Operation support device, system, method, and program

Abstract

The present invention assists in suitably maintaining a rule for dealing with an event occurring in an operation system. This operation assistance device (1) comprises: a storage unit (11) which stores a plurality of pieces of rule information (151-15n) that define a measure corresponding to each of a plurality of events occurring in an operation system; a registration unit (12) which when a measure is executed which is defined in rule information corresponding to a prescribed event among the plurality of pieces of rule information (151–15n) in correspondence to the occurrence of the prescribed event in the operation system, registers, in the storage unit (11), history information including the date and time of the occurrence of the event and the rule information about the event; a specification unit (13) which specifies, on the basis of the history information, rule information in which an occurrence interval of a specific event satisfies a prescribed condition; and an output unit (14) which outputs the specified rule information.

Description

[Technical field]

[0001] The present invention relates to an operation support device, system, method, and program, and more particularly to an operation support device, system, method, and program for monitoring an operation system. [Background technology]

[0002] In recent years, the operation of information systems has become increasingly automated. For example, it is possible to determine a response command from notification information of an event that has occurred in an information system based on predetermined event response rules, and to automatically execute the response command.

[0003] Examples of technologies related to automating operations include Patent Documents 1 and 2. Patent Document 1 discloses a technology related to a failure recovery device that can attempt recovery from a failure other than the failure described in a failure response rule when the failure occurs. Patent Document 2 discloses a technology related to a failure recovery device that takes action according to a predetermined rule based on the priority of a plurality of failure response rules and the operating state of the system. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2005-346331 A [Patent Document 2] JP 2005-038223 A Summary of the Invention [Problem to be solved by the invention]

[0005] Here, when the behavior or state of a system changes due to system modification or the like, the event handling rules for automating the operation of the operation system may no longer meet the conditions and may no longer function as rules. Ideally, it is desirable to change the event handling rules in accordance with system modifications. However, operation systems are becoming larger in scale, and it is not always possible to change the relevant event handling rules to correspond to system modifications. In addition, since there are many event handling rules, maintenance of the rules is cumbersome. Therefore, there is a problem in that it is difficult to maintain the event handling rules so that they function appropriately.

[0006] In view of the above-mentioned problems, an object of the present disclosure is to provide an operation support device, system, method, and program for supporting the appropriate maintenance of rules for dealing with events that occur in an operation system. [Means for solving the problem]

[0007] An operation support device according to a first aspect of the present disclosure, A storage unit that stores a plurality of rule information defining responses to a plurality of events that occur in the operational system; a registration unit that, when a measure defined in rule information corresponding to a predetermined event among the plurality of rule information is executed in response to the occurrence of the predetermined event in the operation system, registers history information including the date and time of the occurrence of the event and the rule information of the event in the storage unit; an identification unit that identifies rule information in which an occurrence interval of a specific event satisfies a predetermined condition based on the history information; an output unit that outputs the specified rule information; Equipped with.

[0008] An operation support system according to a second aspect of the present disclosure includes: A management terminal and an operation support device are provided, The operation support device includes: receiving from the management terminal a plurality of rule information defining responses to a plurality of events occurring in the operational system, and storing the received rule information in a storage device; when a measure defined in rule information corresponding to a predetermined event among the plurality of rule information is executed in response to the occurrence of the predetermined event in the operation system, history information including the date and time of occurrence of the event and the rule information of the event is registered in the storage device; Identifying rule information in which an occurrence interval of a specific event satisfies a predetermined condition based on the history information; The specified rule information is output to the management terminal.

[0009] An operation support method according to a third aspect of the present disclosure includes: The computer a storage device storing a plurality of rule information defining responses to a plurality of events occurring in an operation system, when a response defined in rule information corresponding to a predetermined event is executed in response to the occurrence of the predetermined event in the operation system, registering history information including the date and time of occurrence of the event and the rule information of the event in the storage device; Identifying rule information in which an occurrence interval of a specific event satisfies a predetermined condition based on the history information; The specified rule information is output.

[0010] An operation support program according to a fourth aspect of the present disclosure, a process of registering, in a storage device storing a plurality of pieces of rule information defining responses to a plurality of events occurring in an operational system, history information including the date and time of occurrence of the event and the rule information of the event when a response defined in the rule information corresponding to the predetermined event is executed in response to the occurrence of the predetermined event in the operational system; A process of identifying rule information in which an occurrence interval of a specific event satisfies a predetermined condition based on the history information; A process of outputting the specified rule information; to be executed by the computer. Effect of the Invention

[0011] The present disclosure makes it possible to provide an operation support device, system, method, and program for supporting appropriate maintenance of rules for dealing with events that occur in an operation system. [Brief description of the drawings]

[0012] [Figure 1] 1 is a block diagram showing a configuration of an operation support device according to a first embodiment of the present invention; [Diagram 2] 4 is a flowchart showing the flow of an operation support method according to the first embodiment. [Diagram 3] FIG. 11 is a block diagram showing the overall configuration of an operation support system according to a second embodiment of the present invention. [Figure 4] FIG. 11 is a block diagram showing a configuration of an operation support device according to a second embodiment of the present invention. [Diagram 5] 11 is a flowchart showing the flow of a process for dealing with an occurrence of an event according to the second embodiment. [Figure 6] FIG. 11 is a sequence diagram showing the flow of an inappropriate rule detection and update process according to the second embodiment. [Figure 7] FIG. 11 is a diagram illustrating a concept of an example of detection of a rule in which an event remains unresolved even after a countermeasure is taken according to the second embodiment. [Figure 8] FIG. 11 is a diagram illustrating a concept of an example of detection of a rule whose condition is no longer met due to a change in the system state according to the second embodiment. [Figure 9] FIG. 11 is a diagram showing the concept of an example solved by a rule update according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In each drawing, the same or corresponding elements are denoted by the same reference numerals, and duplicated descriptions will be omitted as necessary for clarity of explanation.

[0014] <Embodiment 1> Fig. 1 is a block diagram showing the configuration of an operation support device 1 according to the first embodiment. The operation support device 1 is an information processing device for managing operations of an operation system and supporting operations by an administrator. Here, the operation system is an information system configured of a plurality of monitored devices such as computers (servers), communication devices (network devices), and storages. The operation system is, for example, a service providing system that provides one or more services via a communication network, or an in-company business system. In addition, the operation system may be one that cooperates with an external information system.

[0015] The operation support device 1 includes a storage unit 11, a registration unit 12, an identification unit 13, and an output unit 14. The storage unit 11 stores rule information 151 to 15n (n is a natural number equal to or greater than 2) and history information 161 to 16m (m is a natural number equal to or greater than 2). The rule information 151 and the like are information that defines countermeasures corresponding to each of a plurality of events that occur in the operation system. The events are not limited to system failures (hardware, software, network) that lead to the service stop of the operation system, but also include a case where the system is operating but the service provided does not satisfy the requirements. The countermeasures include processing instructions, commands, and the like for solving or avoiding the events. For example, the countermeasures include a restart command for the OS (Operating System), middleware, and application, and a command for executing a data correction patch. The history information 161 and the like are a history of when the countermeasures are executed. The history information 161 and the like include the date and time of the occurrence of the event and the rule information of the event.

[0016] When a specific event occurs in an operational system and a countermeasure defined in rule information corresponding to the specific event among multiple rule information is executed, the registration unit 12 registers history information including the date and time of occurrence of the event and the rule information for the event in the memory unit 11.

[0017] The identifying unit 13 identifies rule information in which the occurrence interval of a specific event satisfies a predetermined condition, based on the history information.

[0018] The output unit 14 outputs the specified rule information.

[0019] 2 is a flowchart showing the flow of the operation support method according to the first embodiment. First, it is assumed that a predetermined event has occurred in an operation system. At this time, it is assumed that the operation support device 1 receives a notification of the occurrence of the event from the operation system or a monitoring system for the operation system. At this time, the operation support device 1 identifies rule information corresponding to the notified event from the storage unit 11 that stores rule information 151 to 15n, and executes a measure defined in the identified rule information.

[0020] Then, when the above-mentioned handling is performed, the registration unit 12 registers the history information 161 including the occurrence date and time of the event and the rule information of the event in the storage unit 11 (S11). Next, the identification unit 13 identifies rule information whose occurrence interval of the specific event satisfies a predetermined condition based on the history information 161 to 16m (S12). In other words, the "specific event" is not necessarily the "predetermined event". Thereafter, the output unit 14 outputs the identified rule information (S13). For example, the output unit 14 may output the identified rule information to the management terminal of the administrator. As a result, the management terminal displays the identified rule information. Therefore, the administrator can grasp the rule information whose occurrence interval satisfies the predetermined condition among the events that have occurred and been handled in the operation system.

[0021] The rule information whose occurrence interval satisfies the predetermined condition also includes the case where the tendency of the occurrence of the event has changed compared to before. For example, the occurrence interval of the event may be shorter than before. In other words, it is possible that the event recurs in a short period of time even though the countermeasure defined in the rule information corresponding to the event has been executed. Or, the event that previously occurred periodically may no longer occur, and the countermeasure may no longer be performed. In this case, it is possible that the event no longer conforms to the rule due to a change in the state of the system, or that the rule is no longer necessary. In this way, in this embodiment, the occurrence interval of the event is analyzed from the execution history of the countermeasure against the event, and the rule information is specified and output when the occurrence interval satisfies the predetermined condition. Therefore, the administrator, etc. can consider and implement the maintenance of the rule information, etc., using the output rule information as a clue. Therefore, it is possible to support the appropriate maintenance of the rules that deal with the event that occurred in the operation system.

[0022] The operation support device 1 includes a processor, a memory, and a storage device, which are not shown in the figure. The storage device stores a computer program that implements the processing of the operation support method according to the present embodiment. The processor then reads the computer program from the storage device into the memory and executes the computer program. In this way, the processor realizes the functions of the registration unit 12, the identification unit 13, and the output unit 14.

[0023] Alternatively, each of the components of the operation support device 1 may be realized by dedicated hardware. Also, a part or all of the components of each device may be realized by a general-purpose or dedicated circuit, processor, or a combination of these. These may be configured by a single chip, or may be configured by multiple chips connected via a bus. A part or all of the components of each device may be realized by a combination of the above-mentioned circuits, etc. and a program. Also, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), an FPGA (Field-Programmable Gate Array), a quantum processor (quantum computer control chip), etc. may be used as the processor.

[0024] Furthermore, when some or all of the components of the operation support device 1 are realized by a plurality of information processing devices, circuits, etc., the plurality of information processing devices, circuits, etc. may be centrally arranged or distributed. For example, the information processing devices, circuits, etc. may be realized as a client-server system, a cloud computing system, etc., in a form in which each is connected via a communication network. Furthermore, the functions of the operation support device 1 may be provided in a SaaS (Software as a Service) format.

[0025] <Embodiment 2> Here, the problem to be solved by this embodiment will be described in detail. First, it is possible to use an AI (Artificial Intelligence) model for operational automation. However, there is a problem that the use of an AI model requires learning costs and has a high barrier to entry. Therefore, operational automation can be relatively easily introduced by using a rule-based engine that uses rule information that defines the measures to be taken in response to the above-mentioned events.

[0026] Here, as described above, the event is not limited to a failure that accompanies a system shutdown, but also includes a system itself operating normally, such as not satisfying service specifications. Furthermore, measures taken in response to the occurrence of an event are not limited to recovery from the system failure. For example, measures taken each time an event occurs may involve data correction (application of data patches) or restart as an operation. In other words, while the system should be repaired in principle, operations may be continued by taking measures from the perspective of cost-effectiveness (frequency of occurrence, repair costs, repair time, difficulty, etc.). Therefore, in order to realize such operations, rule information is used that defines the measures to be taken when an event occurs.

[0027] However, as a result of modifying the system, events that have occurred up until now may become different events, and existing rules may no longer be applicable. For this reason, it is desirable to change rule information when the operational system is modified. However, if the creator or manager of the rules is different from the person who modifies the system (modifies it), coordination may be difficult. This may result in oversight of maintenance of rules that affect the system when it is modified. Furthermore, system modifications may cause unexpected changes in the system state, changing events that cannot be detected by existing rules. This may result in the rule engine (operation support device) not functioning normally (events may not be detected as intended) or countermeasures not being executed as expected.

[0028] Therefore, the present embodiment 2 is a specific example of the above-mentioned embodiment 1, and will be described below as solving at least part of the above-mentioned problems. Fig. 3 is a block diagram showing the overall configuration of an operation support system 1000 according to the present embodiment 2. The operation support system 1000 includes an operation system 100, a management terminal 200, an operation support device 300, and a monitoring device 400. The operation system 100, the monitoring device 400, and the operation support device 300 are connected at least via a network N. Here, the network N is a communication network such as the Internet or a dedicated line.

[0029] The operation system 100 may be the above-mentioned service providing system or an in-company business system. The operation system 100 includes at least one or more monitored devices such as a computer server, a network device, and a storage device. The operation system 100 may be capable of acquiring monitored target information from the monitoring device 400 and the operation support device 300. The operation system 100 may be connected to an external system (not shown). The operation system 100 includes, for example, a GW (GateWay) server, a FW (FireWall), a WEB server, an AP (Application) server, a DB (DataBase) server, a router, a switch, a storage device, and the like. However, the configuration of the operation system 100 is not limited to these. Furthermore, the connection relationships between the components in the operation system 100 are not particularly limited.

[0030] FIG. 3 illustrates a server 110 as a part of the configuration of the operation system 100. The server 110 is an example of the above-mentioned computer server, and an OS (Operating System), middleware, application, etc. run on it. Alternatively, the server 110 may be a storage device. The server 110 includes setting information 111 and a log file 112. The setting information 111 is a setting file of the OS, middleware, application, etc. Alternatively, the setting information 111 is not limited to a file, and may be an execution result of various status acquisition commands. The log file 112 is a file that records log information output by the OS, middleware, application, etc. Furthermore, the operation system 100 may include a network device. The network device may include setting information and a log file.

[0031] The monitoring device 400 monitors each monitored device of the operation system 100 via the network N and acquires monitored device information. When the monitoring device 400 detects the occurrence of an event from the monitored device information, it transmits a notification of the occurrence of the event to the operation support device 300 via the network N. The monitoring device 400 may monitor each monitored device according to a predetermined monitoring schedule. The monitoring device 400 may acquire the setting information 111 or the log file 112 as the monitored device information from the server 110. Alternatively, the monitoring device 400 may acquire a specific parameter value in the setting information 111. Alternatively, the monitoring device 400 may acquire a log message (such as a message ID or the date and time of the occurrence of the event) written in the log file 112. Alternatively, the monitoring device 400 may execute a status acquisition command for the server 110 and acquire the execution result of the command. The monitoring device 400 may detect the occurrence of an event by extracting an error message or the like from the acquired monitored device information using a predetermined extraction logic. Alternatively, the monitoring device 400 may notify the operation support device 300 by transmitting the acquired setting information 111 and log file 112 via the network N.

[0032] The management terminal 200 is a terminal device used by the operations manager to operate operations, such as a personal computer. The management terminal 200 is communicably connected to the operations support device 300 via a network or the like. The management terminal 200 accepts input of information such as rule information and a countermeasure command execution file in response to operations by the operations manager, and transmits and registers this to the operations support device 300. The management terminal 200 also accepts input of update information for the rule information from the operations manager, and transmits the update information to the operations support device 300 to update the rule information.

[0033] The operation support device 300 is an example of the above-mentioned operation support device 1. The operation support device 300 is an information processing device that performs registration processing of rule information, etc., handling processing for an occurrence event, detection and update processing of inappropriate rules, etc. (operation support method). The operation support device 300 may be made redundant with multiple servers, and each functional block may be realized by multiple computers.

[0034] 4 is a block diagram showing a configuration of an operation support device 300 according to the second embodiment. The operation support device 300 includes a storage unit 310, a memory 320, a communication unit 330, and a control unit 340. The storage unit 310 is an example of the storage unit 11 described above. The storage unit 310 is an example of a storage device such as a hard disk, a flash memory, or an SSD (Solid State Drive). The storage unit 310 stores a program 311, a rule DB 312, and a history DB 313. The program 311 is a computer program in which the processing of the operation support method according to the second embodiment is implemented.

[0035] The rule DB 312 is a database that manages a plurality of pieces of rule information 3121 to 312n. The rule information 3121 is information that associates a rule ID 31211, a condition 31212, and a countermeasure 31213. The rule ID 31211 is identification information of the rule information. The condition 31212 is an execution condition of a countermeasure including an occurred event. Specifically, the event is a failure, an error, a status change, etc. that occurred in the monitored device of the operation system 100. For example, the condition 31212 includes the setting information 111 or the log file 112 of the server 110, or an ID of a specific error message in the event occurrence notification. The countermeasure 31213 is information indicating the countermeasure content to be executed when the occurred event satisfies the condition 31212. The countermeasure 31213 is an execution command or a job ID for the monitored device where the event occurred or a related device. For example, the countermeasure 31213 may be a command to restart the OS, middleware, or application of the server 110, or a command to execute the command via the network N. Additionally, the rule information 3122 (not shown)...312n has the same configuration as the rule information 3121, but has a different rule ID 31211 and condition 31212.

[0036] The history DB 313 is a database that manages a plurality of pieces of history information 3131 to 313m. The history information 3131, etc. are a history of actions taken in response to the occurrence of an event. The history information 3131 is information that associates an occurring event 31311, an occurrence date and time 31312, a rule ID 31313, and an execution result 31314. The occurring event 31311 is information that identifies the occurring event. The occurring event 31311 is an event defined in the above-mentioned condition 31212, for example, an ID of a specific error message. The occurrence date and time 31312 is the date and time when the occurring event 31311 occurred. The occurrence date and time 31312 may be information included in the occurrence notification of the event, or the date and time when the occurrence notification was received in the operation support device 300. Note that the execution date and time of the action 31213 may be used instead of the occurrence date and time 31312. The rule ID 31313 is identification information of the rule information, and is information that corresponds to the rule ID 31211, etc., in which the executed action is defined. The execution result 31314 is the result of the executed countermeasure. The execution result 31314 is, for example, information indicating whether the countermeasure ended normally or abnormally.

[0037] The memory 320 is a volatile storage device such as a RAM (Random Access Memory), and is a storage area for temporarily holding information during operation of the control unit 340. The communication unit 330 is a communication interface with the network N.

[0038] The control unit 340 is a processor, that is, a control device, that controls each component of the operation support device 300. The control unit 340 loads the program 311 from the storage unit 310 into the memory 320, and executes the program 311. In this way, the control unit 340 realizes the functions of a registration unit 341, a handling unit 342, an identification unit 343, and an output unit 344.

[0039] The registration unit 341 is an example of the registration unit 12 described above. The registration unit 341 performs registration processing and update processing of rule information. The registration unit 341 registers the rule information received from the management terminal 200 in the rule DB 312 of the storage unit 310. The format of the received rule information may be various formats. In this case, the registration unit 341 may convert the received rule information into a specific format such as the rule information 3121 described above using a conversion logic according to the format of the received rule information, and register it in the rule DB 312. The registration unit 341 may also register a countermeasure command execution file received from the management terminal 200 in the storage unit 310. After the countermeasure is executed by the countermeasure unit 342 described later, the registration unit 341 registers history information in the history DB 313 of the storage unit 310. The registration unit 341 also updates the corresponding rule information in the rule DB 312 based on the update information of the rule information received from the management terminal 200.

[0040] The handling unit 342 performs handling processing for the occurring event. When the handling unit 342 receives an occurrence notification of an event from the monitoring device 400, it identifies rule information in which a condition corresponding to the event is defined from the rule DB 312, and executes the handling defined in the identified rule information on the corresponding monitored device, etc. Note that the handling unit 342 may obtain monitored device information from the monitored device of the operation system 100 via the network N, and analyze the monitored device information to detect the occurrence of an event. When the handling unit 342 detects the occurrence of an event, it executes the handling in the same manner as described above.

[0041] The identification unit 343 is an example of the identification unit 13 described above. The identification unit 343 performs an inappropriate rule detection process. In response to an update of the history DB 313 or at a predetermined timing, the identification unit 343 analyzes each history information in the history DB 313 to determine whether or not the occurrence trend of a specific occurrence event satisfies a predetermined condition, and if an occurrence event that satisfies the predetermined condition exists, identifies a rule ID (rule information) associated with the occurrence event. Specifically, the identification unit 343 analyzes the occurrence trend of the event from a plurality of occurrence dates and times of the specific event. Then, when the identification unit 343 detects a change in the trend before and after a predetermined time point from the occurrence trend, it determines that the occurrence interval satisfies the predetermined condition. Then, the identification unit 343 identifies rule information in which an event determined to satisfy the predetermined condition is defined from among the plurality of rule information. In this way, the rule information in which an event in which a change in the occurrence trend is detected is defined is highly likely to have rule conditions or measures that are not appropriate for the current operation system 100. Therefore, it is possible to support the administrator in considering whether or not to correct the rule information.

[0042] In particular, when the identification unit 343 detects that the occurrence frequency of a specific event has increased compared to before a specific time point, it may determine that the occurrence interval satisfies the specified condition. In other words, when the most recent occurrence interval of a specific event is (significantly) shorter than the average of past occurrence intervals, it is highly likely that the rule is inappropriate. Therefore, it is possible to support the administrator in considering whether or not to modify the rule information. Furthermore, the identification unit 343 may determine that the occurrence interval satisfies the specified condition when a specified period of time or more has passed since the specific event last occurred. In this case, it is possible that an event that had a specified occurrence interval in the past has not occurred, or the state has changed due to repairs or the like of the operation system 100. Therefore, it is highly likely that the rule information is no longer necessary for the current operation system 100, or that the rule is inappropriate. Therefore, it is possible to support the administrator in considering whether or not to modify or delete the rule information. Furthermore, the identification unit 343 may calculate, from multiple occurrence dates and times of a specific event, a first occurrence frequency of the event in a period before a specific time point and a second occurrence frequency of the event in a period after the specific time point as occurrence tendencies. In this case, the identification unit 343 determines whether the occurrence interval satisfies a predetermined condition based on the relationship between the first occurrence frequency and the second occurrence frequency. This makes it possible to more accurately detect a change in the occurrence tendency of a specific event based on the degree of difference in the occurrence frequency before and after a predetermined point in time.

[0043] The output unit 344 is an example of the output unit 14 described above. The output unit 344 outputs the specified rule information to the management terminal 200. Furthermore, the output unit 344 outputs the reason for detecting the change in the occurrence tendency to the management terminal 200 together with the specified rule information. The reason for detecting the change in the occurrence tendency is, for example, that the occurrence frequency of a specific event has increased compared to before a predetermined time point, that a specific period of time has passed since the last occurrence of a specific event, or the relationship (comparison result) between the first occurrence frequency and the second occurrence frequency described above. Furthermore, the output unit 344 may further output information on the event that has occurred. Note that the output destination of the output unit 344 may be a display device connected to the operation support device 300 or another information system, in addition to the management terminal 200.

[0044] 5 is a flowchart showing a flow of a process for dealing with an occurrence of an event according to the second embodiment. As a premise, the operation support device 300 has a plurality of rule information 3121 and the like registered in the rule DB 312, and an execution command corresponding to the action defined in each rule information has also been registered or is at least executable via the network N. Then, it is assumed that a predetermined event (such as a fault) has occurred in a monitored device in the operation system 100, for example, the server 110. For example, the monitoring device 400 detects the addition of an error message from the log file 112 of the server 110, and transmits the error message as an occurrence notification of the event to the operation support device 300 via the network N. The occurrence notification of the event includes a message ID and message content, the occurrence date and time (detection date and time), identification information of the detected monitored device (server 110), and the like.

[0045] Therefore, the handling unit 342 of the operation support device 300 receives an event occurrence notification from the monitoring device 400 via the network N (S101). The handling unit 342 may receive an event occurrence notification from the monitoring software in the server 110 via the network N. Alternatively, the handling unit 342 may obtain monitoring target information (log file 112, etc.) from the server 110 via the network N and analyze the monitoring target information to detect the occurrence of a predetermined event.

[0046] Next, the handling unit 342 searches the rule DB 312 for rule information that matches the condition (S102). Specifically, the handling unit 342 searches for an event (such as an error message ID) included in the occurrence notification that matches the condition of each rule information in the rule DB 312. Then, the handling unit 342 determines whether or not rule information that matches the condition exists (S103). For example, if the error message ID included in the occurrence notification is included in the condition 31212, the handling unit 342 determines that rule information that matches the condition exists, and identifies the rule information 3121 in which the condition 31212 is defined. Then, the handling unit 342 executes the action defined in the rule information that matches the condition (S104). For example, the handling unit 342 executes an execution command corresponding to the action 31213 defined in the identified rule information 3121 to the server 110 via the network N. Then, it is assumed that the execution of the execution command has ended.

[0047] Thereafter, the registration unit 341 registers the history information in the history DB 313 (S105). Specifically, the registration unit 341 sets the error message ID included in the occurrence notification as the occurring event 31311, the occurrence date and time included in the occurrence notification as the occurrence date and time 31312, and the rule ID 31211 of the identified rule information 3121 as the rule ID 31313. Then, the registration unit 341 associates the occurring event 31311, the occurrence date and time 31312, the rule ID 31313, and the execution result 31314 of the executed countermeasure, and registers them in the history DB 313 as history information 3131.

[0048] Then, the handling unit 342 outputs the occurrence of the event and the completion of handling to the management terminal 200 (S106). For example, the handling unit 342 outputs an error message ID and the execution result 31314 included in the occurrence notification to the management terminal 200. On the other hand, if it is determined in step S103 that no rule information matching the conditions exists, the handling unit 342 outputs an alert of the occurrence of the event to the management terminal 200 (S107).

[0049] Fig. 6 is a sequence diagram showing the flow of the inappropriate rule detection and update process according to the present embodiment 2. For example, the identifying unit 343 starts the inappropriate rule detection process after the handling process of Fig. 5. Alternatively, the identifying unit 343 may start the inappropriate rule detection process at a predetermined timing.

[0050] First, the identifying unit 343 analyzes the occurrence tendency of a specific event from the history DB 313 (S201). Specifically, the identifying unit 343 identifies a history information group in which an occurrence event is a specific error message ID from the history DB 313, and acquires the occurrence date and time of the identified history information group. Then, the identifying unit 343 calculates the interval (occurrence interval) between adjacent dates and times when the acquired occurrence dates and times are arranged in chronological order. At this time, the identifying unit 343 calculates a first occurrence frequency from a plurality of occurrence intervals in a period before a predetermined time point, and calculates a second occurrence frequency from one or more occurrence intervals in a period after the predetermined time point. Here, the first occurrence frequency and the second occurrence frequency are examples of the occurrence tendency. The identifying unit 343 may also analyze the occurrence tendency using other algorithms, analysis logic, etc.

[0051] Next, the identifying unit 343 detects a change in the occurrence trend (S202). For example, the identifying unit 343 may detect that the second occurrence frequency has become higher than the first occurrence frequency as the change in the occurrence trend. The identifying unit 343 may also detect that the second occurrence frequency has become lower than the first occurrence frequency, for example, that the second occurrence frequency is 0, as the change in the occurrence trend. If no change in the occurrence trend is detected in step S202, the process is terminated. Alternatively, the identifying unit 343 performs an inappropriate rule detection process for another event.

[0052] Then, the identifying unit 343 identifies rule information corresponding to the event for which a change in the occurrence trend has been detected (S203). Specifically, the identifying unit 343 identifies the rule ID 31313 associated with the occurring event 31311, which is the specific error message ID. The identifying unit 343 also identifies the detection reason (the reason for detecting the change in the occurrence trend).

[0053] Thereafter, the output unit 344 transmits the identified rule information and the detection reason to the management terminal 200 via the network N (S204). In response to this, the management terminal 200 displays on the screen the rule information and the detection reason received from the operation support device 300 via the network N. This allows the operation manager to visually confirm the rules that are likely to be inappropriate and the reasons for them. Therefore, the operation manager can consider whether or not the conditions and measures of the corresponding rule information need to be modified and what the modifications should be. Here, it is assumed that the operation manager modifies the conditions and measures of the corresponding rule information. Therefore, the management terminal 200 receives update information of the rule information from the operation manager (S206). Then, the management terminal 200 transmits the update information to the operation support device 300 via the network N (S207).

[0054] In response to this, the registration unit 341 of the operation support device 300 updates the identified rule information based on the update information received from the management terminal 200 (S208). Specifically, the registration unit 341 updates the rule DB 312 with the contents of the update information regarding the conditions or actions of the rule information corresponding to the update information.

[0055] In this way, the operation support device 300 can support the operation manager in maintaining rule information through the inappropriate rule detection and update process.

[0056] FIG. 7 is a diagram showing the concept of an example of detection of a rule that does not resolve an event even after a countermeasure according to the second embodiment. The black circles on the left side of FIG. 7 conceptually show the time when the event occurred in chronological order. The history DB313 on the right side of FIG. 7 shows an example in which each piece of history information for the occurrence event "m002" is arranged in chronological order of the occurrence date and time. Here, in a first period before a predetermined time, the first occurrence frequency f1 is about once a month. In a second period after a predetermined time, the second occurrence frequency f2 is once every 30 minutes. Therefore, for example, when a countermeasure is taken at the occurrence date and time "20XX / 09 / 23 13:29:00" and the registration unit 341 registers the history information in the history DB313, the identification unit 343 may start the inappropriate rule detection process. This allows a change in the occurrence trend of the occurrence event "m002" to be detected quickly, and other countermeasures can be promoted along with rule maintenance.

[0057] FIG. 8 is a diagram showing a concept of an example of detection of a rule whose condition is no longer met due to a change in the system state according to the second embodiment. Here, in a first period before a predetermined time point, the first occurrence frequency f1 is about once a month. In a second period after the predetermined time point, the second occurrence frequency f2 is 0 times a month, that is, it is shown that it has not occurred for more than six months after the predetermined time point. In other words, it is shown that the event "m002" has not occurred even once and has not been dealt with in a period that significantly exceeds the execution frequency up to now. Therefore, it is considered that there is some reason why the event "m002" has not occurred. In addition, since a measure based on the condition of the event "m002" has not been executed, it is possible that an appropriate measure has not been taken for the operation system 100. Therefore, it is preferable that the identification unit 343 periodically starts an inappropriate rule detection process. This makes it possible to detect rules that are not functioning or unnecessary rules, and to encourage maintenance.

[0058] Fig. 9 is a diagram showing the concept of an example of a problem solved by a rule update according to the present embodiment 2. Here, it is assumed that an inappropriate rule was detected in the example of Fig. 7 described above, the rule information and the reason for the detection were notified to the management terminal 200, and the rule information corresponding to the event "m002" was updated accordingly.

[0059] Specifically, after the countermeasure of rule ID "r002" is executed at the occurrence date and time "20XX / 09 / 23 13:29:00", the rule information corresponding to the event "m002" is updated to rule ID "r002a" and the countermeasure is updated to another execution command. As a result, at the occurrence date and time "20XX / 09 / 23 13:59:00" 30 minutes after the previous occurrence of the event "m002", the rule ID "r002a" is identified, the updated execution command is executed as the countermeasure, and the countermeasure is normally terminated. Therefore, after that, the event "m002" does not reoccur after 30 minutes, and the event "m002" returns to occur about once a month as before. Therefore, by detecting an inappropriate rule that has become ineffective according to this embodiment and prompting correction, etc., it is possible to support the appropriate maintenance of rules that deal with events that occur in the operational system.

[0060] <Other embodiments> In the above embodiment, the present disclosure has been described as a hardware configuration, but is not limited to this. Any process of the present disclosure can be realized by causing a CPU to execute a computer program.

[0061] In the above example, the program can be stored and provided to the computer using various types of non-transitory computer readable media. The non-transitory computer readable media includes various types of tangible storage media. Examples of the non-transitory computer readable media include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROM (Read Only Memory), CD-R, CD-R / W, DVD (Digital Versatile Disc), and semiconductor memory (e.g., mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)). The program may also be provided to the computer by various types of transitory computer readable media. Examples of the transitory computer readable media include electric signals, optical signals, and electromagnetic waves. The transitory computer readable media can provide the program to the computer via a wired communication path such as an electric wire and an optical fiber, or via a wireless communication path.

[0062] The present disclosure is not limited to the above-described embodiment, and may be modified as appropriate without departing from the spirit and scope of the present disclosure. In addition, the present disclosure may be implemented by appropriately combining the respective embodiments.

[0063] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. (Appendix A1) A storage unit that stores a plurality of rule information defining responses to a plurality of events that occur in the operational system; a registration unit that, when a measure defined in rule information corresponding to a predetermined event among the plurality of rule information is executed in response to the occurrence of the predetermined event in the operation system, registers history information including the date and time of the occurrence of the event and the rule information of the event in the storage unit; an identification unit that identifies rule information in which an occurrence interval of a specific event satisfies a predetermined condition based on the history information; an output unit that outputs the specified rule information; An operational support device comprising: (Appendix A2) The identification unit is Analyzing the occurrence trend of the specific event based on the plurality of occurrence dates and times of the specific event; When a change in trend is detected from the occurrence trend around a predetermined time point, it is determined that the occurrence interval satisfies a predetermined condition; Identifying rule information in which an event determined to satisfy the predetermined condition is defined from among the plurality of rule information. 2. An operational support device as described in Appendix A1. (Appendix A3) The identification unit is When it is detected that the occurrence frequency of the specific event has increased compared to before the predetermined time point, it is determined that the occurrence interval satisfies a predetermined condition. 2. An operational support device as described in Appendix A2. (Appendix A4) The identification unit is If a predetermined period of time has elapsed since the specific event last occurred, it is determined that the occurrence interval satisfies a predetermined condition. 2. An operational support device as described in appendix A2 or A3. (Appendix A5) The identification unit is calculating, from the plurality of occurrence dates and times of the specific event, a first occurrence frequency of the event in a period before a predetermined time point and a second occurrence frequency of the event in a period after the predetermined time point as the occurrence tendency; A determination is made as to whether or not the occurrence interval satisfies a predetermined condition based on a relationship between the first occurrence frequency and the second occurrence frequency. 13. An operation support device according to claim 12, wherein the operation support device is a (Appendix A6) The output unit is The reason why the change in the occurrence trend was detected is further output together with the specified rule information. 13. An operation support device according to claim 12, wherein the operation support device is a (Appendix B1) A management terminal and an operation support device are provided, The operation support device includes: receiving from the management terminal a plurality of rule information defining responses to a plurality of events occurring in the operational system, and storing the received rule information in a storage device; registering, in the storage device, history information including a date and time of occurrence of the event and the rule information of the event when a measure defined in rule information corresponding to the event among the plurality of rule information is executed in response to the occurrence of the event in the operation system; Identifying rule information in which an occurrence interval of a specific event satisfies a predetermined condition based on the history information; outputting the specified rule information to the management terminal; Operational support system. (Appendix B2) The management terminal includes: Displaying rule information output from the operation support device; Transmitting update information of the rule information to the operation support device; The operation support device includes: The specified rule information is updated based on update information received from the management terminal. 2. An operations support system as described in Appendix B1. (Appendix C1) The computer a storage device storing a plurality of rule information defining responses to a plurality of events occurring in an operation system, when a response defined in rule information corresponding to a predetermined event is executed in response to the occurrence of the predetermined event in the operation system, registering history information including the date and time of occurrence of the event and the rule information of the event in the storage device; Identifying rule information in which an occurrence interval of a specific event satisfies a predetermined condition based on the history information; Output the specified rule information Operational support methods. (Appendix D1) a process of registering, in a storage device storing a plurality of pieces of rule information defining responses to a plurality of events occurring in an operational system, history information including the date and time of occurrence of the event and the rule information of the event when a response defined in the rule information corresponding to the predetermined event is executed in response to the occurrence of the predetermined event in the operational system; A process of identifying rule information in which an occurrence interval of a specific event satisfies a predetermined condition based on the history information; A process of outputting the specified rule information; An operational support program that causes a computer to execute the above.

[0064] Although the present invention has been described above with reference to the embodiments (and examples), the present invention is not limited to the above-mentioned embodiments (and examples). Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0065] This application claims priority based on Japanese Patent Application No. 2021-045848, filed on March 19, 2021, the disclosure of which is incorporated herein in its entirety. [Explanation of symbols]

[0066] 1 Operation support equipment 11 Storage section 12 Registration Department 13 Specific section 14 Output section 151 Rules Information 15n Rules Information 161 History Information 16m History Information 1000 Operational Support System 100 Operational Systems 110 Server 111 Setting information 112 Log Files 200 Management terminal 300 Operation support equipment 310 Storage section 311 Program 312 Rule DB 3121 Rules Information 31211 Rule ID 31212 Condition 31213 Response 312n Rules Information 313 History DB 3131 History Information 31311 Occurrence 31312 Date and time of occurrence 31313 Rule ID 31314 Execution result 313m History Information 320 Memory 330 Communications Department 340 Control Unit 341 Registration Department 342 Response Department 343 Specific part 344 Output section 400 Monitoring equipment N Network f1 First occurrence frequency f2 Second occurrence frequency

Claims

1. A storage means for storing a plurality of rule information defining responses to a plurality of events occurring in the operation system; a registration means for registering, in the case where a measure defined in rule information corresponding to a predetermined event among the plurality of rule information is executed in response to the occurrence of the predetermined event in the operation system, history information including the date and time of the occurrence of the event and the rule information of the event in the storage means; A specification means for specifying rule information that satisfies a predetermined condition regarding a change in occurrence tendency of a specific event before and after a predetermined time point based on the history information; an output means for outputting the specified rule information; An operational support device comprising:

2. The identification means is Analyzing the occurrence trend of the specific event based on the plurality of occurrence dates and times of the specific event; When a change in trend is detected from the occurrence trend around a predetermined time point, it is determined that the occurrence interval satisfies a predetermined condition; Identifying rule information in which an event determined to satisfy the predetermined condition is defined from among the plurality of rule information. The operation support device according to claim 1 .

3. The identification means is When it is detected that the occurrence frequency of the specific event has increased compared to before the predetermined time point, it is determined that the occurrence interval satisfies a predetermined condition. The operation support device according to claim 2 .

4. The identification means is If a predetermined period of time has elapsed since the specific event last occurred, it is determined that the occurrence interval satisfies a predetermined condition.

4. An operation support device according to claim 2 or 3.

5. The identification means is calculating, from the plurality of occurrence dates and times of the specific event, a first occurrence frequency of the event in a period before a predetermined time point and a second occurrence frequency of the event in a period after the predetermined time point as the occurrence tendency; A determination is made as to whether or not the occurrence interval satisfies a predetermined condition based on a relationship between the first occurrence frequency and the second occurrence frequency. The operation support device according to any one of claims 2 to 4.

6. The output means includes: The reason why the change in the occurrence trend was detected is further output together with the specified rule information. The operation support device according to any one of claims 2 to 5.

7. A management terminal and an operation support device are provided, The operation support device includes: receiving from the management terminal a plurality of rule information defining responses to a plurality of events occurring in the operational system, and storing the received rule information in a storage device; registering, in the storage device, history information including a date and time of occurrence of the event and the rule information of the event when a measure defined in rule information corresponding to the event among the plurality of rule information is executed in response to the occurrence of the event in the operation system; Identifying rule information that satisfies a predetermined condition regarding a change in the occurrence trend of a specific event before and after a predetermined time point based on the history information; outputting the specified rule information to the management terminal; Operational support system.

8. The management terminal includes: Displaying rule information output from the operation support device; Transmitting update information of the rule information to the operation support device; The operation support device includes: The specified rule information is updated based on update information received from the management terminal.

8. An operation support system according to claim 7.

9. The computer a storage device storing a plurality of rule information defining responses to a plurality of events occurring in an operation system, when a response defined in rule information corresponding to a predetermined event is executed in response to the occurrence of the predetermined event in the operation system, registering history information including the date and time of occurrence of the event and the rule information of the event in the storage device; Identifying rule information that satisfies a predetermined condition regarding a change in the occurrence trend of a specific event before and after a predetermined time point based on the history information; Output the specified rule information Operational support methods.

10. a process of registering, in a storage device storing a plurality of pieces of rule information defining responses to a plurality of events occurring in an operational system, history information including the date and time of occurrence of the event and the rule information of the event when a response defined in the rule information corresponding to the predetermined event is executed in response to the occurrence of the predetermined event in the operational system; A process of identifying rule information that satisfies a predetermined condition regarding a change in the occurrence tendency of a specific event before and after a predetermined time point based on the history information; A process of outputting the specified rule information; An operational support program that causes a computer to execute the above.

Images