Information processing device, information processing method, and program

Abstract

This information processing device 1 comprises: a manipulation unit 11 for combining various observability data acquired from a subject being managed, collectively at a prescribed time interval; a processing unit 12 for repeating learning by a generator 122 that accepts the combined observability data as input and generates pseudo-generation data using a causal structure matrix that represents a causal structure between the combined observability data and observability data, and an identifier 121 that identifies whether the pseudo-generation data is fake, to update the causal structure matrix; and an output unit 13 for outputting the causal structure between the observability data based on the causal structure matrix.

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] As the importance of integrated services, in which multiple types of services are integrated, increases, there is a demand for short-term, low-cost responses to the emergence of new services related to integrated services and changes to the specifications of existing services.

[0003] An autonomous control loop method has been proposed in which business processes are subdivided and each function is modularized and made autonomous. The autonomous control loop method aims to follow new services and specification changes to existing services in a short period of time and at low cost. In Non-Patent Document 1, in order to understand the behavior of a system using the autonomous control loop method, observability data (logs, metrics, traces) is acquired from each operation component of the autonomous control loop method and displayed to the operator. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Tomoyuki Ikeya, Kensuke Takahashi, Satoru Kondo, "Proposal of an information acquisition method to improve observability in autonomous control loop systems," 2020 IEICE Society Conference B-14-4, IEICE, September 17, 2020 Summary of the Invention [Problem to be solved by the invention]

[0005] However, simply displaying observability data when a fault occurs means that investigation into the cause of the fault is left to the maintenance personnel, which results in a long time being required to resolve the fault.

[0006] The present invention has been made in view of the above, and has an object to reduce the time required to investigate the cause of a failure when it occurs. [Means for solving the problem]

[0007] An information processing device of one embodiment of the present invention includes a processing unit that combines various types of observability data acquired from managed objects at predetermined time intervals, a processing unit that inputs the combined observability data and generates pseudo-observability data using a causal structure matrix representing the combined observability data and the causal structure between the observable data, and a classifier that identifies whether the pseudo-observable data is fake, and updates the causal structure matrix by repeated learning, and an output unit that outputs the causal structure between the observability data based on the causal structure matrix. Effect of the Invention

[0008] According to the present invention, when a failure occurs, the time required to investigate the cause can be reduced. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a functional block diagram showing an example of the configuration of an information processing device according to the present embodiment. [Diagram 2] FIG. 2 is a flowchart illustrating an example of a process flow of the processing unit. [Diagram 3] FIG. 3 is a diagram illustrating an example of processing of observability data. [Figure 4] FIG. 4 is a diagram for explaining the processing unit. [Diagram 5] FIG. 5 is a flowchart illustrating an example of a process flow of the output unit. [Figure 6A] FIG. 6A is a diagram showing an example of a display of the causal structure of observability data. [Figure 6B] FIG. 6B is a diagram showing an example of a display of the causal structure of observability data. [Figure 6C] FIG. 6C is a diagram showing an example of displaying the causal structure of observability data. [Figure 7] FIG. 7 is a diagram illustrating an example of a hardware configuration of an information processing device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0011] [composition] The configuration of an information processing device 1 according to this embodiment will be described with reference to Fig. 1. The information processing device 1 shown in Fig. 1 inputs observability data (logs, metrics, traces, etc.) acquired from a service to be maintained, estimates a causal structure between the observability data, and visualizes the causal structure.

[0012] A data storage unit 3 is connected to the information processing device 1. The data storage unit 3 stores observability data acquired from managed objects. The managed objects are, for example, devices and virtual machines used to provide services, and software running on the devices and virtual machines. The observability data may be character strings or numerical data such as logs and metrics that can be acquired from the managed objects. The observability data may be acquired from each operation component of the autonomous control loop method by the method of Non-Patent Document 1. The information processing device 1 may include the data storage unit 3 and acquire the observability data from the managed objects.

[0013] The information processing device 1 includes a processing unit 11, a processing unit 12, and an output unit 13.

[0014] The processor 11 retrieves the observability data acquired from all managed objects constituting the service from the data storage unit 3, processes the observability data of each managed object, and consolidates the observability data of the entire service into one. Specifically, the processor 11 rounds the time information of each observability data of each managed object to a predetermined interval, and then combines observability data having the same time information into one. As a result, all observability data of all managed objects is consolidated into a predetermined interval, and the observability data of the entire service can be used as the subject of analysis.

[0015] The processing unit 12 inputs the observability data of the entire service, performs causal discovery processing by applying SAM (Structural Agnostic Model), which is a causal discovery method using GAN (Generative Adversarial Networks), and outputs a causal structure matrix as the processing result. The causal structure matrix is ​​a matrix in which the types of observability data of the entire service are arranged vertically and horizontally to express the causal relationships between the observable data in numerical terms. The type of observability data indicates what kind of data was acquired by which management target. For example, the types of observable data are the CPU usage of device A, the memory usage of device A, the CPU usage of device B, the memory usage of device B, the network bandwidth used by service C, etc.

[0016] The output unit 13 outputs the causal structure between the observable data in the form of a directed acyclic graph (DAG) in which the types of observable data are represented as nodes and the causal relationships are represented as edges based on the causal structure matrix. For example, the output unit 13 outputs the causal structure between the observable data to a display device such as a display for display. The output unit 13 may output the causal structure between the observable data to a storage device for storage in the storage device, or may output it to another processing device.

[0017] [Operation] Next, an example of the operation of the processing unit 11 will be described with reference to the flowchart of FIG.

[0018] In step S11, the processing unit 11 acquires observability data of all managed objects constituting the service from the data storage unit 3. In the example of Fig. 3, VM1, VM2, LB, Flask, and Tomcat are illustrated as managed objects. LB runs on VM1, and Flask and Tomcat run on VM2. The data storage unit 3 stores the observability data acquired from these managed objects.

[0019] In step S12, the processing unit 11 converts the time information for each piece of observable data based on a preset setting. For example, if the predetermined interval is preset to be 10 seconds, the processing unit 11 converts the time information from 11:00:00 to 11:00:09 to 11:00:00, and converts the time information from 11:00:10 to 11:00:19 to 11:00:10. As a result, the time information of the observable data is aligned to 10 seconds intervals.

[0020] In step S13, the processor 11 converts the names of the observability data so that the names of the observability data are not duplicated. For example, the processor 11 connects the managed object name and the metrics name with "_". As a specific example, the processor 11 converts the CPU usage rate acquired from VM1 into a metrics name such as "VM1_CPU".

[0021] In step S14, the processing unit 11 merges the observability data using the time information as a key, and generates observability data for the entire service in which the observability data is compiled into one. Specifically, the processing unit 11 extracts observability data having the same time information from all the observability data, and compiles the observability data for each time information. In the example of FIG. 3, the observability data is arranged and combined for each time information in the order of "v1_c", "v1_m", "t_c", "t_m", ..., and all the observability data is compiled into one file. "v1_c" represents the CPU usage of VM1, "v1_c" represents the memory usage of VM1, "t_c" represents the CPU usage of Tomcat, and "t_m" represents the memory usage of Tomcat. Missing values ​​are complemented by the process described later, so observability data that cannot be acquired at each time may remain missing.

[0022] In step S15, the processing unit 11 converts the character string information into a numerical value according to a preset rule. For example, for log information such as "ERROR no response", the conversion rule is set to "log level count". If three metrics, "error, warn, info", are prepared, the aforementioned log is an "error", so it can be converted into the numerical values ​​"1, 0, 0".

[0023] In step S16, the processing unit 11 complements missing values ​​of the observability data of the entire service. For example, if no traffic is flowing through the network at a given time, the metrics of the network traffic are not acquired, resulting in missing data. Examples of the process of complementing missing values ​​include the listwise method of deleting missing rows, the mean value substitution method of complementing the mean value of each column excluding the missing parts, the regression substitution method of complementing the estimated value by regression analysis on a column basis, and the zero padding method of substituting zeros for the missing parts. The complementing process is not limited to the above, and the complementing process may be performed by a method according to the type of observability data.

[0024] The observability data for the entire service generated by the above processing is transmitted to the processing unit 12.

[0025] Next, an example of the operation of the processing unit 12 will be described with reference to FIG.

[0026] The processing unit 12 receives the observability data of the entire service, and repeats learning using a generator 122 and a discriminator 121 to update the causal structure matrix and output the causal structure matrix. The generator 122 receives the observability data of the entire service as an input. The pseudo generator of the generator 122 generates and outputs pseudo generated data similar to actual data from the observability data of the entire service, the causal structure matrix, the complexity matrix, and noise data. The discriminator 121 receives the pseudo generated data output by the generator 122 and discriminates whether the input data is genuine data or fake data. The discrimination result is fed back to the generator 122 and the discriminator 121, and learning is repeated to improve the accuracy of the generator 122 and the discriminator 121. The causal structure matrix is ​​updated and grows by the learning of the generator 122.

[0027] Next, an example of the operation of the output unit 13 will be described with reference to the flowchart of FIG.

[0028] In step S21, the output unit 13 acquires the causal structure matrix from the processing unit 12.

[0029] In step S22, the output unit 13 acquires a threshold value. The threshold value is set, for example, by a slide bar displayed on the display screen output by the output unit 13.

[0030] In step S23, the output unit 13 generates a graph structure in which the types of observability data are represented as nodes and the causal relationships are represented as edges based on the causal structure matrix and the threshold. Specifically, the output unit 13 analyzes the causal structure matrix row by row, and for columns in which the element value is equal to or greater than the threshold, connects the observability data of the row as a source node and the observability data of the column as a destination node with an edge. The element of the i-th row and j-th column of the causal structure matrix is ​​a numerical representation of the causal relationship that exists in the direction from the observable data of the i-th row to the observable data of the j-th column. The elements of the causal structure matrix take values ​​from 0 to 1, and the closer the value is to 1, the more causal relationships are estimated to exist. When the element of the i-th row and j-th column is equal to or greater than the threshold, the causal structure of the observable data of the i-th row with respect to the observable data of the j-th column can be estimated.

[0031] However, if the DAG is violated, that is, if the graph structure is cyclic, the edge with the smallest value is deleted. A DAG violation can be determined by whether or not a topological sort can be performed.

[0032] In step S24, the output unit 13 outputs the graph structure to the display device for display.

[0033] Figures 6A to 6C show examples of graph structure display with different thresholds. In the example of Figure 6A, the threshold is set to 0.8. The threshold can be set using the slide bar at the bottom of the screen. Among the elements of the causal structure matrix shown in the figure, the elements with a value of 0.8 or more are the elements of the v1_c row in the t_c column. Therefore, a graph structure with an edge from the v1_c node to the t_c node is displayed. Note that in Figure 6A, the v1_m node that is not connected by an edge is also displayed, but it is not necessary to display the nodes that are not connected by an edge.

[0034] In the example of Fig. 6B, the threshold is set to 0.5. The elements having a value of 0.5 or more are the elements in the v1_c row and the v1_m row of the t_c column. Therefore, in addition to the edges shown in Fig. 6A, a graph structure having an edge from the v1_m node to the t_c node is displayed.

[0035] In the example of Figure 6C, the threshold is set to 0.4. Elements with a value of 0.4 or more are the elements in the v1_c and v1_m rows of the t_c column and the element in the t_c row of the v1_c column. In this case, in addition to the edges shown in Figure 6B, an edge from the t_c node to the v1_c node is added, but this violates the DAG. In the case of a DAG violation, the edge with the smallest value is deleted. In the example of Figure 6C, the edge from the t_c node to the v1_c node is deleted.

[0036] By gradually decreasing the threshold from 1, the observability data with the strongest causal relationship is connected by edges in order, and the graph structure becomes larger, making it possible to determine the priority of the investigation target.In the case of Figures 6A to 6C, a causal structure of VM1-related metrics for Tomcat CPU usage can be seen, so it can be inferred that VM1 is the cause.

[0037] As described above, the information processing device 1 of this embodiment includes a processing unit 11 that collectively combines various observability data acquired from managed objects at predetermined time intervals, a processing unit 12 that inputs the combined observability data and generates pseudo generated data using the combined observability data and a causal structure matrix that represents the causal structure between the observable data, and a classifier 121 that identifies whether the pseudo generated data is fake or not, and updates the causal structure matrix through repeated learning, and an output unit 13 that outputs the causal structure between observable data based on the causal structure matrix. This allows a maintenance person to understand the causal structure between observable data and shorten the time required to investigate the cause when a failure occurs.

[0038] The information processing device 1 described above may be, for example, a general-purpose computer system including a central processing unit (CPU) 901, a memory 902, a storage 903, a communication device 904, an input device 905, and an output device 906, as shown in Fig. 7. In this computer system, the information processing device 1 is realized by the CPU 901 executing a predetermined program loaded onto the memory 902. This program can be recorded on a computer-readable recording medium such as a magnetic disk, an optical disk, or a semiconductor memory, or can be distributed via a network. [Explanation of symbols]

[0039] 1. Information processing device 11 Processing Department 12 Processing section 13 Output section 3 Data storage section

Claims

1. a processing unit that compiles and combines various observability data acquired from the managed objects at predetermined time intervals; a processing unit that inputs the combined observability data and generates pseudo observable data using a causal structure matrix that represents the combined observability data and a causal structure between observable data, and updates the causal structure matrix by repeating learning using a generator that identifies whether the pseudo observable data is fake or not; An output unit that outputs a causal structure between the observable data based on the causal structure matrix. Information processing device.

2. 2. The information processing device according to claim 1, The processing unit converts the time information of the observability data into time information indicating the predetermined time interval, and combines the observability data having the same time information. Information processing device.

3. 3. The information processing device according to claim 1, The processing unit converts the observability data of the character string into a numerical value. Information processing device.

4. 4. The information processing device according to claim 1, The processing unit complements missing values ​​of the observability data combined for each predetermined time interval. Information processing device.

5. 5. An information processing apparatus according to claim 1, An element of the causal structure matrix is ​​a numerical representation of a causal structure between observability data in a row and observability data in a column of the element, The output unit outputs a directed acyclic graph in which row observability data and column observability data of elements of the causal structure matrix that are equal to or greater than a threshold are treated as nodes, and the nodes are connected by edges. Information processing device.

6. The computer Various observability data obtained from managed objects is collected and combined at a specified time interval, a generator that inputs the combined observability data and generates pseudo observable data using a causal structure matrix that represents the combined observability data and a causal structure between the observable data, and a classifier that identifies whether the pseudo observable data is fake, and updates the causal structure matrix by repeating learning using the generator and a classifier that identifies whether the pseudo observable data is fake, Outputting a causal structure between the observable data based on the causal structure matrix Information processing methods.

7. 6. A program for causing a computer to operate as each unit of the information processing device according to claim 1.

Images