Processing device, processing method, and program

Abstract

A processing device 1 comprises: an acquisition unit 21 that sequentially acquires monitoring values in a processing unit 2; a determination unit 24 that compares a first monitoring value group including a prescribed number of the monitoring values acquired before a prescribed time point with a second monitoring value group including a prescribed number of the monitoring values acquired after the prescribed time point, and that determines consistency or inconsistency between the first monitoring value group and the second monitoring value group; and a notification unit 25 that notifies, when the first monitoring value group and the second monitoring value group are determined as being inconsistent, the inconsistency to a maintenance person terminal.

Description

[Technical Field]

[0001] The present invention relates to a processing device, a processing method, and a program. [Background technology]

[0002] In recent years, the increasing complexity of information provision services has led to a problem of increasing overhead in monitoring software components. Monitoring software components requires increasing costs, including resources such as data capacity and communication costs with components, as well as the need for maintenance personnel to set optimal monitoring intervals for each component.

[0003] For example, there is a technique for adjusting the monitoring interval in accordance with the degree of fluctuation in the monitored value (Non-Patent Document 1). According to Non-Patent Document 1, by setting a wide monitoring interval during normal times, it is possible to reduce the frequency of polling to the agent that manages the monitored values ​​and thereby reduce communication costs.Non-Patent Document 1 also states that by setting a narrow monitoring interval during sudden changes, it is possible to accurately capture the shape of the transition in the monitored values, making it easier for operators to discover abnormalities in the monitored values. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Masaru Sakai, Kensuke Takahashi, Satoshi Kondoh, "A Self-daptive Measurement Rate Control Method for an Agent-based Service Monitoring System", 2020 1st Asia-Pacific Network Operations and Management Symposium (APNOMS) Summary of the Invention [Problem to be solved by the invention]

[0005] Non-Patent Document 1 states that the detection of anomalies in time-series data depends on the visual confirmation of the operator. Even if Non-Patent Document 1 accurately captures the transition of the monitored value by adjusting the monitoring interval, it may be difficult for the operator to detect subtle changes by visual confirmation.

[0006] The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a technique capable of detecting a change in a monitoring value. [Means for solving the problem]

[0007] A processing device according to one embodiment of the present invention includes an acquisition unit that sequentially acquires monitoring values ​​in a processing unit, a determination unit that compares a first group of monitoring values ​​including a predetermined number of monitoring values ​​before a predetermined time with a second group of monitoring values ​​including a predetermined number of monitoring values ​​after the predetermined time, and determines whether the first group of monitoring values ​​and the second group of monitoring values ​​match or mismatch, and a notification unit that notifies a maintenance terminal if the first group of monitoring values ​​and the second group of monitoring values ​​mismatch.

[0008] In one embodiment of the processing method of the present invention, a computer sequentially acquires monitoring values ​​in a processing unit, the computer compares a first group of monitoring values ​​including a predetermined number of monitoring values ​​before a predetermined time with a second group of monitoring values ​​including a predetermined number of monitoring values ​​after the predetermined time, determines whether the first group of monitoring values ​​and the second group of monitoring values ​​match or mismatch, and if the first group of monitoring values ​​and the second group of monitoring values ​​do not match, the computer notifies a maintenance terminal.

[0009] One aspect of the present invention is a program that causes a computer to function as the processing device. [Effects of the Invention]

[0010] According to the present invention, it is possible to provide a technique capable of detecting a change in a monitoring value. [Brief explanation of the drawings]

[0011] [Figure 1]FIG. 1 is a diagram illustrating the system configuration of a processing system according to an embodiment of the present invention and functional blocks of a processing device. [Figure 2] FIG. 2 is a diagram for explaining calculation of a predicted value of a monitored value at a predetermined time. [Figure 3] FIG. 3 is a diagram illustrating the calculation of the change score. [Figure 4] FIG. 4 is a diagram for explaining calculation of the monitoring interval. [Figure 5] FIG. 5 is a diagram illustrating a histogram of change scores. [Figure 6] FIG. 6 is a diagram illustrating the detection of trend changes in the monitored values. [Figure 7] FIG. 7 is a flowchart showing an example of processing by the processing device. [Figure 8] FIG. 8 is a diagram illustrating the hardware configuration of a computer used in the processing device. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the description of the drawings, the same parts are designated by the same reference numerals and the description thereof will be omitted.

[0013] (Processing System) The processing system 5 notifies the maintenance person terminal 4 of the trend change of the monitored value in the processing unit 2 that is the object of monitoring by the maintenance person.

[0014] The processing system 5 includes a processing device 1, a processing unit 2, an agent device 3, and a maintenance person terminal 4. The processing unit 2 and the agent device 3, the agent device 3 and the processing device 1, and the processing device 1 and the maintenance person terminal 4 are connected to each other so that they can communicate with each other. The processing system 5 shown in FIG. 1 includes one processing unit 2 and one agent device 3, but is not limited to this. The processing system 5 may include one or more processing units 2 and one or more agent devices 3. Furthermore, the processing unit 2 and the agent device 3 may be implemented on a single computer.

[0015] When the processing device 1 detects a change in the trend of the monitored value in the processing unit 2, it notifies the maintenance terminal 4 of the change.

[0016] The processing unit 2 outputs a monitoring value to be monitored by a maintenance person. The monitoring value may be, for example, the utilization rate of a computer's CPU or memory, or may be a value from another sensor or the like.

[0017] The agent device 3 acquires the monitoring value from the processing unit 2 in response to a request from the processing device 1 and transmits the acquired monitoring value to the processing device 1.

[0018] The maintenance person terminal 4 is a terminal used by a maintenance person who monitors the monitoring values ​​in the processing unit 2. The maintenance person terminal 4 receives notifications of trend changes in the monitoring values ​​from the processing device 1 and views the monitoring data 11.

[0019] (Processing device) 1, the processing device 1 includes various data including monitoring data 11, and functions of an acquisition unit 21, an adjustment unit 22, a determination unit 24, and a notification unit 25. Each piece of data is stored in a storage device such as a memory 902 or a storage 903. Each function is implemented in a CPU 901.

[0020] The monitoring data 11 is data that accumulates monitoring values ​​of the processing unit 2 acquired by the processing device 1. The monitoring data 11 is data that associates monitoring values ​​with conditions such as the date and time when the monitoring values ​​were acquired, for example. If noise is included in the monitoring values ​​acquired by the processing unit 2, or if noise is included in the process of the processing device 1 acquiring the monitoring values, the noise is removed by the processing unit 2, the agent device 3, or the processing device 1, and the monitoring values ​​after noise removal are accumulated in the monitoring data 11.

[0021] The acquisition unit 21 sequentially acquires the monitoring values ​​in the processing unit 2. The acquisition unit 21 stores the acquired monitoring values ​​in the monitoring data 11 in association with the acquisition date and time, etc. The acquisition unit 21 acquires the monitoring values ​​at a monitoring interval specified by the adjustment unit 22.

[0022] The adjustment unit 22 calculates a change score that is an index of a change in the monitoring value. The adjustment unit 22 adjusts the monitoring interval at which the acquisition unit 21 acquires the monitoring value from the agent device 3, based on the change score. The adjustment unit 22 further uses the calculated change score to adjust the monitoring interval at which the acquisition unit 21 acquires the monitoring value, and detects a change in the monitoring value. The change score represents the deviation between a predicted value at a given time that is inferred from past monitoring values, and the monitoring value acquired at a given time.

[0023] First, we will explain how the adjustment unit 22 calculates the change score. As shown in FIG. 2, the adjustment unit 22 calculates the change score by subtracting the noise from the data sequence x n-N+1 ,…,x n and the timestamp t for each data point n-N+1 ,…,t n At time t n+1 Predicted value x at p is calculated using equation (1). The window size is the predicted value x p This specifies the range of past measured values ​​referenced to calculate

[0024]

number

[0025] Here, time t n+1 The actual measured value x n+1 As shown in Figure 3, we define the predicted vector and the measured vector. The predicted vector is n The actual measured value x n From time t n+1 Predicted value x at p The measured vector is a vector to time t n The actual measured value x n From time t n+1 The actual measured value x n+1 is a vector to

[0026] The similarity between the predicted vector and the measured vector is calculated by equation (2).

[0027]

number

[0028] Also, the time n+1 Data x in n+1 Change score α(x n+1 ) is calculated using equation (3).

[0029]

number

[0030] The adjustment unit 22 adjusts the monitoring interval using the calculated change score. n-N+1 ,…,x n Assuming that the set of change scores for follows a log-normal distribution as shown in FIG. 5, the parameters of the probability density function are estimated. The adjustment unit 22 takes two points in the probability distribution, α1% and α2%. The adjustment unit 22 calculates the interval T to the next data point using equation (4). new Determine where T max , T min The relationship between α1, α2, and α2 is shown in FIG.

[0031]

number

[0032] The adjustment unit 22 adjusts the interval T calculated by the formula (4). new The acquisition unit 21 notifies the acquisition unit 21 of the interval T new The monitoring value is acquired from the agent device 3 every time.

[0033] The adjustment unit 22 includes a detection unit 23 that detects a change in the monitoring value using the calculated change score.

[0034] The detection unit 23 detects that a change score, which represents the deviation between a predicted value at a predetermined time estimated from past monitoring values ​​and a monitoring value acquired at the predetermined time by the acquisition unit 21, is equal to or greater than a threshold. The detection unit 23 notifies the determination unit 24 that the change score is equal to or greater than the threshold. Upon receiving the notification from the detection unit 23, the determination unit 24 determines whether or not there is a change in data trend.

[0035] Detection unit 23 assumes that the set of calculated change scores follows a log-normal distribution as shown in Fig. 5, and sets the right α% of the larger change scores as a threshold. When the change score calculated for a predetermined time is equal to or greater than the right α% that is the threshold, detection unit 23 notifies determination unit 24.

[0036] The determination unit 24 determines a change in the data trend of the monitoring value. In the embodiment of the present invention, the detection unit 23 notifies the determination unit 24 when the change score used when adjusting the monitoring interval exceeds a threshold, which is used as a trigger, and the determination unit 24 determines whether or not there is a change in the data trend when triggered by the notification from the detection unit 23, but this is not limited to this. The determination unit 24 may be triggered by another trigger to determine whether or not there is a change in the data trend, or may periodically determine whether or not there is a change in the data trend.

[0037] The determination unit 24 compares a first monitoring value group including a predetermined number of monitoring values ​​before a predetermined time with a second monitoring value group including a predetermined number of monitoring values ​​after the predetermined time, and determines whether the first monitoring value group and the second monitoring value group match or do not match. The first monitoring value group is a predetermined number of monitoring values ​​acquired before the predetermined time. The second monitoring value group is a predetermined number of monitoring values ​​acquired after the predetermined time. Here, the first monitoring value group and the second monitoring value group do not need to have the same number of monitoring values. The first monitoring value group and the second monitoring value group may be monitoring value groups acquired within a predetermined time period, for example.

[0038] In an embodiment of the present invention, the predetermined time is the timing when the change score exceeds a threshold. If the change score of the monitoring value acquired at the predetermined time is equal to or greater than the threshold, the determination unit 24 determines whether the first monitoring value group and the second monitoring value group match or do not match. Here, the first monitoring value group is the monitoring value group before the change score exceeded the threshold. The second monitoring value group is the monitoring value group after the change score exceeded the threshold.

[0039] The predetermined time is preferably a timing at which a change in the trend of the data over a relatively short time period is detected. The determination unit 24 determines whether or not there is a change in the trend of the data over a relatively long time period, triggered by the timing at which a change in the trend of the data over a relatively short time period is detected. For example, if the predetermined time is a timing at which the change score exceeds a threshold, the first monitoring value group and the second monitoring value group each preferably include monitoring values ​​acquired over a time period wider than the time period of the window size used to calculate the change score.

[0040] The first and second monitoring value groups will be described with reference to FIG. 6. In FIG. 6, the monitoring value at a given time is M. A set of m monitoring values ​​acquired before the time M was acquired is X=(X1, X2, ..., X m ) is the first set of monitored values. The set of n monitored values ​​Y=(Y1, Y2, ..., Y m ) is the second set of monitoring values. Each of n and m may be set to be longer than the window size used when calculating the change score. Furthermore, n and m are specified in advance by an administrator or the like.

[0041] Preferably, the first and second sets of monitored values ​​each include monitored values ​​acquired over a period of time that is longer than the allowable time for a temporary change in the monitored value, thereby enabling maintenance personnel to detect a change in the trend of the monitored value that cannot be overlooked, rather than a temporary change in the monitored value that occurred within the allowable time.

[0042] The determination unit 24 determines that there is a mismatch when there is a difference between the first representative value in the first monitoring value group and the second representative value in the second monitoring value group that is equal to or greater than the significance level. The representative value is a value that represents each value in each monitoring value group, such as the average value, mode, or variance. The significance level (threshold) is appropriately set in advance by a maintenance person or the like.

[0043] First, a case where the representative value is an average value will be described. If formula (5) is satisfied, the determining unit 24 determines that the monitored values ​​before and after the predetermined time are inconsistent (there is a change equal to or greater than the significance level).

[0044]

number

[0045] Next, a case where the representative value is a variance value will be described. When the representative value is a variance value, monitoring values ​​around a predetermined value are acquired so that m = n. The determination unit 24 calculates the statistic F0 according to equation (6).

[0046]

number

[0047] The α point of the F distribution with degrees of freedom (m, n-1) under the significance level α is F α If the inequality in equation (7) is satisfied, the determining unit 24 determines that the monitoring values ​​before and after the predetermined time are inconsistent (there is a change equal to or greater than the significance level).

[0048]

number

[0049] If the first monitoring value group and the second monitoring value group do not match, the notification unit 25 notifies the maintenance operator terminal 4. If the first monitoring value group and the second monitoring value group do not match, this specifically means that there is a difference between the representative value of the first monitoring value group and the representative value of the second monitoring value group that is equal to or greater than the significance level.

[0050] The maintenance person terminal 4 notifies the maintenance person that the first and second monitoring value groups do not match and that a change in the data trend has occurred by displaying a message or sounding an alarm. The maintenance person terminal 4 may inquire of the processing device 1 about the monitoring value around the predetermined time via the notification unit 25. The processing device 1 displays the transition of the monitoring value around the predetermined value on the maintenance person terminal 4.

[0051] The processing by the processing device 1 according to the embodiment of the present invention will be described with reference to Fig. 7. The acquisition unit 21 acquires the monitoring values ​​of the sequential processing unit 2 at monitoring intervals specified by the adjustment unit 22, and stores them in the monitoring data 11. The example shown in Fig. 7 explains the processing in which the adjustment unit 22 and the determination unit 24 process the monitoring values ​​acquired by the acquisition unit 21, and the notification unit 25 notifies according to the results.

[0052] In step S101, the adjustment unit 22 acquires a monitoring value at a predetermined time from the monitoring data 11. At this time, the adjustment unit 22 also acquires a monitoring value before the predetermined time for calculating a predicted value at the predetermined time.

[0053] In step S102, adjustment unit 22 calculates a change score from the difference between a predicted value at a predetermined time predicted from past monitoring values ​​and the monitoring value at the predetermined time acquired in step S101. In step S103, adjustment unit 22 calculates a monitoring interval from the change score calculated in step S102, and notifies acquisition unit 21 of the calculated monitoring interval.

[0054] The detection unit 23 of the adjustment unit 22 determines whether the change score at the predetermined time calculated in step S102 is equal to or greater than a threshold value. If the change score is not equal to or greater than the threshold value, specifically, if the difference between the monitored value acquired at the predetermined time and the predicted value is small, the process ends.

[0055] If the change score at the predetermined time calculated in step S102 is equal to or greater than the threshold, the detection unit 23 notifies the determination unit 24 that the change score at the predetermined time is equal to or greater than the threshold. In step S105, the determination unit 24 determines whether the set of monitoring values ​​before the predetermined time and the set of monitoring values ​​after the predetermined time are inconsistent. If there is no inconsistency, specifically, if there is no difference between the set of monitoring values ​​before the predetermined time and the set of monitoring values ​​after the predetermined time that is equal to or greater than the significance level, the processing ends. If there is a inconsistency, specifically, if there is a difference between the set of monitoring values ​​before the predetermined time and the set of monitoring values ​​after the predetermined time that is equal to or greater than the significance level, the notification unit 25 notifies the maintenance terminal 4 of this in step S106 and ends the processing. After ending the processing, the processing device 1 may perform the processing of steps S101 to S106 for another predetermined time.

[0056] In this way, the processing device 1 according to the embodiment of the present invention determines the change in the monitoring value before and after a specified time, and therefore can detect the change in the monitoring value without relying on the change in the monitoring value being visually inspected by a maintenance person.

[0057] The processing device 1 can adjust the interval for acquiring the monitoring value based on the change score, and use the change score to determine changes in the monitoring value, so that it can detect trend changes in the monitoring value in conjunction with adjusting the monitoring interval.

[0058] The processing device 1 of the present embodiment described above is, for example, a general-purpose computer system including a CPU (Central Processing Unit, processor) 901, a memory 902, a storage 903 (HDD: Hard Disk Drive, SSD: Solid State Drive), a communication device 904, an input device 905, and an output device 906. In this computer system, the CPU 901 executes a program loaded on the memory 902, thereby realizing each function of the processing device 1.

[0059] The processing device 1 may be implemented in one computer or in multiple computers, or may be a virtual machine implemented in a computer.

[0060] The program of the processing device 1 can be stored on a computer-readable recording medium such as an HDD, SSD, USB (Universal Serial Bus) memory, CD (Compact Disc), or DVD (Digital Versatile Disc), or can be distributed via a network.

[0061] The present invention is not limited to the above-described embodiment, and various modifications are possible within the scope of the present invention. [Explanation of symbols]

[0062] 1 Processing equipment 2 Processing section 3 Agent Device 4 Maintenance personnel terminal 5 Processing System 11 Monitoring Data 21 Acquisition Department 22 Adjustment part 23 Detection unit 24 Judgment section 25 Notification Department 901 CPU 902 memory 903 Storage 904 Communication equipment 905 Input Device 906 Output Device

Claims

1. an acquisition unit that successively acquires the monitoring value in the processing unit; a determination unit that compares a first group of monitored values ​​including a predetermined number of monitored values ​​before a predetermined time with a second group of monitored values ​​including a predetermined number of monitored values ​​after the predetermined time, and determines whether the first group of monitored values ​​and the second group of monitored values ​​match or do not match; a notification unit that notifies a maintenance terminal when the first group of monitored values ​​and the second group of monitored values ​​do not match; an adjustment unit that adjusts the monitoring interval for acquiring the monitoring values ​​from the processing unit based on a change score that indicates a difference between a predicted value at a predetermined time estimated from past monitoring values ​​and the monitoring value acquired at the predetermined time; A processing device comprising:

2. Further comprising a detection unit that detects that the change score is equal to or greater than a threshold value. The determination unit determines whether the first group of monitor values ​​and the second group of monitor values ​​match or mismatch when the change score of the monitor value acquired at the predetermined time is equal to or greater than a threshold. The processing device of claim 1 .

3. The determination unit determines that there is a mismatch when there is a difference between a first representative value in the first monitor value group and a second representative value in the second monitor value group that is equal to or greater than a significance level. The processing device of claim 1 .

4. The first group of monitored values ​​and the second group of monitored values ​​each include monitored values ​​acquired over a period of time that is equal to or longer than a period that is allowed as a temporary change in the monitored value. The processing device of claim 1 .

5. The computer sequentially acquires the monitored values ​​in the processing unit, the computer compares a first group of monitored values ​​including a predetermined number of monitored values ​​before a predetermined time with a second group of monitored values ​​including a predetermined number of monitored values ​​after the predetermined time, and determines whether the first group of monitored values ​​and the second group of monitored values ​​match or do not match; the computer notifies a maintenance terminal when the first group of monitored values ​​and the second group of monitored values ​​do not match; The computer adjusts the monitoring interval for acquiring the monitoring values ​​from the processing unit based on a change score that indicates a difference between a predicted value at a predetermined time estimated from past monitoring values ​​and the monitoring value acquired at the predetermined time. Processing method.

6. A program for causing a computer to function as the processing device according to any one of claims 1 to 4.

Images