Monitoring device, monitoring method, and program

Abstract

One objective of the present disclosure is to provide a monitoring apparatus and the like that can assist in monitoring devices in a system that includes devices for which an agent cannot be set. A monitoring apparatus according to an embodiment of the present disclosure is provided with: a storage means that stores configuration information corresponding to each of a plurality of devices included in a system; a first identification means that identifies configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information has not been set; a second identification means that identifies a second device, which is a device among the plurality of devices that corresponds to configuration information similar to the configuration information corresponding to the first device and for which the agent has been set; and an association means that associates operational information of the second device, which includes information collected by the agent, with the first device.

Description

[Technical Field]

[0001] The present disclosure relates to a technique for managing a system using configuration information. [Background technology]

[0002] When managing a system, it is common to monitor the devices included in the system. Patent Document 1 discloses a technology for managing a system that operates a group of multiple virtual servers. In particular, Patent Document 1 discloses monitoring the operating status of the virtual servers based on information collected from agents set in the virtual servers. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2016-051399 A Summary of the Invention [Problem to be solved by the invention]

[0004] Some devices cannot be configured with an agent that collects the above-mentioned information due to reasons such as a lack of resources or the device's operating system (OS) not being compatible with agents. Devices that cannot be directly configured with an agent can collect less information than devices that can be directly configured with an agent. As a result, there is a risk that devices that cannot be directly configured with an agent cannot be monitored appropriately.

[0005] Patent Document 1 does not disclose a monitoring method when there is a device for which an agent cannot be set.

[0006] The present disclosure has been made in consideration of the above-mentioned problems, and one of its objectives is to provide a monitoring device or the like that can assist in monitoring equipment in a system that includes equipment in which an agent cannot be set. [Means for solving the problem]

[0007] A monitoring device according to one aspect of the present disclosure includes a storage means for storing configuration information corresponding to each of a plurality of devices included in a system; a first identification means for identifying configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information is not set; a second identification means for identifying a second device among the plurality of devices for which configuration information similar to that corresponding to the first device is set and for which the agent is set; and a matching means for matching operation information of the second device, including information collected by the agent, with the first device.

[0008] A monitoring method according to one aspect of the present disclosure includes a process of storing configuration information corresponding to each of a plurality of devices included in a system, identifying configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information is not set, identifying a second device among the plurality of devices for which configuration information similar to the configuration information corresponding to the first device and for which the agent is set, and associating operational information of the second device, including information collected by the agent, with the first device.

[0009] A computer-readable storage medium according to one aspect of the present disclosure stores a program that causes a computer to execute the following processes: storing configuration information corresponding to each of a plurality of devices included in a system; identifying configuration information corresponding to a first device among the plurality of devices for which an agent that collects information is not set; identifying a second device among the plurality of devices that corresponds to configuration information similar to that corresponding to the first device and for which the agent is set; and associating operational information of the second device, including information collected by the agent, with the first device. [Effects of the Invention]

[0010] According to the present disclosure, it is possible to assist in monitoring devices in a system that includes devices for which an agent cannot be set. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a diagram schematically illustrating an example of a configuration including a monitoring device according to a first embodiment of the present disclosure. [Figure 2] 1 is a block diagram illustrating an example of a functional configuration of a monitoring device according to a first embodiment of the present disclosure. [Figure 3] 5 is a flowchart illustrating an example of an operation of the monitoring device according to the first embodiment of the present disclosure. [Figure 4] FIG. 10 is a diagram schematically illustrating an example of a configuration including a monitoring device according to a second embodiment of the present disclosure. [Figure 5] FIG. 10 is a block diagram illustrating an example of a functional configuration of a monitoring device according to a second embodiment of the present disclosure. [Figure 6] FIG. 10 is a diagram illustrating an example of a relationship between configuration information according to a second embodiment of the present disclosure. [Figure 7] 10 is a flowchart illustrating an example of an operation of a monitoring device according to a second embodiment of the present disclosure. [Figure 8] 10 is a flowchart showing another example of the operation of the monitoring device according to the second embodiment of the present disclosure. [Figure 9] FIG. 10 is a diagram schematically illustrating an example of a configuration including a monitoring device according to a third embodiment of the present disclosure. [Figure 10] FIG. 10 is a block diagram illustrating an example of a functional configuration of a monitoring device according to a third embodiment of the present disclosure. [Figure 11] 10 is a flowchart illustrating an example of an operation of a monitoring device according to a third embodiment of the present disclosure. [Figure 12] 10 is a flowchart showing an example of the operation of a monitoring device according to a fourth modification of the present disclosure. [Figure 13] FIG. 13 is a block diagram illustrating an example of a functional configuration of a monitoring device according to a fifth modification of the present disclosure. [Figure 14] FIG. 2 is a block diagram showing an example of a hardware configuration of a computer device that realizes a monitoring device according to the first, second, third, and fourth embodiments of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0013] First Embodiment An overview of the monitoring device of the present disclosure will be described.

[0014] FIG. 1 is a diagram schematically illustrating an example of a configuration including a monitoring device 100. As shown in FIG. 1, the monitoring device 100 is communicatively connected to communication devices 200-1, 200-2, ..., 200-n (n is a natural number equal to or greater than 1) via a wireless or wired network. The monitoring device 100 may be further communicatively connected to a terminal (not shown) of a user who manages the monitoring device 100. Here, when there is no need to distinguish between the communication devices 200-1, 200-2, ..., 200-n, they will simply be referred to as communication devices 200. The communication devices 200 may be communicatively connected to other communication devices 200 to form a network. Furthermore, each of the communication devices 200 is not limited to being the same device.

[0015] The monitoring device 100 manages a system including the communication device 200. The system including the communication device 200 is a system that provides services via a network. The communication device 200 is a device that constitutes the system. The communication device 200 includes network devices, server devices, storage devices, etc. The system constituted by the communication device 200 may be, for example, a system that constructs an in-house network of a company, or a system that controls machine tools, sensors, etc. used in a factory. Furthermore, the system constituted by the communication device 200 may be a system that constructs a network of communication lines. When a network of communication lines is constructed, for example, the communication device 200 may be a device having functions such as a base station, a core, and a switch, including an RU (Radio Unit), a DU (Distributed Unit), and a CU (Central Unit), etc.

[0016] 2 is a block diagram showing an example of the functional configuration of the monitoring device 100 according to the first embodiment. As shown in FIG. 2, the monitoring device 100 includes a storage unit 110, a first identification unit 120, a second identification unit 130, and an association unit 140.

[0017] The storage unit 110 stores configuration information. The configuration information is information indicating the configuration of the communication devices 200 included in the system. For example, the configuration information of the communication devices 200 includes information set in the communication devices 200, information on electronic components mounted on the communication devices 200, and information on software installed in the communication devices 200. The configuration information may also include information indicating whether an agent is set in the corresponding communication device 200. The storage unit 110 stores configuration information corresponding to each of the communication devices 200. At this time, the storage unit 110 may store the configuration information, for example, based on input by a user operating the monitoring device 100. In this way, the storage unit 110 stores configuration information corresponding to each of the multiple devices included in the system. The storage unit 110 is an example of a storage means.

[0018] The first identification unit 120 identifies a device that does not have an agent installed among the multiple communication devices 200 included in the system. An agent is a software module that collects various types of information from a target device. Note that the agent may also perform other operations. The agent may also be called an agent program or a software agent. Here, a device that does not have an agent installed is, for example, a device that does not have an agent installed and does not collect information using the agent. Note that devices that do not have an agent installed are not limited to this example. For example, an agent installed on a server may acquire information about devices that can communicate with the server. Such devices that do not have an agent installed directly but indirectly collect information using the agent may also be included in the "devices that do not have an agent installed" in the present disclosure. Note that in the present disclosure, a device that does not have an agent installed is also referred to as a "first device." Then, the first identification unit 120 identifies configuration information corresponding to the first device.

[0019] In this way, the first identifying unit 120 identifies the configuration information corresponding to the first device among the plurality of devices for which an agent that collects information is not set. The first identifying unit 120 is an example of a first identifying means.

[0020] The second identification unit 130 uses the configuration information corresponding to the identified first device to identify a device similar to the first device. A device similar to the first device is a device having a configuration similar to that of the first device. The second identification unit 130, for example, identifies a device similar to the configuration of the first device based on the configuration information. For example, the second identification unit 130 compares the configuration information corresponding to the first device identified by the first identification unit 120 with the configuration information stored in the storage unit 110. At this time, the target to be compared with the configuration information corresponding to the first device is, for example, the configuration information of a device in which an agent is set. Then, for example, the second identification unit 130 identifies a device corresponding to configuration information similar to the configuration information corresponding to the first device as a result of the comparison. The similar configuration information may be configuration information that matches the configuration information corresponding to the first device, or may be configuration information that includes information common to the configuration information corresponding to the first device. In the present disclosure, a device that corresponds to configuration information similar to that corresponding to the first device and in which an agent is set is also referred to as a second device. In this manner, the second identification unit 130 identifies, from among the multiple devices, a second device that corresponds to configuration information similar to that corresponding to the first device and in which an agent is set. The second identification unit 130 is an example of a second identification means.

[0021] The associating unit 140 associates predetermined operation information with the first device. The operation information includes, for example, log information of the communication device 200, statistical information related to various processes of the communication device 200, and various test results. For example, information included in the operation information can be used to detect an abnormality in the communication device 200. The operation information includes information collected by an agent, but may also include other information. The associating unit 140 associates, for example, operation information corresponding to the second device with the first device. Here, the associating process may be, for example, a process of setting a link in the information related to the first device that enables access to the operation information corresponding to the second device. The information related to the first device may be information identifying the first device, configuration information corresponding to the first device, or the like. Alternatively, the associating process may be a process of copying the operation information corresponding to the second device and including the copied operation information in the information related to the first device. This allows the operation information of a second device similar to the first device to be used as a reference when monitoring the first device. In this way, the associating unit 140 associates the operation information of the second device, including the information collected by the agent, with the first device. The associating unit 140 is an example of an associating means.

[0022] Next, an example of the operation of the monitoring device 100 will be described with reference to Fig. 3. In this disclosure, each step in a flowchart will be represented by a number assigned to the step, such as "S1".

[0023] 3 is a flowchart illustrating an example of the operation of the monitoring device 100. The storage unit 110 stores configuration information corresponding to each of a plurality of devices included in the system (S1). The first identification unit 120 identifies configuration information corresponding to a first device, among the plurality of devices, for which an agent that collects information is not set (S2). The second identification unit 130 identifies a second device, among the plurality of devices, that corresponds to configuration information similar to that corresponding to the first device and for which an agent is set (S3). The association unit 140 associates operation information of the second device, including information collected by the agent, with the first device (S4).

[0024] In this way, the monitoring device 100 of the first embodiment stores configuration information corresponding to each of the multiple devices included in the system, and identifies configuration information corresponding to a first device among the multiple devices for which an agent for collecting information is not set.The monitoring device 100 then identifies a second device among the multiple devices, which corresponds to configuration information similar to the configuration information corresponding to the first device and for which an agent is set, and associates operation information of the second device, including information collected by the agent, with the first device.

[0025] A device without an agent installed can collect less information than a device with an agent installed. In response to this, the monitoring device 100 can associate a device without an agent installed with the operation information of a device with similar configuration information and an agent installed. Devices with similar configuration information may perform the same operations or may develop similar abnormalities. Therefore, the monitoring device 100 can monitor a device without an agent installed by referring to the operation information of similar devices. In other words, the monitoring device 100 of the first embodiment can support the monitoring of devices in a system that includes devices in which an agent cannot be installed.

[0026] <Second embodiment> Next, a monitoring device according to a second embodiment will be described. In the second embodiment, the monitoring device 100 described in the first embodiment will be described in more detail.

[0027] 4 is a diagram schematically illustrating an example of a configuration including a monitoring device 100. The monitoring device 100 is communicably connected to each of the communication devices 200. As shown in FIG. 4, the communication device 200-1 is connected to the monitoring device 100 via the conversion server 300.

[0028] In this embodiment, it is assumed that communication device 200-1 is a device in which no agent is set, and communication devices 200-2, ..., 200-n are devices in which an agent is set. An agent is set in conversion server 300. Then, conversion server 300 collects information from communication device 200-1, converts the collected information into an appropriate format, and transmits the information to monitoring device 100. Each of communication devices 200-2, ..., 200-n transmits information collected by the set agent to monitoring device 100. At this time, the amount of information collected from communication device 200-1 in which no agent is directly set is less than the information collected from communication devices 200-2, ..., n in which an agent is set. If the amount of information is less, for example, an abnormality occurring in communication device 200-1 may not be properly detected. In other words, it can be said that communication device 200-1 is in a state where the monitoring level is lower than that of communication devices 200-2, ..., n.

[0029] [Details of the monitoring device 100] Fig. 5 is a block diagram showing an example of the functional configuration of the monitoring device 100 according to the second embodiment. As shown in Fig. 5, the monitoring device 100 includes a storage unit 110, a first identification unit 120, a second identification unit 130, and an association unit 140, similar to the first embodiment. The monitoring device 100 may further include an output unit 150.

[0030] The storage unit 110 stores configuration information corresponding to the system and the communication devices 200 included in the system. The configuration information includes, for example, system configuration information, device configuration information, model configuration information, and software configuration information. The system configuration information is information indicating the configuration of the system. For example, the system configuration information includes information indicating each of the communication devices 200 included in the system. The device configuration information is information created uniquely for each communication device 200. The device configuration information indicates information set in the communication device 200. For example, the device configuration information may include information such as an address set in the device. The storage unit 110 stores device configuration information corresponding to each of the communication devices 200.

[0031] The model configuration information is information about elements installed in communications device 200. Elements are, for example, electronic components such as a CPU and memory, and software. That is, the model configuration information includes, for example, information about the electronic components installed in communications device 200, and information indicating software installed in communications device 200. Without being limited to this, the model configuration information may also include information about the model number and serial number of the communications device. Note that the model configuration information may be information created for each manufacturing lot of the device. That is, the model configuration information corresponding to communications devices 200 manufactured in the same manufacturing lot may be the same. Storage unit 110 stores model configuration information corresponding to each communications device 200.

[0032] Software configuration information is information that indicates the configuration of software. Hereinafter, software configuration information is also referred to as SW configuration information. SW configuration information may be information created for each version of software. The SW configuration information is, for example, a Software Bill of Materials (SBOM). Note that the SW configuration information may also include software authenticity information and vulnerability information. The storage unit 110 stores SW configuration information corresponding to each piece of software included in the communication device 200.

[0033] The device configuration information and model configuration information are configuration information related to hardware. The SW configuration information is configuration information related to software. In this way, the storage unit 110 stores configuration information related to the hardware and configuration information related to the software of each of a plurality of devices.

[0034] Here, the storage unit 110 may associate and store related configuration information. The process of associating configuration information is, for example, a process of including information that allows access to related configuration information in the configuration information. FIG. 6 is a diagram showing an example of the relationship between configuration information stored in the storage unit 110. For example, assume that communication device 200-1 and communication device 200-2 are included in a system. In this case, system configuration information 10 is associated with device configuration information 20 corresponding to communication device 200-1 and device configuration information 30 corresponding to communication device 200-2. Furthermore, the device configuration information 20 is associated with model configuration information 21 corresponding to communication device 200-1. The model configuration information 21 is then associated with software configuration information 211 and 212 corresponding to the respective pieces of software installed in communication device 200-1. Similarly, the device configuration information 30 is associated with model configuration information 31 corresponding to communication device 200-2. Model configuration information 31 is linked to SW configuration information 311, 312, and 313 corresponding to each piece of software installed in communication device 200-2. In this way, storage unit 110 stores, in linked form, configuration information related to hardware and configuration information related to software corresponding to the same device among a plurality of devices.

[0035] Furthermore, the storage unit 110 stores operation information corresponding to each of the communications devices 200. Specifically, the storage unit 110 acquires information collected from the agent and stores it as operation information corresponding to each of the communications devices 200. At this time, the operation information related to the hardware and the operation information related to the software may be stored separately. Furthermore, as shown in FIG. 6, the storage unit 110 may store the operation information by further linking it to each piece of configuration information. In the example of FIG. 6, operation information 40 is linked to device configuration information 20 and 30, operation information 22 is linked to model configuration information 21, and operation information 213 is linked to software configuration information 211 and 212. Each piece of operation information includes log information, statistical information, and the like related to each piece of configuration information. For example, the operation information 22 may include hardware-related operation information, such as temperature, voltage, and fan rotation speed fluctuations, CPU and memory usage rates, and various hardware inspection results, for the device corresponding to the model configuration information 21. Furthermore, for example, the operational information 213 may include operation logs and update histories related to the software corresponding to each of the SW configuration information 211 and 212.

[0036] The first identification unit 120 identifies a first device, which is a device for which an agent is not set. For example, the first identification unit 120 may identify a device for which an agent is not set based on SW configuration information. Alternatively, for example, the first identification unit 120 may identify a device specified by input from a terminal operated by a user as the first device. Then, the first identification unit 120 identifies the configuration information of the first device from the configuration information stored in the storage unit 110. At this time, the first identification unit may identify the configuration information related to the hardware corresponding to the first device and the configuration information related to the software corresponding to the first device.

[0037] The second identification unit 130 identifies configuration information similar to the configuration information identified by the first identification unit 120. Specifically, the second identification unit 130 compares the configuration information corresponding to the first device with each piece of configuration information stored in the storage unit 110. For example, the second identification unit 130 compares the configuration information related to the hardware of the first device with each piece of configuration information related to the hardware stored in the storage unit 110. Furthermore, for example, the second identification unit 130 compares the configuration information related to the software of the first device with each piece of configuration information related to the software stored in the storage unit 110. As a result of the comparison, the second identification unit 130 identifies a device corresponding to the configuration information similar to the configuration information corresponding to the first device.

[0038] In this case, the device corresponding to the configuration information similar to the hardware-related configuration information corresponding to the first device and the device corresponding to the configuration information similar to the software-related configuration information corresponding to the first device may be different devices. For example, suppose that the hardware-related configuration information of communication device 200-1 is similar to the hardware-related configuration information of communication device 200-2, and the software-related configuration information of communication device 200-1 is similar to the software-related configuration information of communication device 200-3. In this case, second identification unit 130 identifies communication device 200-2 and communication device 200-3 as second devices for communication device 200-1. In this way, second identification unit 130 identifies, as second devices, the device corresponding to the configuration information similar to the hardware-related configuration information corresponding to the first device and the device corresponding to the configuration information similar to the software-related configuration information corresponding to the first device.

[0039] The method for determining similarity is not limited to a specific method. For example, if specific information is common to the configuration information of the first device and the configuration information stored in the storage unit 110, the second identification unit 130 may determine that the two pieces of configuration information are similar. In this case, for example, if the configuration information of the first device and the configuration information stored in the storage unit 110 share the same device model number, the second identification unit 130 may determine that the two pieces of configuration information are similar. Furthermore, for example, if the configuration information of the first device and the configuration information stored in the storage unit 110 share the same software version, the second identification unit 130 may determine that the two pieces of configuration information are similar.

[0040] Alternatively, the second identifying unit 130 may determine the similarity by calculating the degree of similarity between the configuration information of the first device and each piece of configuration information stored in the storage unit 110. For example, the second identifying unit 130 may determine whether each item of the configuration information matches, and calculate a value corresponding to the number of matching items, such as the percentage of matching items, as the degree of similarity. The second identifying unit 130 may then determine that configuration information whose similarity is equal to or greater than a threshold is similar to the configuration information of the first device. Note that the method of calculating the similarity is not limited to this example. In this manner, the second identifying unit 130 may identify a device corresponding to configuration information whose similarity, corresponding to the number of items common to the configuration information corresponding to the first device and the stored configuration information, is equal to or greater than a threshold.

[0041] The association unit 140 associates the operation information corresponding to the second device with the first device. More specifically, the association unit 140 associates the operation information related to the hardware and the operation information related to the software corresponding to the second device with the first device. Note that the association unit 140 may associate either the operation information related to the hardware or the operation information related to the software corresponding to the second device with the first device. For example, it is assumed that the hardware configuration information of communication device 200-1 is similar to the hardware configuration information of communication device 200-2, and the software configuration information of communication device 200-1 is similar to the software configuration information of communication device 200-3. In this case, the association unit 140 associates the hardware configuration information of communication device 200-2 with communication device 200-1. Furthermore, the association unit 140 associates the software operation information of communication device 200-3 with communication device 200-1. In this way, the associating unit 140 may associate, with the first device, operation information related to hardware of a device corresponding to configuration information similar to configuration information related to hardware corresponding to the first device. Also, the associating unit 140 may associate, with the first device, operation information related to software of a device corresponding to configuration information similar to configuration information related to software corresponding to the first device.

[0042] The output unit 150 outputs various types of information. For example, when outputting information about a first device, the output unit 150 outputs information about a second device. Furthermore, the output unit 150 displays various types of information on a display device, for example. Here, the display device may be, for example, a display provided on a terminal operated by a user who manages the system. The terminal may be a personal computer or a portable terminal such as a smartphone or a tablet terminal. Note that the present invention is not limited to this example, and the output unit 150 may output various types of information by voice.

[0043] The output unit 150 may output various information in response to a user operation. For example, suppose a specific communication device 200 is designated by a user operation and a request to output operation information is made. In this case, the output unit 150 displays, for example, the operation information of the specific communication device 200 on a display device. Here, if a first device is designated and a request to output operation information is made, the output unit 150 displays the operation information of a second device associated with the first device along with the operation information of the first device. For example, suppose a request to output operation information of communication device 200-1 is made. In this case, the output unit 150 displays the operation information of another device associated with communication device 200-1 along with the operation information of communication device 200-1. In this way, when the output unit 150 receives a request to output operation information of a first device, it outputs the operation information of a second device associated with the first device. The output unit 150 is an example of an output means.

[0044] [Operation Example 1 of Monitoring Device 100] Next, an example of the operation of the monitoring device 100 of the second embodiment will be described with reference to Fig. 7. Fig. 7 is a flowchart showing an example of the operation of the monitoring device 100. More specifically, Fig. 7 shows an example of the operation when the monitoring device 100 associates operation information corresponding to a second device with a first device. In this example of operation, it is assumed that the storage unit 110 has previously stored therein configuration information and operation information corresponding to each communication device 200.

[0045] The first identification unit 120 identifies a first device that is a device for which an agent is not set (S101). Then, the first identification unit 120 identifies configuration information of the identified first device from the configuration information stored in the storage unit 110 (S102). At this time, the first identification unit 120 may identify configuration information related to hardware and configuration information related to software corresponding to the first device.

[0046] The second identification unit 130 compares the configuration information of the first device identified by the first identification unit 120 with each of the stored configuration information (S104). If there is configuration information whose similarity is equal to or greater than the threshold ("Yes" in S105), the second identification unit 130 identifies the device corresponding to the configuration information whose similarity is equal to or greater than the threshold as the second device (S105). The association unit 140 associates the operation information corresponding to the second device with the first device (S106). If there is no configuration information whose similarity is equal to or greater than the threshold ("No" in S105), the monitoring device 100 ends the process.

[0047] [Operation Example 2 of Monitoring Device 100] Next, an example of the operation of the monitoring device 100 of the second embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing another example of the operation of the monitoring device 100. More specifically, Fig. 8 shows an example of the operation when the monitoring device 100 outputs information in response to a request. In this example of operation, it is assumed that the operation information of the second device is associated with the first device in advance.

[0048] The output unit 150 receives a request to output operation information (S201). If the received request is a request to output operation information of a first device ("Yes" in S202), the output unit 150 outputs the operation information of the first device and the operation information of a second device associated with the first device (S203).

[0049] If the received request is not a request to output the operation information of the first device ("No" in S202), the output unit 150 outputs the operation information corresponding to the specified device (S204).

[0050] Note that each of the operation examples 1 and 2 is merely an example, and the operation of the monitoring device 100 is not limited to these examples. For example, instead of the processing of S104 and S105, a process may be performed to identify, as the second component, a device corresponding to configuration information that has specific information in common with the configuration information of the first device.

[0051] In this way, the monitoring device 100 of the second embodiment stores configuration information corresponding to each of a plurality of devices included in the system, and identifies configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information is not set.The monitoring device 100 then identifies a second device among the plurality of devices, which corresponds to configuration information similar to that corresponding to the first device and for which an agent is set, and associates operation information of the second device, including information collected by the agent, with the first device.

[0052] A device without an agent installed can collect less information than a device with an agent installed. In response to this, the monitoring device 100 can link a device without an agent installed with the operational information of a device with similar configuration information and an agent installed. Devices with similar configuration information may perform the same operations or develop similar abnormalities. Therefore, the monitoring device 100 can monitor a device without an agent installed by referring to the operational information of similar devices. This can substantially improve the monitoring level of the first device. In other words, the monitoring device 100 of the second embodiment can support the monitoring of devices in a system that includes devices in which an agent cannot be installed.

[0053] Furthermore, the monitoring device 100 of the second embodiment may identify a device corresponding to configuration information in which the similarity corresponding to the number of items common to the configuration information corresponding to the first device and the stored configuration information is equal to or greater than a threshold value, thereby enabling the monitoring device 100 to identify a second device similar to the first device.

[0054] In the second embodiment, the stored configuration information includes hardware configuration information and software configuration information for each of a plurality of devices. The monitoring device 100 identifies the hardware configuration information corresponding to a first device and the software configuration information corresponding to the first device. The monitoring device 100 then identifies, as the second device, a device corresponding to configuration information similar to the hardware configuration information corresponding to the first device and a device corresponding to configuration information similar to the software configuration information corresponding to the first device. This allows the monitoring device 100 to appropriately identify the second device even if the device with similar hardware configuration information and the device with similar software configuration information are different.

[0055] Furthermore, the monitoring device 100 of the second embodiment associates, with the first device, operation information related to the hardware of a second device that is similar to configuration information related to the hardware corresponding to the first device. Then, the monitoring device 100 associates, with the first device, operation information related to the software of the second device that is similar to configuration information related to the software corresponding to the first device. This allows the monitoring device 100 to associate appropriate operation information with the first device even if the devices with similar hardware configuration information and the devices with similar software configuration information are different.

[0056] Furthermore, when the monitoring device 100 of the second embodiment receives a request to output operation information of a first device, it outputs operation information of a second device associated with the first device. This allows the monitoring device 100 to provide the user with the operation information of the second device as reference information for the first device. This allows the user to manage the first device based on the operation information.

[0057] [Variation 1] When there are multiple devices whose configuration information is similar to that of the first device, multiple second devices may be identified. For example, when there are multiple devices whose configuration information is similar to that of the hardware of the first device, the second identification unit 130 identifies each of the multiple devices mp as a second device. Then, the association unit 140 may associate the operation information of the multiple second devices with the first device. For example, the association unit 140 associates each piece of operation information about the hardware of the second devices with the first device.

[0058] [Variation 2] In the above embodiment, an example has been described in which, when identifying a second device, the configuration information of the first device is compared with the configuration information stored in the storage unit 110. If the configuration information includes vulnerability information in software, the second device may be identified based on the vulnerability information.

[0059] For example, the second identification unit 130 compares the vulnerability information included in the configuration information of the first device with the vulnerability information included in the stored configuration information. If there is configuration information having vulnerability information in which the types and numbers of vulnerabilities match by a predetermined percentage or more, the second identification unit 130 identifies the device corresponding to the configuration information as the second device.

[0060] In this way, the monitoring device 101 may calculate the similarity between the vulnerability information contained in the configuration information of the first device and the vulnerability information contained in each of the stored configuration information, and identify the device corresponding to the configuration information whose calculated similarity is greater than or equal to a threshold as the second device.

[0061] <Third embodiment> Next, a monitoring device according to a third embodiment will be described. In the third embodiment, an example of processing when an abnormality is detected in a case where operation information of a second device is associated with a first device will be mainly described. Note that some of the explanations overlapping with those of the first and second embodiments will be omitted.

[0062] Fig. 9 is a diagram schematically illustrating an example of a configuration including a monitoring device 101. As shown in Fig. 9, the monitoring device 101 may be configured to include a shared server 191 and a countermeasure implementation server 192. The shared server 191 is communicatively connected to the countermeasure implementation server 192 and a communication device 200. The shared server 191 is further communicatively connected to a terminal (not shown) of a user who manages the monitoring device 101.

[0063] In this embodiment, it is assumed that communication device 200-1 is a device in which no agent is set, and communication devices 200-2, ..., 200-n are devices in which an agent is set, and that the operation information of communication device 200-2 is associated with communication device 200-1.

[0064] [More details about Surveillance Device 101] 10 is a block diagram showing an example of the functional configuration of the monitoring device 101 according to the third embodiment. As shown in FIG. 10, the shared server 191 includes a storage unit 110, a first identification unit 120, a second identification unit 130, an association unit 140, an output unit 151, and a detection unit 160. The countermeasure implementation server 192 includes a countermeasure implementation unit 170.

[0065] The detection unit 160 detects an abnormality. Specifically, the detection unit 160 detects an abnormality based on information acquired from the communication device 200. For example, the detection unit 160 may detect a malfunction of the communication device 200 or detect unauthorized access or a cyber-attack against the communication device 200 based on operation information including information collected by an agent. The detection unit 160 may also detect vulnerabilities by diagnosing the vulnerability of the communication device 200. The operation information includes log information collected for each event that occurs in the communication device 200. The detection unit 160 acquires the log information, for example, periodically, and determines whether the log information matches an anomaly model. The detection unit 160 may detect an abnormality based on the result of the determination. The detection unit 160 may detect an abnormality using, for example, an intrusion detection system (IDS) or an intrusion prevention system (IPS). Note that the method for detecting an abnormality is not limited to a specific method. The method for detecting an abnormality may be any method that can identify the device in which the abnormality has occurred and the type of abnormality. When detecting an abnormality, the detection unit 160 may generate information about the abnormality. The information about the abnormality includes information indicating the device in which the abnormality has occurred and the type of abnormality that has occurred. In this way, the detection unit 160 detects an abnormality that has occurred in a device included in the system. The detection unit 160 is an example of a detection means.

[0066] The output unit 151 outputs an alert when an abnormality is detected by the detection unit 160. For example, the output unit 151 displays information about the abnormality as an alert on a display device. Here, if the device in which the abnormality has occurred is a second device, the output unit 151 may also output information about a first device associated with the operation information of the second device. For example, the output unit 151 outputs at least one of information indicating the first device, configuration information of the first device, and operation information of the first device.

[0067] Countermeasure implementation unit 170 of countermeasure implementation server 192 implements countermeasures against the abnormality via shared server 191. When an abnormality is detected by detection unit 160, countermeasure implementation unit 170 may implement countermeasures for the device in which the abnormality occurred. Furthermore, when the device in which the abnormality occurred is the second device, countermeasure implementation unit 170 may implement countermeasures for the device (i.e., the first device) associated with the operation information of the second device. Furthermore, countermeasure implementation unit 170 may implement countermeasures in response to instructions from a user operating monitoring device 101.

[0068] For example, if an abnormality occurs in communication device 200-2 and a vulnerability is detected, countermeasure implementation unit 170 may stop services related to communication device 200-2. For example, if a vulnerability exists in the software of communication device 200-2 and a patch program for the software exists, countermeasure implementation unit 170 may apply the patch program and update the software. At this time, countermeasure implementation unit 170 may also similarly update communication device 200-1, which is similar to communication device 200-2. In this way, if the device in which the abnormality has occurred is a second device, countermeasure implementation unit 170 may implement a countermeasure for the abnormality in a first device. Countermeasure implementation unit 170 is an example of a countermeasure implementation means.

[0069] When software is updated, the SW configuration information is changed. When software is updated, the countermeasure implementation unit 170 may update the SW configuration information of the updated software among the configuration information stored in the storage unit 110.

[0070] Furthermore, countermeasure implementation unit 170 may implement countermeasures that take into consideration the impact on the system. For example, suppose an abnormality is detected in the software of communication device 200-2. If a software update is implemented as a countermeasure to the abnormality, it is necessary to stop the services provided by communication device 200-2. Such an impact on the system caused by implementing a countermeasure is also referred to as a side effect of the countermeasure.

[0071] Here, an abnormality similar to the abnormality that occurred in communication device 200-2 may not necessarily occur in communication device 200-1. Therefore, implementing a measure with serious side effects, such as stopping service, on communication device 200-1 poses a risk. Therefore, countermeasure implementation unit 170 may implement, for example, a countermeasure for communication device 200-1 that allows the continuation of services provided by communication device 200-1. Specifically, countermeasure implementation unit 170 may temporarily suspend the system administrator's authority to change system settings, or restrict even the administrator from remotely connecting to the system console. Countermeasures that allow the continuation of services may include a countermeasure for temporarily stopping services. For example, countermeasures that allow the continuation of services may include countermeasures that have little practical impact on the provision of services, such as stopping services for one minute or stopping services outside of service provision hours. Furthermore, countermeasure implementation unit 170 may, for example, postpone implementing a countermeasure for communication device 200-1. In this way, countermeasure implementation unit 170 may implement, for the second component, a countermeasure that does not require the stopping of services related to the second component.

[0072] [Example of operation of monitoring device 101] Next, an example of the operation of the monitoring device 101 of the third embodiment will be described with reference to Fig. 11. Fig. 11 is a flowchart showing an example of the operation of the monitoring device 101. More specifically, Fig. 11 shows an example of the operation when the monitoring device 101 detects an abnormality. In this example of operation, it is assumed that a first device is associated with operation information of a second device.

[0073] The detection unit 160 detects an abnormality (S301). If the abnormality does not occur in the second device ("No" in S302), the output unit 151 outputs an alert (S306). Then, the countermeasure implementation unit 170 implements a countermeasure for the device in which the abnormality occurs (S307).

[0074] If the abnormality has occurred in the second device ("Yes" in S302), the output unit 151 outputs information about the first device together with an alert (S303). The countermeasure implementation unit 170 implements countermeasures for the device in which the abnormality has occurred (S304). Then, the countermeasure implementation unit 170 implements countermeasures for the detected abnormality in the first device (S305). At this time, if the target in which the abnormality has been detected is the second device, the output unit 151 also outputs information about the first device together with the alert (S306).

[0075] It should be noted that this operation example is merely an example, and the operation of the monitoring device 100 is not limited to this example.

[0076] In this way, the monitoring device 101 of the third embodiment detects an abnormality that has occurred in a device included in the system, and if the device in which the abnormality has been detected is a second device, outputs information about the first device. If an abnormality occurs in the second device, a similar abnormality may also occur in the first device, which has similar configuration information. However, even if a similar abnormality occurs, the abnormality may not be detected in the first device, in which no agent is installed, due to a lack of collected information. In response to this, the monitoring device 101 can notify the user that an abnormality similar to the abnormality that occurred in the second device may also occur in the first device.

[0077] [Variation 3] In the above embodiment, the monitoring device 101 has been described as including the shared server 191 and the countermeasure implementation server 192. The configuration of the monitoring device 101 is not limited to this example. For example, the monitoring device 101 may be configured as a single server. In this case, the storage unit 110, the first identification unit 120, the second identification unit 130, the association unit 140, the output unit 15, the detection unit 160, and the countermeasure implementation unit 170 may be implemented in the single server. Alternatively, the monitoring device 101 may be configured as three or more servers. In this case, the storage unit 110, the first identification unit 120, the second identification unit 130, the association unit 140, the output unit 150, the detection unit 160, and the countermeasure implementation unit 170 may each be implemented in any of the three or more servers.

[0078] [Variation 4] The timing of the process of identifying the second device and associating the operation information corresponding to the second device with the first device is not limited to a specific timing. For example, each process may be triggered by the detection of an abnormality. That is, the monitoring device 101 may perform the operation example shown in FIG. 12 instead of the operation example shown in FIG. 7.

[0079] Fig. 12 is a flowchart showing an example of the operation of the monitoring device 101 of Modification 4. More specifically, Fig. 12 shows an example of the operation of the monitoring device 101 when an abnormality is detected. If the detection unit 160 does not detect an abnormality ("No" in S401), the monitoring device 101 does not proceed with the process.

[0080] If the detection unit 160 detects an abnormality ("Yes" in S401) and the device in which the abnormality occurred is a device for which no agent is set ("No" in S402), the monitoring device 101 ends the processing.

[0081] When the detection unit 160 detects an abnormality ("Yes" in S401) and the device where the abnormality occurred is a device for which an agent is set ("Yes" in S402), the first identification unit 120 identifies a device for which an agent is not set (S403). Then, the first identification unit 120 compares the configuration information of the device for which an agent is not set with the configuration information of the device for which the abnormality occurred (S404). When there is a device for which an agent is not set that corresponds to configuration information whose similarity is equal to or greater than a threshold value ("Yes" in S405), the first identification unit 120 identifies the device as a first device (S406). The association unit 140 associates the operation information of the device for which the abnormality occurred with the first device (S407).

[0082] If there is no device for which an agent is not set that corresponds to configuration information with a similarity equal to or greater than the threshold value ("No" in S405), the monitoring apparatus 101 ends the process.

[0083] [Variation 5] In the above embodiment, it has been explained that when an abnormality is detected in communication device 200-2, a measure with minor side effects may be taken on communication device 200-1, or the measure on communication device 200-1 may be postponed. On the other hand, when the detected abnormality is a high-risk abnormality, it is preferable to take preventative measures on communication device 200-1, even if the measures have serious side effects (i.e., measures that have a significant impact on the provision of services). Therefore, monitoring device 101 may calculate the priority of measures according to the risk level of the abnormality, and take measures according to the priority.

[0084] FIG. 13 is a block diagram showing an example of a functional configuration of the monitoring device 101 according to the fifth modification. As shown in FIG. 13, the countermeasure implementation unit 170 may include a priority calculation unit 171 and a countermeasure determination unit 172. The priority calculation unit 171 calculates the priority of a countermeasure corresponding to an abnormality. Specifically, the priority calculation unit 171 generates a risk level for the detected abnormality. The risk level is an index related to the risk of the detected abnormality. For example, assume that a vulnerability is detected in the communication device 200-2. The priority calculation unit 171 may generate the risk level according to the number of vulnerabilities. The priority calculation unit 171 may also generate the risk level according to the type of impact that may occur when the vulnerability is attacked. The risk level may be a numerical value ranging from 1 to 10, for example, with a higher numerical value indicating a higher risk. Note that the method for generating the risk level is not limited to this example.

[0085] Then, priority calculation unit 171 calculates the priority of the measures to be implemented on communication device 200-1 according to the degree of risk of the abnormality detected in communication device 200-2. The priority may be a numerical value from 1 to 3, with a lower numerical value indicating a higher priority. Note that the expression of priority is not limited to this.

[0086] For example, suppose a vulnerability is detected in communications device 200-2. At this time, two measures have been considered: Countermeasure A, which involves applying a patch to resolve the vulnerability and updating the software; and Countermeasure 2, which involves changing the administrator's authority to change settings. Countermeasure A is a measure that can more reliably deal with the abnormality but requires the service to be stopped (i.e., a measure that is highly effective but has severe side effects). Countermeasure 2 is a measure that is unclear whether it can reliably deal with the abnormality but does not require the service to be stopped (i.e., a measure that is less effective but has mild side effects).

[0087] For example, when the risk of the detected abnormality is less than a threshold, the priority calculation unit 171 sets the priority of measure A to 3 and the priority of measure 2 to 1. Furthermore, for example, when the risk of the detected abnormality is equal to or greater than a threshold, the priority calculation unit 171 sets the priority of measure A to 1 and the priority of measure 2 to 3.

[0088] In this way, the priority calculation unit 171 calculates the priority of each of the plurality of measures based on the risk of the abnormality that occurred in the second device and the impact of each of the plurality of measures on the continuation of the service. The priority calculation unit 171 is an example of a priority calculation means.

[0089] The countermeasure determination unit 172 determines the countermeasure to be implemented according to the priority. For example, if there are countermeasures with priority 1 and countermeasures with priority 3, the countermeasure determination unit 172 determines the countermeasure with priority 1 as the countermeasure to be implemented. In this way, the countermeasure determination unit 172 determines the countermeasure to be implemented for the first device according to the calculated priority. The countermeasure determination unit 172 is an example of a countermeasure determination means.

[0090] The output unit 151 may display information indicating the priority and the countermeasure on a display device of the terminal. Then, the terminal may accept a selection of the countermeasure by the administrator. In this case, the countermeasure determination unit 172 may determine the selected countermeasure as the countermeasure to be implemented.

[0091] In this way, the monitoring device 101 of the fifth modification can take measures by taking into consideration the degree of risk of the detected abnormality and the expected impact of the measures on services.

[0092] <Example of monitoring device hardware configuration> The hardware constituting the monitoring devices of the first, second, and third embodiments described above will now be described. Fig. 14 is a block diagram showing an example of the hardware configuration of a computer device that realizes the monitoring devices in each embodiment. The monitoring devices and monitoring methods described in each embodiment and each modified example are realized in a computer device 90.

[0093] 14, a computer device 90 includes a processor 91, a RAM (Random Access Memory) 92, a ROM (Read Only Memory) 93, a storage device 94, an input / output interface 95, a bus 96, and a drive device 97. The monitoring device may be realized by a plurality of electric circuits.

[0094] The storage device 94 stores a program (computer program) 98. The processor 91 executes the program 98 of the present monitoring device using the RAM 92. Specifically, for example, the program 98 includes a program that causes a computer to execute the processes shown in FIGS. 3, 7, 8, 11, and 12. The processor 91 executes the program 98 to realize the functions of each component of the present monitoring device. The program 98 may be stored in the ROM 93. The program 98 may also be recorded on the storage medium 80 and read out using the drive device 97, or may be transmitted to the computer device 90 from an external device (not shown) via a network (not shown).

[0095] The input / output interface 95 exchanges data with peripheral devices (such as a keyboard, a mouse, and a display device) 99. The input / output interface 95 functions as a means for acquiring or outputting data. The bus 96 connects each component.

[0096] There are various variations in the implementation of the monitoring device. For example, the monitoring device can be implemented as a dedicated device. Alternatively, the monitoring device can be implemented based on a combination of multiple devices.

[0097] The scope of each embodiment also includes a processing method for recording a program for realizing each configuration of the function of each embodiment on a storage medium, reading the program recorded on the storage medium as code, and executing it on a computer. That is, a computer-readable storage medium is also included in the scope of each embodiment. Furthermore, the storage medium on which the above-mentioned program is recorded and the program itself are also included in each embodiment.

[0098] The storage medium may be, but is not limited to, a floppy disk, a hard disk, an optical disk, a magneto-optical disk, a CD (Compact Disc)-ROM, a magnetic tape, a non-volatile memory card, or a ROM. The programs recorded on the storage medium are not limited to standalone programs that execute processes, but also include programs that run on an OS (Operating System) in cooperation with other software and functions of an expansion board.

[0099] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0100] The above-described embodiments and modifications can be combined as appropriate.

[0101] Some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0102] <Additional Notes> [Appendix 1] a storage means for storing configuration information corresponding to each of a plurality of devices included in the system; a first identification means for identifying configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information is not set; a second identification means for identifying a second device among the plurality of devices, the second device corresponding to configuration information similar to configuration information corresponding to the first device, and in which the agent is set; and a correlation means for correlating the operation information of the second device, including the information collected by the agent, with the first device. Monitoring equipment.

[0103] [Appendix 2] the second identification means identifies a device corresponding to configuration information in which a similarity corresponding to the number of items common to the configuration information corresponding to the first device and the stored configuration information is equal to or greater than a threshold value; 10. The monitoring device described in Appendix 1.

[0104] [Appendix 3] the stored configuration information includes configuration information related to the hardware of each of the plurality of devices and configuration information related to the software of each of the plurality of devices; the first identification means identifies configuration information related to hardware corresponding to the first device and configuration information related to software corresponding to the first device; the second identification means identifies, as the second device, a device corresponding to configuration information similar to configuration information related to hardware corresponding to the first device, and a device corresponding to configuration information similar to configuration information related to software corresponding to the first device; 3. A monitoring device according to claim 1 or 2.

[0105] [Appendix 4] The association means Associating hardware operation information of the second device, which is similar to hardware configuration information corresponding to the first device, with the first device; Associating software-related operation information of the second device, which is similar to configuration information related to the software corresponding to the first device, with the first device; 10. The monitoring device described in Appendix 3.

[0106] [Appendix 5] an output unit configured to output operation information of the second device associated with the first device when a request to output operation information of the first device is received; 5. A monitoring device according to any one of claims 1 to 4.

[0107] [Appendix 6] further comprising a detection means for detecting an abnormality occurring in a device included in the system; When the device in which the abnormality has occurred is the second device, the output means outputs information about the first device. 10. The monitoring device described in Appendix 5.

[0108] [Appendix 7] a countermeasure implementation unit that implements a countermeasure for the abnormality occurring in the second device in the first device; 6. A monitoring device as described in Appendix 6.

[0109] [Appendix 8] The countermeasure implementation means a priority calculation means for calculating a priority of each of the plurality of countermeasures based on a risk level of the abnormality occurring in the second device and an impact of each of the plurality of countermeasures on the continuation of the service; a countermeasure decision means for deciding a countermeasure to be implemented on the first device in accordance with the calculated priority; 7. The monitoring device described in Appendix 7.

[0110] [Appendix 9] storing configuration information corresponding to each of a plurality of devices included in the system; Identifying configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information is not set; Identifying a second device among the plurality of devices, the second device corresponding to configuration information similar to that corresponding to the first device, and the second device being a device in which the agent is set; Associating the operation information of the second device, including the information collected by the agent, with the first device; Monitoring method.

[0111] [Appendix 10] In identifying the second device, a device corresponding to configuration information having a similarity corresponding to the number of items common to the configuration information corresponding to the first device and the stored configuration information that is equal to or greater than a threshold is identified. The monitoring method described in Appendix 9.

[0112] [Appendix 11] the stored configuration information includes configuration information related to the hardware of each of the plurality of devices and configuration information related to the software of each of the plurality of devices; In identifying the configuration information, configuration information related to hardware corresponding to the first device and configuration information related to software corresponding to the first device are identified; In identifying the second device, a device corresponding to configuration information similar to configuration information related to hardware corresponding to the first device and a device corresponding to configuration information similar to configuration information related to software corresponding to the first device are identified as the second device. 11. The monitoring method of claim 9 or 10.

[0113] [Appendix 12] In the association, Associating hardware operation information of the second device, which is similar to hardware configuration information corresponding to the first device, with the first device; Associating operation information about the second device and software similar to configuration information about the software corresponding to the first device with the first device; The monitoring method described in Appendix 11.

[0114] [Appendix 13] When a request to output operation information of the first device is received, output operation information of the second device associated with the first device. 13. A monitoring method according to any one of claims 9 to 12.

[0115] [Appendix 14] Detecting an abnormality occurring in a device included in the system, In the output, when the device in which the abnormality has occurred is the second device, information about the first device is output. The monitoring method described in Appendix 13.

[0116] [Appendix 15] Implementing a countermeasure in the first device to deal with the abnormality occurring in the second device. The monitoring method described in Appendix 14.

[0117] [Appendix 16] In implementing the above measures, calculating a priority of each of the plurality of countermeasures based on a risk level of the abnormality that has occurred in the second device and an impact of each of the plurality of countermeasures on the continuation of the service; determining a measure to be implemented on the first device according to the calculated priority; The monitoring method described in Appendix 15.

[0118] [Appendix 17] A process of storing configuration information corresponding to each of a plurality of devices included in the system; A process of identifying configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information is not set; a process of identifying a second device among the plurality of devices, the second device corresponding to configuration information similar to configuration information corresponding to the first device, and in which the agent is set; and a process of associating the operation information of the second device, including the information collected by the agent, with the first device. A computer-readable storage medium.

[0119] [Appendix 18] In the process of identifying the second device, a device corresponding to configuration information in which a similarity corresponding to the number of items common to the configuration information corresponding to the first device and the stored configuration information is equal to or greater than a threshold is identified. 18. The computer-readable storage medium of claim 17.

[0120] [Appendix 19] the stored configuration information includes configuration information related to the hardware of each of the plurality of devices and configuration information related to the software of each of the plurality of devices; In the process of identifying the configuration information, configuration information related to hardware corresponding to the first device and configuration information related to software corresponding to the first device are identified; In the process of identifying the second device, a device corresponding to configuration information similar to configuration information related to hardware corresponding to the first device and a device corresponding to configuration information similar to configuration information related to software corresponding to the first device are identified as the second device. 19. The computer-readable storage medium of claim 17 or 18.

[0121] [Appendix 20] In the association process, Associating hardware operation information of the second device, which is similar to hardware configuration information corresponding to the first device, with the first device; Associating software-related operation information of the second device, which is similar to configuration information related to the software corresponding to the first device, with the first device; 20. The computer-readable storage medium of claim 19.

[0122] [Appendix 21] when receiving a request to output operation information of the first device, further executing a process of outputting operation information of the second device associated with the first device; 21. A computer-readable storage medium according to any one of claims 17 to 20.

[0123] [Appendix 22] further executing a process for detecting an abnormality occurring in a device included in the system; In the output process, if the device in which the abnormality has occurred is the second device, information about the first device is output. 22. The computer-readable storage medium of claim 21.

[0124] [Appendix 23] causing the first device to further execute a process of taking measures to deal with the abnormality that has occurred in the second device; 23. The computer-readable storage medium of claim 22.

[0125] [Appendix 24] In the process of implementing the countermeasure, calculating a priority of each of the plurality of countermeasures based on a risk level of the abnormality that has occurred in the second device and an impact of each of the plurality of countermeasures on the continuation of the service; determining a measure to be implemented on the first device according to the calculated priority; 24. The computer-readable storage medium of claim 23. [Explanation of symbols]

[0126] 100, 101, 102 Monitoring equipment 110 Storage section 120 1st Specific Part 130 Second Specific Part 140 Mapping section 150, 151 Output section 160 Detection unit 170 Countermeasures Implementation Department 180 Priority calculation unit 191 Shared Server 192, 193 Countermeasure implementation server 200 Communication Equipment

Claims

1. a storage means for storing configuration information corresponding to each of a plurality of devices included in the system; a first specifying means for specifying configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information is not set; a second identification means for identifying a second device among the plurality of devices, the second device corresponding to configuration information similar to configuration information corresponding to the first device, and in which the agent is set; and associating means for associating the operation information of the second device, including the information collected by the agent, with the first device. Monitoring equipment.

2. the second identification means identifies a device corresponding to configuration information in which a similarity corresponding to the number of items common to the configuration information corresponding to the first device and the stored configuration information is equal to or greater than a threshold value; The monitoring device of claim 1 .

3. the stored configuration information includes configuration information related to the hardware of each of the plurality of devices and configuration information related to the software of each of the plurality of devices; the first identification means identifies configuration information related to hardware corresponding to the first device and configuration information related to software corresponding to the first device; the second identification means identifies, as the second device, a device corresponding to configuration information similar to configuration information related to hardware corresponding to the first device, and a device corresponding to configuration information similar to configuration information related to software corresponding to the first device; 3. The monitoring device according to claim 1 or 2.

4. The association means Associating hardware operation information of the second device, which is similar to configuration information of the hardware corresponding to the first device, with the first device; Associating software-related operation information of the second device, which is similar to software-related configuration information corresponding to the first device, with the first device; The monitoring device according to claim 3.

5. an output unit configured to output operation information of the second device associated with the first device when a request to output operation information of the first device is received; A monitoring device according to any one of claims 1 to 4.

6. further comprising a detection means for detecting an abnormality occurring in a device included in the system; When the device in which the abnormality has occurred is the second device, the output means outputs information about the first device. The monitoring device according to claim 5.

7. a countermeasure implementation unit that implements a countermeasure corresponding to an abnormality occurring in the second device on the first device; The monitoring device according to claim 6.

8. The countermeasure implementation means a priority calculation means for calculating a priority of each of the plurality of countermeasures based on a risk level of the abnormality occurring in the second device and an impact of each of the plurality of countermeasures on the continuation of the service; a countermeasure decision means for deciding a countermeasure to be implemented on the first device in accordance with the calculated priority. The monitoring device according to claim 7.

9. A computer comprising: storing configuration information corresponding to each of a plurality of devices included in the system; Identifying configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information is not set; Identifying a second device among the plurality of devices, the second device corresponding to configuration information similar to that corresponding to the first device, and the second device being a device in which the agent is set; Associating the operation information of the second device, including the information collected by the agent, with the first device; Monitoring method.

10. In identifying the second device, a device corresponding to configuration information having a similarity level equal to or greater than a threshold value according to the number of items common to the configuration information corresponding to the first device and the stored configuration information is identified. The monitoring method of claim 9.

11. the stored configuration information includes configuration information related to the hardware of each of the plurality of devices and configuration information related to the software of each of the plurality of devices; In the identification of the configuration information, configuration information relating to hardware corresponding to the first device and configuration information relating to software corresponding to the first device are identified; In identifying the second device, a device corresponding to configuration information similar to configuration information related to hardware corresponding to the first device and a device corresponding to configuration information similar to configuration information related to software corresponding to the first device are identified as the second device. The monitoring method according to claim 9 or 10.

12. In the association, Associating hardware operation information of the second device, which is similar to configuration information of the hardware corresponding to the first device, with the first device; Associating operation information relating to the second device and software similar to configuration information relating to the software corresponding to the first device with the first device; The monitoring method of claim 11.

13. outputting the operation information of the second device associated with the first device when a request to output the operation information of the first device is received; A monitoring method according to any one of claims 9 to 12.

14. Detecting an abnormality occurring in a device included in the system, In the output, when the device in which the abnormality has occurred is the second device, information about the first device is output. The monitoring method of claim 13.

15. Implementing a countermeasure in the first device to deal with the abnormality occurring in the second device. The monitoring method of claim 14.

16. In implementing the above measures, calculating a priority of each of the plurality of countermeasures based on a risk level of the abnormality occurring in the second device and an impact of each of the plurality of countermeasures on the continuation of the service; determining a measure to be implemented on the first device according to the calculated priority; 16. The monitoring method of claim 15.

17. A process of storing configuration information corresponding to each of a plurality of devices included in the system; a process of identifying configuration information corresponding to a first device among the plurality of devices for which an agent for collecting information is not set; a process of identifying a second device among the plurality of devices, the second device corresponding to configuration information similar to configuration information corresponding to the first device, and in which the agent is set; and associating operation information of the second device, including information collected by the agent, with the first device.

18. In the process of identifying the second device, a device corresponding to configuration information having a similarity level equal to or greater than a threshold value according to the number of items common to the configuration information corresponding to the first device and the stored configuration information is identified. The program according to claim 17.

19. the stored configuration information includes configuration information related to the hardware of each of the plurality of devices and configuration information related to the software of each of the plurality of devices; In the process of identifying the configuration information, configuration information related to hardware corresponding to the first device and configuration information related to software corresponding to the first device are identified; In the process of identifying the second device, a device corresponding to configuration information similar to configuration information related to hardware corresponding to the first device and a device corresponding to configuration information similar to configuration information related to software corresponding to the first device are identified as the second device.

19. The program according to claim 17 or 18.

20. In the association process, Associating hardware operation information of the second device, which is similar to configuration information of the hardware corresponding to the first device, with the first device; Associating software-related operation information of the second device, which is similar to software-related configuration information corresponding to the first device, with the first device; 20. The program of claim 19.

21. when a request to output operation information of the first device is received, further executing a process of outputting operation information of the second device associated with the first device; 21. The program according to any one of claims 17 to 20.

22. further executing a process for detecting an abnormality occurring in a device included in the system; In the output process, if the device in which the abnormality has occurred is the second device, information about the first device is output.

22. The program of claim 21.

23. causing the first device to further execute a process of taking measures to deal with the abnormality that has occurred in the second device; 23. The program of claim 22.

24. In the process of implementing the countermeasure, calculating a priority of each of the plurality of countermeasures based on a risk level of the abnormality occurring in the second device and an impact of each of the plurality of countermeasures on the continuation of the service; determining a measure to be implemented on the first device according to the calculated priority; 24. The program of claim 23.

Images