JP4456082B2 - Failure prediction system and failure prediction program - Google Patents

Description

  The present invention relates to a failure prediction system and a failure prediction program that can predict the occurrence of a failure in a computer system, and in particular, efficiently calculates the probability of occurrence of a failure in a service system in a computer system with a large number of connected clients, and prevents the failure. In particular, the present invention relates to a failure prediction system and a failure prediction program capable of notifying a person in charge / related person of a high probability of occurrence of a failure.

  In general, computer systems that connect to a large number of clients and provide system services such as ASP (Application Service Provider) services are expected due to increased load on resources / hardware failures / human errors during routine / temporary work. It is known that an unexpected failure occurs and the system service stops. In the case of a failure response by a computer system according to the prior art, after such a failure occurs, a responsible department or vendor is summoned according to the part where the failure has occurred.

  As a technology for dealing with such a failure, the conventional technology supports the functions of the monitoring system SNMP (standardized management protocol in TCP / IP network environment) and ICMP (TCP / IP protocol). The operation status is constantly monitored using a control protocol prepared to perform monitoring, and when a certain threshold is exceeded or the node is monitored for life or death, the person in charge is notified when no ICMP packet is returned. In this monitoring method, however, there is a problem that there is a high possibility that a failure will occur before the person in charge of the failure site starts (applies).

In addition, by providing a computer with a means for judging a fault related to the operation status and a fault avoidance means for performing an operation process based on the avoidance method, the occurrence of the fault is detected in advance and the action for the possible fault is automatically performed. Techniques performed in the following are described in the following patent documents.
Japanese Patent Laid-Open No. 10-49219

  The above-described conventional technology is a technology for monitoring resources and operation processes such as CPU and memory and predicting a client failure based on the transition, so that it is not possible to predict a failure due to a human error during operation or disk / file destruction. There was a problem that the failure of the factor could not be predicted.

  An object of the present invention is to eliminate the above-described problems caused by the prior art, and it is possible to estimate the date and time when the occurrence of a failure in a computer system becomes high, and to efficiently perform preventive maintenance, personnel assignment of a person in charge, etc. It is to provide a failure prediction system and program.

To achieve the above object, the present invention is a failure prediction system for predicting the occurrence of a failure in a computer system connected to a plurality of clients,
For each of a plurality of failures that occurred in the past, a phenomenon category in which the failure phenomenon is classified by failure phenomenon type, a factor category in which the cause of the failure is classified by failure factor type, and the phenomenon category and factor category are classified. A failure information database that stores sample data including downtime caused by a failure;
Time and downtime is from the time of occurrence of disorder symptoms section and cause division stored in the fault information database is divided up recovery time, the downtime caused by phenomena section and cause indicator same multiple failure calculated sum as the total downtime, and failure prediction function unit for calculating the failure probability of failure same phenomenon classification and cause division are divided to generate using said total downtime,
A parameter setting file in which the failure prediction function unit sets a variable k between the time when performing the calculation,
A failure prediction database for storing failure prediction data calculated by the failure prediction function unit and including failure occurrence probability caused by failures of the same phenomenon category and factor category;
A failure occurrence high probability notification function unit for notifying a preset destination when the failure occurrence probability of the failure prediction data stored in the failure prediction database exceeds a preset threshold;
The failure prediction function unit, k the time variable, the time from the past of any of the date and time up to the current X, 'when it was, linear probability P' the total non-operating time x, the linear probability P, and time change While the number k is increased by “k + 1”, the calculation formula “100 × (x + k) / X” is used until the variable k reaches a predetermined value, and the displacement of the calculated linear probability P ′ is generated using the function tanh. The first feature is to calculate the failure occurrence probability until the time variable k reaches a predetermined value by executing the tanh function application process so that the maximum value of the probability is less than 100%.

According to the present invention, in the failure prediction system, a phenomenon category master for storing a phenomenon category in which a phenomenon caused by the failure is classified according to a failure phenomenon type, and a factor category in which the cause of the failure is classified according to a failure factor type are stored. It provided the source segment master, the fault prediction database, the second, characterized in that storing the phenomenon classification master and total downtime due to a combination of all phenomena section and cause division stored in the cause division master.

Further, the present invention provides a phenomenon classification in which a phenomenon caused by a failure is classified according to a failure phenomenon type for each of a plurality of failures that have occurred in the past, a factor classification in which a cause of the failure is classified according to a failure factor type, the phenomenon classification and the factor A failure information database for storing sample data including the downtime caused by the failure in which the division is classified ;
Time and downtime is from the time of occurrence of disorder symptoms section and cause division stored in the fault information database is divided up recovery time, the downtime caused by phenomena section and cause indicator same multiple failure calculated sum as the total downtime, and failure prediction function unit for calculating the failure probability of failure same phenomenon classification and cause division are divided to generate using said total downtime,
A parameter setting file in which the failure prediction function unit sets a variable k between the time when performing the calculation,
The failure prediction function unit is calculated, the failure prediction database fault prediction data, and stores including failure occurrence probability caused by failure of the same phenomenon classification and factors division,
When the failure occurrence probability of the failure prediction data stored in the failure prediction database exceeds a preset threshold, the failure occurrence high probability notification function unit for notifying a preset destination is provided and connected to a plurality of clients. A failure prediction program for a failure prediction system for predicting the occurrence of a failure in a computer system,
In the failure prediction function unit, when the time variable is k, the time from any past date to the present is X, the total downtime is x, and the linear probability is P ′, the linear probability P ′ is the time variable k. Is increased by “k + 1” and is calculated until the variable k reaches a predetermined value by the calculation formula “100 × (x + k) / X”, and the displacement of the calculated linear probability P ′ is calculated using the function tanh . A third feature is to realize a function of calculating a failure occurrence probability until the time variable k reaches a predetermined value by executing the tanh function application process so that the maximum value is less than 100%.

According to the present invention, in the failure prediction system, a phenomenon category master for storing a phenomenon category in which a phenomenon caused by the failure is classified according to a failure phenomenon type, and a factor category in which the cause of the failure is classified according to a failure factor type are stored. According to a fourth feature of the present invention, there is provided a factor category master, and the failure prediction database stores a total downtime by a combination of all the phenomenon categories and factor categories stored in the phenomenon category master and the factor category master .

  In the failure prediction system and the failure prediction method according to the present invention, the failure prediction function unit calculates the total downtime based on the downtime due to the combination of the phenomenon category and the factor category stored in the fault information database, Using linear probability calculation based on the combination of the phenomenon category and the factor category and the total downtime, the combination of the phenomenon category and the factor category where the failure will occur in the future, the date on which the failure occurs due to the combination, and the occurrence of the failure A function for calculating the probability is realized, and the failure occurrence probability of the failure prediction data stored in the failure prediction database is notified to a preset destination when the failure occurrence probability exceeds a preset threshold. By realizing the function, it is possible to predict a failure having a high probability of occurring in the future. In particular, in the present invention, based on a combination of a failure occurrence phenomenon and an occurrence factor that occurred in the past, a total downtime due to a failure corresponding to the combination is calculated, and the combination with a large total downtime is a failure occurrence. If the probability is large, a linear probability calculation can be performed to predict a phenomenon and a failure of a factor that are likely to occur in the future.

Hereinafter, an embodiment of a failure prediction system and a program according to the present invention will be described in detail with reference to the drawings. FIG. 1 is a configuration diagram of a failure prediction system to which a failure prediction program according to a first embodiment of the present invention is applied. FIG. 2 is a first process of a failure prediction function and a failure occurrence high probability notification function according to this embodiment. FIG. 3 is a flowchart showing the detailed operation of the system time acquisition process according to the present embodiment, FIG. 4 is a flowchart showing the detailed operation of the time number calculation process according to the present embodiment, and FIG. 6 is a flowchart showing the detailed operation of the phenomenon / factor category combination acquisition processing according to the form, FIG. 6 is a diagram showing the concept of the total downtime calculation processing of the phenomenon / factor failure according to the present embodiment, and FIG. 7 is the present embodiment. FIG. 8 is a flow chart showing the detailed operation of the uptime calculation processing for the phenomenon / cause failure according to the present embodiment, and FIG. 8 shows the details of the linear probability calculation processing up to the future N according to this embodiment. FIG. 9 is a graph of the tanh function of the tanh function application process according to this embodiment, FIG. 10 is a flowchart showing the detailed operation of the tanh function application process according to this embodiment, and FIG. 11 is a failure according to this embodiment. FIG. 12 is a diagram showing the configuration and sample data of the failure prediction database according to the present embodiment, and FIG. 13 is a diagram of the failure information database according to the present embodiment. FIG. 14 is a diagram illustrating the configuration and sample data of the phenomenon classification master according to the present embodiment, FIG. 15 is a diagram illustrating the configuration and sample data of the factor classification master according to the present embodiment, and FIG. The figure which shows the structure of a parameter setting file by this embodiment, and sample data 7 is a diagram showing the configuration and sample data of the work database according to the present embodiment, FIG. 18 is a diagram showing the configuration of the work database and sample data according to the present embodiment, and FIG. 19 is the configuration of linear probability data according to the present embodiment. It is a figure which shows sample data.
<Description of overall configuration>

  The failure prediction system 101 to which the failure prediction program according to the present embodiment is applied is a failure that stores failure information as sample data via a failure information system 112 that collects failure information from other computer systems, as shown in FIG. A failure prediction function unit 102 for inputting the sample data from the information database (DB) 111, a failure prediction database (DB) 104 for storing failure prediction information created by the failure prediction function 102, and the failure prediction function 102 A failure occurrence high probability notification function unit 103 that receives a report and notifies failure prediction information to a person in charge or a person concerned, a phenomenon classification master 105 that stores a phenomenon of a failure that has occurred in the past, and a past A factor category master 106 for storing the cause (cause) of the failure that has occurred and classifying the cause, and the phenomenon category cell 105 and a parameter setting file 107 for setting parameters that are threshold values for analyzing the phenomenon information and the cause information stored in the factor classification master 106, and a work database (DB) 108 and a work database (DB) 109 to be described later. And a linear probability database (DB) 110 for storing linear probability data for calculating the probability of occurrence of a failure with reference to various data stored in the phenomenon classification master 105.

  As shown in FIG. 13, the failure information DB 111 stores sample data of past failure information. For example, “failure number” “affected member code” “case name” “occurrence date” “recovery date” "Unavailable time", "Symptom category", "Cause category", "Work category", "Symptom details", "Factor details", "Action", "Reoccurrence prevention measures", for example, the failure of failure number "00000001" affects For the member with membership code “JPNGX0001”, the project name “Program Baku” occurred at 23:30 on August 10, 2002 and recovered at 01:10 on August 11, 2002. 1 hour ", phenomenon category is" 0001 ", cause category is" 0004 ", work category is" 0000021912 ", phenomenon details is" order data number error ", cause details is" insufficient specification check ", and response is" Undo “, The fact that the recurrence prevention measure was“ specification review ”is stored.

  As described above, the failure information DB 111 according to the present embodiment categorizes the phenomenon caused by the failure according to the failure phenomenon type and the cause of the failure according to the failure factor type for a plurality of failures that have occurred in the past. The “factor category”, the system downtime caused by the failure, the “non-operation time”, the “occurrence time” of the failure and the like are stored in a database.

  The failure prediction DB 104 stores failure prediction information predicted in the future. As shown in FIG. 12, “year / month / day / hour / minute / second”, “phenomenon division”, “factor division” where a predicted failure occurs is stored. ”,“ Failure occurrence probability ”, for example, at 00:00:00 on January 01, 2005, the failure with the phenomenon classification“ 0001 ”and the factor classification“ 0001 ”is the failure occurrence probability“ Fault prediction information that occurs at “10%” is stored. As described above, the failure prediction DB 104 according to the present embodiment performs a prediction process to be described later based on the past failure cases stored in the failure information DB 111, and the predicted date / phenomenon classification / factor classification as a result thereof. / Stores failure occurrence probability. In addition, the linear probability for obtaining the failure occurrence probability in the present embodiment is a generalized linear model in statistics (a model in which a reaction variable that is a numerical variable is predicted by numerical transformation or linear combination of explanatory variables of factor variables) However, it is not limited to this.

  The phenomenon classification master 105 classifies the failure phenomenon that occurs according to the phenomenon type corresponding to the “phenomenon classification” and the “phenomenon name”. As shown in FIG. The phenomenon name is “system down”, the phenomenon classification “0005” is stored as the phenomenon name “file destruction”, and the phenomenon classification “0008” is stored as the phenomenon name “insufficient security”.

  The factor category master 106 classifies the cause of the failure that occurs by factor type corresponding to “factor category” and “factor name”. As shown in FIG. 15, for example, the factor category “0001” The cause name is “center hardware failure”, the cause category “0005” is stored as the cause name “failure due to external attack”, and the cause category “0008” is stored as the phenomenon name “communication line failure”.

  The parameter setting file 107 is set with parameters (thresholds) and notification destinations for analyzing the phenomenon information and the cause information, and as shown in FIG. “Unit time”, “past M years” that sets the number of years in the past as sample target data, “future N years” that sets the number of years in the future for which probability calculation is performed, and the danger to be notified by performing probability calculation For example, when the unit time is set to “1 second” for each item of “failure probability risk threshold” for setting a threshold of a probability to be determined and “notification destination email address” for setting an email destination, the past 10 years Based on this sample data, it stores emails sent to hitachi@dokono.ne.jp and others when the failure probability threshold is 60% or more in the next five years.

  As shown in FIG. 17, the work database 108 stores associations between “phenomenon categories” and “factor categories”. For example, the work database 108 includes a plurality of factor categories “0001” to “0001” for the phenomenon category “0001”. "0003" is stored, and the work database 109 stores the correspondence of "Fault number" / "Symptom category" / "Factor category" / "Unavailable time" as shown in FIG. For example, the fact that the phenomenon classification of the failure number “001928372” is “0001”, the cause classification is “0004”, and the non-operation time is “1” time is stored.

  The linear probability database 110 stores “linear probability” by a combination of “phenomenon category”, “factor category”, and “elapsed time”. As shown in FIG. 19, for example, the phenomenon category “0001” and Failure with a factor category of “0001” and an elapsed time of “1” hours with a linear probability of “2%”, a phenomenon category of “0001”, a factor category of “0001” and an elapsed time of “8” hours The fact that the linear probability for “6” is “6%” is registered.

  When a failure occurs, the failure information system 112 inputs the failure occurrence date / time / recovery date / time / phenomenon category / cause category / non-operation time / other failure detailed information / failure response manager, and records past failure information. Is stored / updated in the failure information DB 111.

  Further, the failure prediction function unit 102 is activated every hour (the time unit [time, minute, second] is variable, and this time unit is set in the parameter setting file 107), and the failure occurrence date and other failure information. The sample data stored in the failure information DB 111 for the past M years set in the parameter setting file 107 and the future N years set in the parameter setting file 107 are input. The failure prediction probability is estimated by referring to the phenomenon occurrence master 105 / cause division master 106 / work DB 108 / work DB 109 / linear probability database 110 to update the failure prediction DB 104 for each hour. The function that operates and the failure occurrence probability of the failure prediction information during the calculation are the parameter setting file 107 A function of notifying the failure occurrence high probability notification function unit 103 of the prediction date / time / phenomenon classification / factor classification and the mail address list set in the parameter setting file 107 when a set threshold value (for example, 60%) is exceeded; Have

  The failure occurrence high probability notification function unit 103 notifies the prediction date / time / phenomenon / factor classification of the failure prediction information received from the failure prediction function 102 to the person in charge / related person 113 in the mail address list by e-mail. It has a function.

As described above, the failure prediction system 101 according to the present embodiment obtains failure information that has occurred in the past from the failure information system 112, analyzes the failure information according to the parameters set in the parameter setting file 107, and provides phenomenon category information and failure cause category. Are registered in the classification masters 105 and 106, and the failure prediction function 102 determines that the failure occurrence probability is high when the failure occurrence probability for each hour until the next N years exceeds the threshold set in the parameter setting file 107. The notification function unit 103 notifies the person in charge of the prediction date / time / phenomenon classification / factor classification, so that the person in charge can be notified of a predicted failure in advance, and thus the preventive measures are efficiently performed. be able to.
<Detailed operation>

<Definition etc.>
Next, operations of the failure prediction function 102 and the failure occurrence high probability notification function unit 103 will be described in detail with reference to FIG. 2. First, definitions of variables and the like are set as follows.
(1) The failure occurrence probability in units of Δt (hours, minutes, seconds) from the failure record data in the past M years to the future N years ahead is calculated.
(2) Time at present (processing start-up): t (Yt, YYYY / MM / DD HH: MM: SS, etc., Δt unit).
(3) Number of hours from the past M years to t: X (Δt)
(4) Number of hours from t to N years in the future: Y (Δt)
(5) Sum of downtime of the current (current) phenomenon category and factor category: x (Δt)
(6) Failure time of failure in current (current) phenomenon category and factor category τ1, τ2, τ3, ... τn (Δt)
As a precondition, it is assumed that the failure of the phenomenon / factor has occurred n times (0 ≦ n <∞) in the past (M years ago to present), and the failure information DB 104 is the main key up to the affected customer code. Therefore, group by failure number (adopt the record with the largest downtime).
(7) Applicable (current) phenomenon classification: PHENOME (I)
(8) Applicable (current) factor classification: FACTOR (J)
(9) Failure probability threshold: K (%)
<Forecast → Notification operation outline>

The failure prediction function 102 and the failure occurrence high probability notification function unit 103 according to the present embodiment calculates the future failure occurrence probability from the past failure record information, and notifies the person in charge / related party when the threshold is exceeded. This operation will be described with reference to FIG.
[Step S201]

  The system first acquires the current system time as in step S201. In this step S201, for example, when Δt is 1 second, t = YYYYMMDDDHHMSS, and when Δt is 1 minute, YYYYMMDDDHHMM. This Δt is set in the parameter setting file 107. As shown in FIG. 16, the parameter setting file 107 includes unit time / past M year / future N year / failure probability risk threshold / notification destination mail address. Items are registered as 00001/10/5/60%/hitachi@dokono.ne.jp. The unit time “00001” means 1 second.

In this embodiment, the time unit of Δt is shown as 1 hour, 1 minute, and 1 second. However, if the system clock has a value, units such as milliseconds and nanoseconds can be calculated. Is possible by further subdividing the time unit shown in FIG. The system date / time is obtained as much as possible in order to obtain the system date / time and perform data operations / calculations for the past M years and the future N years around the date / time. For example, using an NTP server, You may keep the system date and time synchronized.
[Step S202]

  Next, the failure prediction function 102 and the failure occurrence high probability notification function unit 103, as shown in step S202, the number of hours from the past M years to the current t preset in the parameter setting file 107 and from t to the future N years. Calculate the number of hours. The detailed operation of step S202 will be described later with reference to FIG.

This calculation is calculated as follows when Δt = 1 second:
X = M × 60 × 60 × 24 × 365
Y = N × 60 × 60 × 24 × 365

When Δt is 1 minute, it is calculated as follows.
X = M × 60 × 24 × 365
Y = N × 60 × 24 × 365
[Step S203]

Next, the failure prediction function 102 or the like clears all records in the work database 108 as in step S203.
[Step S204]

  Next, as shown in step S204, the present system registers a combination of all records of the phenomenon category master 105 and the factor category master 106 in the work DB 108, and the first record pair is defined as PHENOME (I) = current phenomenon category. FACTOR (J) = Read as current factor classification.

  This step S204 loops while all records in the work DB 108 are read. Since the work DB 108 is a combination of all the records of the phenomenon classification master 105 and the factor classification master 106, assuming that there are m records and n records, respectively, m × n records are stored in the work DB 108.

In the second and subsequent loops, this step reads the next record of the current phenomenon category-factor category pair.
This step S204 will be described in detail with reference to FIG.
[Step S205]

Next, the present system reads the failure phenomenon category / factor category / non-operation time from the past failure information stored in the failure history DB 111, and stores the past of the phenomenon category (PHENOME (I)) and cause category (FACTOR (J)). The total non-operation time from M years to the current system time is calculated as the total non-operation time x (x = Σ (r = 1) (n) τr). Details of step S205 will be described later with reference to FIGS.
[Step S206]

Next, in step S206, the system determines whether the value of the total non-operation time x is “0”. As a result of this determination, if x = 0, that is, if no failure has occurred in the phenomenon / factor category pair in the past, the future N years of the phenomenon / factor category in the failure prediction DB 104 The process proceeds to step S217 in which “0” is set in the “failure probability” item of the records up to and to step S207 if x ≠ 0.
[Step S207]

Next, as in step S207, linear probabilities of the phenomenon category (PHENOME (I)) and factor category (FACTOR (J)) up to N years in the future are calculated. The linear failure occurrence probability P ′ after t + k (k = 1, 2,...) is 100 × (x + k) / X. This P ′ is calculated every hour until the next N years and temporarily stored in the linear probability database 110. Since x + k increases proportionally, it is assumed that the linear failure occurrence probability P ′ exceeds 100. Therefore, the linear (increase) probability is applied to the actual failure occurrence probability using the tanh function in this step and thereafter. The detailed operation of step S207 will be described later with reference to FIG.
[Step S208]

  Next, the system sets a notification flag to 0 as in step S208. This notification flag is a flag indicating whether or not the failure occurrence high probability notification function shown in FIG. 1 is notified when the phenomenon or the factor exceeds the threshold.

Explaining this, the failure occurrence probability increases in time series, so once the failure occurrence probability of the relevant phenomenon category or factor category exceeds the threshold, the occurrence probability of each hour will exceed the threshold thereafter. After exceeding, all alarm information for every hour up to N years will be notified. The notification flag in this example is to prevent this, and to prevent alarm notifications for two or more unit hours of the relevant event category or factor category once notified beyond the threshold. is there.
[Step S209]

Next, the data in the linear probability database 110 created in step S207 is read one record at a time, and it is determined whether or not the data in the linear probability database 110 is the last record. As a result of the determination, if there is no data in the linear probability database 110 or there is no record to be read after the last record, the process proceeds to the next step S214, and if there is a record to be read, the process proceeds to step S210. This step S209 loops between step SS213 until the end of the linear probability database 110 data.
[Step S210]

Next, as shown in step S210, the present system applies a tanh function to the read record to calculate a failure occurrence probability P (P = 100 × tanh [P ′ / 100]). Details of step S210 will be described later with reference to FIGS.
[Step S211]

Next, as in step S211, it is determined whether or not the failure occurrence probability P calculated in step S210 is equal to or greater than a threshold set in the parameter setting file 107. As a result of this determination, if the failure occurrence probability P is greater than or equal to the threshold, the process proceeds to step S215, and if smaller than the set threshold, the process proceeds to step S212.
[Step S215]

Next, the system determines whether or not the notification flag is “1” as in step S215. As a result of this determination, when the notification flag is 1, that is, the failure occurrence probability exceeds the threshold value, but the notification has been completed, the notification processing is not performed, and the process proceeds to step S212. If the failure occurrence probability exceeds the threshold and is not notified, the process proceeds to the failure occurrence probability high probability process in the next step S216.
[Step S216]

When it is determined in step S215 that the notification flag is not "1", the failure occurrence probability and its time (current system time + after the elapsed time), the phenomenon category, and the factor category information are received using e-mail. It is automatically sent to the person in charge / related person of the failure prediction system, and the notification flag is set to “1”. The detailed operation of step S216 will be described later with reference to FIG.
[Step S212]

Further, following the step S211 or 215, the present system updates the current failure prediction time (system time + elapsed time), phenomenon category, factor category, and failure occurrence probability P to the failure prediction DB 104. The main keys of this update process are failure prediction time (system time + elapsed time), phenomenon category, and factor category. If there is a record, the record is updated. The failure prediction DB 104 stores the failure prediction information illustrated in FIG.
[Step S213]

Next, the next record in the linear probability database 110 is read, and the process loops to the above-described step S209.
[Step S214]
As in step S214, the system determines whether or not the work DB 108 has a pair of phenomena and factor categories. When there is a pair record, the system repeats the processing from step S204 to step S214 described above to the work DB 108. The process ends when the loop process for all stored records is completed.

In this way, the present system determines the future linear failure occurrence probability P ′ based on the relationship between the combination of the phenomenon category and the factor category included in the past failure record information and the total failure time x of failures caused by this combination. Can be calculated in step S207, and the person in charge / related parties can be notified when the calculated linear failure occurrence probability P exceeds a predetermined threshold. Hereinafter, the detailed processing operation in each step will be described step by step.
<Description of System Time Acquisition Processing Step S201>

Next, the system time acquisition process in step S201 described above will be described with reference to FIG.
In this process, as shown in FIG. 3, first, a predetermined unit time (item of Δt) is acquired from the parameter setting file 107, and the current system date and time (at the time of starting the process of FIG. 2) in this unit time is acquired. It is determined whether Δt is “0001” (step S301). If Δt is “0001”, the process proceeds to step S302. If Δt is not “0001”, the process proceeds to step S303.

  In step S302, the system time is set to t (t = time [YYYYMMDDHHMMSS]: time () function is a function for acquiring the system date and time).

  Next, in step S301, the system date and time up to "second" is obtained by time (YYYYMMDDDHMMSS), the system date and time up to "minute" is obtained by time (YYYYMMDDDHHMMM), and the system date and time up to "hour" is obtained by time (YYYYMMDDDHH). get.

In step S303, if Δt is “0002”, the process proceeds to step S304. If Δt is not “0002”, the process proceeds to step S305.
In step S304, the system time is set to t [t = time (YYYYMMDDDHHMM)].

In step S305, if Δt is “0003”, the process proceeds to step S306, and if Δt is not “0003”, the process proceeds to step S307.
In step S306, the system time is set to t [t = time (YYYYMMDDDHH)].
In step S307, error processing is performed assuming that Δt in the parameter setting file cannot be recognized by the failure prediction system. This error occurs when a unit time that cannot be recognized by the system is set in Δt, and log information to that effect is output.

As described above, in this embodiment, the system time is acquired from the parameter setting file 107 in units of unit time (item of Δt: second / minute / hour) defined in advance, and the acquired total time is calculated.
<Description of Time Count Calculation Processing Step S202>

  FIG. 4 is a diagram for explaining the detailed operation of step S202, which is the time number calculation process described with reference to FIG.

  The number of hours calculation process in step S202 first obtains the number of hours from M years ago to the present (when the process is started by the process in FIG. 2) and the number of hours from the present to the next N years, and is a parameter setting file. Items to be acquired (up to hours / minutes / seconds) differ depending on the unit time defined in 107.

  In this process, items Δt, M, and N are first acquired from the parameter setting file 107, and it is determined whether or not the value of Δt is “0001” in step S401. If Δt is “0001”, the process proceeds to step S402. , Δt is not “0001”, the process proceeds to step S403.

  In step S402, the time from the past M years to the present is set to X, and the time from the present to the future N years is set to Y. For example, in the case of the past M years and the future N years, this value is calculated by the equation of X = M × 60 × 60 × 24 × 365 and Y = N × 60 × 60 × 24 × 365.

  Next, in step S403, the process determines whether the value of Δt is “0002”. If Δt is “0002”, the process proceeds to step S404. If Δt is not “0002”, the process proceeds to step S405.

  In step S404, the time from the past M years to the present is set to X, and the time from the present to the future N years is set to Y. This value is calculated by, for example, an equation of X = M × 60 × 24 × 365 and Y = N × 60 × 24 × 365.

  In step S405, it is determined whether or not Δt is “0003”. If Δt is “0003”, the process proceeds to step S406. If Δt is not “0003”, the process proceeds to step S407).

  In step S406, the time from the past M years to the present is set to X, and the time from the present to the future N years is set to Y. This value is calculated by, for example, an equation of X = M × 24 × 365 and Y = N × 24 × 365.

As an error, when the fault prediction system cannot recognize Δt in the parameter setting file, error processing is performed in step S407. This error occurs when a unit time that cannot be recognized by the system is set in Δt, and log information to that effect is output.
In this way, in this process, the time of the past sample object is calculated based on the date of the past sample data, and the time for performing the prediction based on the date of the future is calculated.
<Description of phenomenon / factor category combination acquisition processing step S204>

  Next, the phenomenon / factor category combination acquisition processing in step S204 described above will be described with reference to FIG.

  In this step S204, in order to calculate the failure occurrence probability of all combinations of records stored in the phenomenon classification master 105 and the factor classification master 106, the phenomenon classification and the factor are looped by all combinations of the phenomenon classification and the factor classification. The classification is acquired and stored in the work DB 108.

This process will be described. When the number of records in the phenomenon classification master 105 is m and the number of records in the factor classification master 106 is n, there are m × n combinations. Phenomenon classification → PHENOME (I), factor classification → FACTOR (J), (PHENOME (I), FACTOR (J)) [where I = 1, 2,... M J = 1, 2,. n] pairs are registered in the database DB 108 by loop processing each combination of the phenomenon category and the factor category as in step S501.
In this way, in this processing, a plurality of records are created by a plurality of combinations of phenomenon categories and factor categories. In the present embodiment, the number of all created records is referred to as the total number of records.
<Description of Total Downtime Calculation Processing Step S205 of the Phenomenon / Cause Failure>

As shown in the conceptual diagram of FIG. 6, the phenomenon / factor failure failure sum total calculation process in step S205 is a certain phenomenon from the past M years to the present (base point t) starting from the main process start time point t. Assume that the failure of the category / factor category occurs n times, and is a process for obtaining the sum Στ _n of the non-operation time. As described above, the failure phenomenon category / factor category / The non-working time is read, the non-working time τ _n from the past M years to the current system time of the relevant phenomenon classification is acquired, and this sum is calculated as the non-working time total x. In this process, when there is a failure at the time of the past M years (when the recovery date is from the past M years to the present), regardless of the failure occurrence date and time, the item of the non-operation time of the failure information is set. Get and get the sum.

  The information read from the failure information DB 111 (FIG. 13) includes a number of items related to failures, the primary key is the failure number and the affected customer code, and there are a plurality of the same failure numbers (because the affected customer code is the key). ), Sort in ascending order by non-working time, adopt the value with the largest non-working time and group to obtain the sum.

As shown in FIG. 7, the details of the calculation processing in step S205 are as follows. First, the failure information DB 111 using the phenomenon category-factor category pair stored in the work DB 108 and the extraction condition of past M years ≦ recovery date ≦ t. And the sum of the “unavailable time” of all records stored in the work DB 109 in units of time Δt registered in the parameter setting file 107 is calculated as step S701 in which all of the records are registered in the work DB 109. By sequentially executing step S702 for setting and step S703 for clearing all the records in the work DB 109, the sum x (= Στ _n ) of the non-working time is obtained.
<Description of Linear Probability Calculation Processing Step S207>

  Next, step S207 for performing linear probability calculation processing up to future N will be described with reference to FIG. The principle of this linear probability calculation is to calculate the total non-operation time total x due to failures corresponding to the combinations of many failure occurrence phenomena and the generation factors calculated in step S205, and the combination with a large total non-operation time total x. However, the probability of failure occurrence is calculated by linear probability calculation using the fact that failure occurrence probability is high. The linear probability is preferably a generalized linear model in statistics (a model that predicts a response variable that is a numerical variable by numerical transformation or linear combination of explanatory variables of factor variables), but is not limited to this. The probability calculation method may be used.

  The specific linear probability calculation process in step S207 starts with variable k [variable k is the elapsed time from the current, the unit varies depending on Δt of the parameter setting file 107, and is 1 second, 1 minute, or 1 hour]. Step S801 for setting 1 and then calculating a linear probability P ′ by a calculation formula of P ′ = 100 × (x + k) / X, and storing the phenomenon category, factor category, elapsed time (k), linear probability in the linear probability database 110 , Step S803 to set k = k + 1, and the next time series, step S804 to determine whether k is larger than Y, and k is larger than Y in step S804 Sometimes this process ends, and if k ≦ Y, the process returns to step S802 to operate as a loop. In other words, this processing repeatedly calculates and outputs the linear probability until the time of the future N years calculated in the above-described step S202 is reached.

Here, since the numerator (x + k) of the mathematical formula in step S802 is increased and the denominator (X) is constant, it is assumed that P ′ increases linearly and exceeds 100 (%). Therefore, in the present embodiment, the tanh function application processing step S210 is performed in which the function tanh (x) that increases so that 100% becomes an asymptotic line is applied. By adopting this step S210, the linear probability P ′ according to the present embodiment can have a characteristic in which 100% is an asymptote and increases as shown in FIG. The tanh (Hyperbolic Tangent) is called a hyperbolic tangent.
<Description of Tanh Function Application Processing Step S210>

As shown in FIG. 10, the tanh function application process is created in FIG. 8 by calculating f (x) = 100 _{* 1} * tanh (x / 100 _{* 2} ) from the graph waveform shown in FIG. The tanh function can be applied by executing step S901 in which the items of the linear probability database 110 and the linear probability P ′ are applied to x. In * 1, 100 is multiplied to make f (x) = 100 (%) as an asymptotic line, and in * 2, 100 is divided by the time axis in the time series. This is to adjust the progress to * 1 and delay it. Note that the tanh function application processing in step S210 is executed by the failure prediction function unit 102 or a tanh function application processing unit (not shown).
<Failure High Probability Notification Processing and Notification Flag = 1 Description of Processing Step S210>

  This step S210 is a failure occurrence high probability notification process in FIG. 2 and a process for setting the notification flag to 1. As shown in FIG. 11, the mail address group items are acquired from the parameter setting file 107, and all the mails are acquired. Step S1001 in which the address, failure prediction time, phenomenon classification, factor classification, and threshold are passed to the electronic mail system, and the electronic mail system sends mail to all mail addresses, and then step S1002 in which a notification flag is set to 1. Done by running.

  As described above, in the failure prediction system according to the present embodiment, in determining the future failure occurrence probability from the past failure record, paying attention to the phenomenon and the factors underlying the failure, the frequency (total downtime due to failure) is sampled. Data and failure forecasting system uptime as population data, future failure occurrence probability for each phenomenon / factor, time-series failure / non-operation time for each combination of phenomenon and factor, hourly (seconds, Probability is calculated at the timing of minutes, hours, etc., and a failure occurring in the future can be predicted by notifying the administrator or the like when the calculated failure occurrence probability exceeds a predetermined threshold. That is, for each combination of failure phenomenon and factor that occurred in the past, the sum of the non-operation time due to the failure is calculated. In the future, it is possible to predict a failure that will occur in the future. According to the present embodiment, the past M years, the future N years, the failure occurrence high probability threshold, the phenomenon classification, and the factor classification are converted into a master DB and are variable, so that the versatility is high, and rough prediction to detailed prediction. It can be performed.

  In addition, this invention is not limited to the above-mentioned embodiment, In the range which does not deviate from the summary, various changes are possible. For example, in this embodiment, a configuration may be employed in which a DB that consumes a certain amount of resources, such as the work DB 108 and the work DB 109, is provided as a work file.

The block diagram of the failure prediction system by one Embodiment of this invention. The flowchart which shows the 1st processing operation example of the failure prediction function by this system example, and a failure occurrence high probability notification function. The flowchart which shows the detailed operation | movement of the system time acquisition process by this example. The flowchart which shows the detailed operation | movement of the time number calculation process by this example. The flowchart which shows the combination acquisition process operation of the phenomenon / factor division by this example. The figure which shows the concept of the non-operation time total calculation process of the said phenomenon factor failure by this example. The flowchart which shows the detailed operation | movement of the non-operation time total calculation process of the said phenomenon factor failure by this example. The flowchart which shows the detailed operation | movement of the linear probability calculation process to the future N by this example. The graph of the tanh function of the tanh function application process by this example. The flowchart which shows the detailed operation | movement of a tanh function application process by this example. The flowchart which shows detailed operation | movement of the failure high probability notification process and notification flag = 1 process by this example. The figure which shows the structure and sample data of a failure prediction database by this example. The figure which shows the structure and sample data of a failure information database by this example. The figure which shows the structure and sample data of the phenomenon classification master by this example. The figure which shows the structure and sample data of a factor division master by this example. The figure which shows the structure and sample data of the parameter setting file by this example. The figure which shows the structure and sample data of a work database by this example. The figure which shows the structure and sample data of a work database by this example. The figure which shows the structure and sample data of the linear probability data by this example.

Explanation of symbols

101: Failure prediction system, 102: Failure prediction function unit, 103: Failure occurrence high probability notification function unit, 104: Failure prediction database, 105: Phenomenon classification master, 106: Factor classification master, 107: Parameter setting file, 108: Work Database: 109: Work database, 110: Linear probability database, 111: Failure information database, 112: Failure information system.

Claims (4)

A failure prediction system for predicting a failure occurrence of a computer system connected to a plurality of clients,
For each of a plurality of failures that occurred in the past, a phenomenon category in which the failure phenomenon is classified by failure phenomenon type, a factor category in which the cause of the failure is classified by failure factor type, and the phenomenon category and factor category are classified. A failure information database that stores sample data including downtime caused by a failure;
Time and downtime is from the time of occurrence of disorder symptoms section and cause division stored in the fault information database is divided up recovery time, the downtime caused by phenomena section and cause indicator same multiple failure calculated sum as the total downtime, and failure prediction function unit for calculating the failure probability of failure same phenomenon classification and cause division are divided to generate using said total downtime,
A parameter setting file in which the failure prediction function unit sets a variable k between the time when performing the calculation,
The failure prediction function unit is calculated, the failure prediction database fault prediction data, and stores including failure occurrence probability caused by failure of the same phenomenon classification and disorders division,
A failure occurrence high probability notification function unit for notifying a preset destination when the failure occurrence probability of the failure prediction data stored in the failure prediction database exceeds a preset threshold;
The failure prediction function unit, k the time variable, the time from the past of any of the date and time up to the current X, 'when it was, linear probability P' the total non-operating time x, the linear probability P, and time change While the number k is increased by “k + 1”, the calculation formula “100 × (x + k) / X” is used until the variable k reaches a predetermined value, and the displacement of the calculated linear probability P ′ is generated using the function tanh. A failure prediction system that calculates a failure occurrence probability until a time variable k reaches a predetermined value by executing a tanh function application process so that a maximum value of probability is less than 100%.   A phenomenon classification master that stores a phenomenon classification obtained by classifying the phenomenon according to a failure phenomenon type, and a factor classification master that stores a factor classification obtained by classifying the cause of the failure according to a failure factor type are provided in the failure prediction database. 2. The failure prediction system according to claim 1, wherein total failure time is stored by a combination of all phenomenon categories and factor categories stored in the phenomenon category master and the factor category master. For each of a plurality of failures that occurred in the past, a phenomenon category in which the failure phenomenon is classified by failure phenomenon type, a factor category in which the cause of the failure is classified by failure factor type, and the phenomenon category and factor category are classified. A failure information database that stores sample data including downtime caused by a failure;
Time and downtime is from the time of occurrence of disorder symptoms section and cause division stored in the fault information database is divided up recovery time, the downtime caused by phenomena section and cause indicator same multiple failure calculated sum as the total downtime, and failure prediction function unit for calculating the failure probability of failure same phenomenon classification and cause division are divided to generate using the aggregate downtime,
A parameter setting file in which the failure prediction function unit sets a variable k between the time when performing the calculation,
The failure prediction function unit is calculated, the failure prediction database fault prediction data, and stores including failure occurrence probability caused by failure of the same phenomenon classification and factors division,
When the failure occurrence probability of the failure prediction data stored in the failure prediction database exceeds a preset threshold, the failure occurrence high probability notification function unit for notifying a preset destination is provided and connected to a plurality of clients. A failure prediction program for a failure prediction system for predicting the occurrence of a failure in a computer system,
The failure prediction function unit, k the time variable, the time from the past of any of the date and time up to the current X, 'when it was, linear probability P' the total non-operating time x, the linear probability P, and time change While the number k is increased by “k + 1”, the calculation formula “100 × (x + k) / X” is used until the variable k reaches a predetermined value, and the displacement of the calculated linear probability P ′ is generated using the function tanh. A failure prediction program that realizes a function of calculating a failure occurrence probability until the time variable k reaches a predetermined value by executing tanh function application processing so that the maximum value of the probability is less than 100% . A phenomenon classification master storing phenomenon segment formed by dividing the pre Kigen elephant by disorder phenomena type, provided the source segment master for storing factors segment formed by dividing the factors that the problem has occurred by fault-types, the fault prediction database 4. The failure prediction program according to claim 3, wherein a total downtime is stored by a combination of all the phenomenon categories and factor categories stored in the phenomenon category master and the factor category master.

Images