Fault detection device and fault detection method

Abstract

To provide a fault detection apparatus and a fault detection method for providing stable operation of a network.SOLUTION: A fault detection apparatus configured to detect a fault of a device to be monitored and comprising a processor and a memory, includes a histogram generation unit and a fault detection unit. The histogram generation unit generates a first histogram by aggregating frequencies of a first performance value for a predetermined period by predetermined category, from first performance data formed by recording first performance values representing operation state of the device to be monitored in time series. The fault detection unit detects whether a fault has occurred in the device to be monitored in the predetermined period, in accordance with results of comparing the frequencies in each category of the first histogram with frequencies in each category of a second histogram defined as a reference.SELECTED DRAWING: Figure 17

Description

[Technical field]

[0001] The present invention relates to a fault detection device and a fault detection method. [Background technology]

[0002] Today, communication networks have become part of the social infrastructure, and there is a strong demand for stable operation. Stable operation of a network means that communication is possible and that communication can be performed at a comfortable speed.

[0003] Patent Document 1 describes a failure analysis system that discovers silent failures that cannot be discovered by error messages or inconsistencies in performance data within a managed system.

[0004] In this fault analysis system, an accumulated data processing unit detects the period of change in time series data related to the performance of the managed system, and for each phase of the detected period, calculates and accumulates an expected value of the performance data in a future phase from the past time series data of the phase, and a fault determination unit compares, for each phase in the detected period, the expected value of the performance data in the calculated phase with the actual measured value of the performance data of the managed system at the phase to determine whether there is an abnormality in the actual measured value of the performance data. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2010-86160 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, with the advancement of IT (Information Technology), the number of components in networks is rapidly increasing and they are becoming more complex, making it more difficult to operate them stably. This makes network maintenance and operation more important, and when a network failure does occur, it is desirable to minimize the duration of the failure.

[0007] To achieve this, it is necessary to shorten the time it takes to identify the cause after receiving a customer's complaint about the network.

[0008] To identify the cause of a network failure, it is necessary to narrow down the possible network components that may be causing the failure. The following four technologies are known to be used for this purpose.

[0009] 1. End-to-End Path Analysis: Technology that identifies and visualizes the network devices on the path between the starting point and the destination point used when a customer transmits data.

[0010] 2. Threshold monitoring: Technology that identifies the possibility of a fault when the performance value of a network device exceeds a specified threshold.

[0011] 3. Rule-based analysis (event correlation): A technology that sets rules for the conditions of multiple events that occur when a certain failure occurs, and if a group of events that match the rules is found when a failure actually occurs, it identifies the possibility of a failure.

[0012] 4. Anomaly analysis (multiple metrics linked): If the performance value of a network device is “normal” If the problem is not resolved (e.g., using machine learning), technology that identifies the possibility of a problem

[0013] For example, while visualizing the data transfer path with end-to-end path analysis, it judges whether it is normal or abnormal by monitoring thresholds, judges whether the behavior of the performance value of the network device is normal or abnormal by rule-based analysis based on whether it is behaving in accordance with a pre-stored fluctuation pattern of the performance value when an abnormality occurs, and judges whether it is normal or abnormal by performing anomaly analysis taking into account the correlation between performance information from the operation of the entire system. In this way, it is possible to shorten the time it takes to identify the cause of a network failure.

[0014] However, in this case, for silent failures, the above threshold monitoring and rule-based analysis may not be able to narrow down the cause.Even if the above anomaly analysis is applied, if the cause cannot be guessed or the guess is incorrect, administrators and experts for each device that makes up the system will gather together to roughly guess the cause from the content of the failure that has occurred, and then spend more time investigating all the performance information, which may take several days to several weeks to identify the cause.

[0015] Silent failures can also occur when performance data values ​​hit a ceiling (upper limit of performance) due to device bugs, configuration errors, etc. In this case, past data has also hit a ceiling in the first place, so technology such as that in Patent Document 1 cannot discover the ceiling.

[0016] The present invention has been made in consideration of the above-mentioned circumstances, and has an object to provide a fault detection device and a fault detection method that can provide stable operation of a network. [Means for solving the problem]

[0017] A fault detection device that solves the above problem is a fault detection device that detects a fault in a monitored device, and includes a processor and a memory, and a histogram generation unit that generates a first histogram by aggregating the frequency of a first performance value representing the operating state of the monitored device in predetermined classes from first performance data in which the first performance value is recorded in chronological order, and a fault detection unit that detects whether a fault has occurred in the monitored device during the predetermined period based on a result of comparing the frequency of each class of the first histogram with the frequency of each class of a second histogram that is set as a standard. a period identification unit that identifies, from third performance data in which a third performance value representing an operating state of the monitoring target device is recorded in chronological order, one or more periods in which the third performance value is equal to or lower than a predetermined value as the predetermined period; Equipped with.

[0018] Other problems and solutions disclosed in the present application will be made clear in the section of the description of the invention and the drawings. Effect of the Invention

[0019] According to the present invention, stable operation of a network can be provided. [Brief description of the drawings]

[0020] [Figure 1] FIG. 1 is a diagram showing an overall system configuration according to an embodiment. [Diagram 2] 4 is a table illustrating an example of a routing table according to the embodiment. [Diagram 3] 1 is a table illustrating an example of a metric table according to an embodiment. [Figure 4] 1 is a table illustrating an example of a performance data table according to an embodiment. [Diagram 5] 4 is a table illustrating an example of a communication quality map table according to the embodiment. [Figure 6] 1 is a table illustrating an example of a correlation metric pair table according to an embodiment. [Figure 7] 1 is a table illustrating an example of an anomaly table according to an embodiment. [Figure 8] FIG. 4 is a diagram showing an overall processing sequence according to the embodiment; [Figure 9] 11 is a diagram showing a processing sequence for identifying a path from a start IP to a destination IP according to an embodiment. FIG. [Figure 10] 11 is a diagram showing a processing sequence for creating a map of communication quality of network devices on a path according to an embodiment; [Figure 11] 1 is a diagram showing a processing sequence for detecting an anomaly that causes deterioration of communication quality according to an embodiment; [Figure 12] FIG. 13 is a diagram showing a processing sequence for finding an anomaly by detecting a drop in the correlation coefficient between two metrics according to an embodiment. [Figure 13] FIG. 11 is a diagram showing a processing sequence of another method for detecting an anomaly according to the embodiment. [Figure 14] FIG. 11 is a diagram showing a processing sequence of another method for detecting an anomaly according to the embodiment. [Figure 15] 11 is a diagram showing a processing sequence for associating deterioration of communication quality with an anomaly according to an embodiment; [Figure 16] 13 is a diagram showing an example of a screen for notifying a user of the results of an analysis of the cause of network communication quality degradation according to the embodiment. FIG. [Figure 17] 5A and 5B are diagrams illustrating how a first histogram and a second histogram according to the embodiment are generated. [Figure 18] 5A and 5B are diagrams illustrating how a first histogram and a second histogram according to the embodiment are generated. [Figure 19] FIG. 2 is a diagram illustrating an example of a functional configuration of a failure detection device according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Note that the embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment. Furthermore, the embodiment shown below may be applied alone, or multiple or all of the embodiments may be applied in combination. <Configuration>

[0022] FIG. 1 is a configuration diagram of an entire system including a fault detection device 102 and a monitored system 101 according to an embodiment of the present invention.

[0023] The monitored system 101 is an information system including a plurality of monitored devices. The monitored devices are monitored by a failure detection device 102 to determine whether or not a failure has occurred.

[0024] The monitored system 101 includes, for example, a terminal 103, a switch (SW) 104, a firewall (FW) 105, a router 106, and a business system server 107.

[0025] Each of the devices, the terminal 103, the SW 104, the FW 105, the router 106, and the business system server 107, is a monitoring target device monitored by the failure detection device 102.

[0026] Each of the monitored devices constituting the monitored system 101 is communicably connected to a failure detection device 102 .

[0027] The terminal 103 and the business system server 107 are computers (first information processing device and second information processing device) that are the source and destination (destination) of data. For example, the terminal 103 transmits a specific request to the business system server 107. In response, the business system server 107 transmits a response to the request to the terminal 107. Such a request and response are examples of data.

[0028] The SW 104, FW 105, and router 106 are all data transfer devices that constitute the network 500 that connects the terminal 103 and the business system server 107 so that they can communicate with each other.

[0029] The configuration of the monitored system 101 shown in FIG. 1 is just an example, and the number and connection state of each of the terminals 103, SW 104, FW 105, router 106, and business system server 107 are not limited to the example shown in FIG.

[0030] The failure detection device 102 is a computer that has a processor and a memory, and detects a failure in a monitored device.

[0031] The failure detection device 102 includes a hard disk drive (HDD) 108 , a memory 109 , a central processing unit (CPU) 110 , a network interface card (hereinafter referred to as a NIC) 111 , an input device 119 , an output device 120 , and a recording medium reader 121 .

[0032] The HDD 108 stores various data such as a NW performance analysis program 118 executed or processed by the fault detection device 102, a routing table 112, a metric table 113, a performance data table 114, a communication quality map table 115, a correlation metric pair table 116, and an anomaly table 117. The HDD 108 functions as a routing table storage unit 204, which will be described later.

[0033] A NW performance analysis program 118 and various data stored in the HDD 108 are read into the memory 109 and executed or processed by the CPU 110 (processor), thereby realizing various functions of the fault detection device 102. For example, the fault detection device 102 detects a fault in a device to be monitored.

[0034] Here, the HDD 108 is a non-volatile storage device, and is a solid state drive (SSD). A hard disk drive or flash memory may also be used.

[0035] In addition, the NW performance analysis program 118 is a general term for programs for realizing various functions possessed by the fault detection device 102 in this embodiment, and includes, for example, application programs and an OS (Operating System) that run on the fault detection device 102, various libraries, etc.

[0036] The recording medium reader 121 reads various programs (such as the NW performance analysis program 118) and data recorded on a recording medium 800 such as an SD card or a DVD, and stores them in the HDD .

[0037] The NIC 111 acquires various data such as various performance data from the monitored device. The NIC 111 may also exchange various programs and data with other computers (not shown). For example, the above-mentioned NW performance analysis program 118 may be stored in another computer, and the fault detection device 102 may download the NW performance analysis program 118 from this computer.

[0038] The input device 119 is a device that accepts commands and data input by a user, and may include various buttons and switches, a keyboard, a touch sensor that detects the touch position on a touch panel display, an input interface such as a microphone, an acceleration sensor, a temperature sensor, a position detection sensor such as a GPS receiver or a compass, a camera, etc.

[0039] The output device 109 is an output user interface, such as a display device, a speaker, a vibrator, and lighting.

[0040] The HDD 108 is, for example, an SSD (Solid State Drive), an optical storage device (CD (Compact Disc), DVD (Digital Versatile Disc), etc.), a storage system, a reader / writer for non-transient recording media such as an IC card, an SD card, or an optical recording medium, or a non-transient storage area of ​​a cloud server. Programs and data can be read into the HDD 108 from other information processing devices equipped with non-transient recording media or non-transient storage devices via the recording medium reader 121 or the NIC 111. The programs and data stored (stored) in the HDD 108 are read into the memory 109 as needed.

[0041] Next, the routing table 112 will be described.

[0042] 2 shows the configuration of the routing table 112. In the routing table 112, the next transfer destination when transferring data is defined for each monitored device constituting the monitored system 101, including data transfer devices such as the SW 104, the FW 105, and the router 106, the terminal 103, and the business system server 107.

[0043] In other words, when data is sent from a first information processing device to a second information processing device, for example, this routing table 112 stores information for identifying each device on the transfer path when sending data from the first information processing device, which is the source of the data, to the second information processing device, which is the destination of the data.

[0044] The information in the routing table 112 is updated as needed as the data transfer devices exchange information with each other. If a problem occurs in any of the data transfer devices and data transfer becomes impossible, the routing table 112 is rewritten so that a detour route can be provided, and it can also be set manually.

[0045] The routing table 112 is composed of an IP column in which the IP address of the monitored device itself that constitutes the monitored system 101 is stored, a destination network column in which the IP address of the destination route is stored, an IF column in which the output interface is stored, and a destination column in which the destination of the packet (data) is stored.

[0046] Next, the metric table 113 will be described.

[0047] 3 shows the configuration of the metric table 113. The metric table 113 stores a list of metrics measured or calculated in each monitored device.

[0048] Metrics are indicators for estimating the operating status of each monitored device. For example, in the example shown in Figure 3, it is described that the "number of packet drops" and "number of transmitted bytes" are measured at IF1 of device IP1.

[0049] The number of dropped packets and the number of transmitted bytes fluctuate depending on the operating state of the monitored device, but in normal operating conditions, the values ​​are within a certain expected range.

[0050] The metric table 113 has a metric ID column in which a unique identification number assigned to a metric defined in each device is stored, an IP column in which IP address information of the device is stored, an IF column in which interface information of the device is stored, and a media information column in which the media information of the device is stored. It is configured with a metric name column in which the trick name is stored.

[0051] Next, the performance data table 114 will be described.

[0052] Fig. 4 shows the configuration of the performance data table 114. This performance data table 114 stores performance data in which performance values ​​that represent the operating status of each monitored device are recorded in chronological order for each metric ID defined in the metric table 113. For example, in Fig. 4, each value such as "0" or "3" is a performance value, and the chronological arrangement of these performance values ​​is performance data. Each of these performance values ​​and performance data is data that represents the operating status of each monitored device.

[0053] The performance data table 114 is composed of a metric ID column in which a unique identification number assigned to each metric is stored, a time column in which the time at which the performance value was measured or calculated is stored, and a value column in which the performance value at that time is stored.

[0054] Next, the communication quality map table 115 will be described.

[0055] Fig. 5 shows the configuration of the communication quality map table 115. This communication quality map table 115 stores data (aggregated values) obtained by aggregating the performance values ​​of the metrics recorded in the performance data table 114 for each unit time (for example, every hour). Note that Fig. 5 shows an example in which the number of dropped packets is used as the metric. That is, in the example shown in Fig. 5, the total number of dropped packets for each unit time is recorded.

[0056] Although details will be described later, the aggregated value (number of dropped packets) stored in the communication quality map table 115 indicates the communication quality of the monitoring target device on the transfer path from the first information processing device to the second information processing device.

[0057] The communication quality map table 115 is composed of an IP column in which IP address information of the monitored device is stored, an IF column in which interface information of the monitored device is stored, a period column in which the aggregation interval (unit time) for aggregating the metric performance values ​​is stored, and a packet drop count column in which the aggregated value of the performance values ​​during that period (e.g., the aggregated value of the number of packet drops) is stored.

[0058] Next, the correlation metric pair table 116 will be described.

[0059] 6 shows the configuration of the correlated metric pair table 116. The correlated metric pair table 116 stores, in association with each other, identification information (metric IDs) of pairs of performance data that have a correlation among multiple types of performance data that indicate the operating status of each monitored device. For this reason, the correlated metric pair table 116 stores data that calculates the correlation coefficients of pairs of metrics of each monitored device.

[0060] A correlation coefficient is an index that indicates the strength of the relationship between two types of data. It is expressed as a value between -1 and +1. The closer the value is to -1, the stronger the negative correlation is evaluated, the closer it is to +1, the stronger the positive correlation is evaluated, and the closer it is to 0, the weaker the correlation is evaluated.

[0061] In this embodiment, the absolute value of the correlation coefficient is recorded, which makes it possible to detect silent failures in a monitored device not only when a pair of performance data having a positive correlation is used, but also when a pair of performance data having a negative correlation is used.

[0062] A pair of metric IDs stored in the correlation metric pair table 116 corresponds to the same monitoring The ID may not only be the ID of a metric measured or calculated in the target device, but also the ID of a metric measured or calculated in a different monitored target device.

[0063] The correlated metric pair table 116 is composed of a pair ID column in which a unique identification number assigned to a metric pair is stored, a metric ID1 column in which the ID of each metric selected as a pair is stored, a metric ID2 column, and a correlation coefficient threshold column in which the calculated correlation coefficient (absolute value) of the pair is stored.

[0064] Next, the anomaly table 117 will be described.

[0065] 7 shows the configuration of the anomaly table 117. The anomaly table 117 stores information on anomalies detected by the failure detection device 102. The anomaly table 117 stores one piece of anomaly information (also referred to as an anomaly record) in each row.

[0066] An anomaly is detected when the correlation coefficient of a pair of metrics that should be correlated (for example, first performance data and second performance data) is below a threshold value, or when histograms of performance values ​​are generated for each metric in a pair and compared, as shown in Figure 17 (details will be described later), and a class is detected in which the difference in frequency or percentage exceeds a reference value.

[0067] The anomaly table 117 is composed of an anomaly ID column in which a unique identifier assigned to anomaly information is stored, a metric ID column in which the identifier of the metric in which the anomaly occurred is stored, a period column in which the period in which the anomaly occurred is stored, and a score column in which the degree of abnormality of the anomaly is stored. <Fault detection method>

[0068] The fault detection method according to this embodiment is realized by the fault detection device 102 executing each process procedure described below.

[0069] 8 shows the overall processing procedure executed by the failure detection device 102. Based on the number of packet drops recorded in the communication quality map table 115, the failure detection device 102 finds the monitored device whose communication quality has deteriorated and the period of deterioration, and further, if an anomaly is detected in the same device and period, it detects that a silent failure (deterioration of communication quality) has occurred due to the anomaly and notifies the user.

[0070] The fault detection device 102 first receives the IP address (start IP address) of the device (first information processing device) of the customer (user) who contacted the network 500 to report a deterioration in communication quality, such as a slow communication speed, and the IP address (end IP address) of the communication destination device (second information processing device), and the period during which the communication quality deteriorated (S801). The fault detection device 102 performs the following fault detection process using this period as the period to be analyzed.

[0071] The fault detection device 102 identifies a transfer path for transmitting data from the first information processing device to the second information processing device based on the start IP address (identification information of the first information processing device), the end IP address (identification information of the second information processing device) and the routing table 112, and identifies each device on this transfer path as a monitoring target device. The fault detection device 102 also identifies the IP address and IF name of each monitoring target device (S802). Details of this process will be described with reference to FIG. 9.

[0072] Next, the failure detection device 102 refers to the performance data table 114 for each monitored device on the transfer path, tallies the number of packet drops per unit time (for example, per hour), and A communication quality map table 115 is created (S803).

[0073] In this way, the failure detection device 102 identifies the period during which the communication quality has deteriorated (period of performance degradation). Details of this process will be described with reference to FIG.

[0074] Then, the failure detection device 102 identifies an anomaly that has occurred in each monitored device on the transfer path (S804). Specifically, the failure detection device 102 refers to the performance data table 114 for the metric pairs listed in the correlated metric pair table 116, thereby identifying whether or not an anomaly has occurred in each metric during the performance degradation period (predetermined period) in which the communication quality has deteriorated. If an anomaly has occurred, the failure detection device 102 creates an anomaly table 117. Details of this process will be described with reference to FIGS. 11 to 14.

[0075] The fault detection device 102 associates the deterioration of communication quality identified in S803 with the anomaly identified in S804, and notifies the user that the communication quality has deteriorated due to the anomaly (S805). That is, the fault detection device 102 identifies the monitoring target device in which the communication quality has deteriorated and the anomaly has occurred, and the period during which the anomaly has occurred, and notifies the user. Details of this process will be described with reference to FIG. 15.

[0076] Next, FIG. 9 shows a processing procedure in which the failure detection device 102 identifies a data transfer path from a start point IP (first information processing device) to a destination point IP (second information processing device).

[0077] The failure detection device 102 acquires the IP address (identification information) of the first information processing device, and sets the IP address of the first information processing device as a starting IP address. The failure detection device 102 also acquires the IP address (identification information) of the second information processing device, and sets the IP address of the second information processing device as a finishing IP address. Then, the failure detection device 102 assigns the starting IP address to the variable "IP address" (S901).

[0078] If the content of the variable "IP address" is the destination IP address (the IP address of the second information processing device), the failure detection device 102 proceeds to S906, otherwise to S903 (S902).

[0079] If the content of the variable "IP address" is not the destination IP address, the failure detection device 102 adds the content of the variable "IP address" to an IP address list (not shown) (S903).

[0080] The failure detection device 102 then refers to the routing table 112 for the IP address added to the IP address list, and acquires the IP address of the forwarding destination (S904).

[0081] The failure detection device 102 sets the acquired IP address of the transfer destination to the variable "IP address" (S905).

[0082] Then, the failure detection device 102 repeats the processes of S902 to S905 until the latest IP address set in the variable "IP address" becomes the IP address of the end point.

[0083] If the content of the variable "IP address" is the destination IP address, the failure detection device 102 adds the destination IP address to the IP address list and ends the process (S906).

[0084] In this way, the failure detection device 102 can record the IP address of each device on the transfer path from the first information processing device to the second information processing device in an IP address list (not shown).

[0085] Next, FIG. 10 shows a processing procedure in which the failure detection device 102 refers to the performance data table 114, tallies the number of packet drops per unit time (for example, per hour) in each monitored device on the transfer path, and creates a communication quality map table 115.

[0086] In this embodiment, the number of dropped packets is used as an index of communication quality because a malfunction of the network 500 is often clearly reflected in the number of dropped packets.

[0087] However, other than the number of dropped packets, the number of error packets and the number of packet retransmissions are also considered to be indicators of a malfunction of the network 500, and therefore these may also be used as indicators.

[0088] The failure detection device 102 receives the above-mentioned analysis period and a list of IP addresses (not shown) of devices to be monitored on a path (transfer route) (S1001).

[0089] The failure detection device 102 then checks whether communication quality map creation processing has been performed for each IP address in the received IP address list. If there is an unprocessed IP address, the failure detection device 102 proceeds to step S1003, and if there is no unprocessed IP address, the failure detection device 102 ends the processing (S1002).

[0090] The failure detection device 102 selects one of the IP addresses for which the communication quality map creation process has not yet been performed (S1003).

[0091] Then, the failure detection device 102 acquires the number of packet drops of the monitoring target device identified by the selected IP address using the metric table 113 and the performance data table 114. Then, the total value per unit time (for example, per hour) is calculated (S1004).

[0092] The failure detection device 102 writes the result of the calculation in S1004 in the communication quality map table 115, and creates a communication quality map (S1005).

[0093] The failure detection device 102 repeats the processes of steps S1002 to S1005 until there are no more unprocessed IP addresses.

[0094] In this way, by referring to the communication quality map table 115, the fault detection device 102 can identify the monitored device and period (period of performance degradation) in which the number of packet drops per unit time is equal to or greater than a predetermined value (the third performance value calculated based on the number of packet drops per unit time is equal to or less than a predetermined value).

[0095] 11 shows a process performed by the fault detection device 102 to identify whether an anomaly that causes degradation of communication quality has occurred during the performance degradation period. The fault detection device 102 identifies an anomaly by referring to the performance data table 114 for the metric pairs listed in the correlated metric pair table 116.

[0096] The failure detection device 102 detects, as an anomaly, a metric whose performance value indicates a behavior different from normal. The device to be analyzed is a monitoring target device on a path (transmission route).

[0097] The failure detection device 102 receives a period of performance degradation and a list of IP addresses of devices to be monitored on a path (transmission route) (S1101).

[0098] The failure detection device 102 then receives the IP address list and sends it to each of the monitoring targets recorded in the received IP address list. It is checked whether anomaly detection processing has been performed on the IP address of the target device (S1102).

[0099] If there is an unprocessed IP address, the failure detection device 102 proceeds to step S1103, and if there is no unprocessed IP address, the process ends.

[0100] The failure detection device 102 selects one of the IP addresses for which the anomaly detection process has not yet been performed (S1103).

[0101] Then, the failure detection device 102 uses the metric table 113 and the correlated metric pair table 116 to acquire all correlated metric pairs for the monitored device identified by the IP address (S1104).

[0102] If there is an unprocessed correlated metric pair, the failure detection device 102 proceeds to S1106, and if there is no unprocessed correlated metric pair, the failure detection device 102 proceeds to S1108 (S1105).

[0103] If there are unprocessed correlated metric pairs, the failure detection device 102 selects one from the unprocessed correlated metric pairs (S1106).

[0104] The fault detection device 102 then checks for the presence or absence of an anomaly using the performance values ​​of the two metrics of the correlated metric pair selected in S1106, and if an anomaly is detected, creates a record in the anomaly table 117 (S1107). Detailed processing will be described with reference to FIG. 12 or FIG. 13.

[0105] On the other hand, if there is no correlated metric pair, the fault detection device 102 detects an anomaly using the performance value of one metric without using the correlated metric pair, and creates a record in the anomaly table 117 (S1108). Detailed processing will be described with reference to FIG.

[0106] Next, FIG. 12 shows a processing procedure (first method) in which the fault detection device 102 finds an anomaly by detecting a drop in the correlation coefficient between two metric pairs.

[0107] The fault detection device 102 first refers to the correlated metric pair table 116 and receives the pair of two metrics and the period of performance degradation. The two metrics that make up the pair are written as metric 1 and metric 2 (S1201).

[0108] Next, the failure detection device 102 initializes time T as the first time of the performance degradation period (S1202).

[0109] The fault detection device 102 sets the time window for calculating the correlation coefficient to be between T and T+W, where W is a predetermined fixed time width (S1203).

[0110] The fault detection device 102 checks whether or not the time T+W is within the performance degradation period, and if it is within the performance degradation period, proceeds to S1205, and if not, proceeds to S1207 (S1204).

[0111] The failure detection device 102 refers to the performance data table 114, acquires the performance values ​​of Metric 1 and Metric 2 during the time window, and calculates the correlation coefficient between them. The value is set as the correlation coefficient at time T+W (S1205).

[0112] The failure detection device 102 increments the time T and returns to S1203. The failure detection device 102 advances the time T and repeats the processes of S1203 to S1206.

[0113] In this manner, the failure detection device 102 obtains a correlation coefficient sequence between metrics 1 and 2 at each time from time T+W to the last time of the performance degradation period (S1206).

[0114] The failure detection device 102 then checks for the presence or absence of an anomaly, which is a period during which the absolute value of the correlation coefficient between Metric 1 and Metric 2 is less than a threshold value (S1207).

[0115] In other words, the fault detection device 102 compares the absolute value of the correlation coefficient obtained in the processing of S1205 with a predetermined threshold, and if there are a predetermined number or more (e.g., one or more) of correlation coefficients that are less than the threshold, proceeds to S1208 and creates a record in the anomaly table, and if there are fewer than a predetermined number of correlation coefficients that are less than the threshold (e.g., 0), the processing ends.

[0116] In S1208, the fault detection device 102 creates a record of the detected anomaly and records it in the anomaly table 117. The record recorded in the anomaly table 117 includes information indicating the period during which the absolute value of the correlation coefficient was continuously less than the threshold in S1207.

[0117] The period recorded in the anomaly table 117 stores the first and last times when the absolute value of the correlation coefficient was continuously less than the threshold. The score recorded in the anomaly table stores the degree of abnormality of the anomaly. The degree of abnormality of the anomaly is, for example, the total value of the difference between the absolute value of the correlation coefficient and the threshold.

[0118] Next, FIG. 13 shows another method (second method) by which the fault detection device 102 detects anomalies.

[0119] The anomalies detected here are, for example, those that, due to some unintended cause, prevent the performance value of a specific metric of the monitored device from exceeding a certain value, resulting in an upper limit on the performance. Examples of such an anomaly include a bug in the firmware of the monitored device, an incorrect setting, or a failure of a component of the monitored device.

[0120] To detect such anomalies, the fault detection device 102 uses a pair of metrics that would normally have a high correlation, as in FIG. 12. Such a pair of metrics is called metric 1 and metric 2. Here, it is assumed that there is a problem with metric 1, causing an unintended upper limit to appear in the performance value. First, the fault detection device 102 creates a histogram of the performance values ​​of metric 1 (first performance data) and metric 2 (second performance data) during the performance degradation period, as shown in FIG. 17. Note that the histogram of metric 2 serves as a reference for detecting anomalies that appear in the histogram of metric 1.

[0121] The fault detection device 102 creates the difference between each class of the histogram of metric 1 (first histogram) and the histogram of metric 2 (second histogram). As described above, the performance value of metric 1 has an unintended upper limit. Therefore, in the histogram of metric 1, the frequency of values ​​above the upper limit becomes unnaturally 0 or a very small value. On the other hand, the frequency becomes very high near the upper limit, resulting in a spike.

[0122] On the other hand, such spikes and unnaturally low values ​​do not appear in metric 2. For this reason, when calculating the difference between the histograms of metric 1 and metric 2, it is expected that there will be large spikes (positive values) near the upper limit and continuous negative values ​​above the upper limit. The fault detection device 102 can detect anomalies by finding such spikes and negative values. The processing of each step of this flow is explained below.

[0123] The fault detection device 102 first receives two paired metrics (first performance data, second performance data) and a period of performance degradation. The two metrics are referred to as metric 1 and metric 2 (S1301).

[0124] The fault detection device 102 refers to the performance data table 114 and acquires the performance value of metric 1 during the performance degradation period. The fault detection device 102 creates a histogram of metric 1 from the acquired performance value (S1302). That is, the fault detection device 102 generates a first histogram (histogram 1) by aggregating the frequency of the first performance value during the performance degradation period (predetermined period) into predetermined classes from the first performance data (metric 1) in which the first performance value of the monitored device is recorded in chronological order.

[0125] Next, the fault detection device 102 performs the same process as S1302 on metric 2 to create a histogram (histogram 2) of metric 2 (S1303). That is, the fault detection device 102 generates a second histogram (histogram 2) by aggregating the frequency of the second performance value during a performance degradation period (predetermined period) into predetermined classes from the second performance data (metric 2) in which the second performance value of the monitored device is recorded in chronological order.

[0126] Next, the fault detection device 102 calculates the difference between histogram 1 and histogram 2 (S1304). For example, the fault detection device 102 creates a difference histogram in which the difference between the frequencies of each class in each histogram is set as the value of each class.

[0127] The fault detection device 102 checks the frequency of each class in the difference histogram to check whether or not there is a spike exceeding a threshold (S1305). If there is a spike, the flow proceeds to S1306, and if not, the flow ends.

[0128] The fault detection device 102 calculates the score of the anomaly according to the size of the spike (S1306).

[0129] The fault detection device 102 calculates the total value of the frequency of the difference histogram having a class of V+1 or more, assuming that the class where the spike occurred is V (S1307). The total value may be calculated by simply adding up, or by adding up only negative values. Also, if there is even one positive value, it may be determined that it is not an anomaly, and no record may be created in the anomaly table 117 in S1310.

[0130] If the total value calculated in S1307 is equal to or less than the negative threshold, the probability of it being an anomaly is considered to be even higher, and so the fault detection device 102 proceeds to S1309; if not, the fault detection device 102 proceeds to S1310 (S1308).

[0131] Then, the fault detection device 102 adds up the anomaly scores (S1309). The addition may be the absolute value of the total value calculated earlier, or may be a value obtained by multiplying the absolute value of the total value by a coefficient such as 0.5. Also, an upper limit may be set for the addition.

[0132] The failure detection device 102 creates a record of the detected anomaly in the anomaly table 117 (S1310).

[0133] At this time, the newly created ID is stored in the anomaly ID field of the anomaly table 117. Also, the metric ID of metric 1 is stored in the metric ID field. The period field stores all periods (i.e., performance degradation periods) included in class V in which the performance value of metric 1 observed a spike in S1306 (continuous points in time are considered as one period). The scores calculated in S1306 and S1309 are stored in the score field.

[0134] Next, Fig. 14 shows another method (third method) for the fault detection device 102 to detect an anomaly. The anomaly detected by this third method is similar to that shown in Fig. 13, and is, for example, an anomaly in which the performance value of a metric measured or calculated by the monitored device is prevented from reaching a certain value or more due to some unintended cause, resulting in an upper limit on performance.

[0135] In the third method, an anomaly is detected from one metric (referred to as metric 1). As shown in Fig. 18, first, the fault detection device 102 creates a histogram (first histogram) of metric 1 (first performance data) (referred to as histogram 1).

[0136] Next, the fault detection device 102 smoothes histogram 1 using a technique such as kernel density estimation so as to reduce the variance in the frequency differences between adjacent classes in histogram 1, and creates another histogram (a second histogram) estimated from histogram 1 (called histogram 2).

[0137] Histogram 2 is a smooth histogram that uses histogram 1 as its base. By comparing smooth histogram 2 in this way with the original histogram 1, it is possible to find unnatural spikes caused by the presence of an unintended upper limit value, as well as unnatural drops in frequency that appear to the right of the upper limit value, just as with the second method.

[0138] The fault detection device 102 first receives the metric to be analyzed (metric 1) and the period of performance degradation (S1401).

[0139] The fault detection device 102 refers to the performance data table 114 and acquires the performance value of metric 1 during the performance degradation period. The fault detection device 102 creates a histogram (first histogram) of metric 1 from the acquired performance value (S1402). That is, the fault detection device 102 generates a first histogram (histogram 1) by aggregating the frequency of the first performance value during the performance degradation period (predetermined period) into predetermined classes from the first performance data (metric 1) in which the first performance value of the monitored device is recorded in chronological order.

[0140] Next, the fault detection device 102 creates histogram 2 (second histogram) by smoothing histogram 1 using a method such as kernel density estimation (S1403).

[0141] Note that the processes from S1404 onwards are the same as those in the second method described with reference to FIG. 13, and therefore will not be described.

[0142] 15 shows a process for the fault detection device 102 to associate the deterioration of communication quality with an anomaly. By associating these, it is possible to realize that the cause of the deterioration of communication quality is an anomaly.

[0143] The correlation is performed using the location and time of occurrence as conditions. That is, if the IP address and IF of the monitored device where the communication quality has deteriorated are the same as the IP address and IF of the monitored device where the anomaly has occurred, and the occurrence periods of the two overlap, the deterioration of communication quality and the anomaly are deemed to be correlated, and are displayed on a GUI (Graphical User Interface) or the like provided in the output device 120.

[0144] The fault detection device 102 searches the communication quality map table 115 for the analysis period acquired from the user, and acquires records in which the number of packet drops is equal to or greater than the threshold (the third performance value is equal to or less than a predetermined value) (S1501). These records indicate the monitored device and the period in which the communication quality is degraded (period of performance degradation). In other words, the fault detection device 102 acquires records in which the number of packet drops is equal to or greater than the threshold (the third performance value is equal to or less than a predetermined value) for the monitored device. From the third performance data in which the performance values ​​are recorded in chronological order, one or more periods in which the third performance value is equal to or lower than a predetermined value are identified as predetermined periods (performance degradation periods). These records are referred to as communication degradation records.

[0145] The fault detection device 102 refers to the metric table 113, searches the metric table 113 using the IP address and IF (interface) of the communication degradation record as keys, and acquires the metric record (S1502).

[0146] The failure detection device 102 searches the anomaly table 117 and acquires a record (referred to as an anomaly record) whose metric ID recorded in the anomaly table 117 matches the metric ID of the metric record acquired in S1502 (S1503).

[0147] The fault detection device 102 checks whether the period recorded in the anomaly record overlaps with the period recorded in the communication degradation record, and if there is a record with an overlapping period, proceeds to S1050, and if not, ends the flow (S1504).

[0148] When the period recorded in the anomaly record overlaps with the period recorded in the communication degradation record, it can be said that there is an anomaly record related to the communication degradation record.

[0149] The fault detection device 102 displays the communication degradation record and the anomaly record associated in S1504 on the GUI provided in the output device 120 (S1505). This allows the user to realize that the cause of the displayed communication degradation record may be the displayed anomaly.

[0150] Next, FIG. 16 shows an example of a screen of the output device 120 for notifying the user of the results of the analysis of the cause of the degradation of the network communication quality performed by the fault detection device 102. In FIG.

[0151] By looking at this screen, users can see at a glance the monitored device and IF where degradation in communication quality occurred, the period during which the degradation occurred, and the anomaly that is thought to be the cause of the degradation.

[0152] The fault detection device 102 displays a network path in the upper part of the screen. It displays the IP addresses and IF names of each monitored device on the path (transfer route) from the IP address (starting IP address) of the communication source (first information processing device) where the user contacted the device reporting that the communication quality was deteriorating to the IP address (terminating IP address) of the communication destination (second information processing device).

[0153] In Fig. 16, the starting IP address is IP1, the ending IP address is IP4, and IP2 and IP3 are the IP addresses of network devices (data transfer devices) along the path. IP3 is drawn as a gray circle, which indicates that there is a problem with the communication quality. The monitored devices and IFs along the path are obtained by the processing in Fig. 9.

[0154] The fault detection device 102 also displays the communication quality degradation period in a table format in the middle of the screen. The rows of the table represent the monitored devices and IFs on the path, and the columns represent time. The displayed time range is the period during which users notified the network about degradation in communication quality (analysis period), which is March 28th to March 29th in this figure.

[0155] In Figure 16, this period is divided into hourly intervals, and the periods when communication quality deteriorated (periods of performance degradation) are colored gray. The periods when communication quality deteriorated and IFs are obtained by the processing in Figure 10.

[0156] Furthermore, the fault detection device 102 classifies a period in which the communication quality is deteriorated and an anomaly occurs as a blackout period. It is colored with .

[0157] The period and IF during which an anomaly occurred are obtained by the process of FIG. 11, and the period and IF during which the deterioration of communication quality and the anomaly occurred simultaneously are identified by the process of FIG.

[0158] When these colored areas are clicked, the fault detection device 102 displays a message in the message area at the bottom of the screen.

[0159] The message shows details of the degradation of communication quality that occurred at the clicked location and details of the anomaly that occurred at the same time. Although not shown in Fig. 16, the fault detection device 102 may display a graph of the number of packet drops that indicates the degradation of communication quality and a graph showing the reason for the anomaly. <Functional configuration>

[0160] 19 shows an example of a functional configuration diagram of the fault detection device 102. The fault detection device 102 according to this embodiment has the functions of a histogram generation unit 200, a fault detection unit 201, a period identification unit 202, a fault output unit 203, a routing table storage unit 204, a device information acquisition unit 205, and a monitored device identification unit 206.

[0161] Each of these functions is realized by the hardware of the fault detection device 102 executing the NW performance analysis program 118 according to this embodiment.

[0162] The histogram generating unit 200 generates a first histogram by tallying up the frequency of the first performance value in a predetermined period of time from the first performance data in which the first performance value indicating the operating state of the monitored device is recorded in chronological order. For example, the histogram generating unit 200 generates the histogram 1 shown in Fig. 17 and Fig. 18.

[0163] Here, the monitored device is a device monitored by the failure detection device 102, and in this embodiment, is exemplified as each of the devices, such as the terminal 103, SW 104, FW 105, router 106, and business system server 107, that the monitored system 101 includes.

[0164] Moreover, the first performance data corresponds to, for example, the above-mentioned metric 1, and the first histogram corresponds to histogram 1. The predetermined period corresponds to, for example, a performance degradation period.

[0165] Then, the fault detection unit 201 detects whether or not a fault has occurred in the monitored device during the specified period based on the result of comparing the frequency of each class of the first histogram with the frequency of each class of the second histogram that is set as a standard.

[0166] In this way, the fault detection unit 201 checks the first performance value, thereby making it possible to detect whether or not a fault has occurred in the monitored device. For example, it becomes possible to detect silent faults such as performance peaking.

[0167] At this time, the fault detection unit 201 may detect that a fault has occurred in the monitored device during a specified period when a class is detected in which the frequency in the first histogram is greater than that in the second histogram by a first specified value or a first specified percentage or more.

[0168] This makes it possible to effectively detect a plateau occurring in the first performance data. In other words, when a plateau occurs in the first performance data, a spike appears in the first histogram as shown in FIG. 17, for example, and when the frequency of the class in which this spike appears is compared with the second histogram, the difference is equal to or greater than a first predetermined value or the ratio is equal to or greater than a first predetermined ratio. and can be easily detected.

[0169] Alternatively, the fault detection unit 201 may detect that a fault has occurred in the monitored device during a predetermined period of time when the frequency in the first histogram in a class higher than a certain class is equal to or less than a second predetermined value. Alternatively, the fault detection unit 201 may detect that a fault has occurred in the monitored device during a predetermined period of time when the frequency in the class higher than a certain class V in the above-mentioned difference histogram generated from histogram 1 and histogram 2 is equal to or less than a certain negative value (equal to or less than a second predetermined value).

[0170] This aspect also makes it possible to effectively detect a plateau occurring in the first performance data.

[0171] Alternatively, the fault detection unit 201 may detect that a fault has occurred in the monitored device during a specified period when a class is detected in which the frequency in the first histogram is greater than that in the second histogram by a first specified value or a first specified percentage, and the frequency in the first histogram in a class higher than this class is less than or equal to a second specified value.

[0172] This makes it possible to more reliably detect a plateau occurring in the first performance data. In other words, when a plateau occurs in the first performance data, not only will a spike appear in the first histogram, but the frequency of classes higher than the class in which the spike appears will be lower, and by detecting this, it becomes possible to prevent erroneous detection of a plateau.

[0173] The histogram generating unit 200 may generate the second histogram by aggregating the frequency of the second performance value in a predetermined period of time from the second performance data in which the second performance value, which is indicative of the operating state of the monitored device and has a correlation with the above-mentioned first performance value, is recorded in chronological order.

[0174] With this configuration, it becomes possible to detect a fault in the monitored device based on an increase in the difference (decrease in correlation) between two performance values ​​that are linked with a certain level of correlation when no fault has occurred.

[0175] At this time, the histogram generating unit 200 may identify the first performance data and the second performance data by referring to the correlated metric pair table 116, and generate the first histogram and the second histogram from the first performance data and the second performance data.

[0176] According to this embodiment, the fault detection device 102 can identify a pair of correlated metrics (first performance data and second performance data) in a short period of time, thereby making it possible to improve the efficiency of fault detection processing.

[0177] As shown in FIG. 6, the correlated metric pair table 116 is a table that stores, in association with each other, identification information of a pair of mutually correlated performance data among a plurality of types of performance data (metrics) that indicate the operating status of the monitored device.

[0178] Furthermore, the histogram generating unit 200 may generate the second histogram by smoothing the first histogram so as to reduce the variance in the difference in frequencies between adjacent classes, for example, by using a technique such as kernel density estimation, as shown in FIG. 18 .

[0179] With this aspect, the fault detection device 102 can detect a fault in the monitored device even if there is no second performance data that has a correlation with the first performance data.

[0180] Next, the period determination unit 202 determines, from the third performance data in which the third performance value representing the operating status of the monitored device is recorded in chronological order, one or more periods in which the third performance value is below a predetermined value as the above-mentioned predetermined period.

[0181] In this manner, the fault detection unit 201 can narrow down the period during which the third performance value was equal to or lower than a predetermined value, and then perform fault detection for the monitored device using the first and second histograms, thereby making it possible to detect a fault in a shorter period of time.

[0182] The third performance value may be calculated based on the number of dropped packets per unit time, for example. For example, the reciprocal of the number of dropped packets per unit time may be set as the third performance value.

[0183] Then, the fault output unit 203 outputs information indicating each predetermined period during which the third performance value was equal to or lower than the predetermined value, and information indicating a period during which a fault in the monitored device was detected within each predetermined period.

[0184] With this aspect, as shown in FIG. 16, by presenting to the user the period during which some performance degradation occurred (the period during which the third performance value was below a predetermined value) and the period during which an anomaly occurred due to a failure in the monitored device, it is possible to present the cause of the failure to the user in a manner that is easier to understand.

[0185] The monitored device in this embodiment is a device that is detected by the fault detection device 102 to determine whether or not a fault has occurred, but it may also be, for example, any one of a first information processing device that transmits data to a specified destination using a communication network, a second information processing device that is the destination of the data, and a plurality of data transfer devices that make up the communication network.

[0186] At this time, the fault detection device 102 may be provided with a routing table storage unit 204 that stores a routing table 112 that determines the next transfer destination when transferring data for each of the first information processing device, the second information processing device, and the multiple data transfer devices, and may identify each device on the transfer path when transmitting data from the first information processing device to the second information processing device as a device to be monitored.

[0187] According to this aspect, it becomes possible to effectively identify the cause of a failure that occurs in a communication network in which various devices are connected in a complex manner.

[0188] The routing table storage unit 204 is realized as, for example, the HDD 108 .

[0189] In this case, the fault detection device 102 may be equipped with a device information acquisition unit 205 and a monitored device identification unit 206, the device information acquisition unit 205 acquiring identification information of the first information processing device which is the source of the data and identification information of the second information processing device which is the destination of the data, and the monitored device identification unit 206 identifying each device on the transfer path when transmitting data from the first information processing device to the second information processing device, which is identified based on the identification information of the first information processing device, the identification information of the second information processing device, and the routing table 112, as a monitored device.

[0190] In this manner, it is possible to detect a fault by identifying each device on the transfer path from a first information processing device used by a user who has complained about a malfunction in the communications network to a second information processing device that is the destination of the data, and therefore the fault detection device 102 can effectively narrow down the scope of investigation when searching for the device causing the fault.

[0191] The fault detection device 102 and fault detection method according to the present embodiment have been described above. The fault detection device 102 and fault detection method according to the present embodiment can provide stable operation of the network. It is also possible to automatically detect silent fault candidates in the network. Furthermore, it is possible to shorten the time from receiving a complaint from a customer to identifying the cause. It is also possible to efficiently detect performance plateaus (upper performance limit) occurring in a device that is the subject of fault monitoring.

[0192] Furthermore, even if a silent failure has occurred from the beginning due to a bug in the equipment or the like, it is possible to provide a fault analysis device and a fault analysis system that can detect the point where a performance upper limit (plateau) has occurred at a value other than the expected threshold value and discover the silent failure.

[0193] For example, when a network fault analysis device receives an analysis request for a network device 1, it refers to the correlation table to identify the correlated network device 2. It compares histograms created from the performance values ​​of the network device 1 and the identified network device 2, detects the difference, and determines whether an abnormality has occurred. If there is no correlated network device, it compares a histogram created from the performance value of the network device 1 that received the analysis request with a histogram estimated from that performance value, and determines whether an abnormality has occurred by detecting the difference.

[0194] The fault analysis device and the fault analysis system have a correlation table that records pairs of NW devices whose performance values ​​are correlated. The NW fault analysis device is characterized by comprising the steps of: upon receiving an analysis request for a certain NW device 1, referring to the correlation table to identify a correlated NW device 2; comparing histograms created from the performance values ​​of the NW device 1 and the identified NW device 2 and detecting a difference to determine whether an abnormality has occurred; and, if there is no correlated NW device, comparing a histogram created from the performance value of the NW device 1 that received the analysis request with a histogram estimated from the performance value and detecting a difference to determine whether an abnormality has occurred.

[0195] Also included is a failure analysis device and a failure analysis system that analyzes the performance values ​​of a network management system to detect a type of failure known as a silent failure in order to ensure stable operation of the network system.

[0196] For example, the fault analysis device acquires one or more time series data regarding the performance of a managed system, creates two histograms from the acquired data using a specified method, compares the two histograms, and detects the occurrence of an abnormality by detecting a section (section 1) in which the frequency of histogram 1 is significantly higher than the frequency of histogram 2 compared to the previous and following sections.

[0197] In this case, the step of detecting the occurrence of an anomaly may further include increasing the probability of determining that an anomaly has occurred when it is detected that the frequency of the interval after interval 1 of histogram 1 is significantly low.

[0198] Furthermore, the step of creating the two histograms may further include correlation pair information that records the correspondence between each performance value of the managed system and another performance value that is highly correlated with that performance value, and based on the retained correlation pair information, time series data of a performance value that is highly correlated with the histogram (histogram 1) is obtained, and a histogram created from that time series data may be used as a predicted value of the histogram (histogram 2).

[0199] In addition, the step of creating the two histograms may include, when there is no other performance value having a high correlation with each performance value of the managed system, using the histogram 1 as an input. The density distribution estimated by the above may be used as the histogram 2.

[0200] The step of detecting the occurrence of an abnormality may involve identifying network devices on a path between a start point and an end point of a customer complaint by path analysis.

[0201] The step of detecting the occurrence of an abnormality may also involve plotting the packet loss by time of each identified network device, and identifying (extracting) a time when a failure is likely to occur.

[0202] The above-described embodiment is for the purpose of facilitating understanding of the present invention, and is not intended to limit the present invention. The present invention may be modified or improved without departing from the spirit of the present invention, and equivalents thereof are also included in the present invention.

[0203] In addition, the above-mentioned configurations, functions, processing units, processing means, etc. may be realized in part or in whole by hardware, for example, by designing them as integrated circuits. In addition, the above-mentioned configurations, functions, etc. may be realized in software by a processor interpreting and executing a program that realizes each function. Information such as the programs, tables, and files that realize each function may be stored in a memory, a recording device such as a hard disk or SSD (Solid State Drive), or Alternatively, it may be placed on a recording medium such as an IC card, an SD card, or a DVD.

[0204] In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0205] 101 Monitored Systems 102 Obstacle detection device 103 Terminal 104 SW 105FW 106 Router 107 Business system server 108 HDD 109 Memory 110 CPU 111NIC 112 Routing Table 113 Metric Table 114 Performance Data Table 115 Communication Quality Map Table 116 Correlated Metric Pairs Table 117 Anomaly Table 118 NW Performance Analysis Program 119 Input Device 120 Output Device 121 Recording medium reader 500 Communication Network 800 Recording media

Claims

1. A fault detection device that detects a fault in a monitored device, A processor and a memory, a histogram generating unit that generates a first histogram by aggregating the frequency of the first performance value in a predetermined period of time according to a predetermined class from first performance data in which a first performance value indicating an operating state of the monitored device is recorded in chronological order; a fault detection unit that detects whether a fault has occurred in the monitored device during the predetermined period of time based on a result of comparing a frequency of each class of the first histogram with a frequency of each class of a second histogram that is set as a reference; a period identification unit that identifies, from third performance data in which a third performance value representing an operating state of the monitoring target device is recorded in chronological order, one or more periods in which the third performance value is equal to or smaller than a predetermined value as the predetermined period; A fault detection device comprising:

2. 2. The fault detection device according to claim 1, The failure detection unit A fault detection device that detects that a fault has occurred in the monitored device during the specified period when a class is detected whose frequency in the first histogram is greater than that in the second histogram by a first specified value or a first specified percentage.

3. 2. The fault detection device according to claim 1, The failure detection unit A fault detection device that detects that a fault has occurred in the monitored device during the specified period when a class is detected in which the frequency in the first histogram is greater than or equal to a first specified value or a first specified percentage greater than the second histogram, and when the frequency of the first histogram in a class higher than the first class is less than or equal to a second specified value.

4. 2. The fault detection device according to claim 1, The histogram generation unit of the fault detection device generates the second histogram by aggregating the frequency of the second performance value in the specified period from second performance data in which second performance values ​​that represent the operating status of the monitored device and are correlated with the first performance value are recorded in chronological order, by the specified class.

5. 5. The fault detection device according to claim 4, a correlation metric pair table that stores, in association with each other, identification information of a pair of performance data having a correlation among a plurality of types of performance data that represent the operating status of the monitored device; Further equipped with The histogram generation unit generates the first histogram and the second histogram from the first performance data and the second performance data specified by referring to the correlated metric pair table.

6. 2. The fault detection device according to claim 1, The histogram generating unit generates the second histogram by smoothing the first histogram so as to reduce a variance in the difference in frequency between adjacent classes.

7. A fault detection device as claimed in claim 1, a fault output unit that outputs information indicating each of the predetermined periods during which the third performance value became equal to or less than the predetermined value, and information indicating a period during which a fault was detected in the monitored device among the predetermined periods; The fault detection device further comprises:

8. 2. The fault detection device according to claim 1, the monitoring target device is any one of a first information processing device that transmits data to a predetermined destination using a communication network, a second information processing device that is the destination of the data, and a plurality of data transfer devices that constitute the communication network; a routing table storage unit that stores a routing table that determines a next transfer destination when transferring data for each of the first information processing device, the second information processing device, and the plurality of data transfer devices; a device information acquisition unit that acquires identification information of the first information processing device that is a source of the data and identification information of the second information processing device that is a destination of the data; a monitoring target device specification unit that specifies, as the monitoring target device, each device on a transfer path when transmitting the data from the first information processing device to the second information processing device, the transfer path being specified based on the identification information of the first information processing device, the identification information of the second information processing device, and the routing table; The fault detection device further comprises:

9. The fault detection device according to claim 8, The period determination unit, A fault detection device that identifies, for each data transfer device identified as the monitored device, one or more periods during which a third performance value calculated based on the number of packet drops per unit time is below a predetermined value as the specified period.

10. A method for detecting a failure in a monitored device, comprising: A fault detection device having a processor and a memory, generating a first histogram by aggregating the frequency of the first performance value in a predetermined period of time into a predetermined rank from first performance data in which a first performance value representing an operating state of the monitored device is recorded in chronological order; detecting whether a fault has occurred in the monitored device during the predetermined period of time based on a result of comparing the frequency of each class of the first histogram with a frequency of each class of a second histogram that is set as a reference; A fault detection method, comprising: identifying, from third performance data in which a third performance value representing the operating status of the monitored device is recorded in chronological order, one or more periods in which the third performance value is below a predetermined value as the predetermined period.

Images