plurality of scopes, the processor accepts a fault handling request including information on a target event related to a fault, collects the event log from the event log information based on each of the plurality of scopes, generates related event information, generates a prompt that instructs the processor to analyze the state of the IT system using each of the plurality of related event information and to generate a first analysis text that indicates the results of the analysis, and transmits the prompt to the text generation system. [Effects of the Invention]

[0012] According to the present invention, by acquiring event logs based on multiple scopes, it is possible to prevent the omission of event logs necessary for understanding the status of an IT system in which a failure has occurred. Furthermore, by using LLM, it is possible to acquire text that describes the status of the IT system. Problems, configurations, and effects other than those described above will be made clear by the following description of the embodiment. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a block diagram showing an example of the configuration of an IT system failure handling system according to a first embodiment of the present invention. [Figure 2] FIG. 10 is a diagram illustrating an example of event information according to the first embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of configuration information according to the first embodiment. [Figure 4]FIG. 10 is a diagram illustrating an example of related event information according to the first embodiment. [Figure 5] FIG. 10 is a diagram showing an example of analysis result information according to the first embodiment. [Figure 6] 4 is a flowchart illustrating an example of an analysis process executed by the analysis device of the first embodiment. [Figure 7] FIG. 2 is a diagram showing an example of a management screen presented by the analysis device of the first embodiment. [Figure 8] 10 is a flowchart illustrating an example of a related event log acquisition process executed by the analysis apparatus according to the first embodiment. [Figure 9] 4 is a flowchart illustrating an example of an analysis process executed by the analysis device of the first embodiment. [Figure 10] 10 is a flowchart illustrating an example of an analysis result aggregation process executed by the analysis apparatus according to the first embodiment. [Figure 11] 10 is a flowchart illustrating an example of a response information generating process executed by the analysis device of the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, embodiments of the present invention will be described with reference to the drawings. In each drawing for explaining the embodiments, the same components are given the same names and reference numerals as much as possible, and repeated description thereof will be omitted.

[0015] The present invention is not limited to the following examples, and includes various modifications and equivalent configurations within the spirit and scope of the appended claims. For example, the above examples have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations.

[0016] Furthermore, the processing units described in the embodiments may be realized in hardware, for example by designing some or all of them as integrated circuits, or may be realized in software by having a processor interpret and execute a program that realizes each function.

[0017] The tables, areas, etc. described in the embodiments may be a database (DB) or may be data stored in the main memory. [Example]

[0018] FIG. 1 is a block diagram showing an example of the configuration of an IT system failure handling system according to a first embodiment of the present invention.

[0019] The IT system failure handling system comprises an analysis device 100, an IT system 101, and a text generation system 102.

[0020] The analysis device 100 is connected to an IT system 101 and a text generation system 102 via a communication network 103 such as the Internet, a LAN, a WAN, or a dedicated line. The communication network 103 may be connected via either a wired or wireless method.

[0021] Although the IT system 101 and the text generation system 102 are assumed to be connected to the same communication network 103, the IT system 101 and the text generation system 102 may be connected to the analysis device 100 via different communication networks.

[0022] The IT system 101 is a system to be monitored. The IT system 101 is a system built on a computer system consisting of multiple computers, and is composed of multiple nodes. The nodes include hardware such as servers and storage, software such as an OS, middleware, and applications, and services realized by the hardware and software.

[0023] The text generation system 102 is a system that provides services using LLM. LLM is a natural language processing model constructed using large amounts of text data and can perform various language processing tasks. LLM accepts prompts containing task content, such as questions written in natural language, understands the meaning of the task content, and generates and outputs text that serves as an answer. The LLM in this embodiment performs the task of analyzing the status of an IT system using at least an event log of the IT system and generating text that shows the results of the analysis. The LLM is generated by a learning process using the event log.

[0024] The analysis device 100 includes a calculation device 110 , a memory 111 , a secondary storage device 112 , a network interface 113 , an input device 114 , and an output device 115 .

[0025] The input device 114 is a keyboard, a mouse, a touch panel, etc. The output device 115 is a display, a touch panel, etc.

[0026] The arithmetic device 110 is a CPU (Central Processing Unit) or the like. The arithmetic device 110 operates as a functional unit (module) that realizes a specific function by executing processing according to a program. In the following description, when processing is described using the functional unit as the subject, it indicates that the arithmetic device 110 is executing a program that realizes the functional unit.

[0027] The memory 111 is a RAM (Random Access Memory), a ROM (Read Only Memory), or the like, and is a storage device into which programs executed by the arithmetic device 110 and information used by the programs are loaded. The memory 111 is also used as a work area. The secondary storage device 112 is a HDD (Hard Disc Drive), SSD (Solid State Drive), or the like.

[0028] The network interface 113 is a network interface card (NIC), a wireless communication module, a universal serial interface (USB) module, a serial communication module, or the like.

[0029] The secondary storage device 112 stores programs that implement the related event log acquisition unit 120, the analysis unit 121, the aggregation unit 122, and the response information generation unit 123. The secondary storage device 112 also stores event information 124, configuration information 125, related event information 126, and analysis result information 127.

[0030] FIG. 2 is a diagram illustrating an example of the event information 124 according to the first embodiment.

[0031] The event information 124 stores a log (event log) of events that have occurred in the IT system 101. The event information 124 stores entries each including an ID 201, a timestamp 202, a message 203, and an occurrence node ID 204. One entry corresponds to one event log.

[0032] ID 201 is a field for storing the identifier of the event log. Timestamp 202 is a field for storing the date and time when the event corresponding to the event log occurred. Message 203 is a field for storing a message indicating the content of the event. Occurrence node ID 204 is a field for storing the identifier of the node from which the event occurred.

[0033] In this embodiment, it is assumed that the IT system 101 collects the event logs and transmits them to the analysis device 100. Alternatively, the analysis device 100 may collect the event logs from the IT system 101.

[0034] FIG. 3 is a diagram illustrating an example of the configuration information 125 according to the first embodiment.

[0035] The configuration information 125 stores information relating to the node configuration of the IT system 101. The configuration information 125 stores entries including a node ID 301, a node name 302, and an adjacent node list 303. One entry corresponds to one node.

[0036] Node ID 301 is a field that stores the identifier of a node. Node Name 302 is a field that stores the name of a node. Adjacent Node List 303 is a field that stores a list of nodes that have a logical connection relationship with the node corresponding to the entry. Adjacent Node List 303 stores a list of identifiers of nodes that have a logical connection relationship with the node.

[0037] FIG. 4 is a diagram illustrating an example of the related event information 126 according to the first embodiment.

[0038] The related event information 126 is information generated from an event log of an event (related event) related to the target event. The data structure of the related event information 126 is similar to that of the event information 124, and stores entries each including an ID 401, a timestamp 402, a message 403, and an occurrence node ID 404.

[0039] FIG. 5 is a diagram illustrating an example of the analysis result information 127 according to the first embodiment.

[0040] The analysis result information 127 is information that stores the analysis results of the event log. The analysis result information 127 stores entries including a scope 501 and an analysis result 502. One entry corresponds to one analysis result.

[0041] The scope 501 is a field for storing a scope that indicates the conditions for acquiring event logs of events (related events) related to the target event. The scope is defined based on time or the node configuration of the IT system 101. In this embodiment, multiple scopes are set in advance. Scopes can be added, modified, or deleted as appropriate. Scope groups may be switched depending on the type of event, analysis content, etc.

[0042] The analysis result 502 is a field that stores the analysis result that explains the state of the IT system 101. Text (analysis text) is stored in the analysis result 502. The analysis text includes one or more pieces of information (state information) that represent the state of the IT system.

[0043] Fig. 6 is a flowchart illustrating an example of an analysis process executed by the analysis device 100 of the first embodiment. Fig. 7 is a diagram illustrating an example of a management screen presented by the analysis device 100 of the first embodiment.

[0044] When the analysis device 100 receives access from a user, it presents a management screen 700 as shown in Fig. 7. Here, the management screen 700 will be described. The management screen 700 includes an event selection area 710 and an AI assistant area 720.

[0045] The event selection area 710 includes an event list 711 and operation buttons 713. The event list 711 displays an event log stored in the event information 124. The user selects a target event by operating a check box 712 in the event list 711. The operation buttons 713 are buttons for enabling input to the AI ​​assistant area 720.

[0046] The AI ​​assistant area 720 is an area for inputting a troubleshooting request and outputting response information, and includes a chat field 721. The user inputs a question 722 indicating the content of the troubleshooting request in the chat field 721. The question may be, for example, "What is the cause?", "How do we need to handle it?", or "What systems are affected?" The analysis device 100 outputs response information 723 to the troubleshooting request in the chat field 721.

[0047] The analytical device 100 receives a failure handling request via the management screen 700 (step S100).

[0048] Next, the associated event log acquisition unit 120 of the analysis device 100 executes an associated event log acquisition process (step S200). The associated event log acquisition process will be described in detail later.

[0049] Next, the analysis unit 121 of the analysis device 100 executes an analysis process in cooperation with the text generation system 102 (step S300). The analysis process will be described in detail later.

[0050] Next, the aggregation unit 122 of the analysis device 100 executes an analysis result aggregation process (step S400). Details of the analysis result aggregation process will be described later.

[0051] Next, the answer information generating unit 123 of the analysis device 100 executes an answer information generating process (Step S500). The answer information generating process will be described in detail later.

[0052] In this embodiment, the process is initiated by a user input, but is not limited to this. For example, the analysis device 100 stores information associating events with response policies, monitors an event log, and when it detects the occurrence of a specific event, generates a fault response request including the event log of the event and the response policy.

[0053] FIG. 8 is a flowchart illustrating an example of the associated event log acquisition process executed by the analysis apparatus 100 according to the first embodiment.

[0054] The associated event log acquisition unit 120 selects a scope (step S201).

[0055] The related event log acquisition unit 120 acquires the event log from the event information 124 based on the selected scope (step S202).

[0056] The associated event log acquisition unit 120 generates associated event information 126 from the acquired event log (step S203). At this time, the associated event log acquisition unit 120 adds scope information to the associated event information 126.

[0057] The associated event log acquisition unit 120 determines whether processing has been completed for all scopes (step S204). If processing has not been completed for all scopes, the associated event log acquisition unit 120 returns to step S201. If processing has not been completed for all scopes, the associated event log acquisition unit 120 ends the associated event log acquisition process.

[0058] Here, a specific example of the scope will be described.

[0059] (Case 1) The following are possible scopes that are defined based on the perspective of time: (1) The time range from the target event occurrence date and time to one hour before (2) The time range from the target event occurrence date and time up to 12 hours before (3) The time range from the target event occurrence date and time up to 24 hours before

[0060] In the case of the scope (1), the related event log acquisition unit 120 references the event information 124, acquires the timestamp of the target event, and sets a time range from the timestamp up to one hour before. The related event log acquisition unit 120 acquires the event logs included in the set time range from the event information 124, and generates the related event information 126. Similar processing is performed in the case of the scopes (2) and (3). Note that the retroactive time range and the starting date and time are not limited to those described above.

[0061] The time span to go back may be changed based on operational information of the IT system 101. For example, the analysis apparatus 100 may manage a change history that records the date and time of changes and the details of changes to parameters related to the IT system 101, such as the configuration or specifications of the IT system 101, and refer to the change history of changes applied immediately before the timestamp of the target event, using the date and time of each change as the starting point. The change history can be created using documents and information created and recorded in IT operations management, such as configuration change records of the IT system 101, change history of specifications, and parameter sheets. By determining the time range for acquiring event logs based on the date and time when changes to the IT system 101 were applied, the acquired related event logs are limited to event logs after the change, making it possible to more efficiently extract event logs related to the failure that the user wants to address.

[0062] (Case 2) The following scopes can be considered as scopes defined based on the node configuration of the IT system 101. (4) The node where the target event occurred (5) Neighboring nodes of the node where the target event occurred

[0063] In the case of the scope (4), the related event log acquisition unit 120 acquires the event log of the node where the target event occurred from the event information 124, and generates related event information 126. In the case of the scope (5), the related event log acquisition unit 120 refers to the configuration information 125 to identify the node adjacent to the node where the target event occurred. The related event log acquisition unit 120 acquires the event log of the adjacent node from the event information 124, and generates related event information 126. If there are multiple adjacent nodes, one piece of related event information 126 is generated from the event log of each adjacent node.

[0064] It is also possible to set a scope by combining Case 1 and Case 2. For example, it is conceivable to set "nodes on which a target event occurred in the last hour" as the scope.

[0065] FIG. 9 is a flowchart illustrating an example of the analysis process executed by the analysis device 100 according to the first embodiment.

[0066] The analysis unit 121 generates a prompt that instructs the analysis of the state of the IT system 101 using the event logs included in the related event information 126 and the generation of an analysis text showing the results of the analysis (step S301). The prompt includes all of the related event information 126 generated in the related event log acquisition process, as well as the above-mentioned analysis instruction and generation instruction.

[0067] A prompt template is set in advance in the analysis device 100, and the analysis unit 121 generates a prompt using the template.

[0068] The analysis unit 121 inputs a prompt to the text generation system 102 and obtains the analyzed text (step S302).

[0069] The analysis unit 121 records the analyzed text in the analysis result information 127 (step S303). Specifically, the analysis unit 121 records an entry in which the scope and the analyzed text are associated with each other in the analysis result information 127.

[0070] If multiple states are obtained as a result of analyzing one piece of related event information 126, an analysis text may be generated that explains the relationship between the states. For example, an analysis text may be generated that explains a causal relationship, such as the occurrence of one state causing another state.

[0071] FIG. 10 is a flowchart illustrating an example of the analysis result aggregation process executed by the analysis apparatus 100 according to the first embodiment.

[0072] The aggregating unit 122 selects a target analysis text from the analysis result information 127 (step S401).

[0073] The aggregation unit 122 compares the target analyzed text with the analyzed text registered in the analysis result information 127 (step S402).

[0074] The aggregating unit 122 determines whether there is an analysis text that includes the same status information as the target analysis text (step S403).

[0075] If there is no analysis text that includes the same status information as the target analysis text, the aggregating unit 122 proceeds to step S405.

[0076] If an analysis text with the same content as the target analysis text exists, the aggregation unit 122 executes a duplicate elimination process (step S404), and then proceeds to step S405.

[0077] For example, the aggregation unit 122 deletes duplicated state information from the target analyzed text or the compared analyzed text, merges the target analyzed text and the compared analyzed text into a single analyzed text, and deletes analyzed texts that do not contain any state information.

[0078] In step S405, the aggregation unit 122 determines whether or not there is a comparable analysis text (step S405). Here, it is determined whether or not there is an analysis text that has not been selected as the target analysis text and for which duplicate elimination processing has not been performed.

[0079] If a comparable analyzed text exists, the aggregating unit 122 returns to step S401. If a comparable analyzed text does not exist, the aggregating unit 122 ends the analysis result aggregating process.

[0080] Alternatively, an analysis text (normal) may be generated in advance using an event log from a time period when no failures have occurred (for example, the day before or one week before the target event occurred), and the aggregation unit 122 may update the analysis text so as to retain only status information whose content differs from the status information contained in the analysis text (normal). This makes it possible to extract only the status related to the failure of the IT system 101.

[0081] Alternatively, the LLM may be made to execute an analysis result aggregation process. In this case, the aggregation unit 122 generates analysis result information 127 and a prompt including instructions to compare the analyzed texts and merge or delete state information with the same content, and sends the generated prompt to the text generation system 102. The aggregation unit 122 reflects the results of the analysis text duplication elimination performed by the text generation system 102 in the analysis result information 127.

[0082] FIG. 11 is a flowchart illustrating an example of the response information generation process executed by the analysis device 100 according to the first embodiment.

[0083] The answer information generating unit 123 identifies the countermeasure content (Step S501). For example, the answer information generating unit 123 identifies the countermeasure content in the question sentence by executing a text analysis process.

[0084] Next, the response information generating unit 123 generates response information based on the analysis result information 127 and the content of the measures (step S502).

[0085] For example, if the content of the countermeasure is "identification of the fault," the answer information generation unit 123 generates answer information from the analyzed text stored in the analysis result information 127. If the content of the countermeasure is "identification of the cause," the answer information generation unit 123 identifies the cause by referring to information such as a specification based on the analysis result information 127, and generates answer information for presenting the identified cause. If the content of the countermeasure is "dealing with the fault," the answer information generation unit 123 identifies a countermeasure by referring to information such as a manual based on the analysis result information 127, and generates answer information for presenting the identified countermeasure.

[0086] Next, the answer information generating unit 123 outputs the answer information (step S503), and ends the answer information generating process.

[0087] The answer information may be generated using an LLM. In this case, the answer information generator 123 transmits a prompt to the text generation system 102, including the question, the event log of the target event, the analysis result information 127, and an instruction to generate answer information according to the action content specified in the question. Alternatively, the LLM may be caused to generate answer information using Retrieval Augmented Generation (RAG). That is, a front-end application extracts keywords from the analyzed text and performs a keyword search using a search tool to obtain information necessary for the answer, and inputs the obtained information and the prompt into the LLM. The LLM generates answer information based on the information and the prompt. The search tool may be a web search engine API or a database storing information on related documents such as specifications and manuals.

[0088] This embodiment will be explained below using a specific example. Here, the following case is assumed. A failure occurs in the storage that constitutes an IT system, which causes abnormal operation of multiple databases, and as a result, an error in a web application that depends on the database is detected as an event. Also, it is assumed that the scope of Case 1 is set.

[0089] The analysis apparatus 100 receives a failure handling request in which an event indicating an error in a Web application is set as a target event (step S100).

[0090] In the associated event log acquisition process (step S200), the analytical device 100 acquires an event log for a time range (first time range) from the date and time when the web application error occurred to one hour before, and generates associated event information 126. The analytical device 100 acquires an event log for a time range (second time range) from the date and time to 12 hours before, and generates associated event information 126. The analytical device 100 acquires an event log for a time range (third time range) from the date and time to 24 hours before, and generates associated event information 126.

[0091] The event logs in the first time range include event logs related to the database that is the cause of the web application error, and the event logs in the second time range include event logs related to the storage that is the cause of the database malfunction.

[0092] In the analysis process (step S300), the analysis device 100 generates a first analysis text indicating a database operation abnormality using the related event information 126 generated from the event log for a first time range. The analysis device 100 generates a second analysis text indicating a database operation abnormality and a storage failure using the related event information 126 generated from the event log for a second time range. The analysis device 100 generates a third analysis text indicating a database operation abnormality and a storage failure using the related event information 126 generated from the event log for a third time range.

[0093] In the analysis result aggregation process (step S400), the analysis device 100 performs a duplicate elimination process because the second analysis text and the third analysis text have the same content. Here, it is assumed that the third analysis text has been deleted. In this case, the first analysis text and the second analysis text are stored in the analysis result information 127.

[0094] In the answer information generation process (step S500), the analysis device 100 generates answer information using the first analyzed text and the second analyzed text. For example, the answer information generated may be a text such as "A failure occurred in the storage, which caused an abnormal operation of the database, and further caused an error in the web application."

[0095] According to this embodiment, by acquiring logs of related events in multiple scopes, it is possible to prevent the omission of event logs necessary for understanding the status of an IT system in which a failure has occurred. Furthermore, by using LLM, it is possible to understand the status of the IT system and deal with the failure appropriately.

[0096] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments are provided to explain the present invention in detail, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, some of the configurations of each embodiment can be added to, deleted from, or replaced with other configurations.

[0097] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The present invention can also be realized by software program code that implements the functions of the embodiments. In this case, a storage medium on which the program code is recorded is provided to a computer, and a processor included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium implements the functions of the above-described embodiments, and the program code itself and the storage medium on which it is stored constitute the present invention. Examples of storage media for providing such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, solid-state drives (SSDs), optical disks, magneto-optical disks, CD-Rs, magnetic tapes, non-volatile memory cards, and ROMs.

[0098] Furthermore, the program code that realizes the functions described in this embodiment can be implemented in a wide range of program or script languages, such as assembler, C / C++, perl, Shell, PHP, Python, and Java (registered trademark).

[0099] Furthermore, the program code of the software that realizes the functions of the embodiments may be distributed via a network and stored in a storage means such as a computer's hard disk or memory, or in a storage medium such as a CD-RW or CD-R, and the processor of the computer may read and execute the program code stored in the storage means or storage medium.

[0100] In the above-described embodiment, the control lines and information lines are shown as those considered necessary for the explanation, and not all control lines and information lines are necessarily shown in the product. All components may be interconnected. [Explanation of symbols]

[0101] 100 Analyzer 101 IT Systems 102 Text Generation System 103 Communication Network 110 Arithmetic equipment 111 memory 112 Secondary storage device 113 Network Interface 114 Input Device 115 Output Device 120 Related Event Log Acquisition Unit 121 Analysis Department 122 Consolidation Department 123 Answer information generation section 124 Event Information 125 Configuration Information 126 Related Event Information 127 Analysis result information 700 Management screen

Claims

1. 1. A computer system comprising: a processor, a storage device connected to the processor, and a network interface connected to the processor; an IT system configured with a plurality of nodes connected to a text generation system that uses a natural language processing model to generate answer text in accordance with a prompt that instructs the execution of a language processing task; The system holds event log information for managing an event log of an event that has occurred in the IT system, and scope information for managing a scope that is an acquisition condition for the event log of an event related to a specified event, The scope information stores definition information for a plurality of the scopes, The processor: Accepting a fault handling request including information about a target event related to the fault; Collecting the event log from the event log information based on each of the plurality of scopes and generating related event information; A computer system characterized by generating a prompt to instruct the analysis of the state of the IT system using each of the multiple related event information and the generation of a first analysis text showing the results of the analysis, and sending the prompt to the text generation system.

2. 2. The computer system of claim 1, the troubleshooting request includes information indicating the details of the troubleshooting; The computer system is characterized in that the processor generates and outputs information serving as a response to the troubleshooting request based on the content of the troubleshooting request in the troubleshooting request and the plurality of first analysis texts.

3. 2. The computer system of claim 1, The computer system is characterized in that the processor performs a duplicate elimination process by comparing each of the plurality of first analytical texts and deleting or merging the first analytical texts that include the same analytical content.

4. 3. The computer system according to claim 2, a second analysis text indicating a result of an analysis of the state of the IT system by the text generation system using the event log acquired when the IT system is in a normal state; The computer system is characterized in that the processor deletes, from the plurality of first analytical texts, analytical content that is the same as that of the second analytical text.

5. 2. The computer system of claim 1, A computer system characterized in that the scope information stores definition information of the scope defined based on a time perspective or a configuration perspective of the IT system.

6. 2. The computer system of claim 1, A computer system characterized in that the text generation system analyzes the state of the IT system by referring to information managed by an external system.

7. A failure response support method executed by a computer system, comprising: The computer system a processor, a storage device connected to the processor, and a network interface connected to the processor; an IT system configured with a plurality of nodes connected to a text generation system that uses a natural language processing model to generate answer text in accordance with a prompt that instructs the execution of a language processing task; The system holds event log information for managing an event log of an event that has occurred in the IT system, and scope information for managing a scope that is an acquisition condition for the event log of an event related to a specified event, The scope information stores definition information for a plurality of the scopes, The failure response support method includes: a first step in which the processor receives a fault handling request including information on a target event related to a fault; a second step in which the processor collects the event log from the event log information based on each of the plurality of scopes and generates related event information; a third step in which the processor generates a prompt instructing the analysis of the state of the IT system using each of the plurality of related event information and the generation of a first analysis text indicating the results of the analysis, and sends the generated prompt to the text generation system.

8. 8. The fault handling support method according to claim 7, the troubleshooting request includes information indicating the details of the troubleshooting; A fault handling support method characterized in that the processor generates and outputs information that serves as a response to the fault handling request based on the content of the fault handling in the fault handling request and the plurality of first analysis texts.

9. 8. The fault handling support method according to claim 7, The third step is characterized in that it includes a fourth step in which the processor performs a deduplication process to compare each of the plurality of first analysis texts and delete or merge the first analysis texts that contain identical analysis content.

10. 9. The fault handling support method according to claim 8, a second analysis text indicating a result of an analysis by the text generation system using the event log acquired when the IT system is in a normal state; The fault handling support method, wherein the third step includes a step in which the processor deletes, from the plurality of first analytical texts, analytical content that is the same as that of the second analytical text.

11. 8. The fault handling support method according to claim 7, A fault handling support method, characterized in that the scope information stores definition information of the scope defined based on a time perspective or a configuration perspective of the IT system.

12. 8. The fault handling support method according to claim 7, A fault handling support method comprising a step in which the text generation system refers to information managed by an external system and analyzes the state of the IT system.

Images