Disk abnormality detection system

Abstract

To detect disk abnormality.SOLUTION: The storage device stores I / O latency history information including a history of I / O latencies of the disk device and KPI history information including a history of KPIs of an application program that accesses the disk device. The processor determines whether there is an application abnormality based on the KPI history information, determines whether there is a I / O latency abnormality based on the I / O latency history information, and determines that a disk abnormality has occurred when it is determined that there is an application abnormality and a I / O latency abnormality.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention is a technology for detecting disk abnormalities. [Background technology]

[0002] Applications sometimes read and write data to disk instead of memory in order to store data for long periods of time or to prevent memory pressure. In such cases, disk abnormalities can cause disk read and write failures or delayed disk responses, which can lead to a chain reaction of unstable application behavior. Therefore, technology is needed to detect disk abnormalities that can cause application behavior to become unstable.

[0003] One of the anomaly detection technologies built into disk drives is the SMART technology specified in the Small Form Factor Committee's SFF-803i. This technology detects errors within the disk drive and determines an anomaly when the cumulative number of errors exceeds a predetermined threshold. However, because SMART requires direct access to the disk drive from the operating system (OS), it is difficult to use with disks provided as cloud services.

[0004] Japanese Patent Application Laid-Open Publication No. 2017-146727 describes a technology for identifying resources that cause performance degradation using performance information obtainable in a cloud environment. The publication states, "To identify a virtual machine, the administrator first receives application performance information from the user. The administrator then uses the analysis device 3000 to estimate performance information of virtual machines that are correlated with the application performance information. This makes it possible to identify the virtual machine that is causing the performance degradation of the application being used by the user." Using this method, it is also possible to detect whether the anomaly is caused by a disk device based on the application performance information and virtual machine performance information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 2017-146727 Summary of the Invention [Problem to be solved by the invention]

[0006] In Patent Document 1, correlation values ​​between application performance information and virtual machine performance information (e.g., disk I / O) are calculated for all stored data sets, which is not suitable for systems that require real-time performance from the perspective of computational load.In addition, because disk I / O performance changes depending on the application execution environment and processing load, it is difficult to set a threshold for I / O latency that is considered abnormal. [Means for solving the problem]

[0007] One aspect of the present invention is a system for detecting abnormalities in a disk device, comprising a processor and a storage device, wherein the storage device stores I / O latency history information including a history of I / O latency of the disk device, and KPI history information including a history of KPIs of application programs that access the disk device, and the processor determines whether or not there is an application abnormality based on the KPI history information, determines whether or not there is an I / O latency abnormality based on the I / O latency history information, and determines that a disk abnormality has occurred if it determines that the application abnormality and the I / O latency abnormality exist. [Effects of the Invention]

[0008] According to the present invention, it is possible to detect a disk abnormality.

[0009] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram of a configuration of an anomaly detection system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram of a hardware configuration according to the present embodiment. [Figure 3] 3 is a processing flow of the anomaly detection system according to the present embodiment. [Figure 4] 3 is a processing flow of the application anomaly detection system according to the present embodiment. [Figure 5] 3 shows a processing flow of the disk abnormality detection system according to the present embodiment. [Figure 6] 10 is a table showing a set of sampled values ​​of application KPIs according to the present embodiment. [Figure 7] 10 is a table showing a set of threshold values ​​for application KPIs according to the present embodiment. [Figure 8] FIG. 10 is a table showing a set of sampling values ​​of disk I / O in this embodiment. [Figure 9] FIG. 10 is a table showing threshold values ​​of I / O latency in this embodiment. [Figure 10] FIG. 10 is a table showing the results of anomaly detection in the present embodiment. [Figure 11] 10 is a processing flow of an anomaly detection system including adjustment of an I / O latency threshold in this embodiment. [Figure 12] 3 shows a processing flow of the I / O latency threshold adjustment system according to the present embodiment. [Figure 13A] FIG. 10 is a diagram showing an example of an I / O latency threshold update process according to the present embodiment. [Figure 13B] FIG. 10 is a diagram showing an example of an I / O latency threshold update process according to the present embodiment. [Figure 14] 4 is a table showing candidates for application KPIs in the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, embodiments of the present specification will be described with reference to the accompanying drawings. In the accompanying drawings, functionally identical elements may be designated by the same numerals. Note that the accompanying drawings show specific embodiments in accordance with the principles of the present invention, but these are for understanding the present invention and are not to be used to interpret the present invention in a limiting manner.

[0012] Although the embodiments of the present specification are described in sufficient detail to enable those skilled in the art to practice the present invention, it should be understood that other implementations and forms are possible, and that changes in configuration and structure and substitutions of various elements are possible without departing from the scope and spirit of the technical concept of the present invention. Therefore, the following description should not be interpreted as being limited thereto.

[0013] Furthermore, an embodiment of this specification may be implemented in software running on a general-purpose computer, in specialized hardware, or in a combination of software and hardware, as described below.

[0014] When describing each process in the examples of this specification using "each processing unit as a program" as the subject (acting entity), the program is executed by a processor (CPU, etc.) to perform the specified process using memory and a communication port (communication control device), so the description may also use the processor as the subject.

[0015] In this embodiment, a system in which an application accesses a disk is described. This embodiment describes a technology for detecting disk abnormalities that cause application abnormalities from disk I / O latency with low load and in real time, and also describes a technology for automatically adjusting the threshold used for disk abnormality detection. According to one embodiment of this specification, it is possible to detect disk abnormalities in a prompt manner even in an environment in which disk performance changes.

[0016] In one embodiment of this specification, a disk abnormality is determined when the Key Performance Indicator (KPI) of an application related to disk I / O deteriorates below a predetermined threshold and the latency of the disk I / O also deteriorates compared to past history.

[0017] FIG. 1 is a block diagram showing an example of the logical configuration of a disk abnormality detection system according to this embodiment. A metrics collection unit 1B101 acquires I / O latency. An application KPI collection unit 1B102 collects application KPIs (Key Performance Indicators). The collected application KPIs are managed in an application KPI history 1B106. An application KPI table 1B104 manages one or more combinations of application KPI types and thresholds referenced in determining disk abnormalities. An application abnormality detection unit 1B108 detects application abnormalities based on the application KPIs managed in the application KPI history 1B106 and the application KPI table 1B104.

[0018] The collected I / O latency is managed in I / O latency history 1B105. Disk abnormality detection unit 1B109 detects a disk abnormality based on the I / O latency managed in I / O latency history 1B105.

[0019] The threshold adjustment unit 1B110 adjusts the I / O latency threshold based on the detection results of the disk abnormality detection unit 1B109, the detection results of the application abnormality detection unit 1B108, and the I / O latency history 1B105. Using these functional units, the abnormality detection unit 1B103 detects disk abnormalities that cause application abnormalities. The detection results are output by the abnormality detection output unit 1B107. The abnormality detection output unit 1B107 outputs the detection results to a monitoring log or a user terminal, for example, as an alert. The detection results may be stored in a log file or database, or output to a dashboard or visualization tool.

[0020] FIG. 2 shows an example of a hardware configuration when this embodiment is implemented. This configuration example includes an anomaly detection device 1H200 and a user terminal 1H300, which communicate with each other via a network. The anomaly detection device 1H200 is, for example, a cloud-based device, and may also be running an application program that provides application KPIs referenced for disk anomaly detection. The application program may be running on another computer.

[0021] The anomaly detection device 1H200 includes a CPU (Central Processing Unit) 1H201, a disk 1H202, a clock 1H203, and a memory 1H204. The CPU 1H201 reads a program stored in the memory 1H204 and controls the disk 1H202 and the clock 1H203, thereby realizing various functions. At least a part of the functional units may be configured with logic circuits.

[0022] Disk 1H202 includes one or more physical storage drives, and typically uses an HDD (Hard Disk Drive) or SSD (Solid State Drive). Disk 1H202 may be the target of anomaly detection, or a different disk may be the target of anomaly detection. Memory 1H204 stores programs and tables for anomaly detection unit 1B103, application KPI table 1B104, I / O latency history 1B105, application KPI history 1B106, metrics collection unit 1B101, and application KPI collection unit 1B102 shown in FIG. 1.

[0023] The communication interface 1H205 is an interface for communicating with other devices. The anomaly detection device 1H200 can communicate with the user terminal 1H300 and other devices via the communication interface 1H205. The anomaly detection device 1H200 may also include input / output devices in addition to the above.

[0024] The user terminal 1H300 includes a CPU 1H301 that executes various programs, a memory (main storage device) 1H302 that stores the various programs, and an auxiliary storage device 1H303 that stores various data. The CPU 1H301 can include one or more cores, and the memory 1H302 is, for example, a DRAM that includes a volatile storage area. The auxiliary storage device 1H303 is, for example, an HDD or SSD, and can provide a non-volatile storage area.

[0025] The user terminal 1H300 includes an output device 1H304 for presenting information to the user, an input device 1H305 for inputting instructions, images, etc. from the user, and a network interface 1H306 for communicating with other devices. These are interconnected by a bus.

[0026] The output device 1H304 is composed of devices such as a display, printer, and speaker. The input device 1H305 is composed of devices such as a keyboard, mouse, and microphone. The output device 1H304 presents input results from the user and also presents notifications from the anomaly detection device 1H200. The network interface 1H306 is an interface for performing data communication with other devices connected via a network.

[0027] An outline of the abnormality detection process performed by the abnormality detection unit 1B103 shown in Fig. 1 will be described using Fig. 3. For example, the abnormality detection unit 1B103 starts the processing flow shown in Fig. 3 every time a predetermined number of new records, for example, 100 records, are accumulated in the I / O latency history 1B105 shown in Fig. 1.

[0028] First, the abnormality detection unit 1B103 starts application abnormality detection processing 1F301. The application abnormality detection processing 1F301 will be described later with reference to Fig. 4. Next, the abnormality detection unit 1B103 starts disk abnormality detection processing 1F302. The disk abnormality detection processing 1F302 will be described later with reference to Fig. 5.

[0029] Next, the anomaly detection unit 1B103 executes branching processing 1F303. Branching processing 1F303 determines whether to end the anomaly detection processing or proceed to branching processing 1F304 according to the result of application anomaly detection processing 1F301. Specifically, if no application anomaly is detected (1F303: NO), the flow ends. If an application anomaly is detected (1F303: YES), the flow proceeds to branching processing 1F304.

[0030] Branching processing 1F304 determines whether to proceed to 1F305, which outputs a disk abnormality, or to end the abnormality detection processing, depending on the result of disk abnormality detection processing 1F302. Specifically, if a disk I / O abnormality is not detected (1F304: NO), the flow ends. If a disk I / O abnormality is detected (1F304: YES), the abnormality detection unit 1B103 outputs a result indicating that a disk abnormality has been detected to a log or the user terminal 1H300.

[0031] The application abnormality detection processing 1F301 shown in Fig. 3 will be described using Fig. 4. First, the application abnormality detection processing 1F301 takes the application KPI managed in the application KPI history 1B106 as an input value. The application KPI can be managed in the format of an application KPI sampling value table 1D701 shown in Fig. 6, which will be described later. Next, in processing 1F401, an application KPI threshold value table 1D801 shown in Fig. 7, which will be described later, is called, and in the subsequent branch processing 1F402, a comparison is made between the threshold value and the application KPI.

[0032] Figures 6 and 7 show the time taken for a control loop as an example of an application KPI. A control loop is, for example, the control of an actuator based on information from a sensor, which is executed periodically. An application program periodically obtains information from a specific sensor and operates the actuator based on that information. For example, one control loop extends from obtaining sensor information to completing the operation of the actuator and its associated processing. The application program accesses a disk to obtain and / or store the necessary information for operating the actuator.

[0033] For example, to determine whether an application KPI is larger than a threshold, first, it is confirmed that application KPI 1D703 shown in Fig. 6 and application KPI 1D802 shown in Fig. 7 are the same application KPI. Next, the size determination is performed, for example, by referencing acquisition time 1D702 in Fig. 6 and comparing the latest value of sampling value 1D704 with application KPI threshold 1D803 in Fig. 7. Note that a statistical value calculated from multiple application KPIs, for example, the average of a specified number of recent values ​​(latest moving average), may also be used.

[0034] If the application KPI is equal to or better than the threshold, or if the application KPI is equal to or less than the threshold in the examples shown in FIGS. 6 and 7 (1F402: NO), it is determined that no application abnormality has occurred. Therefore, the application abnormality detection process 1F301 ends. If the application KPI has deteriorated below the threshold, or if the application KPI is greater than the threshold in the examples shown in FIGS. 6 and 7 (1F402: YES), the application abnormality detection process 1F301 proceeds to an abnormality detection result table update process 1F403. The abnormality detection result table update process 1F403 updates the application abnormality detection result 2D202 in FIG. 12, which will be described later. Thereafter, the application abnormality detection process 1F301 ends.

[0035] The disk abnormality detection process 1F302 shown in FIG. 3 will be described using FIG. 5. First, the disk abnormality detection process 1F302 takes the I / O latency managed in the I / O latency history 1B105 as an input value. The I / O latency can be managed in the format of an I / O latency sampled value table 2D001 in FIG. 8, which will be described later. Specifically, the input value is a predetermined number of consecutive records from the most recent record in the I / O latency history 1B105. The number of records may be the same as, less than, or more than the number of records newly added since the previous process. The abnormality detection process shown in FIG. 3 may be executed periodically, for example.

[0036] Next, I / O latency statistical processing 1F501 performs statistical processing on the I / O latency history. For example, as statistical processing, a 95% confidence interval for the I / O latency distribution is calculated, and the upper limit (statistical value) of the 95% confidence interval is set as the I / O latency performance value. Note that a statistical value other than the upper limit of the 95% confidence interval, such as an upper limit of 3σ or 2σ, may also be used. These upper limits enable faster and more appropriate detection of disk abnormalities. In addition, statistical values ​​such as the average value or median value may also be used, or the most recent I / O latency value may also be used. The statistical value allows a performance value for accurate judgment to be obtained from a single sample value.

[0037] The next branching process 1F502 determines whether the performance value is greater than or equal to an I / O latency threshold 2D101 in FIG. 9 (described later). If the performance value is the same as or better than the threshold, i.e., if the performance value is equal to or less than the threshold in the examples of FIGS. 8 and 9 (1F502: NO), disk abnormality detection process 1F302 ends. If the performance value is worse than the threshold, i.e., if the performance value is greater than the threshold in the examples of FIGS. 8 and 9 (1F502: YES), an abnormality detection result table update process 1F503 updates the disk abnormality detection result 2D203 in the abnormality detection result table 2D201 in FIG. 10 (described later). Then, disk abnormality detection process 1F302 ends.

[0038] The application KPIs used in the application abnormality detection process 1F301 shown in Fig. 4 will be described with reference to Fig. 6. The application KPIs are collected by the application KPI collection unit 1B102 in Fig. 1 and managed in the application KPI history 1B106, for example, in the application KPI sampling value table 1D701 shown in Fig. 6.

[0039] The application KPI sampled value table 1D701 is a data set including an application KPI acquisition time 1D702, an application KPI 1D703, and a sampled application KPI value 1D704. The application KPI 1D703 and the sampled value 1D704 are used in branching processing 1F402 in FIG. 4 to compare with the application KPI threshold value described later in FIG. 7.

[0040] The application KPI thresholds used in the application anomaly detection process 1F402 shown in Fig. 4 will be described using Fig. 7. The application KPI thresholds (second thresholds) are managed in the application KPI table 1B104 in Fig. 1, and are managed, for example, in the application KPI threshold table 1D801 shown in Fig. 7. The application KPI threshold table 1D801 can be expressed as a data set including an application KPI 1D802 and its threshold 1D803.

[0041] Application KPI1D802 and application KPI1D803 are used to compare with the sampled application KPI in branching process 1F402 in Fig. 4. For example, the application KPI is the time required for a control loop that periodically controls a specific control target, and its threshold is set in advance to 2.0 [sec]. In this case, if the time required for the control loop obtained by sampling is greater than 2.0 [sec], branching process 1F303 in Fig. 3 detects that an abnormality has occurred in the operation of the application.

[0042] 8, the I / O latency sampled value table 2D001, which is sampled by the metrics collection unit 1B101 in Fig. 1 and managed by the I / O latency history 1B105, will be described. For example, the I / O latency sampled value table 2D001 consists of a data set including the time 2D002 when the I / O latency was acquired and the I / O latency value 2D003.

[0043] In I / O latency statistical processing 1F501 in Fig. 5, acquisition time 2D002 is referenced and an I / O latency performance value (statistical value) is calculated by statistical processing for the latest 1000 I / O latencies 2D003. In branch processing 1F502 in Fig. 5, this performance value is used for comparison with an I / O latency threshold (first threshold) by reference to an I / O latency threshold 2D101 shown in Fig. 9, which will be described later. Here, the I / O latency history used in statistical processing is the latest 1000, but this could be 10000 or later, or just 100.

[0044] The I / O latency threshold 2D101 will be explained using Figure 9. For example, the I / O latency threshold is set to 12.0 [sec]. For example, when the performance value calculated by the I / O latency statistical processing shown in Figure 5 is 14.0 [sec], the branch processing 1F502 shown in Figure 5 detects a disk abnormality.

[0045] The abnormality detection result table 2D201 will be described using Figure 10. For example, the abnormality detection result table 2D201 is a set including a field 2D202 indicating the detection result of an application abnormality and a field 2D203 indicating the detection result of a disk abnormality. When an application KPI exceeds a threshold, the application abnormality detection result 2D202 is rewritten to a value indicating an abnormality by the update process 1F403 of the abnormality detection result table shown in Figure 4. When the I / O latency performance value exceeds a threshold, the disk abnormality detection result 2D203 is rewritten to a value indicating an abnormality by the update process 1F503 of the abnormality detection result table shown in Figure 5.

[0046] For example, when the value representing an abnormality is 1, in process 1F305 for outputting a disk abnormality shown in Fig. 3, if the logical product of the application abnormality detection result 2D202 and the disk abnormality detection result 2D203 in the table is 1, it outputs that a disk abnormality causing an application abnormality has been detected. The application abnormality detection result and disk abnormality detection result are set to 0 for normal and 1 for abnormal, but these may be set as a combination of different numbers, and the detection method is not limited to logical product.

[0047] As described above, according to this embodiment, application abnormality detection based on threshold judgment using application KPIs and abnormality detection based on I / O latency thresholds makes it possible to detect disk-related abnormalities with low load.

[0048] An overview of the abnormality detection process performed by the abnormality detection unit 1B103 including the threshold adjustment unit 1B110 shown in Fig. 1 will be described using Fig. 11. In the abnormality detection process described in Fig. 3, if no abnormality is detected in the branching process 1F303 due to an application abnormality and if no abnormality is detected in the branching process 1F304 due to a disk I / O abnormality, a disk I / O threshold update process 2F301, which will be described later in Fig. 14, is performed.

[0049] The disk I / O threshold update processing 2F301 shown in Fig. 11 will be described using Fig. 12. For example, in the I / O latency statistical processing 2F401, a 95% confidence interval is calculated from the distribution of the I / O latencies of the latest 1000 cases in the disk I / O history, and the upper limit (statistical value) is used as the disk I / O performance value. The calculation of this performance value may be the same as or different from the calculation of the performance value in disk abnormality detection.

[0050] Next, branching process 2F403 checks whether the I / O latency threshold 2D101 shown in Figure 9 is set to a threshold (third threshold) that is a set percentage higher than the performance value. This is performed to prevent disk abnormality detection from failing to function if the I / O latency threshold 2D101 exceeds the third threshold, for example, 30%, relative to the performance value. This percentage represents the difference between the two values, and the specified threshold is set appropriately by design and may be a difference rather than a percentage.

[0051] If the I / O latency threshold 2D101 is set to be 30% greater than the performance value (2F403: YES), the flow proceeds to threshold table update processing 2F407. Otherwise (2F403: NO), the flow proceeds to branch processing 2F405.

[0052] Branching process 2F405 branches the process according to the disk abnormality detection result 2D203 shown in Fig. 10. If the disk abnormality detection result 2D203 is a value indicating normality (2F405: NO), the disk I / O threshold update process 2F301 ends. If the disk abnormality detection result 2D203 is a value indicating abnormality (2F405: YES), the flow proceeds to branching process 2F406.

[0053] Branching process 2F406 branches the process depending on the value of application abnormality detection result 2D202 shown in Fig. 10. If the application abnormality detection result 2D202 is a value indicating an abnormality (2F406: YES), the disk I / O threshold update process ends. If the application abnormality detection process 2D202 is a value indicating normality (2F406: NO), the process proceeds to threshold update process 2F407.

[0054] 9 to the performance value calculated in the I / O latency statistical processing 2F401. Specifically, if the I / O latency threshold is set to a value greater than the calculated performance value (2F403: YES), the threshold value is updated to the performance value calculated in the I / O latency statistical processing 2F401.

[0055] On the other hand, if the I / O latency threshold is not too high (2F403: NO), the disk detection result is abnormal (2F405: YES), and the application detection result is normal (2F406: NO), the threshold is relaxed. In other words, the threshold is updated to a value greater than the current value. An abnormal disk detection result means that the calculated performance value is greater than the threshold. On the other hand, since the application detection result is normal, there is no disk abnormality that should be detected. Relaxing the threshold makes it possible to more appropriately detect I / O latency abnormalities that cause application abnormalities.

[0056] FIG. 13A and 13B are diagrams explaining the relationship between the performance value of I / O latency calculated in the I / O latency statistical process 2F401 of FIG. 12 and the threshold of disk I / O. For example, let the disk I / O threshold T_th obtained by referring to the I / O latency threshold 2D101 of FIG. 9. Let the upper limit T_sample of the 95% confidence interval calculated in the I / O latency statistical process 2F401 of FIG. 12.

[0057] FIG. 13A shows the case where T_sample > T_th (2F405: YES). At this time, if the abnormal detection result of the application is normal (2F406: NO), T_th is replaced by T_sample by the threshold table update process 2F407 of FIG. 14. On the other hand, FIG. 13B shows the case where T_sample < T_th. In this case, if T_th does not exceed the set ratio threshold (third threshold), for example, 30%, with respect to T_sample, the update of the I / O latency threshold 2D101 is not performed, and the disk I / O threshold update process 2F301 ends.

[0058] As described above, it is possible to automatically adjust the threshold of I / O latency by using the application abnormal detection result using the application KPI and, for example, the statistical information of I / O latency. Note that the adjustment of the I / O latency threshold may be updated to a value different from the performance value. For example, it may be increased or decreased by a preset value or a ratio of the current value. The adjustment of the I / O latency threshold may be performed only by increasing or decreasing by the above method and may be returned to the initial value after a predetermined time has elapsed. The automatic adjustment may not be implemented.

[0059] FIG. 14 shows, for example, candidates 2D601 for application KPIs used in the application abnormal detection process 1F402. The user can specify one or more KPIs from the candidates 2D601 for application KPIs.

[0060] The application KPI candidates 2D601 are managed in the application KPI table 1B104 as a data set of the application KPI candidates 2D602 and the thresholds 2D603 for the respective candidates.

[0061] For example, the control loop time, which is one of the application KPI candidates 2D602, is the time it takes for one loop of the control process of a control action that is repeatedly executed to perform I / O to a disk. Also, for example, the number of timeout retries is the number of timeout retries of a processing process after performing disk I / O processing. This is a candidate for an application KPI related to disk I / O, because if a delay occurs in disk I / O, the number of timeout retries of the subsequent processing increases.

[0062] The frequency with which an application that is a candidate for an application KPI returns an error is, for example, the frequency with which an application program returns an error when performing I / O processing to a disk over a certain period of time. For example, if the process involves saving daily logs to a disk, the frequency can be set to two or more errors per week.

[0063] The number of failures in synchronization wait processing for an application KPI candidate is the number of failures in synchronization wait processing in the master-slave system, when considering a process in which the same processing is performed in the master and slave systems, I / O processing is performed on disks owned by each system, and then waiting processing is performed in the master-slave system.

[0064] The application KPI to be used can be selected in the application KPI threshold call process 1F401 shown in Fig. 4. Also, multiple application KPIs may be used instead of a single application KPI. When multiple application KPIs are used, this can be achieved by looping the application anomaly detection process in Fig. 4 as many times as the number of application KPIs to be used. Alternatively, the anomaly detection result table 2D201 may be updated when all application KPIs have deteriorated below their thresholds.

[0065] Even if a KPI is not listed in the application KPI candidate 2D601 for disk abnormality detection processing, it can be applied to disk abnormality detection in this patent if a KPI that correlates with disk I / O latency is used.

[0066] As described above, according to this embodiment, by setting an application KPI that associates the processing performed by an application with disk I / O, it is possible to detect disk abnormalities that cause the operation of an application to become unstable.

[0067] The present invention is not limited to the above-described embodiments and includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0068] Furthermore, the above-mentioned components, functions, processing units, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. Furthermore, the above-mentioned components, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the programs, tables, and files that realize each function can be stored in memory, a storage device such as a hard disk or SSD, or a storage medium such as an IC card or SD card.

[0069] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and do not necessarily show all the control lines and information lines in the product. In reality, it can be assumed that almost all components are interconnected. [Explanation of symbols]

[0070] 1B103...Anomaly detection unit, 1B104...Metrics collection unit, 1B102...Application KPI collection unit, 1B104...Application KPI table, 2F301...Disk I / O threshold update processing

Claims

1. A system for detecting an abnormality in a disk device, comprising: a processor; a storage device, The storage device includes: I / O latency history information including a history of I / O latency of the disk device; KPI history information including a history of KPIs of application programs that access the disk device; The processor: Determine whether or not there is an abnormality in the application based on the KPI history information; determining whether or not an I / O latency abnormality exists based on the I / O latency history information; When it is determined that the application abnormality and the I / O latency abnormality exist, the system determines that a disk abnormality has occurred.

2. 10. The system of claim 1, The processor: Calculating a first statistical value of a plurality of records indicated by the I / O latency history information; The system determines whether or not the I / O latency abnormality exists based on a comparison result between the first statistical value and a first threshold value.

3. 10. The system of claim 1, The processor determines whether or not the application has an abnormality based on a comparison result between the latest KPI value indicated by the KPI history information and a second threshold value.

4. 3. The system of claim 2, The processor adjusts the first threshold based on the first threshold and the I / O latency history information.

5. 3. The system of claim 2, The processor reduces the first threshold when the first threshold is greater than a second statistical value of multiple records indicated by the I / O latency history information and a value representing the difference between the first threshold and the second statistical value exceeds a third threshold.

6. 3. The system of claim 2, The processor increases the first threshold when it determines that the I / O latency abnormality exists and the application abnormality does not exist.

7. 3. The system of claim 2, The processor: When the first threshold is greater than a second statistical value of a plurality of records indicated by the I / O latency history information and a value representing a difference between the first threshold and the second statistical value exceeds a third threshold, the first threshold is decreased; When it is determined that the I / O latency abnormality exists and the application abnormality does not exist, the system increases the first threshold.

8. 10. The system of claim 1, The KPI includes at least one of a control loop processing time, a timeout retry count, and a synchronization wait processing failure count.

9. A method for a system to detect an abnormality in a disk device, comprising: The system comprises: I / O latency history information including a history of I / O latency of the disk device; KPI history information including a history of KPIs of application programs that access the disk device; The method further comprises the steps of: Determine whether or not there is an abnormality in the application based on the KPI history information; determining whether or not an I / O latency abnormality exists based on the I / O latency history information; determining that a disk abnormality has occurred when the application abnormality and the I / O latency abnormality exist.

Images