Fault cause identification support device, fault cause identification support method, and fault cause identification support program

Abstract

To enable providing easily and properly information beneficial to identify a cause of failure.SOLUTION: A management computer 100 for assisting in identifying a cause of a failure relating to execution of an application includes a CPU 101 and an HDD 103. The HDD 103 stores configuration information (configuration information, configuration change history) relating to a configuration at a plurality of time points for a predetermined object component relating to execution of the application, The CPU 101 is configured to calculate a viewpoint-based differential score that is a differential score in each of a plurality of viewpoints between a current configuration and a past configuration for the predetermined object component relating to execution of the application.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a technology for assisting in identifying the cause of a failure that has occurred in an IT system. [Background technology]

[0002] Companies and other organizations use IT systems for various business operations. If an IT system malfunctions, it can have a significant impact on business operations and society, so shortening the response time to resolve the malfunction is important.

[0003] Known techniques for shortening the response time required to resolve a fault include recording the situation at the time the fault occurred and the know-how on how to deal with it, and then reusing the know-how on how to deal with it if a similar situation occurs (see, for example, Patent Document 1).

[0004] Furthermore, a known technique for predicting the occurrence of a failure is to store the situation immediately before the failure and to use the occurrence of a similar situation as a sign of the failure (see, for example, Patent Document 2). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2014-134956 [Patent Document 2] Japanese Patent Application Laid-Open No. 2012-203684 Summary of the Invention [Problem to be solved by the invention]

[0006] In recent years, applications have come to be used in such a way that the software that makes up the application is updated and the configuration of the system that runs the application is changed depending on the operational situation, making it difficult to identify the cause of a failure.

[0007] For example, when investigating the cause of a failure that has occurred in an application, the output of logs, traces, performance, etc. in the current configuration of the system running the application may be compared with the output in a past configuration, but identifying the cause relies on the experience of experts who are familiar with the application.

[0008] Furthermore, when updating software that constitutes an application or changing the configuration of a system that runs the application, there are many cases where a similar situation has not existed in the past, and the technology of Patent Document 1 cannot be used.

[0009] The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a technique that can easily and appropriately calculate information that is useful for identifying the cause of a fault. [Means for solving the problem]

[0010] In order to achieve the above-mentioned object, a fault cause identification support device according to one aspect is a fault cause identification support device for supporting the identification of the cause of a fault related to the execution of an application, the fault cause identification support device having a processor and a storage device, the storage device storing configuration information relating to configurations at multiple points in time for a specified target component related to the execution of the application, and the processor calculating a perspective-specific difference score which is a difference score for each of multiple perspectives between a current configuration and a past configuration for the specified target component related to the execution of the application. [Effects of the Invention]

[0011] According to the present invention, useful information for identifying the cause of a failure can be calculated easily and appropriately. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating an outline of an embodiment. [Figure 2]FIG. 2 is a diagram showing the overall configuration of a computer system according to one embodiment. [Figure 3] FIG. 3 is a configuration diagram of a plug-in repository according to an embodiment. [Figure 4] FIG. 4 is a diagram illustrating the configuration of an application configuration table according to an embodiment. [Figure 5] FIG. 5 is a diagram illustrating the configuration of an application configuration change history table according to an embodiment. [Figure 6] FIG. 6 is a diagram illustrating the configuration of a software configuration table according to an embodiment. [Figure 7] FIG. 7 is a diagram illustrating the configuration of a software configuration change history table according to an embodiment. [Figure 8] FIG. 8 is a configuration diagram of a storage configuration table according to one embodiment. [Figure 9] FIG. 9 is a configuration diagram of a storage configuration change history table according to one embodiment. [Figure 10] FIG. 10 is a diagram showing the configuration of a difference score table according to an embodiment. [Figure 11] FIG. 11 is a diagram showing a difference score calculation result screen according to one embodiment. [Figure 12] FIG. 12 is a diagram showing a difference details screen according to one embodiment. [Figure 13] FIG. 13 is a flowchart of a plug-in registration process according to an embodiment. [Figure 14] FIG. 14 is a flowchart of a failure cause identification support process according to one embodiment. [Figure 15] FIG. 15 is a flowchart of a difference score calculation process according to an embodiment. [Figure 16] FIG. 16 is a flowchart of a past configuration creation process according to an embodiment. [Figure 17] FIG. 17 is a flowchart of a viewpoint-specific difference score calculation process (software version of application) according to an embodiment. [Figure 18]FIG. 18 is a flowchart of a viewpoint-specific difference score calculation process (container configuration of an application) according to an embodiment. [Figure 19] FIG. 19 is a flowchart of a viewpoint-specific difference score calculation process (peripheral container) according to an embodiment. [Figure 20] FIG. 20 is a flowchart of a difference score display process according to an embodiment. [Figure 21] FIG. 21 is a flowchart of a similar configuration recommendation adding process according to one embodiment. [Figure 22] FIG. 22 is a flowchart of a viewpoint-specific recommendation adding process according to one embodiment. [Figure 23] FIG. 23 is a flowchart of a difference detail display process according to an embodiment. [Figure 24] FIG. 24 is a flowchart of the usefulness coefficient update process according to one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] The following description of the embodiments will be given with reference to the drawings. Note that the embodiments described below do not limit the scope of the invention as claimed, and not all of the elements and combinations thereof described in the embodiments are necessarily essential to the solution of the invention.

[0014] In the following explanation, processing may be described with a "program" as the subject of operation, but a program is executed by a processor (e.g., a CPU (Central Processing Unit)) to perform a predetermined process using storage resources (e.g., memory) and / or a communication interface device (e.g., a NIC (Network Interface Card)) as appropriate, so the subject of processing may also be the program. Processing described with a program as the subject of operation may also be processing performed by a processor or a computer or system having that processor.

[0015] In the following explanation, information may be described using the expression "AAA table," but the information may be expressed in any data structure. In other words, to indicate that the information does not depend on the data structure, the "AAA table" may be called "AAA information."

[0016] First, an outline of one embodiment will be described.

[0017] FIG. 1 is a diagram illustrating an outline of an embodiment.

[0018] When a management computer 100, which is an example of a failure cause identification support device according to an embodiment of the present invention, detects a failure in an application 10, it creates (S10) configurations at multiple past points in time (past configurations 1 to N) based on current configuration information 20 (current configuration) about a component (configuration item: suspected component, suspected configuration item) that is suspected of causing a failure among the components that are executing the application, and on configuration information change history 30. Here, the configuration item may be, for example, a container, a process, software, storage, a cluster, or a node.

[0019] Next, the management computer 100 obtains a difference score calculation function 306 that calculates a difference score for each perspective (aspect-specific difference score), from the plug-in 301A in the plug-in repository 300, and uses the difference score calculation function 306 to calculate a perspective-specific difference score, which is a difference score between each of past configurations 1 to N for a plurality of perspectives and the current configuration (S20). Next, the management computer 100 creates a difference score table 1000 using the perspective-specific difference scores for each of past configurations 1 to N. Thereafter, based on the contents of the difference score table 1000, the management computer 100 may output as a recommendation a past configuration that is most similar to the current configuration, or a past configuration that differs significantly in only one of the perspectives, in other words, a past configuration that may provide a clue to solving the problem.

[0020] Next, a computer system according to an embodiment will be described in detail.

[0021] FIG. 2 is a diagram showing the overall configuration of a computer system according to one embodiment.

[0022] The computer system 1 includes a management computer 100, a repository computer 120, one or more clusters 130 (130A, 130B, etc.), and one or more storages 140 (140A, 140B, etc.). The management computer 100, the repository computer 120, and the clusters 130 are connected via a network 110. The network 110 is, for example, a communication path such as a wired LAN (Local Area Network) or a wireless LAN. The clusters 130 are connected to one or more storages 140.

[0023] The cluster 130 includes one or more nodes 131 (131A, 131B, etc.) that execute applications. The storage 140 stores data related to the execution of applications.

[0024] The repository computer 120 is, for example, a computer such as a PC (Personal Computer) or a general-purpose server. The repository computer 120 includes a repository management program 121 and a plug-in repository 300. The repository management program 121 is executed by a processor (not shown) of the repository computer 120 to perform processes for managing plug-ins 301 (301A, 301B, etc.: see FIG. 3 ) in the plug-in repository 300, such as updating the plug-ins 301 and transmitting the plug-ins 301. The plug-in repository 300 will be described later. The repository computer 120 may also be configured using the management computer 100.

[0025] The management computer 100 is, for example, a computer such as a PC or a general-purpose server, and includes a CPU 101 as an example of a processor, memory 102, a storage device 103, and a network (NW) interface 104. The management computer 100 is connected to an input / output device 105.

[0026] The NW interface 104 is an interface such as a wired LAN card or a wireless LAN card, and communicates with other devices (for example, the node 131 of the cluster 130, the repository computer 120) via the network 110.

[0027] The CPU 101 executes various processes in accordance with programs stored in the memory 102 and / or the storage device 103 .

[0028] The memory 102 is, for example, a RAM (RANDOM ACCESS MEMORY), and stores programs executed by the CPU 101 and necessary information.

[0029] The storage device 103 is, for example, a hard disk drive or flash memory, and stores programs executed by the CPU 101 and data used by the CPU 101. In this embodiment, the storage device 103 stores a fault analysis program 200 as an example of a fault cause identification support program, and stores, as data, a difference score table 1000, configuration information 20, and configuration information change history 30. The processing by the fault analysis program 200 will be described later with reference to a flowchart.

[0030] The configuration information 20 includes an application configuration table 400, a software configuration table 600, and a storage configuration table 800. The configuration information change history 30 includes an application configuration change history table 500, a software configuration change history table 700, and a storage configuration change history table 900. The configuration of each table stored in the storage device 103 will be described later.

[0031] The storage device 103 may store a past case database (past case DB: past case information) that stores events that occurred when past failures occurred and examples of how to deal with those events when they occurred, and measurement value information about configuration items related to application execution (for example, information about performance values ​​related to performance (performance value information: for example, CPU usage rate or the number of processed requests), log information (log information) when an application is executed, and event information (event information) when an application is executed).Here, event information is, for example, information including a predetermined keyword extracted from log information, information about a predetermined performance value extracted from performance value information, or information that satisfies a predetermined condition extracted from log information or performance value information.

[0032] The input / output device 105 includes, for example, an input device such as a mouse or keyboard that accepts information input by a user, and an output device such as a display that displays and outputs a user interface including various types of information.

[0033] Next, the plug-in repository 300 will be described in detail.

[0034] FIG. 3 is a configuration diagram of a plug-in repository according to an embodiment.

[0035] The plug-in repository 300 stores one or more plug-ins 301 (301A, 301B, etc.) corresponding to each type of configuration item. Here, a configuration item is an item related to the execution of an application, and may be, for example, a container, a pod, a process, software, storage, a cluster, or a node.

[0036] The plug-in 301 includes a type 302 of the configuration item corresponding to the plug-in 301, a plurality of viewpoint-specific functions 303 related to each viewpoint for the configuration item corresponding to the plug-in 301, and a measurement value difference calculation function 308 that calculates the difference in measurement values ​​for the configuration item corresponding to the plug-in 301.

[0037] The viewpoint-specific function 303 includes a viewpoint 304, a usefulness coefficient 305, a difference score calculation function 306, and a difference display function 307. The viewpoint 304 is the content of the viewpoint corresponding to the viewpoint-specific function 303. For example, if the configuration item is a container, the content of the viewpoint may include the version of software included in the application executed in the container, the container configuration, other containers (peripheral containers) executed on the same node as the container, and the time period during which the application is executed in the container. The usefulness coefficient 305 is a usefulness coefficient used for correction when calculating the difference score. The usefulness coefficient is managed so that the value increases when there is user feedback that the viewpoint-specific difference score calculated by the difference score calculation function 306 is useful. The difference score calculation function 306 is a function for calculating a viewpoint-specific difference score between a current configuration and a past configuration for the viewpoint corresponding to the viewpoint-specific function 303. The difference display function 307 is a function for performing processing to display the viewpoint-specific difference score for the viewpoint corresponding to the viewpoint-specific function 303 on a screen.

[0038] The measurement value difference calculation function 308 includes one or more log difference score calculation functions 309, one or more performance value difference score calculation functions 310, and one or more event difference score calculation functions 311. The log difference score calculation function 309 is a function for calculating a difference score for a log. The performance value difference score calculation function 310 is a function for calculating a difference score for a performance value. The event difference score calculation function 311 is a function for calculating a difference score for an event.

[0039] Next, the application configuration table 400 will be described in detail.

[0040] FIG. 4 is a diagram illustrating the configuration of an application configuration table according to an embodiment.

[0041] The application configuration table 400 is a table for managing the configuration of containers that execute applications. An entry in the application configuration table 400 includes fields for a cluster 401, a node 402, a pod 403, an application 404, and a container 405.

[0042] Cluster 401 stores the identification name of the cluster that executes the application. Node 402 stores the identification name of the node that executes the application. Pod 403 stores the identification name of the pod that executes the application. Here, a pod is a basic execution unit that executes an application, and is composed of one or more containers. Application 404 stores the identification name of the application to be executed. Container 405 stores information about the container that executes the application, and includes fields for name 406, type 407, and version 408. Name 406 stores the name of the container. Type 407 stores the type of the container. Version 408 stores the version number of the container.

[0043] Next, the application configuration change history table 500 will be described in detail.

[0044] FIG. 5 is a diagram illustrating the configuration of an application configuration change history table according to an embodiment.

[0045] The application configuration change history table 500 is a table that manages the change history of configuration items (here, containers, pods, nodes, etc.) that execute applications, and stores an entry for each configuration change of a configuration item. An entry in the application configuration change history table 500 includes fields for recording time 501, change operation 502, configuration item type 503, and configuration item 504.

[0046] The recording time 501 stores the time when the change corresponding to the entry was made. The change operation 502 stores the change operation corresponding to the entry. Change operations include addition, deletion, and update. The configuration item type 503 stores the type of the configuration item that was changed corresponding to the entry. The configuration item 504 stores the name of the configuration item that was changed corresponding to the entry.

[0047] Next, the software configuration table 600 will be described in detail.

[0048] FIG. 6 is a diagram illustrating the configuration of a software configuration table according to an embodiment.

[0049] The software configuration table 600 is a table for managing the configuration of software included in an application, and stores an entry for each application. The entry of the software configuration table 600 includes fields for application 601, container type 602, container version 603, software 604, and version 605.

[0050] The application 601 stores the name of the application corresponding to the entry. The container type 602 stores the type of container used to run the application corresponding to the entry. The container version 603 stores the version number of the container used to run the application corresponding to the entry. The software 604 stores the names of one or more software programs that make up the application corresponding to the entry. The version 605 stores the version number of the corresponding software.

[0051] Next, the software configuration change history table 700 will be described in detail.

[0052] FIG. 7 is a diagram illustrating the configuration of a software configuration change history table according to an embodiment.

[0053] The software configuration change history table 700 is a table that manages the history of changes made to the software configuration of an application, and stores an entry for each software configuration change. The entries in the software configuration change history table 700 include fields for recording time 701, change operation 702, application 703, container type 704, old container version 705, new container version 706, software 707, old version 708, and new version 709.

[0054] The recording time 701 stores the time when the software corresponding to the entry was changed. The change operation 502 stores the change operation for the software corresponding to the entry. Change operations include add, delete, update, etc. The application 703 stores the name of the application that includes the software corresponding to the entry. The container type 704 stores the type of container in which the software corresponding to the entry runs. The old container version 705 stores the version number of the container before the software corresponding to the entry was changed. The new container version 706 stores the version number of the container after the software corresponding to the entry was changed. The software 707 stores the name of the software corresponding to the entry. The old version 708 stores the version number of the software corresponding to the entry before the change. The new version 709 stores the version number of the software corresponding to the entry after the change.

[0055] Next, the storage configuration table 800 will be described in detail.

[0056] FIG. 8 is a configuration diagram of a storage configuration table according to one embodiment.

[0057] The storage configuration table 800 is a table for managing the configuration of the storage 140, and stores an entry for each storage. The entry of the storage configuration table 800 includes fields for storage 801, model 802, control program version 803, volume ID 804, capacity 805, QoS priority 806, pool ID 807, copy volume ID 808, and copy method 809.

[0058] The storage 801 stores the name of the storage corresponding to the entry. The model 802 stores the model name of the storage corresponding to the entry. The control program 803 stores the version number of the control program of the storage corresponding to the entry. The volume ID 804 stores the ID of the volume (volume ID) of the storage corresponding to the entry. The capacity 805 stores the capacity of the volume of the volume ID in the entry. The QoS priority 806 stores the priority in QoS (Quality of Service). The pool ID 807 stores the ID (pool ID) of the pool that provides storage space to the volume of the volume ID corresponding to the entry. The copy volume ID 808 stores the ID of the volume (copy volume) that is the copy destination of the volume of the volume ID corresponding to the entry. The copy method 809 stores the method (copy method) for copying to the copy volume. Examples of copy methods include synchronous, which copies synchronously, asynchronous, which copies asynchronously, and snapshot, which uses a snapshot.

[0059] Next, the storage configuration change history table 900 will be explained in detail.

[0060] FIG. 9 is a configuration diagram of a storage configuration change history table according to one embodiment.

[0061] The storage configuration change history table 900 is a table for managing the history of changes made to the configuration of the storage 140, and stores an entry for each change to the storage configuration. An entry in the storage configuration change history table 900 includes fields for recording time 901, change operation 902, configuration item type 903, configuration item 904, and change content 905.

[0062] The recording time 901 stores the time when the change corresponding to the entry was made. The change operation 902 stores the change operation corresponding to the entry. Change operations include add, delete, update, etc. The configuration item type 903 stores the type of configuration item (configuration item type) in the storage where the change corresponding to the entry was made. Configuration item types include storage, copy volume, volume, etc. The configuration item 904 stores the name of the configuration item (storage, volume, etc.) where the change corresponding to the entry was made. The change content 905 stores the content of the change corresponding to the entry.

[0063] Next, the difference score table 1000 will be described in detail.

[0064] FIG. 10 is a diagram showing the configuration of a difference score table according to an embodiment.

[0065] The difference score table 1000 is a table for managing perspective-specific difference scores and measurement value difference scores for multiple past configurations, and is created by the fault cause identification support process (see FIG. 14 ), which will be described later. The difference score table 1000 stores an entry for each past configuration. The entry in the difference score table 1000 includes fields for a past configuration 1001, a start time 1002, an end time 1003, a perspective-specific difference score 1004, and a measurement value difference score 1009.

[0066] The past configuration 1001 stores the name of the past configuration corresponding to the entry. The start time 1002 stores the time when the past configuration corresponding to the entry started. The end time 1003 stores the time when the past configuration corresponding to the entry ended. The perspective-specific difference score 1004 stores perspective-specific difference scores for multiple perspectives of the past configuration corresponding to the entry. In this embodiment, the perspective-specific difference score 1004 includes fields for a software version 1005, a container configuration 1006, a peripheral container 1007, and a time period 1008.

[0067] The software version 1005 stores a difference score by perspective when the software version is used as a perspective. The container configuration 1006 stores a difference score by perspective when the container configuration is used as a perspective. The surrounding container 1007 stores a difference score by perspective when the surrounding container is used as a perspective. The time period 1008 stores a difference score by perspective when the time period of execution is used as a perspective.

[0068] A difference score (measurement value difference score) regarding the measurement value of the past configuration corresponding to the entry is stored in the measurement value difference score 1009. In this embodiment, the measurement value difference score 1009 includes fields for a log output content 1010, an occurring event 1011, and a performance value 1012.

[0069] The log output content 1010 stores a difference score for a measurement value related to the log output content (for example, the number of specified logs output, etc.). The occurring event 1011 stores a difference score for a measurement value related to an occurring event (for example, the number of times an event occurred, etc.). The performance value 1012 stores a difference score for a performance value of the configuration that executes the application (for example, the CPU usage rate used, the number of requests processed, etc.).

[0070] Next, a difference score calculation result screen 1100 output by the management computer 100 will be described.

[0071] FIG. 11 is a diagram showing a difference score calculation result screen according to one embodiment.

[0072] The difference score calculation result screen 1100 is a screen displayed by the fault cause identification support processing (see FIG. 14) described later.

[0073] The difference score calculation result screen 1100 includes a configuration item display area 1101, a difference score table display area 1102, a similar configuration recommendation display area 1103, and a viewpoint-specific recommendation display area 1104 (1104A, 1104B).

[0074] A configuration item display area 1101 displays the configuration item (for example, suspected configuration item) for which a difference score is to be displayed, the type of the target configuration item, and the application.

[0075] The difference score table display area 1102 displays a difference score table created based on the difference score table 1000 generated by the fault cause identification support processing. On the display screen, for example, if the difference score is equal to or greater than a predetermined value, the display area for that difference score is highlighted compared to other areas. In this embodiment, by pressing an area for the difference score by perspective of the past configuration in the difference score table display area 1102, a difference details screen (see FIG. 12) is displayed that shows in detail the differences for the perspective of the pressed past configuration.

[0076] The similar configuration recommendation display area 1103 displays recommendations based on the contents of past configurations added to the past configuration recommendation list by the similar configuration recommendation addition process (see FIG. 21) described later. Here, the contents of the recommendation may include, for example, the name of the past configuration to be recommended (recommended past configuration), the start time and end time of this past configuration, the viewpoint of why it was selected as a recommendation (in this case, most similar), the average score of the difference scores for this past configuration, etc.

[0077] The viewpoint-specific recommendation display area 1104 displays recommendations based on the contents of past configurations added to the past configuration recommendation list by the viewpoint-specific recommendation addition process (see FIG. 22) described below. Here, the contents of the recommendation may include, for example, the name of the past configuration to be recommended (recommended past configuration), the start time and end time of this past configuration, the viewpoint (recommended viewpoint) as to why it was selected as the recommendation, and the average score of the difference scores for this past configuration.

[0078] Next, the difference details screen 1200 will be described.

[0079] Fig. 12 is a diagram showing a difference details screen according to one embodiment. Fig. 12 is the difference details screen for past configuration 2 shown in Fig. 11. The difference details screen 1200 is displayed, for example, by the difference details display process (see Fig. 23) described later.

[0080] The difference details screen 1200 includes a configuration item display area 1201 , a difference location display area 1202 , a measurement value difference content display area 1203 , a useful button 1205 , and a close button 1206 .

[0081] In the configuration item display area 1201, the configuration item that is the target of the difference details screen (target configuration item), the type of the target configuration item, and the application are displayed.

[0082] The difference part display area 1202 displays the differences between the current configuration and the past configuration for the target configuration item for which the difference in the perspective-specific difference score for the target configuration item is equal to or greater than a predetermined value. In this embodiment, the difference part display area 1202 includes a current configuration display area 1202A that displays the current configuration for the target configuration item, and a past configuration display area 1202B that displays the past configuration. In the current configuration display area 1202A, the parts that differ from the past configuration are highlighted compared to other parts.

[0083] The measurement value difference content display area 1203 displays selectable difference content for multiple measurement value differences. In the example of FIG. 12, the measurement value difference content display area 1203 displays difference content 1203A for log output content, difference content 1203B for occurred events, and difference content 1203C for performance values, overlapping each other. By selecting a tab, the corresponding difference content can be confirmed. In the example of FIG. 12, the state in which difference content 1203B for occurred events is selected is shown. The difference content 1203B for occurred events includes a current content display area 1204A that displays the number of times the event occurred in the current configuration, and a past content display area 1204B that displays the number of times the event occurred in the past configuration. In the difference content 1203B for occurred events, differences between the current content and the past content are highlighted. Note that when difference content 1203A for log output content or difference content 1203C for performance values ​​is selected, the corresponding current content and past content are also displayed.

[0084] The useful button 1205 is a button that is displayed when the past configuration targeted by the difference details screen is a recommended past configuration, and is a button that the user is to press when they think that information about the difference for the displayed perspective of the displayed past configuration is useful for identifying the cause of the fault. When the useful button 1205 is pressed, a usefulness coefficient update process (see FIG. 24), which will be described later, is executed to update the usefulness coefficient that adjusts the difference score for the perspective displayed on the difference details screen.

[0085] The close button 1206 is a button that is pressed to close the difference details screen 12, and when the close button 1206 is pressed, the difference details screen 12 is closed.

[0086] Next, the processing operation of the computer system 1 will be described.

[0087] First, the plug-in registration process for registering a new plug-in 301 in the repository computer 120 will be described.

[0088] FIG. 13 is a flowchart of a plug-in registration process according to an embodiment.

[0089] The repository management program 121 of the repository computer 120 (strictly speaking, the processor that executes the repository management program 121) receives a new plug-in, for example, via the network 110 (S201). Note that the new plug-in may be created by the management computer 100 or by another device.

[0090] Next, the repository management program 121 registers the received plug-in in the plug-in repository 300 (S202).

[0091] According to this plug-in registration process, newly required plug-ins can be registered in the plug-in repository 300 and used.

[0092] Next, the processing operation by the management computer 100 will be explained.

[0093] FIG. 14 is a flowchart of a failure cause identification support process according to one embodiment.

[0094] The failure cause identification support processing is executed, for example, when the management computer 100 detects the occurrence of a failure in an application, or when notified of the occurrence of a failure in an application.

[0095] The fault analysis program 200 of the management computer 100 (strictly speaking, the CPU 101 that executes the fault analysis program 200) receives a group of events related to the application in which a fault has occurred (S100).

[0096] Next, the fault analysis program 200 infers a configuration item suspected of being the cause of the fault (suspected configuration item) based on the group of events. Note that a known method can be used to infer a suspected configuration item.

[0097] Next, the fault analysis program 200 determines whether or not there is an event pattern in the past case DB that is similar to the event pattern in the current fault (S102).

[0098] As a result, if it is determined that the past case DB contains an event pattern similar to the event pattern of the current failure (S102: Y), the failure analysis program 200 presents the countermeasures for the past cases in the past case DB, for example, via the input / output device 105 (S103), and terminates the processing. Here, the technology of Patent Document 1 may be used for the processing of steps S102 and S103. In this way, if the countermeasure is found in the past case DB, it is possible to quickly present an appropriate countermeasure by presenting that countermeasure.

[0099] On the other hand, if it is determined that the past case DB does not contain an event pattern similar to the event pattern in the current failure (S102: N), the past case DB cannot be used, so the failure analysis program 200 executes a difference score calculation process (see Figure 15) to calculate a difference score between the current configuration and the past configuration for the suspect configuration item (S104).

[0100] Next, the fault analysis program 200 executes a difference score display process (see FIG. 20) that displays the difference score for the suspected configuration item, and ends the fault cause identification support process.

[0101] Next, the difference score calculation process in step S104 will be described.

[0102] FIG. 15 is a flowchart of a difference score calculation process according to an embodiment.

[0103] The fault analysis program 200 acquires configuration information of an IT system (application, software, storage, etc.) that includes a suspected configuration item from the storage device 103 (S301). Next, the fault analysis program 200 acquires the configuration change history of the IT system from the storage device 103 (S302). Here, when acquiring N past configurations, the period for acquiring the configuration change history may be the period from the point in time that is unit time × N before the current time.

[0104] Next, the failure analysis program 200 executes a past configuration creation process (see FIG. 16) for creating a predetermined number of past configurations (N in this example) (S303).

[0105] Next, the failure analysis program 200 acquires the plug-in 301 corresponding to the configuration item type of the suspected configuration item from the plug-in repository 300 of the repository computer 120 (S304).

[0106] Next, the fault analysis program 200 acquires the viewpoint-specific functions 303 for all viewpoints and the measurement value difference calculation function 308 from the plug-in 301 (S305).

[0107] Next, the fault analysis program 200 selects one of the unprocessed difference score calculation functions from the measurement value difference calculation functions 308 (S306), applies the selected difference score calculation function to each created past configuration to calculate the measurement value difference score (S307), and stores the calculated measurement value difference score in the corresponding field of the difference score table 1000 (S308).

[0108] Next, the fault analysis program 200 determines whether processing has been performed using all the difference score calculation functions in the measurement value difference calculation function 308 (S309), and if processing has not been performed using all the difference score calculation functions (S309: N), the program proceeds to step S306 and performs processing using the difference score calculation functions that have not been processed.

[0109] On the other hand, if processing has been performed using all the difference score calculation functions (S309: Y), the fault analysis program 200 selects a perspective-specific difference score calculation function 306 of the unprocessed perspective-specific function 303 (S310), and executes a perspective-specific difference score calculation process that applies the selected perspective-specific difference score calculation function to the N past configurations to calculate a perspective-specific difference score of each past configuration (S311). Here, examples of the perspective-specific difference score calculation process include the perspective-specific difference score calculation process using the software version of an application as a perspective as shown in Fig. 17, the perspective-specific difference score calculation process using the container configuration of an application as a perspective as shown in Fig. 18, and the perspective-specific difference score calculation process using a peripheral container as a perspective as shown in Fig. 19.

[0110] Next, the fault analysis program 200 stores the viewpoint-specific difference scores obtained by the viewpoint-specific difference score calculation process in the corresponding fields of the difference score table 1000 (S312).

[0111] Next, the fault analysis program 200 determines whether or not all aspects have been processed (S313). As a result, if all aspects have not been processed (S313: N), the process proceeds to step S310. On the other hand, if all aspects have been processed (S313: Y), the difference score calculation process is terminated and the process returns to the fault cause identification support process.

[0112] Next, the past configuration creation process in step S303 will be described.

[0113] FIG. 16 is a flowchart of a past configuration creation process according to an embodiment.

[0114] The failure analysis program 200 acquires the current configuration from the configuration information (S401), sets the current configuration to the variable "configuration" (S402), and sets the variable K to 1 (S403).

[0115] Next, the failure analysis program 200 acquires the configuration change history for the period from (K-1) x unit time to K x unit time before the reference time point (the current time point in this example) (S404).

[0116] Next, the fault analysis program 200 applies the acquired configuration change history to the "configuration" to create a past configuration from K×unit time ago (S405). Specifically, the fault analysis program 200 creates a past state by making changes opposite to those in the acquired configuration change history.

[0117] Next, the failure analysis program 200 sets the past configuration K to "configuration" (S406), and adds 1 to K (S407).

[0118] Next, the fault analysis program 200 determines whether K is equal to or less than N (S408). As a result, if K is equal to or less than N (S408: Y), this means that N past configurations have not yet been created, and the fault analysis program 200 proceeds to the process at step S404. On the other hand, if K is not equal to or less than N (S408: N), this means that N past configurations have been created, and the fault analysis program 200 ends the past configuration creation process and returns to the fault cause identification support process.

[0119] Next, the viewpoint-specific difference score calculation process in step S311 will be described.

[0120] FIG. 17 is a flowchart of a viewpoint-specific difference score calculation process (software version of application) according to an embodiment.

[0121] The failure analysis program 200 acquires the current software configuration (S501), sets the current software configuration to the variable "software configuration" (S502), and sets the variable K to 1 (S503).

[0122] Next, the failure analysis program 200 acquires the software configuration change history for the target application during the period from (K-1) x unit time to K x unit time before the reference time point (the current time point in this example) (S504).

[0123] Next, the fault analysis program 200 sets the difference score to 0 (S505), applies the acquired software configuration change history to the "software configuration", and creates a software configuration of the past configuration K x unit time ago (past configuration K) (S506).

[0124] Next, the fault analysis program 200 selects one container from the current software configuration (S507), and determines whether the selected container exists in the software configuration of past configuration K (S508). As a result, if the selected container does not exist in the software configuration of past configuration K (S508: N), the fault analysis program 200 proceeds to step S510.

[0125] On the other hand, if the selected container is present in the software configuration of past configuration K (S508: Y), the fault analysis program 200 adds a score based on the difference in the version number of the container to the difference score (S509), and proceeds to step S510. Here, as the score based on the difference in the version number, for example, if the version number is composed of a major number, a minor number, and a patch number, the score may be 5 if the major numbers are different, 1 if the minor numbers are different, and 0.5 if the patch numbers are different.

[0126] In step S510, the failure analysis program 200 determines whether or not there is an unprocessed container among the containers of the current software configuration, and if there is an unprocessed container (S510: Y), the process proceeds to step S507.

[0127] On the other hand, if there are no unprocessed containers (S510: N), the fault analysis program 200 sets the value of the "Difference Score" as the difference score of the past configuration K (S511), adds 1 to K (S512), and determines whether K is less than or equal to N (S513).

[0128] As a result, if K is equal to or less than N (S513: Y), this means that the difference scores for the N past configurations have not yet been calculated, and the fault analysis program 200 proceeds to step S504. On the other hand, if K is not equal to or less than N (S513: N), this means that the difference scores for the N past configurations have been created, and the fault analysis program 200 sets the difference score for each past configuration to a value obtained by dividing the maximum value of the difference scores for the past configurations by M (for example, 10) (S514), terminates the per-perspective difference score calculation process, and returns to the fault cause identification support process. Here, the process of step S514 is a process of normalizing the difference score calculated by this per-perspective difference score calculation process so that it does not become a large value compared to the difference scores calculated by other per-perspective difference score calculation processes.

[0129] FIG. 18 is a flowchart of a viewpoint-specific difference score calculation process (container configuration of an application) according to an embodiment.

[0130] The fault analysis program 200 acquires the current application configuration (S601), sets the variable "application configuration" to the current application configuration (S602), sets the variable K to 1, and sets the difference score to 0 (S603).

[0131] Next, the fault analysis program 200 acquires the application configuration change history for the period from (K-1) x unit time to K x unit time before the reference time point (the current time point in this example) (S604).

[0132] Next, the fault analysis program 200 selects the newest unprocessed application configuration change history from the acquired application configuration change history (referred to as the target application configuration change history in the explanation of this process) (S605), and sets a value corresponding to the change operation type of the target application configuration change history to the variable "score" (S606). Here, the value corresponding to the change operation type may be, for example, 2 for deletion, or 1 for addition.

[0133] Next, the fault analysis program 200 adds a value according to the type of configuration item in the target application configuration change history to the "score" (S607). Here, the value according to the type of configuration item may be, for example, 1 for a container and 2 for a pod.

[0134] Next, the fault analysis program 200 determines whether there is any change history that offsets the target application configuration change history in the application configuration change history for the period 0 to (K-1) x unit time before the reference time point (the present time in this example) (S608). Here, the change history that offsets the target application configuration change history refers to a change history in which an opposite change operation is performed on the same configuration item, for example, a change in which the same container is deleted in response to the addition of a container. In this embodiment, to prevent the difference score from increasing even when a change that returns to the original state is made, an offset process (S609, S610) described below is performed to adjust the score in such cases.

[0135] As a result, if it is determined that there is an offsetting change history (S608: Y), the fault analysis program 200 sets the score for the offsetting change history to the offset score (S609), subtracts the offset score from the difference score (S610), and proceeds to step S612. On the other hand, if it is determined that there is no offsetting change history (S608: N), the fault analysis program 200 adds the score value to the difference score (S611), and proceeds to step S612.

[0136] In step S612, the fault analysis program 200 determines whether there is any unprocessed application configuration change history among the acquired application configuration change history, and if there is any unprocessed application configuration change history (S612: Y), the process proceeds to step S604.

[0137] On the other hand, if there is no unprocessed application configuration change history (S612: N), the fault analysis program 200 sets the value of the "Difference Score" as the difference score of the past configuration K (S613), adds 1 to K (S614), and determines whether K is less than or equal to N (S615).

[0138] As a result, if K is equal to or less than N (S615: Y), this means that the difference scores for N past configurations have not yet been calculated, and so the fault analysis program 200 proceeds with the process to step S604. On the other hand, if K is not equal to or less than N (S615: N), this means that the difference scores for N past configurations have been created, and so the fault analysis program 200 sets the difference score for each past configuration to a value obtained by dividing the maximum value of the difference scores for the past configurations by M (for example, 10) (S616), terminates the perspective-specific difference score calculation process, and returns to the fault cause identification support process. Here, the process of step S616 has the same purpose as step S514.

[0139] FIG. 19 is a flowchart of a perspective-based difference score calculation process (peripheral container) according to one embodiment. The behavior of peripheral containers around a certain container can affect the operation of that container. For example, if a peripheral container consumes a large amount of CPU or I / O or OS resources such as page cache, this can lead to a performance degradation of the target container. Therefore, in the perspective-based difference score calculation process (peripheral container), the difference in the influence of peripheral containers between the current configuration and the past configuration is calculated as a difference score.

[0140] The fault analysis program 200 receives the name of the container to be calculated (target container) (S701), sets the variable K to 1, and sets the difference score to 0 (S702).

[0141] Next, the fault analysis program 200 acquires the application configuration change history for the period from (K-1) x unit time to K x unit time before the reference time point (the current time point in this example) (S703).

[0142] Next, the fault analysis program 200 narrows down the acquired application configuration change history to only application configuration change history related to containers (peripheral containers) that do not run the same application as the target container and that exist on the same node as the target container (S704).

[0143] Next, the fault analysis program 200 selects the newest unprocessed application configuration change history from the narrowed-down application configuration change history (referred to as the target application configuration change history in the explanation of this process) (S705), and sets a value corresponding to the change operation type of the target application configuration change history to the variable "score" (S706). Here, the value corresponding to the change operation type may be, for example, 2 for deletion, or 1 for addition.

[0144] Next, the fault analysis program 200 adds a value according to the type of configuration item in the target application configuration change history to the "score" (S707). Here, the value according to the type of configuration item may be, for example, 1 for a container and 2 for a pod.

[0145] Next, the fault analysis program 200 determines whether there is any change history that offsets the target application configuration change history in the application configuration change history for the period 0 to (K-1) x unit time before the reference time point (the present time in this example) (S708). Here, the change history that offsets the target application configuration change history refers to a change history in which an opposite change operation is performed on the same configuration item, for example, a change in which the same container is deleted in response to the addition of a container. In this embodiment, to prevent an increase in the difference score even when a change is made to return to the original state, an offset process (S709, S710) described below is performed to adjust the score in such cases.

[0146] As a result, if it is determined that there is an offsetting change history (S708: Y), the fault analysis program 200 sets the score for the offsetting change history to the offset score (S709), subtracts the offset score from the difference score (S710), and proceeds to step S712. On the other hand, if it is determined that there is no offsetting change history (S708: N), the fault analysis program 200 adds the score value to the difference score (S711), and proceeds to step S712.

[0147] In step S712, the fault analysis program 200 determines whether there is any unprocessed application configuration change history among the narrowed-down application configuration change history, and if there is any unprocessed application configuration change history (S712: Y), the process proceeds to step S705.

[0148] On the other hand, if there is no unprocessed application configuration change history (S712: N), the fault analysis program 200 sets the value of the "Difference Score" as the difference score of the past configuration K (S713), adds 1 to K (S714), and determines whether K is less than or equal to N (S715).

[0149] As a result, if K is equal to or less than N (S715: Y), this means that the difference scores for N past configurations have not yet been calculated, and so the fault analysis program 200 proceeds with the process to step S703. On the other hand, if K is not equal to or less than N (S715: N), this means that the difference scores for N past configurations have been created, and so the fault analysis program 200 sets the difference score for each past configuration to a value obtained by dividing the maximum value of the difference scores for the past configurations by M (for example, 10) (S716), terminates the perspective-specific difference score calculation process, and returns to the fault cause identification support process. Here, the process of step S716 has the same purpose as step S514.

[0150] Next, the difference score display process in step S105 will be described.

[0151] FIG. 20 is a flowchart of a difference score display process according to an embodiment.

[0152] The fault analysis program 200 acquires (S801) the differential score table 1000 created in the differential score calculation process (S104), and executes (S802) a similar configuration recommendation addition process (see FIG. 21) that adds the similar configuration that is most similar to the current configuration among multiple past configurations to the past configuration recommendation list.

[0153] Next, the fault analysis program 200 executes a viewpoint-based recommendation list addition process (see FIG. 22) for identifying a past configuration to be referred to for each viewpoint and adding it to the past configuration recommendation list.

[0154] Next, the fault analysis program 200 displays a screen (difference score calculation result screen 1100) including the difference score and the past configuration recommendation list, terminates the difference score display process, and returns to the fault cause identification support process.

[0155] Next, the similar configuration recommendation addition process difference score display process in step S802 will be described.

[0156] FIG. 21 is a flowchart of a similar configuration recommendation adding process according to one embodiment.

[0157] The failure analysis program 200 calculates an average difference score A, which is the average value of the difference scores for the measurement values, for each past configuration (S901).

[0158] Next, the failure analysis program 200 sets the average difference score A of the measurement values ​​to a value obtained by dividing the maximum value of the difference scores of the measurement values ​​of the past configurations by M (for example, 10) (S902). This process has the same effect as step S514.

[0159] Next, the fault analysis program 200 calculates an average difference score B, which is the average value of the perspective-specific difference scores, for each past configuration (S903).

[0160] Next, the fault analysis program 200 calculates the average difference score A - the average difference score B (S904), adds a predetermined number of past configurations to the past configuration recommendation list in descending order of the value of A and B (S905), terminates the similar configuration recommendation addition process, and returns to the difference score display process. Here, the similar configuration recommendation addition process is a process of adding to the recommendation list past configurations that are identical to the current configuration (i.e., have a small average value for the average difference score B for the perspective), but have significantly different performance values, log and event outputs (i.e., have a large average difference score A for the measured values). This process is performed based on the idea that if the configurations are identical but the log and event outputs are different, a detailed investigation of the logs and events is likely to lead to the cause of the fault.

[0161] Next, the viewpoint-specific recommendation addition process in step S803 will be described.

[0162] FIG. 22 is a flowchart of a viewpoint-specific recommendation adding process according to one embodiment.

[0163] The failure analysis program 200 calculates an average difference score A, which is the average value of the difference scores for the measurement values, for each past configuration (S1001).

[0164] Next, the failure analysis program 200 sets the average difference score A of the measurement values ​​to a value obtained by dividing the maximum value of the difference scores of the measurement values ​​of the past configurations by M (for example, 10) (S1002). This process has the same effect as step S514.

[0165] Next, the fault analysis program 200 selects one unprocessed perspective (S1003), and calculates an average difference score B, which is the average value of the perspective-specific difference scores excluding the selected perspective (selected perspective), for each past configuration (S1004).

[0166] Next, the problem analysis program 200 acquires the difference score C of the selected viewpoint (S1005), and sets the value obtained by multiplying the difference score C by the usefulness coefficient of the selected viewpoint as the difference score C (S1006).

[0167] Next, the fault analysis program 200 calculates the average difference score A + difference score C - average difference score B (S1007), and adds a predetermined number (e.g., N) of past configurations to a past configuration recommendation candidate list in descending order of the value of A + CB (S1008).

[0168] Next, the fault analysis program 200 determines whether or not all aspects have been processed (S1009), and if not all aspects have been processed (S1009: N), the process proceeds to step S1003.

[0169] On the other hand, if all perspectives have been processed (S1009: Y), the fault analysis program 200 adds a predetermined number (e.g., N) of past configurations from the past configuration recommendation candidate list to the past configuration recommendation list in descending order of the value of A+CB (S1010), terminates the perspective-specific recommendation addition process, and returns to the difference score display process. Here, the perspective-specific recommendation addition process is a process of adding to the recommendation list past configurations in which only the difference (difference score C) in a certain perspective (e.g., the perspective of a surrounding container) is large and the differences (average difference score B) in the other perspectives are small, and in which the difference (average difference score A) in the output of logs and events is large. This process is performed based on the idea that a detailed investigation of the logs and events of such past configurations is likely to lead to the cause of the fault.

[0170] Next, the detailed difference display process will be described.

[0171] 23 is a flowchart of a difference detail display process according to an embodiment. The difference detail display process is executed, for example, when the area for the perspective-specific difference score of the past configuration in the difference score table display area 1102 in FIG. 11 is pressed.

[0172] The fault analysis program 200 receives information on the specified past configuration (specified past configuration) and perspective (specified perspective) of the specified target configuration item (target configuration item) (S1101), and determines whether the specified past configuration is included in the past configuration recommendation list (S1102).

[0173] As a result, if the specified past configuration is included in the past configuration recommendation list (S1102: Y), the fault analysis program 200 displays the useful button 1205 on the difference details screen 1200 (S1103), and acquires a plug-in corresponding to the type of the target configuration item from the plug-in repository 300 (S1104). On the other hand, if the specified past configuration is not included in the past configuration recommendation list (S1102: N), the fault analysis program 200 acquires a plug-in 301 corresponding to the type of the target configuration item from the plug-in repository 300 (S1104).

[0174] Next, the fault analysis program 200 acquires information on the specified viewpoint and the difference display function 307 corresponding to the specified viewpoint from the plug-in 301 (S1105), and identifies the differences between the specified past configuration and the current configuration using the difference display function 307 (S1106).

[0175] Next, the fault analysis program 200 displays a graph of the current configuration and the specified past configuration on the difference details screen 1200, highlights the differences (e.g., added or deleted areas), and displays the differences between the current configuration and the past configuration regarding the measurement value differences in the specified past configuration (S1107), and then terminates the difference details display process.

[0176] Next, the usefulness coefficient update process will be described.

[0177] 24 is a flowchart of the beneficial degree coefficient update process according to one embodiment. The beneficial degree coefficient update process is executed when the beneficial button 1205 on the difference details screen 1200 is pressed, for example.

[0178] The fault analysis program 200 receives information (feedback information) that the useful button 1205 has been pressed, and acquires a viewpoint based on the target past configuration on the difference details screen 1200 (S1201). Next, the fault analysis program 200 adds the usefulness coefficient of the acquired viewpoint and performs processing to reflect the added viewpoint in the plug-in repository 300 (S1202). For example, the fault analysis program 200 adds a predetermined value (α) to the usefulness coefficient of the plug-in repository 300, and ends the usefulness coefficient update processing.

[0179] The present invention is not limited to the above-described embodiment, and can be modified appropriately without departing from the spirit of the present invention.

[0180] For example, in the above embodiment, the difference score is calculated for a plurality of past configurations, but the present invention is not limited to this, and the difference score may be calculated for one past configuration.

[0181] In addition, in the above embodiment, when a failure occurs, a difference score calculation process and a difference score display process are performed on a suspect configuration item to display the difference score. However, the present invention is not limited to this. For example, regardless of the occurrence of a failure, a difference score calculation process and a difference score display process may be performed on a configuration item specified by a user to calculate and display the difference score.

[0182] Furthermore, in the above embodiment, the viewpoint-specific difference score and the measurement value difference score are calculated for the past configuration, but the present invention is not limited to this, and only the viewpoint-specific difference score may be calculated.

[0183] In addition, in the above-described embodiments, some or all of the processing performed by the processor may be performed by a hardware circuit. Also, the programs in the above-described embodiments may be installed from a program source. The program source may be a program distribution server or a recording medium (e.g., a portable recording medium). [Explanation of symbols]

[0184] 1...computer system, 10...application, 20...configuration information, 30...configuration change history, 100...management computer, 101...CPU, 102...memory, 103...storage device, 110...network, 120...repository computer, 130 (130A, 130B, etc.)...cluster, 131 (131A, 131B, etc.)...node, 140 (140A, 140B, etc.)...storage

Claims

1. A fault cause identification support device for supporting identification of a cause of a fault relating to execution of an application, the failure cause identification support device includes a processor and a storage device; The storage device storing configuration information relating to configurations at multiple points in time for a predetermined target configuration involved in the execution of the application; The processor: Calculating a difference score for each of a plurality of perspectives between the current configuration and the past configuration for a predetermined target configuration related to the execution of an application A device to assist in identifying the cause of a fault.

2. The target composition is Any container that executes the application, The above aspects include: The viewpoint includes any one of a viewpoint regarding software that configures an application executed in the container, a viewpoint regarding the container, a viewpoint regarding a peripheral container that is a container existing around the container, and a viewpoint regarding a time period during which the application is executed by the container.

2. The fault cause identification support device according to claim 1.

3. The processor: Display the calculated difference scores by perspective 3. The fault cause identification support device according to claim 1.

4. The processor: Calculating the difference scores by viewpoint between the current configuration and each of the past configurations at a plurality of points in time 3. The fault cause identification support device according to claim 1.

5. The processor: Based on the plurality of difference scores for each viewpoint, a recommended past configuration, which is a past configuration suitable for identifying the cause of the failure of the target configuration, and a recommended viewpoint, which is a viewpoint to be noted, are determined.

5. The fault cause identification support device according to claim 4.

6. The processor: The difference scores for each viewpoint in past configurations at a plurality of points in time are calculated by accumulating the difference scores from the configuration at the immediately preceding point in time, starting from the past configuration closest to the present, and if the configuration at a certain point in time has a part that is the same as a configuration at any point in time closer to the present than the certain point in time, that part is deemed to have no difference score.

5. The fault cause identification support device according to claim 4.

7. The processor: Displaying the recommended past configuration and the recommended viewpoint 6. The fault cause identification support device according to claim 5.

8. The processor: receiving feedback information from a user indicating that the recommended past configuration and the recommended viewpoint are appropriate; determining a coefficient to be used to adjust a perspective difference score for a perspective corresponding to the recommended perspective for the target construct according to the feedback information; 8. The fault cause identification support device according to claim 7.

9. The processor: The calculated viewpoint-specific difference score is displayed in an emphasized manner when the viewpoint-specific difference score is greater than a predetermined value.

4. The fault cause identification support device according to claim 3.

10. The storage device storing measurement value information relating to predetermined measurement values ​​measured at the plurality of points in time during execution of the application; The processor: Based on the measurement value information, a measurement value difference score is calculated, which is a difference score between the measurement values ​​in the current configuration and the past configuration during execution of the application.

2. The fault cause identification support device according to claim 1.

11. The processor: Detecting the occurrence of a fault during execution of the application, and identifying a suspect component that is a component suspected of being the cause of the fault; The suspected constituent is the target constituent.

2. The fault cause identification support device according to claim 1.

12. The storage device storing past case information that is information about past cases that occurred during execution of the application; The processor: Detecting the occurrence of a fault during execution of the application; If a case similar to the detected fault exists in the past case information, the past case information is displayed; If no case similar to the detected fault exists in the past case information, the suspected component, which is a component suspected of being the cause of the fault, is set as the target component, and the viewpoint-specific difference score is calculated.

2. The fault cause identification support device according to claim 1.

13. A failure cause identification support method by a failure cause identification support device for supporting identification of a cause of a failure related to execution of an application, comprising: storing configuration information relating to configurations at multiple points in time for a predetermined target configuration relating to the execution of the application; Calculating a difference score for each of a plurality of perspectives between the current configuration and the past configuration for a predetermined target configuration related to the execution of an application Methods for assisting in identifying the cause of a problem.

14. A fault cause identification support program that causes a computer to execute a process for supporting the identification of a cause of a fault relating to the execution of an application, The computer stores configuration information relating to configurations at multiple points in time for a predetermined target configuration involved in the execution of the application, The failure cause identification support program To the computer Based on the configuration information, a viewpoint-specific difference score is calculated, which is a difference score for each of a plurality of viewpoints between a current configuration and a past configuration for a predetermined target configuration related to the execution of an application. A program to assist in identifying the cause of a problem.

Images