Registration device, registration method, and program

Abstract

A registration device according to an embodiment comprises an acquisition unit, a generation unit, a temporary registration unit, a calculation unit, a determination unit, and a registration unit. The acquisition unit acquires log data of failures related to a failure device presumed to be having a failure and to a peripheral device installed around the failure device. The generation unit generates, from the log data, groups each including similar event logs generated at or above a certain frequency. When an event log present in one of the groups that includes an event log associated with teacher data for eliminating a failure is associated with operation data related to the operation of a certain device, the temporary registration unit registers this operation data as temporary teacher data. The calculation unit calculates a reliability for each measure against device failure on the basis of whether or not there is the temporary teacher data related to the failure device or the peripheral device. The determination unit determines whether or not the reliability is equal to or greater than a threshold value. The registration unit registers, as teacher data, the temporary teacher data for which the reliability is equal to or greater than the threshold value.

Description

[Technical field]

[0001] The embodiments relate to a registration device, a registration method, and a program. [Background technology]

[0002] There is a technology that extracts a unique combination of failure events for each failure case from a database in which network failure cases are registered, so that there is no duplication with already registered failure cases, and automatically creates and modifies rules that can determine the cause of the failure as a characteristic failure event.

[0003] In a network that is already in operation, in order to generate this rule, it is necessary to register fault information from past fault history information. The fault history information includes, for example, the location of the fault, the cause of the fault, and a method of dealing with the fault. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Publication No. 2018-028778 Summary of the Invention [Problem to be solved by the invention]

[0005] However, in order to create rules for inferring a fault, a person must manually register information about the faulty device after the fault has been dealt with. This requires human labor and creates problems such as delays and omissions in registration.

[0006] The embodiments provide a registration device, a registration method, and a program for reliably and easily registering information for creating rules for inferring a fault. [Means for solving the problem]

[0007] The registration device of the embodiment includes an acquisition unit, a generation unit, a provisional registration unit, a calculation unit, a determination unit, and a registration unit. The acquisition unit acquires log data on a fault related to a faulty device estimated to have a fault and a peripheral device installed around the faulty device. The generation unit generates one or more groups including similar event logs generated at a certain frequency or more from the log data. The provisional registration unit registers the operation data as provisional teacher data when one or more event logs in a group including an event log corresponding to teacher data for eliminating the fault correspond to operation data related to the operation of a certain device. The calculation unit calculates a certainty factor for each response to the fault of the device based on whether there is provisional teacher data related to the faulty device or the peripheral device. The determination unit determines whether the certainty factor is equal to or greater than a threshold value. The registration unit registers the provisional teacher data having a certainty factor equal to or greater than a threshold value as teacher data. Effect of the Invention

[0008] The embodiment can reliably and easily register information for creating rules for inferring a fault. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating a hardware configuration of a fault information registration device according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating functions of the fault information registration device according to the embodiment. [Diagram 3] FIG. 3 is a diagram showing the contents of the teacher data and the operational data acquired by the log data acquisition unit in FIG. [Figure 4] FIG. 4 is a flowchart showing registration of provisional teacher data, which is an example of the operation of the fault information registration device according to the embodiment. [Diagram 5] FIG. 5 is a diagram showing the contents of the teacher data and the operational data, each of which includes a log of the result of clustering performed by the group generating unit in FIG. [Figure 6]FIG. 6 is a diagram showing the degree of agreement for each action name of the operation data corresponding to the teacher data for each failed device and peripheral device. [Figure 7] FIG. 7 is a flowchart showing registration of teacher data, which is an example of the operation of the fault information registration device according to the embodiment. [Figure 8] FIG. 8 is a diagram showing the contents of the teacher data registered in the teacher DB of FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment will be described with reference to the drawings.

[0011] (Hardware configuration) An example of a hardware configuration of a fault information registration device (also simply referred to as a registration device) of this embodiment will be described with reference to FIG. The fault information registration device 100 of this embodiment includes a processor 101, a ROM 102, a RAM 103, an interface 104, a display 105, and a storage 106.

[0012] The processor 101 is a processing device that controls the entire fault information registration device 100. The processor 101 is, for example, a CPU (Central Processing Unit). The processor 101 is not limited to a CPU. An ASIC (Application Specific IC) or the like may be used instead of the CPU. The number of processors 101 may be two or more.

[0013] The ROM 102 is a read-only storage device that stores firmware and various programs required for the operation of the fault information registration device 100.

[0014] The RAM 103 is a storage device that can be written to at will. The RAM 103 is used as a working area for the processor 101, and temporarily stores firmware and the like stored in the ROM 102.

[0015] The interface 104 is a device for exchanging information with an external device. The interface 104 accepts, for example, operational data, teacher data, and input from a user. The interface 104 may also transmit and receive information to and from an external server, etc.

[0016] The display 105 is a display device that displays various screens. The display 105 may be a liquid crystal display, an organic EL display, etc. The display 105 may also include a touch panel.

[0017] The storage 106 is a storage device such as a hard disk, etc. The storage 106 stores, for example, various applications executed by the processor 101, data that is input to the applications, and data obtained by executing the applications.

[0018] (Functional configuration) Next, an example of the function of the fault information registration device 100 of this embodiment will be described with reference to FIG. The fault information registration device 100 of this embodiment includes, as functional blocks, an operation data acquisition unit 201, a fault information receiving unit 202, a teacher DB (hereinafter, database will be abbreviated to DB) 203, a log data acquisition unit 204, a group generation unit 205, a temporary teacher data registration unit 206, a confidence factor calculation unit 207, a confidence factor determination unit 208, and a teacher data registration unit 209.

[0019] Furthermore, the operation data acquisition unit 201 and the fault information reception unit 202 are realized, for example, by the interface 104. The log data acquisition unit 204, the group generation unit 205, the provisional teacher data registration unit 206, the confidence factor calculation unit 207, the confidence factor determination unit 208, and the teacher data registration unit 209 are realized, for example, by the processor 101, the ROM 102, the RAM 103, and the storage 106. The teacher DB 203 is realized, for example, by the storage 106. At least one of the fault information reception unit 202 and the teacher data registration unit 209 may be realized, for example, by the interface 104 and the display 105.

[0020] The operation data acquisition unit 201 acquires operation data from an external DB or the like via a network or directly connected. The operation data includes information related to the operation of one or more devices. The operation data includes at least one of information related to a failure of one or more devices, information related to how to deal with the failure, and information related to recovery from the failure. Upon receiving the acquired operation data, the operation data acquisition unit 201 outputs the operation data to the log data acquisition unit 204 in sequence. In addition, the operation data acquisition unit 201 may output the operation data to the log data acquisition unit 204 in sequence once a predetermined amount of operation data has been stored in a buffer (for example, within the operation data acquisition unit 201). The operation data will be described later with reference to FIG. 3.

[0021] The fault information receiving unit 202 receives fault information regarding a network fault determined by a user or a device acting on behalf of the user. For example, the user or the device acting on behalf of the user investigates operation data to estimate fault information. The fault information includes information indicating the estimated fault (for example, information including the fault name), information indicating the location where the fault is estimated to have occurred, information indicating that a certain measure has been taken against the fault, information indicating whether the measure has resulted in recovery or not, and the like. The information indicating the location where the failure is estimated to have occurred includes information about the failed device that the user estimates to have a failure, and information about peripheral devices installed around the failed device. A peripheral device is not defined by its physical distance from the failed device, but is defined as a node closer to the failed device on a network connection. Therefore, a peripheral device is a device that is more susceptible to the effects of a failure in the failed device than other devices. This fault information may not be accurate because it is estimated by the user or a device acting on behalf of the user. However, the fault information registration device 100 of this embodiment can register highly accurate teacher data by a process described below even if inaccurate fault information is input. As a result, the fault information registration device 100 can accurately estimate the fault in the network, the fault location (also called the fault position), and the device that has been dealt with and recovered. The fault location indicates a location on the network, and is specified by at least one of a host name or an IP address, for example.

[0022] The teacher DB 203 stores teacher data acquired in advance and teacher data newly registered by the teacher data registration unit 209. The teacher data acquired in advance is acquired, for example, from an external DB or the like via a network or by direct connection. The teacher data includes information for creating rules for estimating a fault location. The teacher data includes at least one of information on one or more faults, information on how to deal with the faults, and information on how to recover from the faults. The teacher data will be described later with reference to FIG. 3.

[0023] The log data acquisition unit 204 acquires log data relating to the faulty device and peripheral devices based on the fault information accepted by the fault information acceptance unit 202 from log data consisting of the operation data acquired by the operation data acquisition unit 201 and the teacher data stored in the teacher DB 203. That is, the log data acquisition unit 204 acquires log data relating to the faulty device and peripheral devices estimated by the user.

[0024] The group generation unit 205 extracts event logs from the log data acquired by the log data acquisition unit 204, and executes clustering processing on these multiple event logs. The event log is a log extracted from all the log data of the operation data and the teacher data, for example, Syslog. There are four examples of event logs, as shown in the boxed area of ​​FIG. 3. Note that the rows of "Teacher A" and "Teacher B" in FIG. 3 indicate a portion of the data included in the teacher data, and the rows of "Operation A" and "Operation B" in FIG. 3 indicate a portion of the data included in the operation data. The event log is included in either the teacher data or the operation data.

[0025] The group generation unit 205 groups similar event logs based on the occurrence frequency of event logs generated by the faulty device and peripheral devices. The group generation unit 205 generally generates a plurality of groups in which similar event logs are grouped together. The clustering process groups event logs (or events) that are similar in terms of the occurrence frequency or order of the event logs from the event logs generated by each device (also called a node). The method of executing the clustering process includes, for example, LogCluster and Drain, but is not particularly limited.

[0026] The provisional teacher data registration unit 206 extracts a group including an event log included in the teacher data from the groups generated by the group generation unit 205. The provisional teacher data registration unit 206 then determines whether the extracted group includes other event logs, and if other event logs are included, determines whether the event logs are included in the operational data and are different from the event logs included in the teacher data. An event log that is different from the event log included in the teacher data and is included in the operational data is adopted as a new event log.

[0027] Furthermore, when the temporary teacher data registration unit 206 determines that the extracted group contains another event log, and that this event log is included in the operation data, and that these event logs are different, it registers data obtained by merging this operation data with the teacher data including the event log included in this group as temporary teacher data. This merged data is, for example, the teacher data included in this group overwritten with only the items for which data exists in this operation data. An example of temporary teacher data will be described later with reference to FIG. 5.

[0028] The temporary teacher data registration unit 206 repeatedly extracts groups including event logs included in the teacher data for each group generated by the group generation unit 205, and repeats the above process to register all the temporary teacher data. This temporary teacher data is temporarily stored in an arbitrary storage device. The temporary teacher data is stored, for example, in a buffer provided in the temporary teacher data registration unit 206.

[0029] The certainty calculation unit 207 first collects provisional teacher data for each of the faulty devices and the peripheral devices. For each device that is one of the faulty devices or the peripheral devices, the certainty calculation unit 207 determines whether there is provisional teacher data related to this device. Specifically, for example, the certainty calculation unit 207 determines that the device indicated by the device information included in the provisional teacher data is related to this provisional teacher data. The provisional teacher data includes operation data including device information, and therefore includes device information (see, for example, FIG. 3 and FIG. 5). Then, when the information indicated in the countermeasure content (item "countermeasure content" shown in FIG. 3 or FIG. 5) included in the provisional teacher data indicates countermeasure -*- ("(countermeasure)" shown in FIG. 3 or FIG. 5), the certainty calculation unit 207 determines whether the countermeasure was taken for each countermeasure, and if the countermeasure was taken, whether the recovery was achieved by this countermeasure. This countermeasure includes whether the countermeasure was taken and whether the recovery was achieved by this countermeasure for each countermeasure content specified by the countermeasure name.

[0030] The confidence level calculation unit 207 calculates the confidence level for each countermeasure based on the countermeasure taken on a certain device and whether or not the countermeasure has led to recovery. The confidence level is an index corresponding to the probability that a certain countermeasure will lead to recovery of a failed device, with respect to the countermeasure taken on a failed device. An example of the confidence level will be described later with reference to FIG. 6.

[0031] The certainty factor calculation unit 207 calculates the certainty factor for each measure taken against a failure of an apparatus using all the provisional teaching data registered by the provisional teaching data registration unit 206. As a result, the certainty factor calculation unit 207 can calculate the certainty factor for each measure taken against a failed apparatus and peripheral apparatus and obtain the calculation results.

[0032] The certainty determination unit 208 determines whether each certainty calculated by the certainty calculation unit 207 is equal to or greater than a threshold. This threshold may be set in advance by a user, or may be set depending on an algorithm used in the clustering process of the group generation unit 205, a method of calculating the certainty performed by the certainty calculation unit 207, or the like. The threshold may also be adaptively determined according to the accuracy of the teacher data registered in the teacher DB 203. For example, if the certainty determination unit 208 determines that the accuracy of the teacher data tends to decrease, the threshold is increased. Furthermore, the threshold may be determined by referring to the number of teacher data registered in the teacher data registration unit 209. For example, if the certainty determination unit 208 determines that the number of registered teacher data tends to decrease, this tendency may be set as one of the factors for lowering the threshold.

[0033] The teacher data registration unit 209 receives the determination result from the certainty determination unit 208, and registers the provisional teacher data corresponding to the countermeasure content whose certainty is determined to be equal to or greater than a threshold value in the teacher DB 203 as (true) teacher data.

[0034] At least one of the fault information receiving unit 202 and the teacher data registration unit 209 may, for example, display the received fault information or display the teacher data to be registered. Based on these displays, the user or a device acting on behalf of the user can monitor the fault information registration device 100, and it is expected that the monitoring will improve the registration accuracy. At least one of the fault information receiving unit 202 and the teacher data registration unit 209 may present information to the user or a device acting on behalf of the user by voice rather than displaying it as a presentation unit. At least one of the fault information receiving unit 202 and the teacher data registration unit 209 may transmit information by other means, not limited to display or voice, as long as the information is transmitted to the user or a device acting on behalf of the user.

[0035] By performing clustering processing on the event log, the fault information registration device 100 can prepare teacher data to be stored in the teacher DB 203. As a result of this preparation, the fault information registration device 100 can register information for creating rules for estimating a fault location with high accuracy.

[0036] (Teaching data and operational data, clustering) An example of the teacher data and the operational data will be described with reference to FIG. The teacher data includes an event log, a countermeasure, and a regular expression corresponding to the countermeasure. The countermeasure includes at least one of information about the failure, information about the countermeasure for the failure, and information about the recovery from the failure. The row of Teacher A shown in FIG. 3 indicates teacher data, and indicates that this teacher data includes an event log of "restart port:03", a countermeasure indicating that the countermeasure is "card restart (countermeasure)", and a regular expression of the countermeasure "restart port:ID<>". Similarly, the teacher data shown in the row of Teacher B shown in FIG. 3 indicates that it includes an event log of "restart-OK", a countermeasure indicating that the recovery is "card restart (recovery)", and a regular expression of the countermeasure "restart-OK".

[0037] "restart port:ID<>" indicates that the problem will be dealt with by restarting the port with ID. ID is a variable, and corresponds to a specific ID number (e.g., a natural number) in the operational data. "restart-OK" indicates that the device has been restarted (recovered) by the corresponding solution.

[0038] The operation data includes an event log and a device IP as shown in FIG. 3. Although not shown in FIG. 3, the operation data includes at least one of information about a failure of a certain device or information about the contents of the failure. The information about the failure of a certain device includes, for example, the date and time when the failure occurred, the location of the failure (device IP such as host name or IP address), and the urgency of the failure (Emerg, Alert, Notice, Info, etc.). The information about the contents of the failure includes, for example, at least one of information about dealing with the failure or information about recovering from the failure. In the following, the operation data will be focused on the device IP indicating the location of the failure, which is mainly used in this embodiment, and the event log including information about dealing with or recovering from the failure. Therefore, in this embodiment, the operation data will be described as including at least one of these pieces of information of interest. Note that the operation data includes the above-mentioned information in addition to the information of interest, even if not specified.

[0039] "Operation A" shown in Fig. 3 indicates operation data, and includes information indicating that a failure has occurred at device IP XX, and information on how to deal with the failure, "restart port: 12". "Operation B" shown in Fig. 3 indicates operation data, and includes information indicating that a failure has occurred at device IP YY, and information on how to deal with the failure, "re-insert card: 04".

[0040] "restart port:12" specifies the specific number 12, and indicates that the failure will be dealt with by restarting port 12. "re-insert card:04" specifies the specific number 04, and indicates that the failure will be dealt with by re-inserting card 04.

[0041] The clustering process performed by the group generation unit 205 is performed on the event logs included in all the log data of the operational data and the teacher data. In the example of Fig. 3, these event logs are the four Syslogs included in the box in Fig. 3. That is, the group generation unit 205 performs clustering on the four event logs, "restart port:03", "restart-OK", "restart port:12", and "re-insert card:04".

[0042] (Temporary teacher data registration process) Next, an example of the operation of the fault information registration device 100 until the provisional teacher data is registered will be described with reference to FIG.

[0043] In step S401, the fault information receiving unit 202 receives fault information determined by a user or a device acting on behalf of the user.

[0044] In step S 402 , the log data acquiring unit 204 acquires operation data acquired from the operation data acquiring unit 201 and teacher data acquired from the teacher DB 203 based on the fault information received from the fault information receiving unit 202 .

[0045] In step S403, the group generating unit 205 acquires all event logs contained in the operation data and teacher data acquired by the log data acquiring unit 204 from these data.

[0046] In step S404, the group generating unit 205 executes a clustering process on all the event logs acquired in step S403.

[0047] In step S405, the group generation unit 205 groups similar event logs based on the occurrence frequency of the event logs, and as a result, the group generation unit 205 generates one or more groups including similar event logs.

[0048] In step S406, if a group generated in step S405 includes an event log included in the teacher data, the temporary teacher data registration unit 206 determines whether the group includes an event log included in the operation data. If the temporary teacher data registration unit 206 determines that the group includes an event log included in the operation data and that the event log included in the teacher data and the event log included in the operation data are different, the process proceeds to step S407, and if the temporary teacher data registration unit 206 determines that the group does not include the event log included in the operation data, the process proceeds to step S408. If it is determined that the event log included in the teacher data and the event log included in the operation data are different, it can be said that the event log included in the operation data is a new event log.

[0049] In step S407, the provisional teacher data registration unit 206 registers the merged data of the operational data including the new event log determined to be included in step S406 and the teacher data including the event log included in the group in step S406 as provisional teacher data.

[0050] In step S408, the provisional teacher data registration unit 206 determines whether there is a group (referred to as an unconfirmed group) among the groups generated in step S405 for which it has not been determined whether the event log included in the teacher data is included. If the provisional teacher data registration unit 206 determines that there is an unconfirmed group, it returns to step S406, and if it determines that there is no unconfirmed group, it ends the process.

[0051] (Temporary teacher data) The provisional teacher data registered by the provisional teacher data registration unit 206 will be described with reference to FIG.

[0052] In the example of FIG. 5, the row "Operation A" indicates the contents of the provisional teacher data. In the example of FIG. 5, the event log "restart port:03" included in the teacher data (row "Teacher A") and the event log "restart port:12" included in the operation data (row "Operation A") are classified into the same group by the group generating unit 205. The provisional teacher data shown in FIG. 5 is obtained by overwriting the operation data of "Operation A" shown in FIG. 3 on the contents of the teacher data including the event log "restart port:03" (row "Teacher A" in FIG. 5). The regular expression "restart port:ID<>" and the action content "Card restart (action)" underlined and written in bold in FIG. 5 are the remaining content of the overwritten teacher data, and the remaining Syslog "restart port:12" and device IP "XX" are the content of the operation data and the content of the teacher data changed by overwriting the corresponding data of the teacher data.

[0053] (Response and Recovery) Responses and recovery from failures occurring in the device will be explained using FIG.

[0054] Examples of the action contents specified by the action name are "Card Restart" and "Port Change" shown in FIG. 6. In the example of FIG. 6, whether the action was taken is described in the "Action" field, and if the action was taken, "○" is displayed, and if the action was not taken, "X" is displayed. Similarly, whether the corresponding action was taken to recover is described in the "Recovery" field, and if the action was taken, "○" is displayed, and if the action was not taken, "X" is displayed. In the example shown in FIG. 6, for the action name "Card Restart", it is shown that the device IP was taken and recovered when it was XX, but was not taken and was not recovered when it was YY. On the other hand, for the action name "Port Change", it is shown that neither of the two actions was taken when the device IP was XX or YY, and neither recovery was made.

[0055] (Confidence) The certainty of a device for each action will be described with reference to FIG.

[0056] The certainty of the device is calculated for each countermeasure as shown in FIG. 6. Specifically, the certainty calculation unit 207 determines, for example, that if a countermeasure is taken for a certain countermeasure, the value is 1, and that if not, the value is 0, and that if the countermeasure is taken, the value is 1, and if the countermeasure is not taken, the value is 0. The certainty calculation unit 207 then calculates the certainty as the sum of the number of types of countermeasures taken and 1 corresponding to recovery, and the sum of 0 or 1 depending on whether the countermeasure was taken and 0 or 1 depending on whether the countermeasure was recovered. In FIG. 6, the countermeasure name "Card Restart" for the device IP "XX" indicates that the countermeasure was taken and the result was recovery. Therefore, for the countermeasure name "Card Restart" for the device IP "XX", the certainty is (1+1) / (1+1)=2 / 2=1. On the other hand, for the countermeasure name "Card Restart" for the device IP "YY", the certainty is (0+0) / (1+1)=0 / 2=0. Also, for the action name "restart card", the certainty factor is (0+0+0) / (2+1)=0 / 3=0 whether the device IP is "XX" or "YY".

[0057] (Teacher data registration process) Next, an example of the operation of the fault information registration device 100 from collection of provisional teacher data to registration of the teacher data will be described with reference to FIG.

[0058] In step S701, the certainty factor calculation unit 207 collects provisional teaching data for each failed device and peripheral device.

[0059] In step S702, the certainty factor calculation unit 207 checks the event log generated in each device, which is a faulty device or a peripheral device, in the order in which the event logs occurred. The certainty factor calculation unit 207 tracks the date and time of the operation data for each device, in the order of fault, countermeasure, and recovery, and checks whether there is a fault, whether each countermeasure has been taken, and whether recovery has been achieved according to the countermeasure.

[0060] In step S703, the certainty factor calculation unit 207 judges whether there is provisional teacher data for each of the countermeasures for each device, which is one of the faulty devices or peripheral devices, when the countermeasures are related to the device. This judgement makes it clear whether the countermeasures have been taken for each of the countermeasures and whether the device has recovered according to the countermeasures.

[0061] In step S704, the certainty factor calculation unit 207 calculates the certainty factor for each countermeasure content for each device that is either the failed device or one of the peripheral devices, based on the result of step S703.

[0062] In step S705, the certainty determination unit 208 determines whether the certainty calculated in step S704 is equal to or greater than a threshold in the faulty device. If it is determined that the faulty device has a countermeasure that would make the certainty equal to or greater than the threshold, the process proceeds to step S708, and if it is not determined that the faulty device has a countermeasure that would make the certainty equal to or greater than the threshold, the process proceeds to step S706.

[0063] In step S706, the certainty determination unit 208 determines whether the certainty calculated in step S704 is equal to or greater than a threshold in one of the peripheral devices. If it is determined that the peripheral device has an action content whose certainty is equal to or greater than the threshold, the process proceeds to step S708, and if it is not determined that the peripheral device has an action content whose certainty is equal to or greater than the threshold, the process proceeds to step S707.

[0064] In step S707, the certainty factor determination unit 208 decides to investigate the certainty factor of a peripheral device other than the peripheral device determined in step S706, and step S706 is executed for the peripheral device decided to be investigated. If it is determined in step S707 that there is no peripheral device to be investigated, the process ends.

[0065] In step S708, the teacher data registration unit 209 receives the judgment result from the certainty judgment unit 208, and registers the provisional teacher data corresponding to the countermeasure content whose certainty is judged to be equal to or greater than the threshold in the teacher DB 203 as (true) teacher data. If it is estimated that there are multiple failed devices, step S705 and subsequent steps are executed for each failed device. In this case, the peripheral devices in step S706 are the peripheral devices related to the failed device in step S705.

[0066] The manner in which the teacher data registration unit 209 registers the teacher data in the teacher DB 203 in step S708 will be described with reference to FIG.

[0067] Fig. 8 shows an example in which the provisional teacher data registered in step S407 is the data shown in "Operation A" in Fig. 5, and this provisional teacher data is registered in step S708. The teacher DB 203 already stores the teacher data of "Teacher A" shown in Fig. 5. In this case, the teacher data registration unit 209 adds an event log corresponding to the newly registered teacher data only to the event log (Syslog) of "Teacher A," which has the same regular expression and action content.

[0068] The teacher data registered in the teacher DB 203 includes an event log, a regular expression, and a countermeasure for each piece of teacher data, as shown in Fig. 8. A plurality of event logs can be described in the event log item (Syslog).

[0069] According to the fault information registration device of the embodiment described above, log data related to a faulty device in which a fault is estimated to occur and its peripheral devices are acquired, and event logs similar to each other at a certain frequency or higher are grouped. Then, the fault information registration device of the embodiment registers the operation data as provisional teacher data when the event log corresponding to the operation data is included in a group including the event log corresponding to the teacher data for resolving the fault, and can calculate the confidence level for each of the measures taken against the fault of the device based on whether or not there is provisional teacher data for each device. The fault information registration device of the embodiment registers the provisional teacher data whose confidence level is equal to or higher than a threshold value as true teacher data. Therefore, the fault information registration device of the embodiment can store more accurate teacher data for resolving the fault in the teacher DB. As a result, the fault information registration device of the embodiment can accurately estimate the fault location in the network.

[0070] Furthermore, the fault information registration device of this embodiment can reduce resources required for inputting many types of data required for learning rules including fault causes and fault alarms. Since this resource is reduced, this embodiment also has the effect of shortening the time required to create a more accurate database for resolving faults. Therefore, this embodiment shortens the time from fault recovery to learning.

[0071] (Modification) <Teacher DB203> At least one of the buffers included in the teacher DB 203 or the temporary teacher data registration unit 206 may not be included in the fault information registration device 100 and may be located outside the fault information registration device 100. For example, at least one of the buffers included in the teacher DB 203 or the temporary teacher data registration unit 206 may be included in an external server or the like. In this case, the fault information registration device 100 exchanges information with at least one of the buffers included in the teacher DB 203 or the temporary teacher data registration unit 206 via the interface 104.

[0072] The apparatus of the embodiment can also be realized by a computer and a program, and the program can be recorded on a recording medium (or storage medium) or provided via a network.

[0073] Each of the above devices and their device parts can be implemented either as a hardware configuration or as a combination of hardware resources and software. The software for the combination is a program that is installed in advance on a computer from a network or a computer-readable recording medium (or storage medium) and executed by the processor of the computer to cause the computer to realize the operation (or function) of each device.

[0074] The present invention is not limited to the above-mentioned embodiment, and can be modified in various ways without departing from the gist of the present invention. The embodiments may be combined as appropriate, and in that case, the combined effect can be obtained. Furthermore, the above-mentioned embodiment includes various inventions, and various inventions can be extracted by combinations selected from the multiple components disclosed. For example, if the problem can be solved and the effect can be obtained even if some components are deleted from all the components shown in the embodiment, the configuration from which the components are deleted can be extracted as an invention. [Explanation of symbols]

[0075] 100...Fault information registration device 101…Processor 102...ROM 103…RAM 104...Interface 105…Display 106…Storage 201…Operational Data Acquisition Section 202…Fault Information Reception Department 203…Teacher DB 204…Log data acquisition unit 205...Group generation section 206…Temporary teacher data registration section 207...Confidence calculation section 208...Confidence level judgment section 209…Teacher Data Registration Department

Claims

1. an acquisition unit that acquires log data regarding a fault in a faulty device that is presumed to be faulty and in a peripheral device installed in the vicinity of the faulty device; a generation unit that groups similar event logs based on an occurrence frequency of the event logs from the log data and generates one or more groups including the similar event logs; a provisional registration unit that, when one or more event logs in a group including an event log corresponding to teacher data for resolving the fault correspond to operation data related to the operation of a device that is one of the faulty device or the peripheral devices, registers the operation data as provisional teacher data; a calculation unit that calculates a degree of certainty for each of measures to be taken against a failure of the one device based on whether or not there is provisional teaching data related to the failed device or the peripheral device; A determination unit that determines whether the confidence level is equal to or greater than a threshold value; a registration unit that registers the provisional teacher data having a certainty level equal to or greater than a threshold as teacher data; A registration device comprising:

2. The registration device according to claim 1 , wherein the generation unit generates the groups by performing a clustering process that groups similar event logs based on an occurrence frequency of the event logs generated by the faulty device and the peripheral device.

3. The registration device according to claim 1 or 2, wherein the determination unit determines whether the certainty factor of the faulty device is greater than or equal to a threshold, and if the certainty factor of the faulty device is less than the threshold, determines whether the certainty factor of the peripheral device is greater than or equal to a threshold.

4. The registration unit registers provisional teacher data corresponding to the certainty level of the faulty device as teacher data when the certainty level of the faulty device is equal to or greater than a threshold value; The registration device according to claim 1 , wherein the determination unit does not determine the certainty of the peripheral devices when the certainty of the faulty device is equal to or greater than a threshold value.

5. A registration device as described in any one of claims 1 to 4, wherein the generation unit generates the group using data including the teacher data including at least one of information regarding a failure, information regarding how to deal with the failure, or information regarding recovery from the failure, and the operational data including at least one of information regarding a failure of the failed device or a device that is one of the peripheral devices, or information regarding the contents of the failure, as the log data.

6. The system further includes a reception unit for receiving failure information relating to a faulty device in which a failure is presumed to have occurred and a peripheral device installed in the vicinity of the faulty device, The registration device according to claim 1 , wherein the acquisition unit acquires the log data based on the fault information.

7. The acquisition unit acquires log data on a fault in a faulty device in which a fault is presumed to have occurred and in a peripheral device installed in the vicinity of the faulty device; a generation unit that groups similar event logs based on an occurrence frequency of the event logs from the log data and generates one or more groups including the similar event logs; a provisional registration unit, when one or more event logs in a group including an event log corresponding to the teacher data for solving the fault correspond to operation data related to an operation of a device that is one of the faulty device or the peripheral devices, registering the operation data as provisional teacher data; A calculation unit calculates a certainty factor for each of the measures taken to deal with the failure of the one device based on whether or not there is provisional teaching data related to the failed device or the peripheral device; and A determination unit determines whether the certainty is equal to or greater than a threshold value; a registration unit registering the provisional teacher data having the certainty degree equal to or greater than a threshold as teacher data; A registration method comprising:

8. A program for causing a computer to function as each unit of the registration device according to any one of claims 1 to 6.

Images