Information processing device, monitoring system, monitoring method, and monitoring program

Abstract

To provide an information processing apparatus and the like which can evaluate the state of a monitoring device itself which monitors a device to be monitored.SOLUTION: An information processing apparatus monitors a monitoring device which monitors a device to be monitored. The information processing apparatus includes a determination unit, a collection unit, a comparison unit, and an evaluation unit. The determination unit determines whether log information of the monitoring device has been periodically acquired or not. If the log information could not be acquired, the collection unit collects resource information of a comparison object of the monitoring device. The comparison unit compares the resource information of the comparison object collected by the collection unit with previously stored ordinary resource information. The evaluation unit evaluates a state of the monitoring device on the basis of a comparison result of the comparison unit.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to an information processing device, a monitoring system, a monitoring method, and a monitoring program. [Background technology]

[0002] FIG. 18 is an explanatory diagram showing an example of a conventional monitoring system 200. The monitoring system 200 shown in FIG. 18 includes an installation store 201A, a data center 202, and a security center 203. The installation store 201A is a store or the like in which an ATM (Automatic Teller Machine) 201, which is a monitored device, is installed. The data center 202 includes a GW (Gateway) device 204. The GW device 204 is a monitoring device that provides a business application to the ATM 201 and remotely monitors the state of the ATM 201. The business application is an application for executing a business in the ATM 201. The GW device 204 includes an active GW (Gateway) device 204A and a standby GW device 204B. The security center 203 is a base of a security company that guards and maintains the ATM 201. The security center 203 includes an operator terminal 203A operated by an operator.

[0003] For example, when an abnormality such as vibration is detected by a sensor in the ATM 201, the ATM 201 notifies the GW device 204 of the details of the failure by a dial report on a telephone line and a TCP report on an Internet line. Note that the TCP report is a primary report including, for example, identification information for identifying the faulty ATM 201, the model of the faulty ATM 201, and detailed failure information indicating the details of the failure, whereas the dial report is a secondary report including, for example, the telephone number of the location where the faulty ATM 201 is installed. When the GW device 204 receives the dial report and the TCP report from the ATM 201, the GW device 204 merges the dial report and the TCP report and reports the merged report to the operator terminal 203A in the security center 203. As a result, the operator of the security center 203 recognizes the details of the failure from the dial report and the TCP report, and recognizes the failure or abnormality of the ATM 201. Then, the operator can dispatch a security guard to the faulty ATM 201. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2007-323198 A [Patent Document 2] JP 2007-272328 A [Patent Document 3] JP 2013-175085 A [Patent Document 4] JP 2019-49411 A [Patent Document 5] JP 2002-7172 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, in the conventional monitoring system 200, even if the ATM 201 breaks down, if the GW device 204 itself freezes due to an abnormality in a business application, the GW device 204 cannot send a dial report or a TCP report to the security center 203. In other words, if the GW device 204 breaks down, it cannot report to the security center 203. Therefore, the reality is that there is a demand for an information processing device that evaluates the state of a monitoring device itself, such as the GW device 204 that monitors a monitored device such as the ATM 201.

[0006] One aspect of the present invention is to provide an information processing device etc. capable of evaluating the state of a monitoring device itself that monitors a monitored device. [Means for solving the problem]

[0007] An information processing device of one embodiment monitors a monitoring device that monitors a monitored device. The information processing device has a determination unit, a collection unit, a comparison unit, and an evaluation unit. The determination unit determines whether log information of the monitoring device has been periodically acquired. The collection unit collects resource information of a comparison target of the monitoring device when the log information cannot be acquired. The comparison unit compares the resource information of the comparison target collected by the collection unit with normal state resource information stored in advance. The evaluation unit evaluates the state of the monitoring device based on the comparison result of the comparison unit. Effect of the Invention

[0008] As one aspect, the status of the monitoring device itself that monitors the monitored device can be evaluated. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is an explanatory diagram showing an example of a monitoring system according to the present embodiment. [Diagram 2] FIG. 2 is a block diagram showing an example of a functional configuration of an ATM. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a functional configuration of the GW device. [Figure 4] FIG. 4 is a block diagram illustrating an example of a functional configuration of the server device. [Diagram 5] FIG. 5 is an explanatory diagram illustrating an example of a table configuration of the resource memory. [Figure 6] FIG. 6 is an explanatory diagram illustrating an example of a table configuration of the target resource memory. [Figure 7] FIG. 7 is an explanatory diagram showing an example of a table configuration of the resource memory in normal mode. [Figure 8] FIG. 8 is an explanatory diagram showing an example of a table configuration of the threshold pattern memory. [Figure 9] FIG. 9 is a flow chart showing an example of the processing operation of the CPU in the server device related to the first collection processing. [Figure 10] FIG. 10 is a flow chart showing an example of a processing operation of the CPU in the server device related to the monitoring process. [Figure 11] FIG. 11 is a flow chart showing an example of a processing operation of the CPU in the server device related to the verification processing. [Figure 12] FIG. 12 is a flow chart showing an example of the processing operation of the CPU in the server device related to the second collection processing. [Figure 13] FIG. 13 is a flow chart showing an example of the processing operation of the CPU in the server device related to the evaluation processing. [Figure 14] FIG. 14 is a flow chart showing an example of a processing operation of the CPU in the server device related to the re-verification processing. [Figure 15] FIG. 15 is a flow diagram showing an example of a processing operation of the CPU in the server device related to the GW switching processing. [Figure 16] FIG. 16 is a flowchart showing an example of the processing operation of the CPU in the server device related to the third collection process. [Figure 17] FIG. 17 is a block diagram showing an example of the configuration of an information processing device that executes a monitoring program. [Figure 18] FIG. 18 is an explanatory diagram showing an example of a conventional monitoring system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the information processing device and the like disclosed in the present application will be described in detail with reference to the drawings. Note that the disclosed technology is not limited to the embodiment. In addition, the embodiments shown below may be appropriately combined as long as no contradiction occurs. EXAMPLES

[0011] [Configuration of monitoring system 1] FIG. 1 is an explanatory diagram showing an example of a monitoring system 1 of the present embodiment. The monitoring system 1 shown in FIG. 1 includes an installation store 2A, a data center 3, and a security center 4. The installation store 2A is a store or the like in which an ATM (Automatic Teller Machine) 2, which is a monitored device, is installed. The data center 3 includes a GW (Gateway) device 5 and a server device 6. The GW device 5 is a monitoring device that provides business applications to the ATM 2 and remotely monitors the state of the ATM 2. The GW device 5 includes an active GW device 5A and a standby GW device 5B. The server device 6 is an information processing device that monitors the GW device 5. The security center 4 is a base of a security company that guards and maintains the ATM 2. The security center 4 includes an operator terminal 4A operated by an operator of the security center 4.

[0012] [ATM Configuration] FIG. 2 is a block diagram showing an example of a functional configuration of the ATM 2. The ATM 2 shown in FIG. 2 has a deposit / withdrawal mechanism 11, a first communication unit 12, a second communication unit 13, a touch panel 14, a memory 15, a sensor 16, a mechanism control unit 17, and a CPU (Central Process Unit) 18. The deposit / withdrawal mechanism 11 is a mechanical mechanism for depositing and withdrawing cash. The first communication unit 12 is a communication interface for communicating with the GW device 5 by dial communication on a telephone line. The second communication unit 13 is a communication interface for communicating with the GW device 5 by TCP communication on an Internet line. The touch panel 14 is an input / output interface having a panel function for displaying various information and a touch function for inputting various commands. The memory 15 is an area for storing various information related to the ATM 2. The sensor 16 is various sensors in the ATM 2, and includes, for example, a vibration sensor for detecting external vibrations to the ATM 2. The mechanism control unit 17 is a mechanical control unit that drives and controls the deposit / withdrawal mechanism 11. The CPU 18 controls the entire ATM 2. When the ATM 2 detects the lock / unlock of the door or abnormal vibration by the sensor 16, it notifies the GW device 5 of the ATM abnormality by TCP notification and dial notification. By reporting using different communication lines for TCP notification and dial notification, even if a failure occurs in one line, the ATM 2 notifies the GW device 5 of the abnormality of the ATM 2 using the other communication line. Furthermore, the ATM 2 notifies the GW device 5A of the active system and the GW device 5B of the standby system of the abnormality of the ATM 2 by dial notification and TCP notification. Note that the TCP notification of the Internet line is the main notification of the main line, and the dial notification of the telephone line is the secondary notification of the secondary line.

[0013] [GW device] FIG. 3 is a block diagram showing an example of the functional configuration of the GW device 5. The GW device 5 shown in FIG. 3 has a first communication unit 21, a second communication unit 22, a third communication unit 23, a server communication unit 24, a memory 25, and a CPU 26. The first communication unit 21 is a communication interface that communicates with the ATM 2 by dial communication on a telephone line. The second communication unit 22 is a communication interface that communicates with the ATM 2 by TCP communication on an Internet line. The third communication unit 23 is a communication interface that communicates with the security center 4 by a dedicated line. The server communication unit 24 is a communication interface that communicates with the server device 6. The memory 25 is an area that stores information related to the GW device 5. The CPU 26 controls the entire GW device 5. The GW device 5 in the monitoring system 1 has a GW device 5A of an active system and a GW device 5B of a standby system, but the configurations are the same. The active GW device 5A is a GW device that monitors the ATM 2, which is a monitoring target device. The standby GW device 5B is a GW device for switching over the active GW device 5A when the active GW device 5A fails. When the active GW device 5A receives an abnormality of the ATM 2 by a dial report and a TCP report from the ATM 2, it notifies the operator terminal 4A in the security center 4 of the ATM abnormality. The operator in the security center 4 uses the operator terminal 4A that received the ATM abnormality to dispatch a security guard to the ATM 2 in the store 2A where the ATM is installed, based on the ATM identification information in the ATM abnormality.

[0014] [Server device] Fig. 4 is a block diagram showing an example of a functional configuration of the server device 6. The server device 6 shown in Fig. 4 has a communication unit 31, a memory 32, and a CPU 33. The communication unit 31 is a communication interface that communicates with the GW device 5. The memory 32 is an area that stores various information related to the server device 6. The CPU 33 controls the entire server device 6.

[0015] The memory 32 has a log update date and time memory 41, a setting memory 42, a resource memory 43, a target resource memory 44, a normal resource memory 45, and a threshold pattern memory 46. The log update date and time memory 41 is an area for storing the date and time of periodic log updates for the GW device 5. The setting memory 42 is an area for storing log monitoring timing 42A and resource acquisition timing 42B. The log monitoring timing 42A is a monitoring interval for periodic log monitoring for the GW device 5. The monitoring interval is, for example, 10 seconds and can be changed as appropriate. The resource acquisition timing 42B is a collection interval for periodically collecting resource information in the GW device 5. The collection interval is, for example, 10 seconds and can be changed as appropriate.

[0016] The resource information in the GW device 5 is, for example, resource information such as CPU usage rate, memory usage rate, disk usage rate, and network usage rate. The CPU usage rate is the usage rate currently in use from the maximum usage rate (100%) available for the CPU 26 in the GW device 5. The memory usage rate is the usage rate currently in use from the maximum usage rate (100%) available for the memory 25 in the GW device 5. The disk usage rate is the usage rate currently in use from the maximum usage rate (100%) available for the disk (not shown) in the GW device 5. The network usage rate is the usage rate currently in use from the maximum usage rate (100%) available for the first communication unit 21, the second communication unit 22, and the third communication unit 23 in the GW device 5.

[0017] The resource memory 43 is an area for storing periodically collected resource information by collection date and time. FIG. 5 is an explanatory diagram showing an example of a table configuration of the resource memory 43. The resource memory 43 shown in FIG. 5 is an area for storing resource names, collection dates and times, and usage rates in association with each other. The resource name is information for identifying, for example, CPU usage rate, memory usage rate, DISK usage rate, and network usage rate. The collection date and time is the date and time when the resource information was collected. The usage rate is the usage rate related to the resource information at the collection date and time. The first collection unit 53 periodically collects resource information during execution of a business application in the GW device 5 in accordance with the collection interval timing, and sequentially stores the collected resource information in the resource memory 43.

[0018] The target resource memory 44 is an area for storing resource information to be compared. The resource information to be compared is resource information to be compared with normal resource information to be described later. FIG. 6 is an explanatory diagram showing an example of a table configuration of the target resource memory 44. The target resource memory 44 shown in FIG. 6 is an area for storing resource names related to the resource information to be compared and usage rates in association with each other. The resource names are information for identifying, for example, CPU usage rate, memory usage rate, DISK usage rate, and network usage rate. The usage rates are usage rates related to the resource information to be compared. The second collection unit 54 searches the resource memory 43 for resource information during the most recent business application execution based on the log date and time, and stores the searched resource information in the target resource memory 44 as resource information to be compared.

[0019] The normal resource memory 45 is an area in which resource information in normal times to be compared with the resource information to be compared is stored in advance. The resource information in normal times is resource information in a state in which the business application of the GW device 5 operates normally and there is no TCP report or dial report from the ATM 2. FIG. 7 is an explanatory diagram showing an example of a table configuration of the normal resource memory 45. The normal resource memory 45 shown in FIG. 7 is an area in which resource names related to the resource information in normal times and normal usage rates are stored in association with each other. The resource names are, for example, information identifying the CPU usage rate, memory usage rate, DISK usage rate, and network usage rate. The normal usage rate is a usage rate related to the resource information in normal times while the business application is being executed. For convenience of explanation, the CPU usage rate, memory usage rate, DISK usage rate, and network usage rate are normal usage rates, for example, 10%.

[0020] The threshold pattern memory 46 is an area for storing evaluation contents according to a comparison result of comparing resource information to be compared with resource information in a normal state. FIG. 8 is an explanatory diagram showing an example of a table configuration of the threshold pattern memory 46. The threshold pattern memory 46 shown in FIG. 8 is an area for storing a judgment formula and a comparison result in association with each other for each pattern. In the pattern "1", the state of the GW device 5 is "frozen" as a comparison result. In the pattern "2", the state of the GW device 5 is "not frozen" as a comparison result. In the pattern "3", the state of the GW device 5 is "reverification" as a comparison result. In the pattern "4", the state of the GW device 5 is "frozen" as a comparison result of the reverification. In the pattern "5", the state of the GW device 5 is "not frozen" as a comparison result of the reverification.

[0021] The CPU 33 has an acquisition unit 51, a judgment unit 52, a first collection unit 53, a second collection unit 54, a third collection unit 55, a comparison unit 56, and an evaluation unit 57. The acquisition unit 51 acquires the log update date and time of the GW device 5 in accordance with the log monitoring timing. The log monitoring timing is, for example, at intervals of 10 seconds. The acquisition unit 51 periodically acquires the log of the business application executed in the GW device 5 by using a remote command of the server OS in the GW device 5. The log is the update date and time of the log acquired by the acquisition unit 51.

[0022] The determination unit 52 determines whether the log update date and time acquired by the acquisition unit 51 is new or not by comparing it with the log update date and time stored in the log update date and time memory 41. If the acquired log update date and time is new, the determination unit 52 determines that the periodic log of the GW device 5 has been successfully acquired, and stores the acquired log update date and time in the log update date and time memory 41. If the acquired log update date and time is not new, the determination unit 52 determines that the periodic log of the GW device 5 cannot be acquired.

[0023] The first collection unit 53 collects resource information during execution of a business application in the GW device 5 according to the resource collection timing, and stores the collected resource information and collection date and time in the resource memory 43. The resource information is the CPU usage rate, memory usage rate, DISK usage rate, and network usage rate of the GW device 5.

[0024] If the judgment unit 52 determines that the log update date and time is not new, the second collection unit 54 searches the resource memory 43 for resource information related to the collection date and time most recent from the log update date and time, and stores this resource information in the target resource memory 44 as resource information to be compared.

[0025] If the comparison result is "re-verification", the third collection unit 55 collects resource information of the current GW device 5 during execution of the business application, and stores this resource information in the target resource memory 44 as resource information to be compared.

[0026] The comparison unit 56 compares the resource information to be compared with the resource information in normal times when the determination unit 52 determines that the log update date and time is not new. When the comparison result is “re-verification”, the comparison unit 56 compares the resource information to be compared with the resource information in normal times.

[0027] The evaluation unit 57 refers to the threshold pattern memory 46, and when the comparison result is pattern "1", evaluates the state of the GW device 5 as abnormal, for example, a frozen state. The evaluation unit 57 evaluates the state of the GW device 5 as a frozen state when the CPU usage rate in a normal state > the CPU usage rate of the comparison target, the memory usage rate in a normal state > the memory usage rate of the comparison target, the DISK usage rate in a normal state > the DISK usage rate of the comparison target, and the DISK usage rate in a normal state > the DISK usage rate of the comparison target.

[0028] The evaluation unit 57 refers to the threshold pattern memory 46, and when the comparison result is pattern "2", evaluates the state of the GW device 5 as normal, for example, a no-freeze state. The evaluation unit 57 evaluates the state of the GW device 5 as a no-freeze state when the CPU utilization rate in normal state≦the CPU utilization rate of the comparison target, the memory utilization rate in normal state≦the memory utilization rate of the comparison target, the DISK utilization rate in normal state≦the DISK utilization rate of the comparison target, and the DISK utilization rate in normal state≦the DISK utilization rate of the comparison target.

[0029] The evaluation unit 57 refers to the threshold pattern memory 46, and when the comparison result is pattern "3", evaluates the state of the GW device 5 as re-verification. When the evaluation unit 57 detects any one of the following: CPU usage rate in normal state > CPU usage rate of the comparison target, memory usage rate in normal state > memory usage rate of the comparison target, DISK usage rate in normal state > DISK usage rate of the comparison target, and DISK usage rate in normal state > DISK usage rate of the comparison target, the evaluation unit 57 evaluates the state of the GW device 5 as re-verification. Note that, since there is a state of waiting for processing even when the business application of the GW device 5 is operating normally, the re-verification process is executed taking such a state into consideration. Then, when the comparison unit 56 evaluates the state of the GW device 5 as re-verification, the comparison unit 56 executes a re-verification process of comparing the current resource information as the resource information of the comparison target with the resource information in normal state.

[0030] Then, the evaluation unit 57 refers to the threshold pattern memory 46, and if the comparison result after re-verification is pattern "4", evaluates the state of the GW device 5 as abnormal, for example, a frozen state. If the evaluation unit 57 detects any one of the following: CPU usage rate in normal times > CPU usage rate of the comparison target, memory usage rate in normal times > memory usage rate of the comparison target, DISK usage rate in normal times > DISK usage rate of the comparison target, or DISK usage rate in normal times > DISK usage rate of the comparison target, the evaluation unit 57 evaluates the state of the GW device 5 as a frozen state.

[0031] Furthermore, the evaluation unit 57 refers to the threshold pattern memory 46, and when the comparison result after re-verification is pattern "5", evaluates the state of the GW device 5 as normal, for example, a no-freeze state. The evaluation unit 57 evaluates the state of the GW device 5 as a no-freeze state when the CPU utilization rate in normal state≦the CPU utilization rate of the comparison target, the memory utilization rate in normal state≦the memory utilization rate of the comparison target, the DISK utilization rate in normal state≦the DISK utilization rate of the comparison target, and the DISK utilization rate in normal state≦the DISK utilization rate of the comparison target.

[0032] When the state of the GW device 5 is not frozen as an evaluation result of the evaluation unit 57, the evaluation unit 57 judges that the state of the GW device 5 is normal and continues monitoring. When the state of the GW device 5 is frozen as an evaluation result of the evaluation unit 57, the evaluation unit 57 judges that the state of the GW device 5 is abnormal and executes GW switching processing of the GW device 5. That is, the GW switching processing is a process of switching the active GW device 5A evaluated as abnormal to the standby GW device 5B, and at the same time outputting a command to each GW device 5 to switch the standby GW device 5B to the active GW device 5A. As a result, the business application of the abnormal GW device 5 monitoring the ATM 2 is automatically restored.

[0033] Next, the operation of the monitoring system 1 of this embodiment will be described.

[0034] [First collection process] Fig. 9 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the first collection process. In Fig. 9, the first collection unit 53 in the CPU 33 in the server device 6 determines whether or not the current time is a regular collection timing (step S11). The regular collection timing is the collection interval timing of the first collection unit 53. If the current time is a regular collection timing (step S11: Yes), the first collection unit 53 acquires the current date and time as the collection date and time (step S12).

[0035] After acquiring the current date and time, the first collection unit 53 collects the CPU utilization rate at the collection date and time related to the GW device 5 (step S13). The first collection unit 53 stores the collected CPU utilization rate at the collection date and time in the resource memory 43 (step S14).

[0036] Furthermore, the first collection unit 53 collects memory usage rates at the collection dates and times related to the GW device 5 (step S15). The first collection unit 53 stores the collected memory usage rates at the collection dates and times in the resource memory 43 (step S16).

[0037] Furthermore, the first collection unit 53 collects the DISK usage rate at the collection date and time related to the GW device 5 (step S17). The first collection unit 53 stores the collected DISK usage rate at the collection date and time in the resource memory 43 (step S18).

[0038] Furthermore, the first collection unit 53 collects the network usage rate at the collection date and time related to the GW device 5 (step S19). The first collection unit 53 stores the collected network usage rate at the collection date and time in the resource memory 43 (step S20). Then, the CPU 33 determines whether or not there is an end interrupt (step S21).

[0039] If there is an end interrupt (step S21: Yes), the CPU 33 ends the processing operation shown in Fig. 9. If there is no end interrupt (step S21: No), the CPU 33 returns to the processing of step S11 to determine whether or not it is currently the regular collection timing.

[0040] If the current timing is not the regular collection timing (step S11: No), the CPU 33 returns to the process of step S21 to determine whether or not there is an end interrupt.

[0041] The server device 6 executing the first collection process periodically collects the CPU utilization rate, memory utilization rate, disk utilization rate, and network utilization rate of the GW device 5. Then, the server device 6 stores the CPU utilization rate, memory utilization rate, disk utilization rate, and network utilization rate for each collection date and time in the resource memory 43. As a result, the server device 6 can periodically collect resource information of the GW device 5. Note that, although the example has been given of the case where the server device 6 collects resource information of each GW device 5, for example, both the active GW device 5A and the standby GW device 5B, the server device 6 may periodically collect only the resource information of the active GW device 5A, and this can be changed as appropriate.

[0042] [Monitoring process] Fig. 10 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the monitoring process. In Fig. 10, the CPU 33 in the server device 6 sets a monitoring target, a log monitoring timing, and normal time resources (step S31). The monitoring target is the GW device 5 to be monitored. The acquisition unit 51 in the CPU 33 acquires a periodic log of the active GW device 5A to be monitored (step S32). After acquiring the periodic log, the determination unit 52 in the CPU 33 refers to the log update date and time memory 41 and determines whether the log date and time of the periodic log is new or not (step S33).

[0043] If the log date and time of the periodic log is new (step S33: Yes), the determination unit 52 updates the log date and time of the current periodic log as the log update date and time in the log update date and time memory 41 (step S34). The acquisition unit 51 determines whether or not the current time is the log monitoring timing (step S35).

[0044] If the current time is the log monitoring timing (step S35: Yes), the acquisition unit 51 returns to the process of step S32 to acquire a periodic log. If the current time is not the log monitoring timing (step S35: No), the CPU 33 determines whether or not there is an end interrupt (step S36).

[0045] If there is an end interrupt (step S36: Yes), the CPU 33 ends the monitoring process shown in Fig. 9. If there is no end interrupt (step S36: No), the determination unit 52 returns to the process of step S35 to determine whether or not it is now the log monitoring timing.

[0046] Furthermore, the determination unit 52 refers to the log update date and time memory 41, and if the log date and time of the periodic log is not new (step S33: No), it determines that there is a possibility of an abnormality in the GW device 5, and executes the verification process shown in Fig. 11 (step S37). After executing the verification process, the evaluation unit 57 in the CPU 33 determines whether the verification result is freeze or not (step S38).

[0047] If the verification result is freeze (step S38: Yes), the evaluation unit 57 executes the GW switching process shown in Fig. 15 (step S39). After executing the GW switching process, the evaluation unit 57 determines whether the GW switching is normal or not (step S40).

[0048] If the GW switching is normal (step S40: Yes), the determination unit 52 returns to the process of step S35 to determine whether or not the current time is the log monitoring timing. If the GW switching is not normal (step S40: No), the evaluation unit 57 outputs an error log (step S41) and returns to the process of step S35 to determine whether or not the current time is the log monitoring timing. The evaluation unit 57 notifies the operator terminal 4A of the security center 4 of the error log. As a result, the operator of the security center 4 can recognize the error of the GW device 5 from the error log. If the verification result is not freeze (step S38: No), the determination unit 52 returns to the process of step S35 to determine whether or not the current time is the log monitoring timing.

[0049] When the log date and time of the periodic log of the GW device 5 is not new, the server device 6 that executes the monitoring process determines that there is a possibility of an abnormality in the GW device 5, and executes a verification process to verify the state of the GW device 5. As a result, the server device 6 executes the verification process at the timing when it determines that there is a possibility of an abnormality in the GW device 5.

[0050] If the verification result indicates a freeze, the server device 6 automatically switches the GW device 5. As a result, the burden on operators and security guards required for the recovery work of the GW device 5 can be reduced.

[0051] In addition, the judgment unit 52 refers to the log update date and time memory 41, and performs the verification process when the log date and time of the periodic log is not new. However, the verification process may be performed when the log date and time of the periodic log cannot be obtained periodically, and can be changed as appropriate.

[0052] [Verification process] Fig. 11 is a flow diagram showing an example of a processing operation of the CPU 33 in the server device 6 related to the verification processing. In Fig. 11, the second collection unit 54 in the CPU 33 in the server device 6 executes the second collection processing shown in Fig. 12 (step S51). Furthermore, after executing the second collection processing, the comparison unit 56 in the CPU 33 executes the evaluation processing shown in Fig. 13 (step S52).

[0053] After executing the evaluation process, the evaluation unit 57 in the CPU 33 determines whether the evaluation result is freeze or not (step S53). If the evaluation result is freeze (step S53: Yes), the evaluation unit 57 outputs freeze as the verification result (step S54) and ends the verification process shown in FIG.

[0054] Moreover, if the evaluation result is not freeze (step S53: No), the evaluation unit 57 outputs "no freeze" as the verification result (step S55), and ends the verification process shown in FIG.

[0055] If the evaluation result is "freeze", the server device 6 that executes the verification process outputs "freeze" as the verification result. As a result, the server device 6 determines that the GW device 5 is in a frozen state, which is an abnormality.

[0056] [Second collection process] Fig. 12 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the second collection process. In Fig. 12, the second collection unit 54 in the CPU 33 in the server device 6 acquires the collection date and time (step S61). After acquiring the collection date and time, the second collection unit 54 searches the resource memory 43 for the CPU usage rate related to the active GW device 5A for the date and time immediately preceding the collection date and time (step S62). The second collection unit 54 stores the searched CPU usage rate for the date and time immediately preceding the collection date and time in the target resource memory 44 (step S63).

[0057] Furthermore, the second collection unit 54 searches the resource memory 43 for the memory usage rate related to the active GW device 5A from the collection date and time to the most recent date and time (step S64). The second collection unit 54 stores the searched memory usage rate for the most recent date and time in the target resource memory 44 (step S65).

[0058] Furthermore, the second collection unit 54 searches the resource memory 43 for the DISK usage rate related to the active GW device 5A from the collection date and time to the most recent date and time (step S66). The second collection unit 54 stores the searched DISK usage rate for the most recent date and time in the target resource memory 44 (step S67).

[0059] Furthermore, the second collection unit 54 searches the resource memory 43 for the network usage rate related to the active GW device 5A from the collection date and time to the most recent date and time (step S68). The second collection unit 54 stores the searched network usage rate from the most recent date and time in the target resource memory 44 (step S69), and executes the second collection process shown in FIG.

[0060] The server device 6 executing the second collection process searches the resource memory 43 for resource information on the CPU usage rate, memory usage rate, disk usage rate, and network usage rate for the most recent date and time from the collection date and time. Then, the server device 6 stores the searched resource information for the most recent date and time in the target resource memory 44. As a result, the server device 6 can obtain the resource information for the most recent date and time from the collection date and time as the resource information to be judged.

[0061] [Evaluation process] Fig. 13 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the evaluation processing. In Fig. 13, the comparison unit 56 in the CPU 33 in the server device 6 acquires normal resources including a CPU usage rate under normal conditions, a memory usage rate under normal conditions, a disk usage rate under normal conditions, and a network usage rate under normal conditions from the normal resource memory 45 (step S71).

[0062] The comparison unit 56 acquires from the target resource memory 44 resources to be judged, including the CPU utilization rate of the judgment target, the memory utilization rate of the judgment target, the disk utilization rate of the judgment target, and the network utilization rate of the judgment target (step S72).

[0063] The comparison unit 56 compares the normal resource in step S71 with the judgment target resource in step S72 (step S73). The evaluation unit 57 in the CPU 33 refers to the threshold pattern memory 46 based on the comparison result and judges whether the comparison result is pattern "1" or not (step S74).

[0064] If the comparison result is pattern "1" (step S74: Yes), the evaluation unit 57 evaluates that the state of the GW device 5 is frozen, that is, abnormal (step S75), and ends the processing operation shown in FIG.

[0065] If the comparison result is not pattern "1" (step S74: No), the evaluation unit 57 refers to the threshold pattern memory 46 based on the comparison result and determines whether the comparison result is pattern "2" (step S76).

[0066] If the comparison result is pattern "2" (step S76: Yes), the evaluation unit 57 evaluates that the state of the GW device 5 is not frozen, that is, normal (step S77), and ends the processing operation shown in FIG.

[0067] If the comparison result is not pattern "2" (step S76: No), the evaluation unit 57 refers to the threshold pattern memory 46 based on the comparison result and determines that the comparison result is pattern "3" (step S78). After determining that the comparison result is pattern "3", the evaluation unit 57 executes the re-verification process shown in Fig. 14 (step S79) and ends the processing operation shown in Fig. 13.

[0068] The server device 6 that executes the evaluation process compares the resource information of the judgment target with the resource information in normal times, and if the comparison result is pattern "1", evaluates the state of the GW device 5 as a frozen state as the evaluation result. As a result, the server device 6 can recognize that the state of the GW device 5, i.e., the state of the active GW device 5A, is abnormal.

[0069] If the comparison result is pattern "2", the server device 6 evaluates the state of the GW device 5 as a non-freeze state as an evaluation result. As a result, the server device 6 can recognize the state of the GW device 5, i.e., the state of the active GW device 5A, as normal.

[0070] If the comparison result is pattern "3", the server device 6 evaluates that the state of the GW device 5 is re-verification as the evaluation result. As a result, the server device 6 can recognize that the state of the GW device 5, i.e., the state of the active GW device 5A, is re-verification.

[0071] [Re-verification process] Fig. 14 is a flow diagram showing an example of a processing operation of the CPU 33 in the server device 6 related to the re-verification process. In Fig. 14, the third collection unit 55 in the CPU 33 in the server device 6 executes the third collection process shown in Fig. 16 (step S81). After executing the third collection process, the third collection unit 55 collects current resources including a current CPU usage rate, a current memory usage rate, a current disk usage rate, and a current network usage rate (step S82).

[0072] The comparison unit 56 in the CPU 33 compares the normal resource with the current resource in step S82 (step S83). The evaluation unit 57 in the CPU 33 refers to the threshold pattern memory 46 based on the comparison result and determines whether the comparison result is pattern "4" or not (step S84).

[0073] If the comparison result is pattern "4" (step S84: Yes), the evaluation unit 57 evaluates that the state of the GW device 5 is frozen, that is, abnormal (step S85), and ends the processing operation shown in FIG.

[0074] If the comparison result is not pattern "4" (step S84: No), the evaluation unit 57 refers to the threshold pattern memory 46 based on the comparison result and determines that the comparison result is pattern "5" (step S86). After determining that the comparison result is pattern "5", the evaluation unit 57 evaluates that the state of the GW device 5 is not frozen, that is, normal (step S87), and ends the processing operation shown in FIG.

[0075] The server device 6 that executes the re-verification process compares the resource information in the normal state with the current resource information, and if the comparison result is pattern "4", evaluates the state of the GW device 5 as a frozen state as the evaluation result. As a result, the server device 6 can re-verify and recognize that the state of the GW device 5, i.e., the state of the active GW device 5A, is abnormal.

[0076] The server device 6 compares the resource information in normal times with the current resource information, and if the comparison result is pattern "5", evaluates the state of the GW device 5 as a non-freeze state as an evaluation result. As a result, the server device 6 can re-verify and recognize the state of the GW device 5, i.e., the state of the active GW device 5A, as normal.

[0077] [GW switching process] Fig. 15 is a flow diagram showing an example of a processing operation of the CPU 33 in the server device 6 related to the GW switching process. In Fig. 15, the evaluation unit 57 in the CPU 33 in the server device 6 switches the current active GW device 5 to the standby GW device 5, and at the same time outputs a switching signal to each GW device 5 for switching the standby GW device 5 to the active GW device 5 (step S91).

[0078] After outputting the switching signal, the CPU 33 determines whether the switching of the GW device 5 is normal (step S92). If the switching of the GW device 5 is normal (step S92: Yes), the CPU 33 sets the switching to normal (step S93) and ends the processing operation shown in FIG.

[0079] Furthermore, if the switching of the GW device 5 is not normal (step S92: No), the CPU 33 sets a switching abnormality (step S94) and ends the processing operation shown in FIG.

[0080] The server device 6 that executes the GW switching process switches the active GW device 5A to the standby GW device 5B, and the standby GW device 5B to the active GW device 5A. The server device 6 sets the switching to normal when the switching is normal, and sets the switching to abnormal when the switching is abnormal. As a result, the server device 6 can automatically restore the abnormal GW device 5.

[0081] [Third collection process] Fig. 16 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the third collection process. In Fig. 16, the third collection unit 55 in the CPU 33 in the server device 6 collects the CPU utilization rate at the current date and time related to the active GW device 5A (step S101). The third collection unit 55 stores the collected CPU utilization rate at the current date and time in the target resource memory 44 (step S102).

[0082] Furthermore, the third collection unit 55 collects the memory usage rate at the current date and time related to the active GW device 5A (step S103). The third collection unit 55 stores the collected memory usage rate at the current date and time in the target resource memory 44 (step S104).

[0083] Furthermore, the third collection unit 55 collects the DISK usage rate at the current date and time related to the active GW device 5A (step S105). The third collection unit 55 stores the collected DISK usage rate at the current date and time in the target resource memory 44 (step S106).

[0084] Furthermore, the third collection unit 55 collects the network usage rate at the current date and time related to the active GW device 5A (step S107). The third collection unit 55 stores the collected network usage rate at the current date and time in the target resource memory 44 (step S108), and ends the third collection process shown in FIG.

[0085] The server device 6 executing the third collection process collects the CPU utilization rate, memory utilization rate, disk utilization rate, and network utilization rate of the active GW device 5A at the current date and time. The server device 6 stores the collected CPU utilization rate, memory utilization rate, disk utilization rate, and network utilization rate at the current date and time in the resource memory 43. As a result, the server device 6 can collect current resource information of the active GW device 5A.

[0086] In this embodiment, the server device 6 collects resource information of the comparison target of the GW device 5 when log information of a business application executed by the GW device 5 cannot be periodically acquired. The server device 6 compares the collected resource information of the comparison target with normal resource information stored in advance, and evaluates the status of the GW device 5 based on the comparison result. As a result, the server device 6 can evaluate the status of the GW device 5 monitoring the ATM 2. For example, even if the GW device 5 executing the business application freezes, the server device 6 can recognize an abnormality in the GW device 5.

[0087] When the server device 6 is unable to periodically acquire log information of an application executed by the active GW device 5A, the server device 6 collects resource information of a comparison target of the active GW device 5A. The server device 6 compares the collected resource information of the comparison target with normal resource information stored in advance, and evaluates the state of the active GW device 5A based on the comparison result. As a result, the server device 6 can evaluate the state of the active GW device 5A. For example, even if the active GW device 5A that executes a business application freezes, the server device 6 can recognize an abnormality in the active GW device 5A.

[0088] When the usage rate in the resource information to be compared is less than the usage rate in the normal resource information, the server device 6 evaluates the state of the active GW device 5A as abnormal. When the usage rate in the resource information to be compared is equal to or greater than the usage rate in the normal resource information, the server device 6 evaluates the state of the active GW device 5A as normal. As a result, the server device 6 can evaluate the state of the active GW device 5A that monitors the ATM 2.

[0089] The server device 6 evaluates the state of the active GW device 5A as abnormal when all the usage rates for different types in the resource information to be compared are less than the usage rates for each type in the resource information in normal state. Furthermore, the server device 6 evaluates the state of the active GW device 5A as normal when all the usage rates for each type in the resource information to be compared are equal to or greater than the usage rates for each type in the resource information in normal state. As a result, the server device 6 can evaluate the state of the active GW device 5A that monitors the ATM 2.

[0090] The server device 6 periodically collects resource information of the active GW device 5A, and stores the resource information for each collected collection date and time in the resource memory 43. Furthermore, when the server device 6 is unable to acquire log information, it searches the resource memory 43 for resource information with the collection date and time closest to the log date and time as resource information to be compared. As a result, the server device 6 can use the resource information with the collection date and time closest to the log date and time as resource information to be compared.

[0091] When the usage rate of a part of the different types in the resource information to be compared is less than the usage rate of each type in the resource information in normal time, the server device 6 evaluates the state of the GW device 5A of the active system as re-verification. When the state of the GW device 5A of the active system is evaluated as re-verification, the server device 6 collects the current resource information of the active system GW device 5A. The server device 6 compares the collected current resource information with the resource information in normal time, and when the usage rate of a part of the different types in the resource information to be compared is less than the usage rate of each type in the resource information in normal time, the server device 6 evaluates the state of the GW device 5A of the active system as abnormal. When all the usage rates of each type in the resource information to be compared are equal to or greater than the usage rate of each type in the resource information in normal time, the server device 6 evaluates the state of the GW device 5A of the active system as normal. As a result, the server device 6 can re-evaluate the state of the GW device 5A of the active system even when the state is evaluated as re-verification.

[0092] In this embodiment, it is possible to determine whether a business application is frozen and automatically recover it in the event of an abnormality without directly modifying the business application by using resource information on the GW device 5 on which the business application executed by the GW device 5 runs. Moreover, even if the implementation or architecture of the business application is old and there are few engineers who can maintain it, it is possible to automatically recover the GW device 5 from an abnormal state to a normal state.

[0093] Conventionally, because an operator cannot detect a malfunction of a business application, the GW device is periodically switched and other operational measures (preventive measures) are taken. In contrast, in this embodiment, since an abnormality in the GW device 5 can be automatically detected, periodic switching work is not required. As a result, the burden on the operator monitoring the monitoring system 1 can be significantly reduced.

[0094] Moreover, in this embodiment, even if it is impossible to determine whether the business application of the GW device 5 has frozen or is waiting for processing under normal operation, the state of the GW device 5 can be evaluated. As a result, even if it is unclear whether the GW device 5 has frozen, a re-verification process is executed without switching the GW device 5 unnecessarily. As a result, the burden on the operator monitoring the monitoring system 1 can be significantly reduced.

[0095] In this embodiment, the case where various processes are executed in the server device 6 in the data center 3 has been exemplified, but the processes of the server device 6 may be executed in the cloud, and changes can be made as appropriate.

[0096] Furthermore, in the monitoring system 1, a system for monitoring the status of the GW device 5 that monitors the ATM 2 for financial operations as the monitored device has been exemplified. However, the monitored device is not limited to the ATM 2, and may be various devices such as a personal computer, a vending machine, a betting ticket terminal, a payment terminal, etc., and may be changed as appropriate.

[0097] In addition, in this embodiment, examples of resource information for evaluating the status of the GW device 5 include CPU utilization rate, memory utilization rate, DISK utilization rate, and network utilization rate, but these are not limited to these, and the indicators for evaluating the status of the GW device 5 can be changed as appropriate.

[0098] In the acquisition unit 51 of this embodiment, an example is shown of a case where log information of a business application executed by the GW device 5 is periodically acquired, but this is not limited to the log information of the business application, and the log information of the GW device 5 may be periodically acquired, and this can be changed as appropriate.

[0099] Furthermore, each component of each unit shown in the figure does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each unit is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

[0100] Furthermore, the various processing functions performed by each device may be executed in whole or in part on a CPU (Central Processing Unit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), etc. Also, the various processing functions may be executed in whole or in part on a program that is analyzed and executed by a CPU, etc., or on hardware using wired logic.

[0101] The area for storing various information may be configured, for example, with a ROM (Read Only Memory), a RAM (Random Access Memory) such as an SDRAM (Synchronous Dynamic Random Access Memory), an MRAM (Magnetoresistive Random Access Memory), or an NVRAM (Non-Volatile Random Access Memory).

[0102] The various processes described in this embodiment can be realized by executing a prepared program in a processor such as a CPU in an information processing device. Therefore, an example of an information processing device 100 that executes a program having the same functions as those in the above embodiment will be described below. Fig. 17 is an explanatory diagram showing an example of an information processing device 100 that executes a monitoring program.

[0103] 17 includes a communication unit 101, a HDD 102, a ROM 103, a RAM 104, a processor 105, and a bus 106. The communication unit 101, the HDD 102, the ROM 103, the RAM 104, and the processor 105 are connected via the bus 106. The information processing device 100 monitors a monitoring device that monitors a monitoring target device.

[0104] The ROM 103 stores a monitoring program that performs the same functions as those of the above embodiment. The ROM 103 stores a judgment program 103A, a collection program 103B, a comparison program 103C, and an evaluation program 103D as monitoring programs. The information processing program may be stored in a computer-readable recording medium, not in the ROM 103, but in a drive (not shown). The recording medium may be, for example, a portable recording medium such as a CD-ROM, a DVD disk, or a USB memory, or a semiconductor memory such as a flash memory.

[0105] Then, the processor 105 reads out the judgment program 103A from the ROM 103, and causes it to function as a judgment process 104A on the RAM 104. Furthermore, the processor 105 reads out the collection program 103B from the ROM 103, and causes it to function as a collection process 104B on the RAM 104. Furthermore, the processor 105 reads out the comparison program 103C from the ROM 103, and causes it to function as a comparison process 104C on the RAM 104. Furthermore, the processor 105 reads out the evaluation program 103D from the ROM 103, and causes it to function as an evaluation process 104D on the RAM 104.

[0106] The processor 105 judges whether or not log information of a monitoring device is periodically acquired. If the processor 105 is unable to acquire the log information, the processor 105 collects resource information of the monitoring device to be compared. The processor 105 compares the collected resource information of the comparison target with normal resource information stored in advance. The processor 105 evaluates the status of the monitoring device based on the comparison result. As a result, the status of the monitoring device itself that monitors the monitored device can be evaluated. [Explanation of symbols]

[0107] 1. Surveillance System 2 ATM 5 GW equipment 6 Server equipment 43 Resource Memory 44 Target Resource Memory 45 Normal resource memory 46 Threshold Pattern Memory 51 Acquisition Department 52 Judgment section 53 First Collection Section 54 Second Collection Section 55 The Third Collection Section 56 Comparison section 57 Evaluation Section

Claims

1. An information processing device that monitors an ATM (Automatic Teller Machine) and a monitoring device that provides a business application to the ATM, a determination unit that determines whether log information of the business application executed in the monitoring device is periodically acquired; a collection unit that collects resource information of the monitoring device to be compared when the log information cannot be acquired; a comparison unit that compares the resource information to be compared collected by the collection unit with normal resource information stored in advance; an evaluation unit that evaluates whether or not the monitoring device has frozen based on a comparison result of the comparison unit, The evaluation unit is An information processing device characterized in that when the utilization rate in the resource information to be compared is less than the utilization rate in the normal resource information, the state of the monitoring device is evaluated as being in a frozen state, and when the utilization rate in the resource information to be compared is equal to or greater than the utilization rate in the normal resource information, the state of the monitoring device is evaluated as being in a non-frozen state.

2. The evaluation unit is The information processing device according to claim 1, characterized in that if the usage rates of all different types in the resource information to be compared are less than the usage rates of each type in the normal resource information, the status of the monitoring device is evaluated as abnormal, and if the usage rates of all the types in the resource information to be compared are equal to or greater than the usage rates of each type in the normal resource information, the status of the monitoring device is evaluated as normal.

3. a first collection unit that periodically collects resource information of the monitoring device; a resource memory that stores the resource information for each collection date and time collected by the first collection unit, The collecting unit includes:

3. The information processing apparatus according to claim 2, characterized in that, when the log information cannot be acquired, the resource information having the collection date and time closest to the date and time when the log information could not be acquired is searched for from the resource memory as the resource information to be compared.

4. The evaluation unit is 4. The information processing apparatus according to claim 3, wherein when a usage rate of a part of different types in the resource information to be compared is less than a usage rate of the type in the normal resource information, the state of the monitoring apparatus is evaluated as being re-verified.

5. a second collection unit that collects current resource information of the monitoring device when the evaluation unit evaluates the state of the monitoring device as the re-verification, The comparison unit is comparing the current resource information collected by the second collection unit with the resource information in the normal state; The evaluation unit is 5. The information processing device according to claim 4, characterized in that if the usage rate of some of the different types in the resource information to be compared is less than the usage rate of each type in the normal resource information, the state of the monitoring device is evaluated as abnormal, and if the usage rates of all of the types in the resource information to be compared are equal to or greater than the usage rates of each type in the normal resource information, the state of the monitoring device is evaluated as normal.

6. An information processing device as described in any one of claims 2 to 5, characterized in that the utilization rate in the resource information includes at least one of a CPU utilization rate indicating the utilization status of a CPU in the monitoring device, a memory utilization rate indicating the utilization status of a memory in the monitoring device, a disk utilization rate indicating the utilization status of a disk in the monitoring device, and a network utilization rate indicating the utilization status of network communication of the monitoring device.

7. A monitoring system having an ATM (Automatic Teller Machine), a monitoring device that monitors the ATM and provides a business application to the ATM, and an information processing device that monitors the monitoring device, The information processing device includes: a determination unit that determines whether log information of the business application executed in the monitoring device is periodically acquired; a collection unit that collects resource information of the monitoring device to be compared when the log information cannot be acquired; a comparison unit that compares the resource information to be compared collected by the collection unit with normal resource information stored in advance; an evaluation unit that evaluates whether or not the monitoring device has frozen based on a comparison result of the comparison unit, The evaluation unit is A monitoring system characterized by evaluating the state of the monitoring device as being in a frozen state when the utilization rate in the resource information to be compared is less than the utilization rate in the normal resource information, and evaluating the state of the monitoring device as being in a non-frozen state when the utilization rate in the resource information to be compared is equal to or greater than the utilization rate in the normal resource information.

8. An information processing device that monitors an ATM (Automatic Teller Machine) and a monitoring device that provides a business application to the ATM, determining whether log information of the business application executed in the monitoring device is periodically acquired; When the log information cannot be acquired, resource information of the monitoring device is collected for comparison; comparing the collected resource information to be compared with pre-stored normal resource information; Based on the comparison result, a process of evaluating whether or not the monitoring device has frozen is performed; The process to be evaluated is A monitoring method characterized by evaluating the state of the monitoring device as being in a frozen state when the utilization rate in the resource information to be compared is less than the utilization rate in the normal resource information, and evaluating the state of the monitoring device as being in a non-frozen state when the utilization rate in the resource information to be compared is equal to or greater than the utilization rate in the normal resource information.

9. A processor in an information processing device that monitors an ATM (Automatic Teller Machine) and a monitoring device that provides a business application to the ATM, determining whether log information of the business application executed in the monitoring device is periodically acquired; When the log information cannot be acquired, resource information of the monitoring device is collected for comparison; comparing the collected resource information to be compared with pre-stored normal resource information; Executing a process for evaluating whether or not the monitoring device has frozen based on the comparison result; The process to be evaluated is A monitoring program characterized by evaluating the state of the monitoring device as being in a frozen state when the utilization rate in the resource information to be compared is less than the utilization rate in the normal resource information, and evaluating the state of the monitoring device as being in a non-frozen state when the utilization rate in the resource information to be compared is equal to or greater than the utilization rate in the normal resource information.

Images