Program, evaluation method, and information processing device.

Abstract

To appropriately evaluate the similarity between systems.SOLUTION: A storage section 11 stores case information 11a, including a description in a natural language of a case of system configuration for each of a plurality of systems. A processing section 12 generates a case feature amount D10a, ... indicating a feature of cooperation between components in each of the plurality of systems by natural language analysis on the case information 11a stored in the storage section 11. When search information D20, including a description in the natural language of a system configuration of a system 20, is input, the processing section 12 generates a search feature amount D20a indicating a feature of cooperation between components in the system 20 by natural language analysis on the search information D20. The processing section 12 evaluates the similarity between the system 20 and each of the plurality of systems in the case information 11a on the basis of the search feature amount D20a and the case feature amount D10a, ...SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a program, an evaluation method, and an information processing apparatus.

Background Art

[0002] In the field of operation of an information processing system, when a support person investigates an event such as a trouble that has occurred in the information processing system, the support person may check whether a similar event has occurred in other systems or the like in the past. Therefore, a device for searching information on past system cases that have been accumulated may be used.

[0003] For example, there has been a proposal for a case search system that searches for an optimal case that matches or is most similar to a search case specified by a search user from a large number of target cases accumulated in a case database.

[0004] In addition, there has also been a proposal for a search method that performs a search from a document collection in which a large number of document data are stored based on words such as text and voice received from a user for search. The proposed search method directly searches for a sentence unit whose meaning is similar to the received word from a sentence unit, which is a unit of meaning aggregation in a document whose meaning dynamically changes in the context flow.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0006] In some cases, the accumulated information on past system cases in databases and other resources may be written in natural language. In such cases, a device that searches for system cases may use keyword search methods to search for similar cases that have occurred in the past from the accumulated information on system cases written in natural language.

[0007] In keyword searches, keywords are used to describe the system environment at the time the event occurred in the current system, as well as the content of the event, such as error messages. Keywords describing the system environment include, for example, the names of system components such as software or server types.

[0008] In keyword searches, the determination of whether an event is similar or not is based on whether the descriptions of past events and system environments registered as examples contain the specified keywords. Therefore, there is a problem in that search results may retrieve system examples that have the same components as the current system, but whose interrelationships between components are completely different from those of the current system.

[0009] In one aspect, the present invention aims to appropriately evaluate the similarities between systems. [Means for solving the problem]

[0010] In one embodiment, a program is provided that causes a computer to perform the following processes: The computer generates case features that indicate the characteristics of the interactions between components in each of the multiple systems by performing natural language analysis on case information, which includes natural language descriptions of the system configurations of each of the multiple systems. When search information, which includes a natural language description of the system configuration of the first system, is input to the computer, the computer generates search features that indicate the characteristics of the interactions between components in the first system by performing natural language analysis on the search information. The computer evaluates the similarity between the first system and each of the multiple systems based on the search features and the case features of each of the multiple systems.

[0011] Also, in one aspect, an evaluation method executed by a computer is provided. Also, in one aspect, an information processing apparatus having a storage unit and a processing unit is provided.

Effect of the Invention

[0012] In one aspect, the similarity between systems can be appropriately evaluated.

Brief Description of the Drawings

[0013] [Figure 1] It is a diagram for explaining the information processing apparatus of the first embodiment. [Figure 2] It is a diagram showing a hardware example of the case search apparatus of the second embodiment. [Figure 3] It is a diagram showing an example of support using the case search apparatus. [Figure 4] It is a diagram showing a functional example of the case search apparatus. [Figure 5] It is a diagram showing a functional example of the case search apparatus. [Figure 6] It is a diagram showing an example of a case table. [Figure 7] It is a diagram showing an example of a server type dictionary. [Figure 8] It is a diagram showing an example of a linked word dictionary. [Figure 9] It is a diagram showing an example of a case feature quantity table. [Figure 10] It is a diagram showing an example of generation of case feature quantity data. [Figure 11] It is a diagram showing an example of generation of search feature quantity data. [Figure 12] It is a diagram showing a first output example of natural language analysis. [Figure 13] It is a diagram showing a second output example of natural language analysis. [Figure 14] It is a diagram showing an example of generation of case feature quantity data. [Figure 15] It is a diagram showing an example of search with system configuration similarity evaluation. [Figure 16] It is a flowchart showing an example of generation of case feature quantity data. [Figure 17] It is a flowchart showing an example of extracting case feature amounts. [Figure 18] It is a flowchart showing an example of extracting server types. [Figure 19] It is a flowchart showing an example of extracting association relationships. [Figure 20] It is a flowchart showing an example of converting case feature amount data. [Figure 21] It is a flowchart showing an example (continuation) of converting case feature amount data. [Figure 22] It is a flowchart showing an example (continuation) of converting case feature amount data. [Figure 23] It is a flowchart showing an example of search with evaluation of system configuration similarity. [Figure 24] It is a flowchart showing an example of keyword search. [Figure 25] It is a flowchart showing an example of case feature amount search. [Figure 26] It is a flowchart showing an example (continuation) of case feature amount search. [Figure 27] It is a flowchart showing an example of converting search feature amount data. [Figure 28] It is a flowchart showing an example (continuation) of converting search feature amount data. [Figure 29] It is a flowchart showing an example (continuation) of converting search feature amount data. [Figure 30] It is a flowchart showing an example of similarity evaluation. [Figure 31] It is a diagram showing an example of optimizing search results by case feature amount search.

Mode for Carrying Out the Invention

[0014] Hereinafter, this embodiment will be described with reference to the drawings. [First Embodiment] The first embodiment will be described.

[0015] Figure 1 is a diagram illustrating the information processing device of the first embodiment. The information processing device 10 is used to search for examples of information processing systems. The information processing device 10 may also be called a computer. The information processing device 10 has a storage unit 11 and a processing unit 12.

[0016] The memory unit 11 may be a volatile semiconductor memory such as RAM (Random Access Memory), or a non-volatile storage such as an HDD (Hard Disk Drive) or flash memory. The processing unit 12 is a processor such as a CPU (Central Processing Unit), GPU (Graphics Processing Unit), or DSP (Digital Signal Processor). However, the processing unit 12 may also include application-specific electronic circuits such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array). The processor executes programs stored in memory such as RAM (which may also be the memory unit 11). A collection of multiple processors is sometimes called a "multiprocessor" or simply a "processor."

[0017] System 20 is an information processing system that is actually in operation. System 20 has multiple components, such as hardware and software. In Figure 1, servers 21, 22, ... are shown as an example of multiple components. Servers 21, 22, ... are units of service provision, and each corresponds to one piece of hardware or software. System 20 and the information processing device 10 may be connected via a network. Each server 21, 22, ... is distinguished by a server type name such as "WEB server" or "DB server" depending on the service it provides.

[0018] The memory unit 11 stores case information 11a. Case information 11a is information that indicates a case of a system. Case information 11a records the details of events that occurred during the operation of multiple systems. Case information 11a has records that include, for example, a case number and the details of the case. The case number is the identification information of the case. The details of the case include information on the system configuration of each of the multiple systems and information describing the events that occurred in natural language. The system configuration information includes a natural language description of the components of the system and the cooperation relationships between each component. The cooperation relationship indicates a relationship in which two components exchange data. System 20 (the first system) may or may not be included in the multiple systems in case information 11a.

[0019] Case D10 describes the content of case number 1 included in case information 11a. For example, case D10 is described as follows: "The backup server is connected to the web server and the DB server. The backup server output the message 'error: Timeout occurred'."

[0020] The case information 11a may be stored in an external storage device of the information processing device 10, and at least a portion of the case information 11a may be read from the storage device to the storage unit 11 by the processing unit 12 in accordance with the processing of the processing unit 12.

[0021] The processing unit 12 generates case feature quantities for each case of a system by performing natural language processing on the case information 11a, which indicate the characteristics of the cooperation between the constituent elements in each of the multiple systems. Case feature quantity D10a is an example of a case feature quantity for case D10. For example, the processing unit 12 generates case feature quantity D10a by performing natural language processing on case D10. Case feature quantity D10a indicates the characteristics of the cooperation between the constituent elements in the system corresponding to case D10.

[0022] For example, Case D10 includes descriptions of "backup server," "web server," and "DB (Database) server" as components. Furthermore, Case D10 includes the description of the interrelationship between these components: "The web server and DB server are connected to the backup server."

[0023] The processing unit 12 detects, through lexical analysis, part-of-speech analysis, and semantic analysis of the description in case D10, that the "backup server" and the "web server" have a cooperative relationship, and that the "backup server" and the "DB server" also have a cooperative relationship. Dictionary information of words indicating component names, and dictionary information of cooperative relationships between components and words representing cooperative relationships, which are used in natural language analysis, are stored in advance in the storage unit 11.

[0024] The case feature D10a represents, for example, the relationship as matrix information. Each row and column of case feature D10a corresponds to a component such as a web server, DB server, and backup server, respectively. In case feature D10a, if the component in row x (the server in this example) and the component in column y have a relationship, "1" is set in row x, column y; if there is no relationship, "0" is set in row x, column y. It is generated in the same way as the case features of other cases in case information 11a.

[0025] The processing unit 12 stores the case feature quantities generated for each case of the case information 11a in the storage unit 11, associating them with the case number. The processing unit 12 may also store the case information 11a in an external storage device. The case feature quantities generated for each case are used when searching for past cases related to events that occurred in the system 20. The processing unit 12 performs the case search as follows.

[0026] The processing unit 12 receives input of search information D20. Search information D20 is input to the information processing device 10 by the user, for example, when an event such as a failure occurs in system 20. Search information D20 includes a natural language description of the system configuration of system 20. Search information D20 may also include a description of message logs output by system 20.

[0027] When the processing unit 12 receives the search information D20 as input, it generates a search feature quantity D20a that shows the characteristics of the cooperation between the components in the system 20 by performing natural language processing on the search information D20. The search feature quantity D20a is information in the same format as the case feature quantity D10a.

[0028] For example, search information D20 is a description that says, "A Timeout error message is output in an environment where the WEB server and DB server are connected." In this case, search information D20 includes descriptions of "WEB server" and "DB server" as its components. Furthermore, search information D20 includes a description of the relationship between the components that says, "The WEB server and DB server are connected." The processing unit 12 performs lexical analysis, part-of-speech analysis, and semantic analysis on the description in search information D20 to detect that the "WEB server" and "DB server" have a relationship, and generates a search feature D20a that indicates this relationship.

[0029] The processing unit 12 then evaluates the similarity between system 20 and each of the multiple systems based on the search feature D20a and the case features of each of the multiple systems in the case information 11a. For example, the processing unit 12 calculates the distance between the search feature D20a and the case features D10a, ... for each of the case numbers 1, 2, ... and determines that the smaller the distance, the higher the similarity between the system of the corresponding case number and system 20.

[0030] In one example, the processing unit 12 calculates the Euclidean norm as the distance between each case feature and the search feature D20a. In this case, the processing unit 12 uses, for example, the matrix elements of the case feature and the search feature D20a that correspond to pairs of components included in both the system corresponding to the case feature and system 20. For example, the case feature D10a includes a matrix element corresponding to the pair of "WEB server" and "backup server," but this pair is not included in the search feature D20a. Therefore, the processing unit 12 may ignore the matrix element of the case feature D10a corresponding to the pair of "WEB server" and "backup server" when calculating the distance to the search feature D20a.

[0031] The processing unit 12 prioritizes outputting information about systems that are evaluated as having a high similarity to system 20 among the multiple systems in the case information 11a. For example, in addition to the similarity evaluation described above, the processing unit 12 may further acquire specific descriptions such as "Timeout" that indicate the content of the occurrence included in the search information D20, and further narrow down the cases that include such descriptions as keywords before outputting them.

[0032] Furthermore, the processing unit 12 may acquire information on maintenance work performed as a countermeasure for a given case, which is pre-recorded and associated with the case to be output, and present the details of the maintenance work to the user by displaying it on the display device. This makes it easy for the user to check the details of maintenance work performed for similar issues in systems with a system configuration highly similar to that of system 20.

[0033] As explained above, the information processing device 10 generates example features that show the characteristics of the cooperation between components in each of the multiple systems through natural language analysis of example information, which includes natural language descriptions of the system configurations of each of the multiple systems. When search information, which includes a natural language description of the system configuration of the first system, is input, search features that show the characteristics of the cooperation between components in the first system are generated through natural language analysis of the search information. The similarity between the first system and each of the multiple systems is evaluated based on the search features and the example features of each of the multiple systems.

[0034] This allows the information processing device 10 to appropriately evaluate the similarity between systems. For example, the information processing device 10 can reduce the possibility of obtaining system examples in the search results that have the same components as the first system (e.g., system 20), but whose interrelationships between components are completely different from those of the first system, resulting in low similarity to the first system. As a result, the information processing device 10 can support users in efficiently identifying maintenance work records for events such as troubles in examples that are highly similar to the first system.

[0035] In the example of the first embodiment, the system components were represented by server names or server type names such as "WEB server" or "DB server." However, system components may be represented by names other than server names or server type names. For example, system components may be represented by hardware names such as switches or storage, or software names such as operating systems, middleware, or applications.

[0036] [Second Embodiment] Next, a second embodiment will be described. Figure 2 shows an example of the hardware of the case search device according to the second embodiment.

[0037] The case search device 100 is a computer that searches for system cases. The case search device 100 has a processor 101, RAM 102, HDD 103, GPU 104, input interface 105, media reader 106, and communication interface 107. These units of the case search device 100 are connected to a bus inside the case search device 100. The processor 101 corresponds to the processing unit 12 of the first embodiment. The RAM 102 or HDD 103 corresponds to the storage unit 11 of the first embodiment.

[0038] The processor 101 is an arithmetic unit that executes program instructions. The processor 101 is, for example, a CPU. The processor 101 loads at least a portion of the programs and data stored in the HDD 103 into the RAM 102 and executes the program. The processor 101 may include multiple processor cores. The case retrieval device 100 may also have multiple processors. The processes described below may be executed in parallel using multiple processors or processor cores. A collection of multiple processors is sometimes referred to as a "multiprocessor" or simply a "processor."

[0039] RAM 102 is a volatile semiconductor memory that temporarily stores programs executed by the processor 101 and data used by the processor 101 for calculations. The case search device 100 may be equipped with other types of memory besides RAM, and may be equipped with multiple types of memory.

[0040] HDD103 is a non-volatile storage device that stores software programs such as the OS (Operating System), middleware, and application software, as well as data. The case search device 100 may also be equipped with other types of storage devices such as flash memory or SSD (Solid State Drive), and may be equipped with multiple non-volatile storage devices.

[0041] The GPU 104 outputs images to the display 111 connected to the case search device 100, according to instructions from the processor 101. Any type of display can be used as the display 111, such as a CRT (Cathode Ray Tube) display, a liquid crystal display (LCD), a plasma display, or an organic electro-luminescence (OEL) display.

[0042] The input interface 105 acquires input signals from the input device 112 connected to the case search device 100 and outputs them to the processor 101. The input device 112 can include pointing devices such as a mouse, touch panel, touchpad, or trackball, as well as a keyboard, remote controller, or button switch. Furthermore, multiple types of input devices may be connected to the case search device 100.

[0043] The media reader 106 is a reading device that reads programs and data recorded on the recording medium 113. The recording medium 113 can be, for example, a magnetic disk, an optical disk, a magneto-optical disk (MO), or semiconductor memory. Magnetic disks include flexible disks (FD) and HDDs. Optical disks include CDs (Compact Discs) and DVDs (Digital Versatile Discs).

[0044] The media reader 106 copies programs and data read from the recording medium 113 to other recording media such as RAM 102 or HDD 103. The read programs are executed by the processor 101, for example. The recording medium 113 may be a portable recording medium and may be used for distributing programs and data. The recording medium 113 and HDD 103 are sometimes referred to as computer-readable recording media.

[0045] The communication interface 107 is connected to the network 114 and communicates with other information processing devices via the network 114. The communication interface 107 may be a wired communication interface connected to a wired communication device such as a switch or router, or a wireless communication interface connected to a wireless communication device such as a base station or access point.

[0046] The case search device 100 is an example of the information processing device 10 of the first embodiment. Figure 3 shows an example of support using the case search device. The information processing system 30 provides predetermined services. The information processing system 30 is operated and maintained by the inquirer. The inquirer is the user responsible for the operation and maintenance of the information processing system 30. The information processing system includes, for example, a web server 31 and a database server 32. The web server 31 and the database server 32 are each implemented as physical computers (physical machines). The web server 31 and the database server 32 may also be implemented as virtual computers (virtual machines) that run using resources such as the CPU and RAM of the physical machine. Furthermore, the case search device 100 may be able to communicate with the information processing system 30, for example, via a network 114.

[0047] The case search device 100 is operated by a support staff member. The support staff member searches for cases using the case search device 100 in response to the inquirer's inquiry and provides the search results to the inquirer.

[0048] For example, if a failure occurs in web server 31, web server 31 will output a message log indicating the failure. In one example, the content of the message log is "error: Timeout occurred". The inquirer checks the output message log (step S1).

[0049] The inquirer informs a support staff member of the system configuration of the information processing system 30 and the contents of the message log via telephone, email, etc., and asks for a solution (Step S2). The support staff inputs search information, which is a natural language description of the system configuration and message log contents provided by the inquirer, into the case search device 100, and has the case search device 100 search for cases. The case search device 100 presents the search results to the support staff. The search results include information such as the system configuration of the searched case and the countermeasures taken for the relevant failure. The support staff notifies the inquirer of the presented search results and supports the inquirer in their response (Step S3).

[0050] The case search device 100 evaluates the similarity between systems by considering the interrelationships between system components when searching for cases. Figure 4 shows an example of the function of the case search device.

[0051] The case retrieval device 100 includes a case storage unit 120, a control information storage unit 130, a case feature storage unit 140, and a case feature table generation unit 150. The case storage unit 120, the control information storage unit 130, and the case feature storage unit 140 use the storage areas of RAM 102 and HDD 103. The case feature table generation unit 150 is realized when a program stored in RAM 102 is executed by processor 101.

[0052] The case storage unit 120 stores the case table 121. The case table 121 holds information about system cases. For example, the case table 121 pre-registers information such as the system configuration of an existing information processing system and the contents of message logs indicating events such as failures that occurred in the information processing system, described in natural language. The case information registered in the case table 121 is linked to information about the countermeasures taken for the relevant events. New cases may also be added to the case table 121 by support staff who receive inquiries about events that occur in the existing information processing system. The case storage unit 120 may also be called a case database.

[0053] The control information storage unit 130 stores control information. The control information includes a server type dictionary 131 and a linkage word dictionary 132. The server type dictionary 131 is a list of words indicating the type of server. The server type may also be called the server category. The linkage word dictionary 132 is a list of words indicating the linkage relationships between the components of the information processing system. Here, in the second embodiment, server types are given as examples of system components. Examples of server types include web servers, database servers, application (AP) servers, and backup servers.

[0054] The case feature memory unit 140 stores the case feature table 141. The case feature table 141 holds case feature data generated for cases registered in the case table 121. The case feature data consists of case features that indicate the cooperation relationships between servers.

[0055] The case feature table generation unit 150 pre-generates the case feature table 141 and stores it in the case feature storage unit 140. The case feature table generation unit 150 also includes a case feature extraction unit 151.

[0056] The case feature extraction unit 151 extracts words and parts of speech from each case (natural language document) in the case table 121 using natural language analysis techniques (lexical analysis, syntactic analysis, morphological analysis), interprets the server type, the connection relationships between server types, and the meaning of the collaboration, and generates case feature information.

[0057] For example, the case feature extraction unit 151 uses natural language processing technology to extract the server types "XX server" and "YY server" and the relationship "connected," and interprets the meaning as "XX server and YY server are connected." In extracting the server type, the server type may be identified from the string "server." Alternatively, a pre-prepared server type dictionary 131 may be used for server type extraction. Furthermore, regarding the word "connected," a thesaurus (linked word dictionary 132) is used to allow the server type to be extracted from sentences that also use words such as "connection" and "relationship."

[0058] The case feature extraction unit 151 includes a server type extraction unit 151a and a cooperation relationship extraction unit 151b. The server type extraction unit 151a extracts words indicating the server type from the description of each case included in the case table 121, based on the server type dictionary 131.

[0059] The relationship extraction unit 151b extracts the relationship between server types from the descriptions of each case included in the case table 121, based on the relationship word dictionary 132. The case feature extraction unit 151 generates case feature data that shows the cooperation relationships between server types extracted by the server type extraction unit 151a and the cooperation relationship extraction unit 151b, associates it with the case identification information, and registers it in the case feature table 141.

[0060] For example, the case feature extraction unit 151 may generate case feature data for a system case each time a new system case is registered in the case table 121 and register it in the case feature table 141.

[0061] Figure 5 shows an example of the function of the case search device. In addition to the functions illustrated in Figure 4, the case search device 100 further includes a search unit 160. The search unit 160 is realized when a program stored in the RAM 102 is executed by the processor 101.

[0062] When the search unit 160 receives the trouble information 40, it searches for cases based on the trouble information 40, the case table 121, and the case feature table 141. The search unit 160 outputs the search result, which is the search result case list 50. For example, the search unit 160 displays the search result case list 50 on the display 111 and presents it to the support staff. Based on the search result case list 50 screen, the support staff can refer to the track record of countermeasures taken for past incidents.

[0063] Here, the trouble information 40 is search information entered into the case search device 100 by the support staff. The support staff may create the trouble information 40 by inputting the system configuration and event details of the information processing system 30 in natural language using an input device 112 such as a keyboard, based on the details of the problem notified by the inquirer, and then input it into the case search device 100.

[0064] The search unit 160 includes a keyword search unit 161, a case feature search unit 162, and a similarity evaluation unit 164. The keyword search unit 161 obtains the keyword to be searched and performs a case search on the case table 121 using the keyword search method. The keyword may be entered by a support staff member. The keyword may also be extracted by the keyword search unit 161 from the trouble information 40 as words representing the incident, such as the contents of the message log. In the latter case, the control information storage unit 130 may have a list of words representing the incident that may be included in the message log as dictionary information for extracting the keyword. The keyword search unit 161 notifies the similarity evaluation unit 164 of the cases obtained as a result of the keyword search.

[0065] The case feature search unit 162 searches for cases with a system configuration similar to the information processing system 30 based on the search feature data extracted from the trouble information 40 and the case feature data registered in the case feature table 141. The case feature search unit 162 includes a search feature extraction unit 163.

[0066] The search feature extraction unit 163 generates search feature data by performing natural language analysis on the trouble information 40. The search feature extraction unit 163 includes a server type extraction unit 163a and a cooperation relationship extraction unit 163b.

[0067] The server type extraction unit 163a extracts words indicating the server type from the description contained in the trouble information 40, based on the server type dictionary 131. The cooperation relationship extraction unit 163b extracts the cooperation relationships between server types from the descriptions included in the trouble information 40, based on the cooperation word dictionary 132.

[0068] The search feature extraction unit 163 generates search feature data indicating the cooperation relationships between server types extracted by the server type extraction unit 163a and the cooperation relationship extraction unit 163b, and stores it, for example, in the control information storage unit 130.

[0069] The case feature search unit 162 evaluates the similarity between the system configuration of the information processing system 30 and each case in the case table 121, based on the generated search feature data and the case feature data registered in the case feature table 141.

[0070] Similarity is evaluated, for example, by the distance between the search feature data and the case feature data. A smaller distance indicates a higher degree of similarity in the system configurations between systems. A larger distance indicates a lower degree of similarity in the system configurations between systems. For example, the Euclidean norm is used as the distance. The case feature search unit 162 extracts cases where the distance is less than a threshold and notifies the similarity evaluation unit 164.

[0071] The similarity evaluation unit 164 generates and outputs a list of search results examples 50 based on the results of the keyword search by the keyword search unit 161 and the results of the feature search based on the example features and search features by the example feature search unit 162. For example, the search unit 160 may include in the search results example list 50 any examples that are included in both the keyword search results and the feature search results.

[0072] Although an example was shown in which the case search device 100 has a case feature table generation unit 150 and a search unit 160, the case feature table generation unit 150 and the search unit 160 may be provided in separate devices. In that case, the case storage unit 120, the control information storage unit 130, and the case feature storage unit 140 may be implemented on a storage device shared by the first information processing device having the case feature table generation unit 150 and the second information processing device having the search unit 160. Thus, the functions of the case search device 100 may be implemented by a "case search system" (information processing system) including the first information processing device and the second information processing device.

[0073] Figure 6 shows an example of a case table. Case Table 121 includes fields for Case Number and Case Details. The Case Number field contains a number that identifies the case details, i.e., the Case Number. The Case Details field contains the details of the case. The case details are information describing the system configuration of the system in question and the events that occurred, written in natural language.

[0074] For example, the case table 121 contains a record with the case number "Case 01" and the case description "The web server and DB server are connected. The message "error:Timeout occurred" was output."

[0075] Case table 121 also registers the case details for other case numbers in the same way. Figure 7 shows an example of a server type dictionary. The server type dictionary 131 is a list of words that indicate server types. For example, the server type dictionary 131 includes words such as "WEB server," "AP server," "DB server," "backup server," and "monitoring server" as words that indicate server types.

[0076] For example, the server type dictionary 131 pre-registers all server types listed in the manufacturer's official documentation (catalogs, application examples, etc.), product manuals, user materials, etc.

[0077] Furthermore, to accommodate variations in the notation of server types, such as English, katakana, and abbreviated forms, the server type dictionary 131 includes synonyms for server types. For example, in the case of a web server, "web server" and "WEB" are registered as synonyms for "web server" in the server type dictionary 131. In the case of an application server, "application server" and "AP" are registered as synonyms for "application server" in the server type dictionary 131.

[0078] Figure 8 shows an example of a linked word dictionary. The linked word dictionary 132 is a list of words that indicate the linked relationships between the components of the system. For example, the linked word dictionary 132 includes words that indicate linked relationships, such as the original word "connection," and its synonyms "linkage" and "connect."

[0079] Thus, the linked word dictionary 132 has pre-registered synonyms such as "connection" and "collaboration," which are found in thesauruses and thesauruses, for example. The linked word dictionary 132 may include words related to data exchange between one server and another, such as "request" and "transmit," as words indicating the linkage between components. In this way, for example, in a sentence like "request from the web server to the database server...", it becomes possible to extract the linkage between the "web server" and the "database server."

[0080] Figure 9 shows an example of a case feature table. Case Feature Table 141 includes fields for case number and case feature data. The case number field contains the case number. The case feature data field contains the case feature data obtained from the case details of the case with that case number.

[0081] For example, the case feature table 141 contains a record of case feature data 141a for case number "case 01". Case feature data 141a is case feature data extracted from the case content of case 01 in case table 121. The case feature data is represented in matrix format, with rows and columns corresponding to system components. If the component in row x and the component in column y have a cooperative relationship, the matrix element in row x and column y of the case feature data is set to "1". If the component in row x and the component in column y do not have a cooperative relationship, the matrix element in row x and column y of the case feature data is set to "0".

[0082] Case feature data 141a shows that in case 01, a web server and a database server are included, indicating that the web server and the database server have a cooperative relationship. Figure 9 also shows examples of case feature data 141b corresponding to case 02, case feature data 141c corresponding to case 03, case feature data 141d corresponding to case 04, and case feature data 141e corresponding to case 05. Case feature table 141 similarly registers case feature data corresponding to other case numbers.

[0083] Figure 10 shows an example of generating case feature data. Figure 10 shows an example of the generation of case feature information 142 and case feature data 141c by the case feature extraction unit 151 based on the case content 121a of case 03.

[0084] First, the server type extraction unit 151a extracts words indicating server types, such as "WEB server," "AP server," and "DB server," from the example content 121a using natural language analysis with the server type dictionary 131.

[0085] Then, the relationship extraction unit 151b extracts words indicating a relationship from the case content 121a using natural language analysis with the relationship word dictionary 132, and extracts pairs of words indicating the server type linked by the words indicating the relationship.

[0086] In example 121a, the word "connected" is present, indicating a collaborative relationship. Based on the sentence "The WEB server, AP server, and DB server are all connected," which contains this word, the pairs "WEB server" and "AP server," "WEB server" and "DB server," and "AP server" and "DB server" are extracted.

[0087] The case feature extraction unit 151 outputs the pair of two words extracted by the relationship extraction unit 151b to the case feature information 142. The case feature information 142 is, for example, data in CSV (Comma Separated Values) format. The case feature information 142 is stored, for example, in the case feature storage unit 140.

[0088] The case feature extraction unit 151 converts the case feature information 142 into case feature data 141c and registers it in the case feature table 141. Figure 11 shows an example of generating search feature data.

[0089] Figure 11 shows an example of the generation of search feature information 191 and search feature data 192 by the search feature extraction unit 163 based on the trouble information 40. The search feature data 192 is feature data in the same matrix format as the case feature data such as the case feature data 141a. The trouble information 40 includes a natural language description that says, "A timeout error message was output in an environment where the WEB server and DB server are connected."

[0090] First, the server type extraction unit 163a extracts the words "WEB server" and "DB server" that indicate the server type from the trouble information 40 by performing natural language analysis using the server type dictionary 131.

[0091] Then, the relationship extraction unit 163b extracts words indicating relationship from the trouble information 40 using natural language analysis with the relationship word dictionary 132, and extracts pairs of words indicating the server types linked by the words indicating the relationship.

[0092] In the example of troubleshooting information 40, the word "connection" is present, indicating a cooperative relationship. Based on the sentence "The web server and DB server are connected," which contains this word, pairs of "web server" and "DB server" linked by "connection" are extracted.

[0093] The search feature extraction unit 163 outputs the pair of two words extracted by the relationship extraction unit 163b to the search feature information 191. The search feature information 191 has the same data structure as the case feature information 142. The search feature information 191 is, for example, data in CSV format.

[0094] The search feature extraction unit 163 converts the search feature information 191 into search feature data 192. The search feature information 191 and the search feature data 192 are stored, for example, in the control information storage unit 130. The search feature information 191 and the search feature data 192 may also be stored in other storage areas such as RAM 102.

[0095] Here, the case feature extraction unit 151 and the search feature extraction unit 163 can obtain information such as the following through natural language processing. Figure 12 shows an example of the first output of natural language processing.

[0096] The case feature extraction unit 151 and the search feature extraction unit 163 perform natural language analysis using a predetermined natural language analysis module. In Figure 12, the case content 121b of case 05 is used as an example input to the module. Output 122 is the result of performing natural language analysis on the input using the Japanese morphological analysis API (Application Programming Interface) provided by Yahoo! Japan (https: / / developer.yahoo.co.jp / webapi / jlp / ma / v2 / parse.html). Yahoo! is a registered trademark. Yahoo! Japan is a registered trademark.

[0097] When using the Japanese morphological analysis API, the server type extraction units 151a and 163a determine whether the noun "server" in output 122 is registered in the server type dictionary 131 as a combined phrase of the noun "server" and the noun immediately preceding it. For example, if the noun "backup" is immediately preceding the noun "server", the server type extraction units 151a and 163a determine whether "backup server" is registered in the server type dictionary 131.

[0098] Figure 13 shows a second example of natural language processing output. In Figure 13, the content 121b of Case 05 is used as an input example. Output 123 is the result of natural language analysis performed on this input using morphological analysis software called MeCab (MeCab: Yet Another Part-of-Speech and Morphological Analyzer, https: / / taku910.github.io / mecab).

[0099] When using MeCab, the server type extraction units 151a and 163a determine whether the noun "server" and the noun immediately preceding it are registered in the server type dictionary as a combined phrase, similar to the explanation in Figure 12, if the noun immediately preceding it is a noun.

[0100] Figure 14 shows an example of case feature data generation. First, the case feature extraction unit 151 reads each case from the case table 121 and performs natural language analysis (step ST10). Figure 14 shows an example where the case content 121b of case 05 is read.

[0101] In natural language processing, lexical analysis, part-of-speech analysis, and semantic analysis are performed. In lexical analysis, lexical phrases contained in the sentences included in the example content 121b are extracted. In part-of-speech analysis, the part of speech of the extracted lexical phrases is identified. In semantic analysis, the meaning of the cooperation relationships between servers is analyzed based on the server type dictionary 131 and the cooperation word dictionary 132. As a result of semantic analysis, the example feature extraction unit 151 obtains, for example, the cooperation relationship between "backup server" and "WEB server" and the cooperation relationship between "backup server" and "DB server" for the example content 121b.

[0102] The case feature extraction unit 151 generates case feature information 143 that shows the cooperation relationships between the acquired servers. In the example in Figure 14, the case feature information 143 has records for "backup server, web server" and "backup server, DB server". The case feature information 143 can be said to be a list of cooperation relationships (cooperation list) between the components of the information processing system in the case (server types in this example).

[0103] The case feature extraction unit 151 converts the case feature information 143 into case feature data 141e (step ST11). The case feature extraction unit 151 registers the case feature data 141e in the case feature table 141.

[0104] Thus, as a pre-processing step before searching for cases, the case search device 100 generates case feature data for each case in the case table 121. Figure 15 shows an example of a search with system configuration similarity evaluation.

[0105] The case feature search unit 162 receives the trouble information 40 input from the support staff, and performs natural language analysis on the trouble information 40 using the functions of the search feature extraction unit 163 (step ST20).

[0106] In natural language processing, lexical analysis, part-of-speech analysis, and semantic analysis are performed, similar to step ST10. The search feature extraction unit 163 obtains the cooperation relationship between the "WEB server" and the "DB server" based on the natural language processing of the trouble information 40. The search feature extraction unit 163 generates search feature information 191 that shows the cooperation relationship between the acquired servers. For example, the search feature information 191 has a record of "WEB server, DB server".

[0107] The search feature information 191 can be described as a list of the relationships between the components (server types in this example) of the information processing system 30 that is the target of this search (a list of relationships). The search feature extraction unit 163 converts the search feature information 191 into search feature data 192 (step ST21).

[0108] The case feature search unit 162 performs a case feature search based on the search feature data 192 and the case feature data 141a, 141b, ... registered in the case feature table 141 (step ST22).

[0109] In case feature retrieval, the case feature retrieval unit 162 evaluates the similarity between the search feature data 192 and each of the case feature data 141a, 141b, ... For example, the similarity is evaluated by the Euclidean norm of the search feature data and the case feature data, as described above. In this case, the smaller the Euclidean norm, the greater the degree of similarity between the two systems, i.e., the higher the similarity, and the larger the Euclidean norm, the lower the similarity. For example, the case feature retrieval unit 162 calculates the Euclidean norm A for each of the search feature data 192 and the case feature data 141a, 141b, ... using equation (1).

[0110]

number

[0111] Here, S = {s ij} represents the search feature data. C={c ij} represents case feature data. m is the number of components (in this example, server type), which is an integer of 2 or more. However, in the calculation of Equation (1), the case feature search unit 162 only performs calculations for the components common to the search feature data and the case feature data.

[0112] For example, the Euclidean norm A1 between the search feature data 192 and the case feature data 141c of case 03 is A1 = { (0 - 0)^2 + (1 - 1)^2 + (0 - 0)^2 + (1 - 1)^2}^(1 / 2) = 0. Also, the Euclidean norm A2 between the search feature data 192 and the case feature data 141e of case 05 is A2 = { (0 - 0)^2 + (1 - 0)^2 + (0 - 0)^2 + (1 - 0)^2}^(1 / 2) = √2. In this case, since A1 < A2, it is determined that case 03 is more similar to the system configuration of the information processing system 30 to be searched this time than case 05.

[0113] The case feature search unit 162 outputs, as the result of the case feature search, the cases corresponding to the case feature data whose Euclidean norm with the search feature data 192 is smaller than the threshold value to the similarity evaluation unit 164.

[0114] Also, the keyword search unit 161 accepts the input of a search keyword (e.g., "Timeout") by the support staff and performs a case search by keyword search (step ST30). The search keyword may be extracted from the occurrence trouble information 40. The keyword search unit 161 extracts, as the result of the keyword search, the cases whose case contents registered in the case table 121 include the search keyword and outputs them to the similarity evaluation unit 164.

[0115] Note that the keyword search by the keyword search unit 161 and the case feature search by the case feature search unit 162 may be executed in an arbitrary order or may be executed in parallel.

[0116] The similarity evaluation unit 164 registers the cases included in both the case feature search results and the keyword search results as the final search results in the search result case list 50 and outputs the search result case list 50 (step ST40).

[0117] Next, the processing procedure of the case search device 100 will be explained. First, the procedure for generating case feature data by the case feature table generation unit 150, as explained in Figure 14, will be described. Figure 16 is a flowchart showing an example of case feature data generation.

[0118] (S10) The case feature extraction unit 151 reads one case data from the case table 121. The case data corresponds to one record in the case table 121. (S11) The case feature extraction unit 151 executes the case feature extraction process. Details of the case feature extraction process will be described later.

[0119] (S12) The case feature extraction unit 151 executes case feature data transformation processing. Details of the case feature data transformation processing will be described later. (S13) The case feature extraction unit 151 stores the case feature data in the case feature table 141.

[0120] (S14) The case feature extraction unit 151 determines whether or not it has stored case feature data for all case data. If it has stored case feature data for all case data, the case feature data generation is completed. If it has not stored case feature data for all case data, the process proceeds to step S10.

[0121] Figure 17 is a flowchart showing an example of case feature extraction. The case feature extraction process corresponds to step S11. (S20) The case feature extraction unit 151 extracts the first sentence from the case data. Here, the case data consists of one or more sentences.

[0122] (S21) The case feature extraction unit 151 performs natural language analysis on the extracted sentences. In step S21, lexical analysis and part-of-speech analysis are performed as part of the natural language analysis. As a result of the lexical analysis and part-of-speech analysis, the case feature extraction unit 151 obtains, for example, output 122 in Figure 12 and output 123 in Figure 13.

[0123] (S22) The server type extraction unit 151a executes a server type extraction process to extract the server type contained in the relevant sentence. Details of the server type extraction process will be described later. (S23) The case feature extraction unit 151 determines whether or not the server type was extracted in step S22. If the server type was extracted, the process proceeds to step S24. If the server type was not extracted, the process proceeds to step S29.

[0124] (S24) The case feature extraction unit 151 determines whether two or more server types were extracted in step S22. If two or more server types were extracted, the process proceeds to step S25. If two or more server types were not extracted, the process proceeds to step S29.

[0125] (S25) The cooperation relationship extraction unit 151b executes a cooperation relationship extraction process to extract cooperation relationships between servers. Details of the cooperation relationship extraction process will be described later. (S26) In step S25, the case feature extraction unit 151 determines whether or not a cooperation relationship between servers has been extracted. If a cooperation relationship has been extracted, the process proceeds to step S27. If a cooperation relationship has not been extracted, the process proceeds to step S29.

[0126] (S27) The case feature extraction unit 151 determines whether the case feature information contains the combination of server types related to the cooperative relationship extracted in step S25. If the case feature information contains the corresponding combination of server types, the process proceeds to step S29. If the case feature information does not contain the corresponding combination of server types, the process proceeds to step S28. Here, the case feature information is, for example, data in CSV format, as shown in case feature information 142.

[0127] (S28) The case feature extraction unit 151 adds the combination of server types related to the cooperative relationship extracted in step S25 to the case feature information. (S29) The case feature extraction unit 151 determines whether all sentences have been extracted from the case data. If all sentences have been extracted from the case data, the case feature extraction process for that case data is completed. If not all sentences have been extracted from the case data, the process proceeds to step S30.

[0128] (S30) The case feature extraction unit 151 extracts the following sentence from the case data. Then, the process proceeds to step S21. Figure 18 is a flowchart showing an example of server type extraction.

[0129] The server type extraction process corresponds to step S22. (S40) The server type extraction unit 151a extracts the first word in the relevant sentence and the part of speech of that word. For example, the server type extraction unit 151a obtains words and parts of speech contained in the sentence based on output 122 or output 123. Here, as mentioned above, for output 122 or output 123, if, for example, the noun "server" is immediately preceded by the noun "backup", the server type extraction unit 151a obtains "backup server" as a single noun by concatenating them.

[0130] (S41) The server type extraction unit 151a determines whether the part of speech of the extracted word is a noun. If the part of speech is a noun, the process proceeds to step S42. If the part of speech is not a noun, the process proceeds to step S44.

[0131] (S42) The server type extraction unit 151a determines whether the extracted word is registered in the server type dictionary 131. If the word is registered in the server type dictionary 131, the process proceeds to step S43. If the word is not registered in the server type dictionary 131, the process proceeds to step S44.

[0132] (S43) The server type extraction unit 151a adds the extracted words to the case feature information. (S44) The server type extraction unit 151a determines whether all words have been extracted from the sentence. If all words have been extracted from the sentence, the server type extraction process ends. If not all words have been extracted from the sentence, the server type extraction unit 151a extracts the next word from the sentence and proceeds to step S41.

[0133] Figure 19 is a flowchart showing an example of extracting collaborative relationships. The process of extracting the relationship between the partners corresponds to step S25. (S50) The linkage extraction unit 151b sets the linkage to the initial value "none".

[0134] (S51) The relationship extraction unit 151b extracts the first word in the relevant sentence and the part of speech of that word. (S52) The relationship extraction unit 151b determines whether the part of speech of the extracted word is a noun. If the part of speech is a noun, the process proceeds to step S53. If the part of speech is not a noun, the process proceeds to step S55.

[0135] (S53) The linkage extraction unit 151b determines whether the extracted word is registered in the linkage word dictionary 132. If the word is registered in the linkage word dictionary 132, the process proceeds to step S54. If the word is not registered in the linkage word dictionary 132, the process proceeds to step S55.

[0136] (S54) The linkage relationship extraction unit 151b sets the linkage relationship to "yes". If the linkage relationship is "yes", the linkage relationship extraction unit 151b identifies two words indicating server types that are linked by the corresponding word indicating the linkage relationship.

[0137] (S55) The relationship extraction unit 151b determines whether all words have been extracted from the sentence. If all words have been extracted from the sentence, the relationship extraction process ends. If not all words have been extracted from the sentence, the relationship extraction unit 151b extracts the next word from the sentence and proceeds to step S52.

[0138] Figure 20 is a flowchart showing an example of case feature data transformation. The case feature data transformation process corresponds to step S12. (S60) The case feature extraction unit 151 extracts the first row of the case feature information.

[0139] (S61) The case feature extraction unit 151 extracts the first server type from the extracted row. (S62) The case feature extraction unit 151 determines whether or not the extracted server type is present in the row of the case feature data to be created, that is, whether or not there is a row for the corresponding server type in the case feature data. If there is a row for the corresponding server type, the process proceeds to step S64. If there is no row for the corresponding server type, the process proceeds to step S63.

[0140] (S63) The case feature extraction unit 151 adds the extracted server type to the row of case feature data. (S64) The case feature extraction unit 151 determines whether the extracted server type is present in the column of the case feature data to be created, that is, whether the case feature data contains a column for the corresponding server type. If the column for the corresponding server type is present, the process proceeds to step S66. If the column for the corresponding server type is not present, the process proceeds to step S65.

[0141] (S65) The case feature extraction unit 151 adds a column of extracted server types to the case feature data column. (S66) The case feature extraction unit 151 determines whether all server types have been extracted from the extracted rows. If all server types have been extracted, the process proceeds to step S68. If not all server types have been extracted, the process proceeds to step S67.

[0142] (S67) The case feature extraction unit 151 extracts the next server type from the corresponding row. Then, the process proceeds to step S62. Figure 21 is a flowchart showing an example of case feature data transformation (continued).

[0143] (S68) The case feature extraction unit 151 determines whether all rows of the case feature information have been extracted. If all rows have been extracted, the process proceeds to step S70. If not all rows have been extracted, the process proceeds to step S69.

[0144] (S69) The case feature extraction unit 151 extracts the next row of case feature information. Then, the process proceeds to step S61. (S70) The case feature extraction unit 151 sets all cells in the rows added in step S63 and the columns added in step S65 of the case feature data to 0 (no connection). A cell represents one matrix element of matrix-format data.

[0145] (S71) The case feature extraction unit 151 extracts the first row of the case feature information. (S72) The case feature extraction unit 151 extracts the first server type from the extracted case feature information row and stores it in the variable [row].

[0146] (S73) The case feature extraction unit 151 identifies the row number of the server type obtained in the variable [row] from the row of the case feature data. (S74) The case feature extraction unit 151 extracts the first server type from the row of the extracted case feature information and assigns it to the variable [column].

[0147] (S75) The case feature extraction unit 151 determines whether the variable [row] and the variable [column] are the same. If they are the same, the process proceeds to step S78. If they are not the same, the process proceeds to step S76.

[0148] (S76) The case feature extraction unit 151 identifies the column number of the server type extracted from the case feature data column into the variable "column". Then, the process proceeds to step S77. Figure 22 is a flowchart showing an example of case feature data transformation (continued).

[0149] (S77) The case feature extraction unit 151 stores 1 (linked) in the cell of the case feature data that is indicated by the row number corresponding to the variable [row] and the column number corresponding to the variable [column]. (S78) The case feature extraction unit 151 determines whether all server types have been extracted into the variable [column] from the rows of extracted case feature information. If all server types have been extracted into the variable [column], the process proceeds to step S80. If not all server types have been extracted into the variable [column], the process proceeds to step S79.

[0150] (S79) The case feature extraction unit 151 extracts the next server type after the extracted server type from the row of case feature information into the variable [column]. Then the process proceeds to step S75.

[0151] (S80) The case feature extraction unit 151 determines whether all server types have been extracted into the variable [row] from the extracted case feature information rows. If all server types have been extracted into the variable [row], the process proceeds to step S82. If not all server types have been extracted into the variable [row], the process proceeds to step S81.

[0152] (S81) The case feature extraction unit 151 extracts the next server type after the extracted server type from the extracted case feature information row and assigns it to the variable [row]. Then, the process proceeds to step S73.

[0153] (S82) The case feature extraction unit 151 determines whether all rows of the case feature information have been extracted. If all rows of the case feature information have been extracted, the case feature data conversion process ends. If not all rows of the case feature information have been extracted, the process proceeds to step S82-1.

[0154] (S82-1) The case feature extraction unit 151 extracts the next row of case feature information and proceeds to step S72. Next, we will explain the procedure for searching with system configuration similarity evaluation by the search unit 160, as described in Figure 15.

[0155] Figure 23 is a flowchart showing an example of a search with system configuration similarity evaluation. (S90) The search unit 160 receives input of the trouble information 40. (S91) The keyword search unit 161 retrieves the search keywords contained in the incident trouble information 40 and performs a keyword search on the case table 121 using the search keywords. Details of the keyword search will be described later. The search keywords may be specified separately from the natural language description of the problem in the incident trouble information 40.

[0156] (S92) The case feature search unit 162 performs a case feature search based on the case feature table 141. Details of the case feature search will be described later. (S93) The similarity evaluation unit 164 obtains the results of the keyword search performed by the keyword search unit 161 and the results of the case feature search performed by the case feature search unit 162, and based on these results, performs a similarity evaluation and generates a list of search result cases 50.

[0157] (S94) The search unit 160 outputs a list of search results 50. Then, the search with system configuration similarity evaluation is completed. Figure 24 is a flowchart showing an example of a keyword search.

[0158] The keyword search process corresponds to step S91. (S100) The keyword search unit 161 searches for search keywords across all case data stored in the case table 121.

[0159] (S101) The keyword search unit 161 sorts the searched cases by the frequency of occurrence of the searched keyword. For example, the keyword search unit 161 sorts each case data in the case content of the case table 121 from the case with the highest frequency of occurrence of the search keyword, and the sorted list of cases becomes the case search results list based on the keyword search. The case search results list includes the case number that indicates the relevant case data. Then the keyword search is completed.

[0160] Figure 25 is a flowchart showing an example of case feature search. The case feature search process corresponds to step S92. (S110) The search feature extraction unit 163 extracts the first sentence from the trouble information 40. Here, the trouble information 40 consists of one or more sentences.

[0161] (S111) The search feature extraction unit 163 performs natural language analysis on the extracted sentences. In step S111, lexical analysis and part-of-speech analysis are performed as natural language analysis. As a result of the lexical analysis and part-of-speech analysis, the search feature extraction unit 163 obtains outputs similar to, for example, output 122 in Figure 12 and output 123 in Figure 13.

[0162] (S112) The server type extraction unit 163a performs a server type extraction process to extract the server type contained in the relevant sentence. The procedure for the server type extraction process is the same as in Figure 18. In the procedure in Figure 18, simply replace "server type extraction unit 151a" with "server type extraction unit 163a" and "case feature information" with "search feature information 191".

[0163] (S113) The search feature extraction unit 163 determines whether or not the server type was extracted in step S112. If the server type was extracted, the process proceeds to step S114. If the server type was not extracted, the process proceeds to step S119.

[0164] (S114) The search feature extraction unit 163 determines whether two or more server types were extracted in step S112. If two or more server types were extracted, the process proceeds to step S115. If two or more server types were not extracted, the process proceeds to step S119.

[0165] (S115) The cooperation relationship extraction unit 163b executes a cooperation relationship extraction process to extract cooperation relationships between servers. The procedure for the cooperation relationship extraction process is the same as in Figure 19. In the procedure in Figure 19, simply replace "cooperation relationship extraction unit 151b" with "cooperation relationship extraction unit 163b".

[0166] (S116) In step S115, the search feature extraction unit 163 determines whether or not a cooperation relationship between servers has been extracted. If a cooperation relationship has been extracted, the process proceeds to step S117. If a cooperation relationship has not been extracted, the process proceeds to step S119.

[0167] (S117) The search feature extraction unit 163 determines whether the search feature information 191 contains the combination of server types related to the cooperative relationship extracted in step S115. If the search feature information 191 contains the corresponding combination of server types, the process proceeds to step S119. If the search feature information 191 does not contain the corresponding combination of server types, the process proceeds to step S118.

[0168] (S118) The search feature extraction unit 163 adds the combination of server types related to the cooperative relationship extracted in step S115 to the search feature information 191. (S119) The search feature extraction unit 163 determines whether all sentences have been extracted from the trouble information 40. If all sentences have been extracted from the trouble information 40, the process proceeds to step S121. If not all sentences have been extracted from the trouble information 40, the process proceeds to step S120.

[0169] (S120) The search feature extraction unit 163 extracts the following sentence from the trouble information 40. Then, the process proceeds to step S111. (S121) The search feature extraction unit 163 performs search feature data conversion. Details of the search feature data conversion process will be described later. Through the search feature data conversion, the search feature information 191 is converted into search feature data 192. Then, the process proceeds to step S122.

[0170] Figure 26 is a flowchart showing an example of case feature search (continued). (S122) The case feature search unit 162 retrieves one case feature data from the case feature table 141.

[0171] (S123) The case feature search unit 162 calculates the distance between the case feature data and the search feature data 192. The case feature search unit 162 can use, for example, formula (1) to calculate this distance.

[0172] (S124) The case feature search unit 162 determines whether the distance calculated in step S123 is within the similarity determination distance. If it is within the similarity determination distance, the process proceeds to step S125. If it is not within the similarity determination distance, the process proceeds to step S126. Here, the "similarity determination distance" is a predetermined threshold for the distance calculated in step S123. If the distance calculated in step S123 is less than the threshold, it is determined to be within the similarity determination distance. If the distance calculated in step S123 is greater than or equal to the threshold, it is determined to be not within the similarity determination distance.

[0173] (S125) The case feature search unit 162 adds the case feature data extracted in step S122 to the case feature data list. The case feature data list contains information corresponding to the results of the case feature search. The case feature data list also includes the distance to the search feature data 192 calculated for the case feature data. The case feature data list may also include the case number corresponding to the case feature data.

[0174] (S126) The case feature search unit 162 determines whether it has calculated the distance between the search feature data 192 and all the case feature data in the case feature table 141. If it has calculated the distance to all the case feature data, the process proceeds to step S128. If it has not calculated the distance to all the case feature data, the process proceeds to step S127.

[0175] (S127) The case feature search unit 162 retrieves one case feature data from the case feature table 141. Then, the process proceeds to step S123. (S128) The case feature search unit 162 sorts each case feature data in the case feature data list by the distance calculated in step S123. For example, the case feature search unit 162 sorts the case feature data in ascending order of distance. Then the case feature search is completed.

[0176] Figure 27 is a flowchart showing an example of search feature data transformation. The search feature data transformation process corresponds to step S121. (S130) The search feature extraction unit 163 extracts the first line of the search feature information 191.

[0177] (S131) ​​The search feature extraction unit 163 extracts the first server type from the extracted row. (S132) The search feature extraction unit 163 determines whether or not the extracted server type is present in the rows of the search feature data 192, that is, whether or not there is a row for the corresponding server type in the search feature data 192. If there is a row for the corresponding server type, the process proceeds to step S134. If there is no row for the corresponding server type, the process proceeds to step S133.

[0178] (S133) The search feature extraction unit 163 adds the extracted server type to the row of the search feature data 192. (S134) The search feature extraction unit 163 determines whether or not the extracted server type exists in the columns of the search feature data 192, that is, whether or not the column for the corresponding server type exists in the search feature data 192. If the column for the corresponding server type exists, the process proceeds to step S136. If the column for the corresponding server type does not exist, the process proceeds to step S135.

[0179] (S135) The search feature extraction unit 163 adds a column of extracted server types to the columns of the search feature data 192. (S136) The search feature extraction unit 163 determines whether all server types have been extracted from the extracted rows. If all server types have been extracted, the process proceeds to step S138. If not all server types have been extracted, the process proceeds to step S137.

[0180] (S137) The search feature extraction unit 163 extracts the next server type from the corresponding row. Then, the process proceeds to step S132. Figure 28 is a flowchart showing an example of search feature data transformation (continued).

[0181] (S138) The search feature extraction unit 163 determines whether all rows of the search feature information 191 have been extracted. If all rows have been extracted, the process proceeds to step S140. If not all rows have been extracted, the process proceeds to step S139.

[0182] (S139) The search feature extraction unit 163 extracts the next line from the search feature information 191. Then, the process proceeds to step S131. (S140) The search feature extraction unit 163 sets all cells in the rows added in step S133 and the columns added in step S135 of the search feature data 192 to 0 (no connection).

[0183] (S141) The search feature extraction unit 163 extracts the first row of the search feature information 191. (S142) The search feature extraction unit 163 extracts the first server type from the row of the extracted search feature information 191 and stores it in the variable [row].

[0184] (S143) The search feature extraction unit 163 identifies the row number of the server type obtained in the variable [row] from the rows of the search feature data 192. (S144) The search feature extraction unit 163 extracts the first server type from the row of the extracted search feature information 191 and stores it in the variable [column].

[0185] (S145) The search feature extraction unit 163 determines whether the variable [row] and the variable [column] are the same. If they are the same, the process proceeds to step S148. If they are not the same, the process proceeds to step S146.

[0186] (S146) The search feature extraction unit 163 identifies the column number of the server type extracted from the columns of the search feature data 192 into the variable "column". Then, the process proceeds to step S147. Figure 29 is a flowchart showing an example of search feature data transformation (continued).

[0187] (S147) The search feature extraction unit 163 stores 1 (linked) in the cell of the search feature data 192 that is indicated by the row number corresponding to the variable [row] and the column number corresponding to the variable [column].

[0188] (S148) The search feature extraction unit 163 determines whether all server types have been extracted into the variable [column] from the rows of the extracted search feature information 191. If all server types have been extracted into the variable [column], the process proceeds to step S150. If not all server types have been extracted into the variable [column], the process proceeds to step S149.

[0189] (S149) The search feature extraction unit 163 extracts the next server type after the extracted server type from the row of the extracted search feature information 191 and places it in the variable [column]. Then the process proceeds to step S145.

[0190] (S150) The search feature extraction unit 163 determines whether all server types have been extracted into the variable [row] from the rows of the extracted search feature information 191. If all server types have been extracted into the variable [row], the process proceeds to step S152. If not all server types have been extracted into the variable [row], the process proceeds to step S151.

[0191] (S151) The search feature extraction unit 163 extracts the next server type after the extracted server type from the row of the extracted search feature information 191 and assigns it to the variable [row]. Then, the process proceeds to step S143.

[0192] (S152) The search feature extraction unit 163 determines whether all rows of the search feature information 191 have been extracted. If all rows of the search feature information 191 have been extracted, the process of converting the search feature data is completed. If not all rows of the search feature information 191 have been extracted, the process proceeds to step S152-1.

[0193] (S152-1) The search feature extraction unit 163 extracts the next line from the search feature information 191 and proceeds to step S142. Figure 30 is a flowchart showing an example of similarity evaluation.

[0194] The similarity evaluation process corresponds to step S93. (S160) The similarity evaluation unit 164 retrieves one case feature data from the list of case feature data, which is the result of the case feature search.

[0195] (S161) The similarity evaluation unit 164 retrieves the identification information of the case data corresponding to the case feature data. The identification information of the case data corresponds to the case number. (S162) The similarity evaluation unit 164 determines whether there are any cases in the list of case search results, which are the results of the keyword search, that match the identification information (case number) extracted in step S161. If there are cases that match the identification information, the process proceeds to step S163. If there are no cases that match the identification information, the process proceeds to step S164.

[0196] (S163) The similarity evaluation unit 164 adds the relevant case to the search result case list 50. For example, the similarity evaluation unit 164 may add the details of the relevant case to the search result case list 50. Alternatively, the similarity evaluation unit 164 may add the details of the countermeasure work record registered for the relevant case.

[0197] (S164) The similarity evaluation unit 164 determines whether all case feature data has been extracted from the case feature data list. If all case feature data has been extracted, the similarity evaluation process ends. If not all case feature data has been extracted, the process proceeds to step S165.

[0198] (S165) The similarity evaluation unit 164 retrieves the next case feature data from the case feature data list. Then, the process proceeds to step S161. Figure 31 shows an example of optimizing search results using case feature analysis.

[0199] Table 60 shows a comparative example of search results for cases 01 to 05 registered in Case Table 121 when using keyword search only, and an example of search results when using both keyword search and case feature search. Table 60 also shows an example of the search results that a support staff member would expect for an inquiry corresponding to the trouble information 40 provided by the inquirer. In this case, the expected search results include the relationship between the "WEB server" and the "DB server," and are cases where a timeout error occurred, such as Cases 01, 03, and 04.

[0200] In this comparative example, the search keywords are specified as "WEB server," "DB server," "connection," and "Timeout." In this case, the keyword search will find cases that contain all of the keywords "WEB server," "DB server," "connection," and "Timeout." Note that for "Timeout," the alternative keyword "timeout" is also specified, and if "timeout" is found, it will be considered as a hit for "Timeout." As a result, in the comparative example's keyword search only, only cases 01 and 05 will be found, while cases 02, 03, and 04 will not be found. In other words, only case 01 of the expected search results will be found, while cases 03 and 04 will not. In addition, the unnecessary case 05 will be obtained as a search result. Therefore, the search results are insufficient.

[0201] On the other hand, when using case feature search, the search keywords can be narrowed down to the content of the event, and the search related to the system configuration can be left to case feature search. For example, when using case feature search, the case search device 100 specifies "Timeout" or "Timeout" as the search keywords. In case feature search, the case search device 100 searches for system cases with a system configuration similar to the information processing system 30 based on the search feature data 192 generated from the trouble information 40 and the case feature data. The case search device 100 then outputs the cases included in both the keyword search results and the case feature search results as the final search results and presents them to the support staff.

[0202] Thus, the case search device 100 may perform a case search that combines keyword search and case feature search. This allows the case search device 100 to appropriately search for cases 01, 03, and 04 in relation to the occurrence trouble information 40. Compared to the search results of the comparative example, the expected search results, such as cases 03 and 04, are appropriately retrieved. In addition, the undesirable search result, case 05, is not included in the search results. Therefore, the case search device 100 can obtain appropriate cases as search results and provide them to support staff. In other words, the accuracy of the searched cases is improved. As a result, the case search device 100 can support support staff in efficiently responding to inquiries. Furthermore, support staff will be able to investigate troubles with products used in the information processing system 30 while being aware of the system configuration.

[0203] As explained above, the case search device 100 performs the following processing, for example. Processor 101 generates case features that show the characteristics of the interactions between components in each of the multiple systems by performing natural language analysis on case information that includes natural language descriptions of the system configurations of each of the multiple systems. When search information that includes a natural language description of the system configuration of the first system is input to processor 101, it generates search features that show the characteristics of the interactions between components in the first system by performing natural language analysis on the search information. Based on the search features and the case features of each of the multiple systems, processor 101 evaluates the similarity between the first system and each of the multiple systems.

[0204] This allows the case search device 100 to appropriately evaluate the similarities between systems. The case search device 100 can improve search accuracy by searching for cases while considering the cooperation between system components. Case table 121 is an example of case information. Multiple information processing systems corresponding to multiple cases in case table 121 are an example of multiple systems in case information. Information processing system 30 is an example of the first system. Occurring trouble information 40 is an example of search information. "WEB server" and "DB server" are examples of system components. For example, system components may be represented by hardware names such as switches and storage, or software names such as operating systems, middleware, and applications.

[0205] For example, in evaluating similarity, processor 101 evaluates that the shorter the distance between the search feature and the example feature, the higher the similarity between the first system and the system corresponding to that example feature. This allows processor 101 to easily evaluate the similarity between the first system and the system corresponding to the example feature.

[0206] For example, in the similarity evaluation, processor 101 calculates the distance between the search feature and the case feature of each of the multiple systems, and outputs first search result information that indicates the case corresponding to the case feature whose distance is smaller than a threshold.

[0207] As a result, the case search device 100 can appropriately output cases from the case information that have a higher similarity to the system configuration of the first system than the standard. The case feature data list shown in Figure 26 is an example of the first search result information.

[0208] The processor 101 outputs third search result information that shows cases included in both the second search result information and the first search result information, which are the results of a keyword search on case information using the search keywords corresponding to the search information.

[0209] This allows the case search device 100 to further improve the accuracy of case searches. Search keywords may include words that describe the content of the event that occurred, such as "Timeout." The aforementioned list of case search results, which shows the results of a keyword search, is an example of the second-order search results information. The search result case list 50 is an example of the third-order search results information.

[0210] In generating case features, processor 101 may extract the relationships between components in each of multiple systems from case information based on a first dictionary containing words representing the types of components and a second dictionary containing words representing the relationships between components. In generating search features, processor 101 may extract the relationships between components in the first system from search information based on the first and second dictionary information.

[0211] This allows the case search device 100 to appropriately generate case features and search features. The server type dictionary 131 is an example of the first dictionary information. The linked word dictionary 132 is an example of the second dictionary information.

[0212] Furthermore, the information processing of the first embodiment can be realized by having the processing unit 12 execute a program. Similarly, the information processing of the second embodiment can be realized by having the processor 101 execute a program. The program can be recorded on a computer-readable recording medium 113.

[0213] For example, a program can be distributed by distributing a recording medium 113 on which the program is stored. Alternatively, the program may be stored on another computer and distributed via a network. A computer may, for example, store (install) a program stored on the recording medium 113 or a program received from another computer into a storage device such as RAM 102 or HDD 103, and then read and execute the program from that storage device. [Explanation of Symbols]

[0214] 10 Information Processing Devices 11 Storage section 11a Case Information 12 Processing Units 20 Systems Servers 21 and 22 D10 Case Study D10a Case Features D20 Search Information D20a Search Features

Claims

1. By performing natural language analysis on case information that includes natural language descriptions of the system configurations of multiple systems, case feature quantities that show the characteristics of the interactions between the components in each of the multiple systems are generated. When search information including a natural language description of the system configuration of the first system is input, natural language analysis is performed on the search information to generate search feature quantities that show the characteristics of the interactions between the components of the first system. Based on the search features and the example features of each of the multiple systems, the similarity between the first system and each of the multiple systems is evaluated. A program that instructs a computer to perform a process.

2. In the similarity evaluation described above, the shorter the distance between the search feature and the example feature, the higher the similarity between the first system and the system corresponding to the example feature. The program according to claim 1, which causes the computer to perform the processing.

3. In the similarity evaluation, the distance between the search feature and the case feature of each of the multiple systems is calculated, and first search result information indicating the case corresponding to the case feature for which the distance is smaller than a threshold is output. The program according to claim 1, which causes the computer to perform the processing.

4. The system outputs a second search result information, which is the result of a keyword search on the case information using the search keywords corresponding to the search information, and a third search result information, which shows the case included in both the first and second search result information. The program according to claim 3, which causes the computer to perform the processing.

5. In generating the aforementioned case features, the cooperative relationships between the components in each of the multiple systems are extracted from the case information based on a first dictionary information in which words representing the types of the components are registered, and a second dictionary information in which words representing the cooperative relationships between the components are registered. In generating the search features, the relationships between the components in the first system are extracted from the search information based on the first dictionary information and the second dictionary information. The program according to claim 1, which causes the computer to perform the processing.

6. Computers By performing natural language analysis on case information that includes natural language descriptions of the system configurations of multiple systems, case feature quantities that show the characteristics of the interactions between the components in each of the multiple systems are generated. When search information including a natural language description of the system configuration of the first system is input, natural language analysis is performed on the search information to generate search feature quantities that show the characteristics of the interactions between the components of the first system. Based on the search features and the example features of each of the multiple systems, the similarity between the first system and each of the multiple systems is evaluated. Evaluation method.

7. A memory unit that stores example information, including natural language descriptions of the system configurations of multiple systems, A processing unit that performs natural language processing on the case information stored in the memory unit to generate case feature quantities that indicate the characteristics of the cooperation between components in each of the multiple systems, and when search information including a natural language description of the system configuration of the first system is input, performs natural language processing on the search information to generate search feature quantities that indicate the characteristics of the cooperation between components in the first system, and evaluates the similarity between the first system and each of the multiple systems based on the search feature quantities and the case feature quantities of each of the multiple systems, An information processing device having

Images