JP4618263B2 - Software behavior monitoring apparatus and software behavior monitoring system - Google Patents

Description

  The present invention relates to a software behavior monitoring apparatus, a software behavior monitoring system, and a program for monitoring software behavior.

Currently, many companies operate systems using software. In such systems, the behavior of software is monitored in order to detect signs of failure. For example, there is Patent Document 1 for monitoring the behavior of software. According to Patent Document 1, a service application that performs normal business processing is executed on a first OS that is a general OS. The first OS records the operation performed by the first OS as operation record information together with the operation time. The multi-OS control unit interface provided in the second OS having higher reliability than the first OS operates the multi-OS control unit from an analysis prediction application operating on the second OS. Then, the analysis prediction application analyzes the states of the first OS and the service application, and detects a failure sign.
JP 2005-115751 A

  However, in the prior art including Patent Document 1, there is no mechanism for dynamically adjusting the behavior monitoring target. Therefore, if the behavior monitoring target is not set in detail, detailed behavior monitoring information cannot be obtained from the behavior monitoring target of the lower layer, even when a failure sign is detected in the behavior monitoring target of the upper layer, and it is accurate. Failure prediction is not possible. On the other hand, if the behavior monitoring target is set in detail, resources such as CPU and memory are unnecessarily used even when the software is operating normally, which may hinder the processing of the original application. become.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a software behavior monitoring apparatus and the like capable of accurately predicting a failure using a minimum necessary resource.

In order to achieve the above-described object, the first invention stores an application composed of a plurality of behavior monitoring modules, and stores behavior monitoring information indicating the behavior of a monitoring item related to a monitoring part included in the behavior monitoring module. A behavior monitoring information database comprising a behavior monitoring information database, a behavior monitoring information analysis means for referring to the behavior monitoring information database and analyzing the behavior monitoring information stored immediately before, and all the behavior monitoring modules The total of behavior monitoring resources for each of the behavior monitoring modules is suppressed to the maximum behavior monitoring resource, which is the total amount of resources that can be used for behavior monitoring, for each behavior monitoring module based on the analysis result by the behavior monitoring information analysis means. Behavior monitoring information amount control means for allocating the behavior monitoring resources and controlling the amount of behavior monitoring information; Based on the amount by said behavior monitoring resources increase or decrease results provided to the behavior monitoring signal determining means for determining the behavior monitoring signal indicating whether or suppress promoting behavior monitoring, and the behavior monitoring module, the software An execution means for executing a function of an original application, and a behavior monitoring flag setting means for setting a behavior monitoring flag of a monitoring item related to a monitoring portion included in the behavior monitoring module based on the behavior monitoring signal. And a behavior monitoring information output unit that outputs the behavior monitoring information for which the behavior monitoring flag is turned on to the behavior monitoring information database .

The behavior monitoring target included in the behavior monitoring information includes monitoring parts such as subprograms and data groups included in the behavior monitoring module, execution time, CPU load change rate, input / output values, internal data, program counter transition history, etc. And the monitoring item.

The behavior monitoring information analyzing means preferably the difference between the normal value of the current and the behavior monitoring information measured or predicted in advance of the behavior monitoring information is to determine whether within the tolerance.

  The behavior monitoring information amount control means includes the behavior monitoring resource of the behavior monitoring module in which a failure sign is detected, and the behavior monitoring module group preceding or following the behavior monitoring module in which a failure sign is detected. It is desirable to increase behavior monitoring resources.

A second invention is a software behavior monitoring apparatus for storing an application composed of a plurality of behavior monitoring modules, wherein the behavior monitoring module includes an execution means for executing the function of the original application. , A behavior monitoring information database for storing behavior monitoring information indicating the behavior of a monitoring item related to the monitoring part included in the behavior monitoring module, and the behavior monitoring information database stored in the behavior monitoring information database. The behavior monitoring information analyzing means, and the behavior monitoring resources for all the behavior monitoring modules are suppressed to be equal to or less than the maximum behavior monitoring resource, which is the total amount of resources that can be used for behavior monitoring. The behavior monitoring module is analyzed for each behavior monitoring module based on the analysis result by the analyzing means. Behavior monitoring information amount control means for allocating resources and controlling the amount of behavior monitoring information, and a behavior monitoring signal indicating whether behavior monitoring is promoted or suppressed based on the increase / decrease result of the allocated behavior monitoring resources. A behavior monitoring signal determining means for determining, a behavior monitoring flag setting means for setting a behavior monitoring flag of a monitoring item related to a monitoring part included in the behavior monitoring module based on the behavior monitoring signal, and the behavior monitoring flag being turned on The software behavior monitoring apparatus is configured to function as behavior monitoring information output means for outputting the behavior monitoring information in the behavior monitoring information database .

The behavior monitoring information analyzing means preferably the difference between the normal value of the current and the behavior monitoring information measured or predicted in advance of the behavior monitoring information is to determine whether within the tolerance.

The behavior monitoring information amount control means includes the behavior monitoring resource of the behavior monitoring module in which a failure sign is detected, and the behavior monitoring module group preceding or following the behavior monitoring module in which a failure sign is detected. It is desirable to increase behavior monitoring resources .

According to a third aspect of the present invention, there is provided a first computer for storing an application composed of a plurality of behavior monitoring modules, and behavior monitoring for storing behavior monitoring information indicating the behavior of a monitoring item related to a monitoring part included in the behavior monitoring module. A software behavior monitoring system comprising a second computer having an information database, wherein the second computer refers to the behavior monitoring information database and analyzes the behavior monitoring information stored immediately before The behavior monitoring information analyzing unit is configured to suppress the total of the behavior monitoring resources for the monitoring information analyzing unit and all the behavior monitoring modules to be equal to or less than the maximum behavior monitoring resource that is the total amount of resources that can be used for behavior monitoring. The behavior monitoring resource is allocated to each behavior monitoring module based on the analysis result by A behavior monitoring information amount control means for controlling the amount of behavior monitoring information, and a behavior monitoring signal indicating whether the behavior monitoring is promoted or suppressed based on the increase / decrease result of the distributed behavior monitoring resources, Behavior monitoring signal transmitting means for transmitting to the first computer, and the behavior monitoring module executes the first computer based on the behavior monitoring signal and execution means for executing the function of the original application. , Behavior monitoring flag setting means for setting a behavior monitoring flag of a monitoring item related to a monitoring part included in the behavior monitoring module, and outputting the behavior monitoring information in which the behavior monitoring flag is turned on to the behavior monitoring information database It is a software behavior monitoring system characterized by functioning as behavior monitoring information output means .

The behavior monitoring information analyzing means preferably the difference between the normal value of the current and the behavior monitoring information measured or predicted in advance of the behavior monitoring information is to determine whether within the tolerance.

  The behavior monitoring information amount control means includes the behavior monitoring resource of the behavior monitoring module in which a failure sign is detected, and the behavior monitoring module group preceding or following the behavior monitoring module in which a failure sign is detected. It is desirable to increase behavior monitoring resources.

  According to the present invention, it is possible to provide a software behavior monitoring apparatus and the like that can perform accurate failure prediction using the minimum necessary resources.

  Hereinafter, a first embodiment will be described in detail with reference to the drawings.

FIG. 1 is a hardware configuration diagram of a computer that realizes the software behavior monitoring apparatus 1 according to the first embodiment. Note that the hardware configuration in FIG. 1 is an example, and various configurations can be adopted depending on the application and purpose.
The software behavior monitoring apparatus 1 includes a control unit 3, a storage unit 5, a media input / output unit 7, a communication control unit 9, an input unit 11, a display unit 13, a peripheral device I / F unit 15 and the like connected via a bus 17. Is done.

  The control unit 3 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like.

The CPU calls and executes a program stored in the storage unit 5, ROM, recording medium, or the like to a work memory area on the RAM, drives and controls each device connected via the bus 17, and the software behavior monitoring device 1. The process to be described later is realized.
The ROM is a non-volatile memory and permanently holds a computer boot program, a program such as BIOS, data, and the like.
The RAM is a volatile memory, and temporarily stores programs, data, and the like loaded from the storage unit 5, ROM, recording medium, and the like, and includes a work area used by the control unit 3 for performing various processes.

The storage unit 5 is an HDD (hard disk drive), and stores a program executed by the control unit 3, data necessary for program execution, an OS (operating system), and the like. As for the program, a control program corresponding to an OS (operating system) and an application program corresponding to processing described later are stored.
Each of these program codes is read by the control unit 3 as necessary, transferred to the RAM, read by the CPU, and executed as various means.

  The media input / output unit 7 (drive device) performs data input / output. For example, a floppy (registered trademark) disk drive, a CD drive (-ROM, -R, RW, etc.), a DVD drive (-ROM, -R, -RW etc.) and media input / output devices such as MO drives.

  The communication control unit 9 includes a communication control device, a communication port, and the like, and is a communication interface that mediates communication between the computer and the network 19, and performs communication control between other computers via the network 19.

The input unit 11 inputs data and includes, for example, a keyboard, a pointing device such as a mouse, and an input device such as a numeric keypad.
An operation instruction, an operation instruction, data input, and the like can be performed on the computer via the input unit 11.

  The display unit 13 includes a display device such as a CRT monitor and a liquid crystal panel, and a logic circuit (such as a video adapter) for realizing a video function of the computer in cooperation with the display device.

  The peripheral device I / F (interface) unit 15 is a port for connecting a peripheral device to the computer, and the computer transmits and receives data to and from the peripheral device via the peripheral device I / F unit 15. The peripheral device I / F unit 15 is configured by USB, IEEE 1394, RS-232C, or the like, and usually has a plurality of peripheral devices I / F. The connection form with the peripheral device may be wired or wireless.

  The bus 17 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

Next, a configuration for realizing the function of the software behavior monitoring apparatus 1 will be described with reference to FIG.
FIG. 2 is a block diagram showing an outline of functions of the software behavior monitoring apparatus 1.

As shown in FIG. 2, the software behavior monitoring apparatus 1 includes an application 23, a behavior monitoring control unit 21, a behavior monitoring information database 25, and the like. The application 23 includes a plurality of behavior monitoring modules 43. The behavior monitoring supervision unit 21 supervises behavior monitoring of the entire application 23. The behavior monitoring information database 25 stores behavior monitoring information output from the behavior monitoring module 43. Then, the behavior monitoring target included in the behavior monitoring information is dynamically changed by the behavior monitoring management unit 21.
In the first embodiment, the behavior monitoring supervision unit 21 supervises behavior monitoring of the application 23 including the three behavior monitoring modules 43. When the behavior monitoring management unit 21 detects any sign of a failure, the behavior monitoring resource that is a resource for behavior monitoring is equal to or less than the maximum behavior monitoring resource that is the amount of behavior monitoring resources that can be used as a whole for behavior monitoring. The monitoring of the behavior is strengthened with a focus on the behavior monitoring module 43 that detects the failure sign.

First, the application 23 to be monitored is described.
The application 23 includes a plurality of behavior monitoring modules 43. Each behavior monitoring module 43 includes a behavior monitoring adjustment unit 45, an application module unit 57, and the like. The behavior monitoring adjustment unit 45 adjusts its own behavior monitoring based on the information transmitted from the behavior monitoring supervision unit 21. The application module unit 57 executes a program that performs the function of the original application, performs behavior monitoring adjusted by the behavior monitoring adjustment unit 45, and outputs its own behavior monitoring information. The original application function refers to a function excluding a function related to behavior monitoring, and should be a business function originally required for the application 23.

  The behavior monitoring adjustment unit 45 includes behavior monitoring flag setting means, and based on the behavior monitoring signal transmitted from the behavior monitoring signal transmission unit 41, the behavior monitoring flag between the subprogram and the data group included in the behavior monitoring module 43 63 is set. The behavior monitoring adjustment unit 45 holds a behavior monitoring correspondence table 51 that can be referred to by the corresponding application module unit 57.

The application module unit 57 includes a program unit 59, a data unit 61, and the like. Then, the application module unit 57 includes behavior monitoring information output means, and outputs behavior monitoring information on the subprograms and data groups for which the behavior monitoring flag 63 is turned on.
In the first embodiment, the program unit 59 is composed of subprograms having a two-level hierarchy. In the case of the behavior monitoring module (1), the upper layer is the subprogram P1, the lower layer is the subprogram P11, and the subprogram P12, and each subprogram has a behavior monitoring flag 63. The data section 61 is composed of a data group used for each lower layer subprogram, and the data group D11 and the data group D12 also have a behavior monitoring flag 63. Then, the behavior monitoring information corresponding to the current behavior monitoring level 49 is output to the subprogram whose behavior monitoring flag 63 is turned on according to the behavior monitoring correspondence table 51 after the program is executed. The behavior monitoring information is stored in the behavior monitoring information database 25.

FIG. 3 is a diagram showing the behavior monitoring correspondence table 51.
As shown in FIG. 3, the behavior monitoring correspondence table 51 is a table showing monitoring parts, monitoring items, and consumption monitoring resources for each behavior monitoring level 49. The monitoring part indicates the hierarchy to be monitored, the monitoring item indicates the item to be monitored, and the consumption monitoring resource indicates the amount of resource consumed by the monitoring. When the behavior monitoring level 49 is “1”, the monitoring part is “Pk”, which is the upper layer subprogram, the monitoring item is “execution time”, and the consumption monitoring resource is “1”. On the other hand, when the behavior monitoring level 49 is “4”, the monitoring part is “Pk1, Pk2” which is a subprogram of the lower layer, the monitoring items are “execution time, CPU load change rate, input / output value”, and the consumption monitoring resource is “4”. That is, as the value of the behavior monitoring level 49 increases, the monitoring part moves from the upper layer to the lower layer, and the monitoring items increase. As a result, consumption monitoring resources also increase.
For convenience, it is assumed that the value of the behavior monitoring level 49 of each behavior monitoring module 43 is equal to the consumption monitoring resource of the application module unit 57.
In addition to the execution time, CPU load change rate, and input / output values, the monitoring items may include internal data update history, program counter transition history, and the like.
The behavior monitoring correspondence table 51 is called to the work memory area on the RAM when the application 23 is activated.

Next, the behavior monitoring control unit 21 will be described.
The behavior monitoring control unit 21 includes an analysis engine 27 that analyzes the contents of the behavior monitoring information database 25, a behavior monitoring signal transmission unit 41 that transmits a behavior monitoring signal, and the like. The analysis engine 27 includes a behavior monitoring information analysis unit 29, a behavior monitoring information amount control unit 35, and the like.

  A behavior monitoring information analysis unit 29 including an analysis algorithm 33 that is a behavior monitoring information analysis unit refers to the normal operation table 31 and the behavior monitoring information database 25 and analyzes the behavior monitoring information stored immediately before. The analysis algorithm 33 will be described later with reference to FIG.

FIG. 4 is a diagram illustrating the normal operation table 31.
As shown in FIG. 4, the normal operation table 31 normally indicates the value of the monitoring item that is one element for determining the behavior monitoring target when the subprogram of the program unit 59 is operating normally. It is a table | surface which shows. The monitoring items are the execution time, CPU load change rate, and input / output values as described above, and numerical values indicating normal operation are set for each subprogram. The numerical value after “+” and “−” is an allowable value. For example, for the execution time for the subprogram P1, the normal value is 15 [μs], and the allowable value range is 4 [μs]. The normal rate of CPU load change rate for the subprogram P1 is 5 [%], and the allowable value range is 4 [%]. As for the execution time and the CPU load change rate, numerical values in the normal operation table 31 are set from normal values measured in advance. On the other hand, for the input / output values, for example, a mathematical expression indicating the relationship R between input and output is set as a normal value predicted in advance. For example, if the relationship R1 between the input and output of the subprogram P1 is a value obtained by doubling the input value x, R1 is set to “2x”. Then, the behavior monitoring information analysis unit 29 determines whether the difference between the current value of the behavior monitoring target and the normal value measured or predicted in advance is within an allowable value.
The normal operation table 31 is called to the work memory area on the RAM when the application 23 is activated.

  The behavior monitoring information amount control unit 35 including the control algorithm 39 which is a behavior monitoring information amount control unit allocates behavior monitoring resources to the behavior monitoring modules 43 based on the analysis result of the behavior monitoring information analysis unit 29, and performs behavior monitoring. Control the amount of information. The behavior monitoring information amount is controlled by updating the module monitoring level table 37. The control algorithm 39 will be described later with reference to FIG.

FIG. 5 is a diagram showing the module monitoring level table 37.
As shown in FIG. 5, the module monitoring level table 37 is a table showing the current behavior monitoring level for each behavior monitoring module 43. FIG. 5 shows that the current behavior monitoring level of the behavior monitoring module (1) is “3” and the current behavior monitoring levels of the behavior monitoring modules (2) and (3) are “1”.
It is assumed that the module monitoring level table 37 is called to the work memory area on the RAM when the application 23 is activated and a predetermined initial value is set.

The behavior monitoring signal transmission unit 41 including the behavior monitoring signal transmission unit is a behavior indicating whether the behavior monitoring is promoted or suppressed based on the increase / decrease result of the behavior monitoring resource allocated by the behavior monitoring information amount control unit 35. A monitoring signal is determined and transmitted to the behavior monitoring module 43. Here, the promotion of 53 and the suppression of 55 in FIG. 2 mean a behavior monitoring signal.
The form of transmission includes a form using inter-process communication, a form using an event transmission / reception function, a form via an inter-process shared memory, etc., but any form may be used.

Next, details of the operation of the software behavior monitoring apparatus 1 will be described with reference to FIGS.
FIG. 6 is a flowchart showing the overall flow of the software behavior monitoring apparatus 1.

  As shown in FIG. 6, the control unit 3 acquires the behavior monitoring information stored immediately before (S101). Next, the control unit 3 compares the normal operation table 31 with the behavior monitoring information stored immediately before by the analysis algorithm 33 (S102).

FIG. 7 is a flowchart showing the flow of the analysis algorithm 33.
As shown in FIG. 7, the control unit 3 acquires the current value of the monitoring item of the subprogram that is the behavior monitoring target from the acquired behavior monitoring information (S201). Next, the control unit 3 acquires the normal value and the allowable value of the monitoring item of the subprogram that is the behavior monitoring target from the normal operation table 31 (S202).

Next, the control unit 3 checks whether or not the difference between the current value and the normal value is within an allowable value (S203). That is, it is determined whether the difference between the current value of the behavior monitoring target and the behavior monitoring target measured or predicted in advance is within an allowable value.
If it is not within the allowable value, the target behavior monitoring module 43 determines that it is a sign of failure, and ends the process (S204).
If it is within the allowable value, the process proceeds to S205.

Next, the control unit 3 confirms whether or not the processing has been completed for all the subprograms included in the target behavior monitoring module 43 (S205).
If the process has not been completed, the process is repeated from S201.
When the process is completed, the target behavior monitoring module 43 determines that the process is normal and ends the process (S206).
The above processing is performed for all behavior monitoring modules 43, and behavior monitoring information is analyzed.

  Next, the control unit 3 adjusts the module monitoring level table 37 by the control algorithm 39 (S103).

FIG. 8 is a flowchart showing the flow of the control algorithm 39.
As illustrated in FIG. 8, the control unit 3 increases the behavior monitoring resource by 1 for the behavior monitoring module 43 in which a failure sign is detected and the subsequent behavior monitoring module 43 (S301). That is, the behavior monitoring resource of the behavior monitoring module 43 in which the failure sign is detected and the behavior monitoring resource of the behavior monitoring module 43 group that follows the behavior monitoring module 43 in which the failure sign is detected are increased.

Next, the control unit 3 compares the maximum behavior monitoring resource with the total of the allocated behavior monitoring resources (S302).
If the total of the allocated behavior monitoring resources is equal to or less than the maximum behavior monitoring resource, the distribution of behavior monitoring resources is terminated (S303).
When the total of the allocated behavior monitoring resources is larger than the maximum behavior monitoring resource, the process proceeds to S304.

  Next, the control unit 3 reduces the behavior monitoring resource of the behavior monitoring module 43 in which no failure sign is detected by 1 (S304).

Next, the control unit 3 compares the maximum behavior monitoring resource with the total of the allocated behavior monitoring resources (S305).
If the total of the allocated behavior monitoring resources is equal to or less than the maximum behavior monitoring resource, the distribution of behavior monitoring resources is terminated (S306).
When the total of the allocated behavior monitoring resources is larger than the maximum behavior monitoring resource, the process proceeds to S307.

  Next, in the behavior monitoring module 43 in which the behavior monitoring resource is increased in S301, the control unit 3 sets the behavior monitoring resource to only one behavior monitoring resource in the order in which the execution order is far from the behavior monitoring module 43 in which the sign of failure is detected. Reduce (S307).

Next, the control unit 3 compares the maximum behavior monitoring resource with the total of the allocated behavior monitoring resources (S308).
If the total of the allocated behavior monitoring resources is less than or equal to the maximum behavior monitoring resource, the distribution of behavior monitoring resources is terminated (S309).
If the total of the allocated behavior monitoring resources is larger than the maximum behavior monitoring resource, the processing is repeated from S307.
As described above, the behavior monitoring resources are allocated so that the total of the behavior monitoring resources for all the behavior monitoring modules 43 is kept below the maximum behavior monitoring resource, and the adjustment of the module monitoring level table 37 is completed.

Next, the control unit 3 transmits a behavior monitoring signal according to the adjustment of the module monitoring level table 37 (S104). And the control part 3 performs the behavior monitoring loop shown below about all the behavior monitoring modules 43 (S105).
The control unit 3 receives the behavior monitoring signal (S106). Next, the control unit 3 determines the behavior monitoring level 49 from the behavior monitoring signal, and sets the behavior monitoring flag 63 of the application module unit 57 (S107). Next, the control unit 3 executes the program and outputs behavior monitoring information of the program unit 59 and the data unit 61 in which the behavior monitoring flag 63 is set (S108). The output behavior monitoring information is stored in the behavior monitoring information database 25.
As described above, the programs of all the behavior monitoring modules 43 are executed, and behavior monitoring information corresponding to the behavior monitoring level 49 is output.

Next, distribution of behavior monitoring resources when the software behavior monitoring apparatus 1 is implemented will be described with reference to FIGS. 9 to 11.
Below, the behavior monitoring correspondence table 51, the normal operation table 31, and the module monitoring level table 37 are set as shown in FIGS. 3 to 5, and the case where the application 23 is executed three times will be described as an example. . It is assumed that the maximum behavior monitoring resource is 6.

(First time)
FIG. 9 is a diagram showing the module monitoring level table 37 immediately before the first application execution.
As shown in FIG. 9, immediately before the first application execution, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) are (3, 1, 1).
The control unit 3 sequentially executes the programs of behavior monitoring modules (1), (2), and (3). Since the current behavior monitoring level of the behavior monitoring module (2) is 1, the control unit 3 observes the execution time of the subprogram P2 and stores it in the behavior monitoring information database 25.
Next, the control unit 3 compares the content stored in the behavior monitoring information database 25 with the normal operation table 31. If the execution time of the subprogram P2 is 20 [μs], since the current value exceeds the allowable value, the control unit 3 determines that it is a sign of failure, and the behavior monitoring modules (2) and (3) The behavior monitoring resource is increased by 1. At this time, the current behavior monitoring level of the behavior monitoring modules (1), (2), and (3) is (3, 2, 2). However, since the total of the allocated behavior monitoring resources is 7, which exceeds the maximum behavior monitoring resource, the control unit 3 reduces the behavior monitoring resource of the behavior monitoring module (1) by one.

(Second time)
FIG. 10 is a diagram showing the module monitoring level table 37 immediately before the second application execution.
As shown in FIG. 10, immediately before the second application execution, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) are (2, 2, 2).
The control unit 3 sequentially executes the programs of behavior monitoring modules (1), (2), and (3). Since the current behavior monitoring level of the behavior monitoring module (2) is 2, the control unit 3 observes the execution time of the subprogram P2 and the CPU load change rate and stores it in the behavior monitoring information database 25.
Next, the control unit 3 compares the content stored in the behavior monitoring information database 25 with the normal operation table 31. If the execution time of the subprogram P2 is 20 [μs] and the CPU load change rate is 20 [%], the current value exceeds the allowable value, so the control unit 3 determines that it is a sign of failure, The behavior monitoring resources of the behavior monitoring modules (2) and (3) are increased by one. At this time, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) are (2, 3, 3). However, since the total of the allocated behavior monitoring resources is 8, which exceeds the maximum behavior monitoring resource, the control unit 3 reduces the behavior monitoring resource of the behavior monitoring module (1) by one. At this time, the current behavior monitoring level of the behavior monitoring modules (1), (2), and (3) is (1, 3, 3). Since the total of the allocated behavior monitoring resources is 7 and still exceeds the maximum behavior monitoring resource, the behavior monitoring resource of the behavior monitoring module (3) that is the successor of the behavior monitoring module (2) in which the sign of failure is detected. Is reduced by one.

(3rd)
FIG. 11 is a diagram showing the module monitoring level table 37 immediately before the third application execution.
As shown in FIG. 11, immediately before the third application execution, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) are (1, 3, 2).
As described above, the behavior monitoring resource is preferentially assigned to the behavior monitoring module (2) in which the failure sign is detected, and can effectively collect information for dealing with the failure.

  As described above in detail, according to the first embodiment, the software behavior monitoring apparatus 1 includes the application 23 configured by a plurality of behavior monitoring modules 43 and the behavior monitoring control unit 21 that controls the behavior monitoring of the application 23. And a behavior monitoring information database 25 for storing behavior monitoring information of the behavior monitoring module 43. Then, the behavior monitoring supervision unit 21 analyzes behavior monitoring information stored in the behavior monitoring information database 25 and allocates behavior monitoring resources mainly to the behavior monitoring module 43 in which a failure sign is detected. Each behavior monitoring module 43 outputs behavior monitoring information using the allocated behavior monitoring resource after the execution of the subprogram. The output behavior monitoring information is stored in the behavior monitoring information database 25 and used for the next analysis of behavior monitoring information.

  According to the first embodiment, the monitoring part for determining the behavior monitoring target of the software and the monitoring item are dynamically adjusted, and information for dealing with the failure is effectively collected by using the minimum necessary resources. be able to. Then, accurate failure prediction can be performed.

  Further, in addition to the behavior monitoring module 43 in which a failure sign is detected, the behavior monitoring resource is allocated to the subsequent behavior monitoring module 43, whereby the influence range of the failure can be specified. In the same way, it is possible to increase the number of behavior monitoring resources for the following behavior monitoring module, thereby effectively collecting information to investigate the cause of the failure sign. it can. That is, behavior monitoring resources may be allocated to the preceding behavior monitoring module 43.

  In addition, by allocating behavior monitoring resources within a range not exceeding the maximum behavior monitoring resource, it is possible to avoid a situation where resources used by the original application function are insufficient.

  In the first embodiment, an embodiment using one computer is shown. However, for example, the behavior monitoring control unit 21 and the application 23 operate on different computers, and behavior monitoring signals are transmitted and received via the network 19. It is also possible to provide a software behavior monitoring system using a plurality of computers, which is performed by the communication performed. In this case, the computer on which the application 23 operates can allocate more resources to the execution of the application module unit 57.

  In addition, when the behavior monitoring level 49 is changed to a predetermined threshold value or more, for example, the administrator can perform timely failure handling by notifying the software system administrator using e-mail or the like. I can do it.

  Next, the second embodiment will be described in detail.

  FIG. 1 is a hardware configuration diagram of a computer that implements a software behavior monitoring apparatus 1a according to the second embodiment. Since the hardware configuration of the software behavior monitoring device 1a is the same as that described in the first embodiment, the description thereof is omitted.

Next, a configuration for realizing the function of the software behavior monitoring device 1a will be described with reference to FIG.
FIG. 12 is a block diagram showing an outline of functions of the software behavior monitoring apparatus 1a.
Note that elements having the same functions as those shown in FIG. 2 are denoted by the same reference numerals to avoid redundant description.

As shown in FIG. 12, the software behavior monitoring apparatus 1a includes an application 23a composed of a plurality of behavior monitoring modules 43a. The behavior monitoring module 43a includes a local behavior monitoring unit 65, a behavior monitoring adjustment unit 45, an application module unit 57, a behavior monitoring information database 25a, and the like. The local behavior monitoring unit 65 supervises own behavior monitoring. The behavior monitoring adjustment unit 45 adjusts its own behavior monitoring based on the information transmitted from the local behavior monitoring unit 65. The application module unit 57 executes a program that performs the function of the original application, performs behavior monitoring adjusted by the behavior monitoring adjustment unit 45, and outputs its own behavior monitoring information. The behavior monitoring information database 25a stores behavior monitoring information. The behavior monitoring target included in the behavior monitoring information is dynamically changed by the local behavior monitoring unit 65.
In the second embodiment, the application 23a is composed of k behavior monitoring modules 43a. As each behavior monitoring module 43a executes a simple algorithm, appropriate behavior monitoring is performed as a whole.

  The local behavior monitoring unit 65 includes a local analysis engine 67, a behavior monitoring signal transmission unit 41, and the like. The local analysis engine 67 includes an analysis algorithm 33 that is behavior monitoring information analysis means and a local algorithm that is behavior monitoring signal determination means. The analysis algorithm 33 is the same as that in the first embodiment. The local algorithm determines a behavior monitoring signal indicating whether the behavior monitoring is promoted or suppressed based on the previous analysis result of the own behavior monitoring information and the previous analysis result of the behavior monitoring information of the adjacent behavior monitoring module 43a. To do. The behavior monitoring signal transmission unit 41 transmits the determined behavior monitoring signal.

Next, details of the operation of the software behavior monitoring apparatus 1a will be described with reference to FIGS.
FIG. 13 is a flowchart showing the overall flow of the software behavior monitoring apparatus 1a.

As shown in FIG. 13, the control unit 3 performs the behavior monitoring loop shown below for all behavior monitoring modules 43a (S401).
The control unit 3 acquires behavior monitoring information stored immediately before (S402). Next, the control unit 3 compares the normal operation table 31 with the behavior monitoring information stored immediately before by the analysis algorithm 33 (S403). The analysis algorithm 33 is as described in FIG. That is, it is determined as a sign of failure or normal depending on whether the difference between the current value of the behavior monitoring target and the behavior monitoring target measured or predicted in advance is within an allowable value. Next, the control unit 3 determines a behavior monitoring signal to be transmitted by a local algorithm (S404).

FIG. 14 is a flowchart showing the flow of the local algorithm.
FIG. 14 shows the determination of the behavior monitoring signal for the behavior monitoring module (m) (1 ≦ m ≦ k).
As shown in FIG. 14, the control unit 3 acquires the previous analysis result for the behavior monitoring modules (m−1), (m), and (m + 1) (S501).

Next, the control unit 3 checks whether or not the previous analysis result for the behavior monitoring module (m) is a sign of failure (S502).
In the case of a failure sign, the control unit 3 determines to transmit a “promotion” behavior monitoring signal to the behavior monitoring module (m) (S503), and ends the determination of the behavior monitoring signal (S504).
If it is not a sign of failure, the process proceeds to S505.

Next, the control unit 3 confirms whether or not the previous analysis result for the behavior monitoring module (m−1) is a sign of failure (S505).
In the case of a failure sign, the control unit 3 determines to transmit a “promotion” behavior monitoring signal to the behavior monitoring module (m) (S506), and ends the determination of the behavior monitoring signal (S507).
If it is not a sign of failure, the process proceeds to S508.

Next, the control unit 3 checks whether or not the previous analysis result for the behavior monitoring module (m + 1) is a sign of failure (S508).
In the case of a failure sign, the control unit 3 determines to transmit a “suppression” behavior monitoring signal to the behavior monitoring module (m) (S509), and ends the determination of the behavior monitoring signal (S510).
If it is not a sign of failure, the control unit 3 determines not to transmit the behavior monitoring signal (S511), and ends the determination of the behavior monitoring signal (S512).

As described above, the local algorithm is either the previous analysis result of the behavior monitoring information of the behavior monitoring module (m) that is itself or the previous analysis result of the behavior monitoring information of the preceding adjacent behavior monitoring module (m−1). If it is a sign of failure, a behavior monitoring signal of “promotion” is sent to the behavior monitoring module (m), and the previous analysis result of the behavior monitoring information of the succeeding behavior monitoring module (m + 1) is a sign of failure. If there is, a behavior monitoring signal of “suppression” is transmitted to the behavior monitoring module (m).
In order to investigate the cause of the sign of failure, the local algorithm uses the previous analysis result of the behavior monitoring information of the behavior monitoring module (m) that is itself or the behavior of the preceding adjacent behavior monitoring module (m-1). If any of the previous analysis results of the monitoring information is a sign of failure, a behavior monitoring signal of “suppression” is transmitted to the behavior monitoring module (m), and the behavior monitoring of the subsequent adjacent behavior monitoring module (m + 1) is performed. If the previous analysis result of information is a sign of failure, a behavior monitoring signal “promotion” may be transmitted to the behavior monitoring module (m).

Next, the control unit 3 transmits a behavior monitoring signal determined by the local algorithm (S405).
The above processing is autonomously performed in all behavior monitoring modules 43a.

The control unit 3 receives the previous behavior monitoring signal (S406). The behavior monitoring loop from S401 to S408 is repeatedly executed from the start to the stop of the application 23a. If the current behavior monitoring loop is n-th time, the behavior monitoring signal transmitted in the (n-1) th S405 is received. Next, the control unit 3 determines the behavior monitoring level 49 from the behavior monitoring signal, and sets the behavior monitoring flag 63 of the application module unit 57 (S407). Next, the control unit 3 executes the program and outputs behavior monitoring information of the program unit 59 and the data unit 61 in which the behavior monitoring flag 63 is set (S408).
As described above, the programs of all the behavior monitoring modules 43a are executed, and behavior monitoring information corresponding to the behavior monitoring level 49 is output.

Next, distribution of behavior monitoring resources when the software behavior monitoring device 1a is implemented will be described with reference to FIGS.
Hereinafter, the case where the application 23a is executed five times for the three behavior monitoring modules 43a will be described as an example. It is assumed that the maximum behavior monitoring resource is 6.

FIG. 15 is a diagram illustrating the output of the analysis algorithm 33 and the output of the local algorithm for each behavior monitoring module 43a.
For example, “normal” and “sign of failure” in the output of the analysis algorithm 33 indicate that “normal” and “sign of failure” are determined, respectively. In addition, “Do not transmit”, “Suppress”, and “Promote” of the local algorithm respectively transmit “Do not transmit behavior monitoring signal”, “Send suppression behavior monitoring signal”, and “Stimulate behavior monitoring signal”. "Is shown.
Hereinafter, how the module monitoring level table 37 changes in addition to how the output of the local algorithm is determined when the output of the analysis algorithm 33 illustrated in FIG. 15 is assumed will be described. To do.

(First time)
FIG. 16 is a diagram showing the module monitoring level table 37 immediately before the first application execution.
As shown in FIG. 16, immediately before the first application execution, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) are (3, 1, 1).
Further, since the execution of the application 23a is not performed in the previous time (0th time), as shown in FIG. 15, all the outputs of the first local algorithm are “not transmitted”.
In addition, since the application 23a has not been executed in the previous time (0th), the behavior monitoring signal is not transmitted. It does not change.

(Second time)
FIG. 17 is a diagram showing the module monitoring level table 37 immediately before the second application execution.
As shown in FIG. 17, immediately before the second application execution, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) are (3, 1, 1).
Further, since the analysis result of the previous (first) behavior monitoring module (2) is “failure sign”, as shown in FIG. 15, the output of the second local algorithm is the behavior monitoring module (1). Then it is “suppressed”. On the other hand, the behavior monitoring modules (2) and (3) are “promoted”.
Furthermore, since all the previous (first) behavior monitoring signals have not been transmitted, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) do not change.

(3rd)
FIG. 18 is a diagram showing the module monitoring level table 37 immediately before the third application execution.
As shown in FIG. 18, immediately before the third application execution, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) are (3, 1, 1).
Further, since the analysis result of the previous (second) behavior monitoring module (2) is “sign of failure”, as shown in FIG. 15, the output of the third local algorithm is the behavior monitoring module (1). Then it is “suppressed”. On the other hand, the behavior monitoring modules (2) and (3) are “promoted”.
Further, the previous (second) behavior monitoring signal is “suppression”, “promotion”, and “promotion” with respect to the behavior monitoring modules (1), (2), and (3). Therefore, the behavior monitoring module (1) is reduced by 1 and the behavior monitoring modules (2) and (3) are increased by 1 in the current behavior monitoring level.

(4th)
FIG. 19 is a diagram showing a module monitoring level table 37 immediately before the fourth application execution.
As shown in FIG. 19, immediately before the fourth application execution, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) are (2, 2, 2).
Further, since all the previous (third) analysis results are “normal”, the output of the fourth local algorithm is the behavior monitoring modules (1), (2), (3) as shown in FIG. In all of the cases, it is “not transmitted”.
Further, the previous (third) behavior monitoring signal is “suppression”, “promotion”, and “promotion” with respect to the behavior monitoring modules (1), (2), and (3). Therefore, the current behavior monitoring level should be reduced by 1 for the behavior monitoring module (1) and increased by 1 for the behavior monitoring modules (2) and (3). However, since the current behavior monitoring level of the behavior monitoring module (2) is equal to the maximum behavior monitoring resource when the current behavior monitoring level of the behavior monitoring module (2) is increased by 1, increasing the current behavior monitoring level of the behavior monitoring module (3) by 1 Can not.

(5th)
FIG. 20 is a diagram showing the module monitoring level table 37 immediately before the fifth application execution.
As shown in FIG. 20, immediately before the fifth application execution, the current behavior monitoring levels of the behavior monitoring modules (1), (2), and (3) are (1, 3, 2).
As described above, behavior monitoring resources can be appropriately distributed without a function for supervising behavior monitoring of the entire application.

  As described above, according to the second embodiment, the behavior monitoring module 43a configuring the application 23a includes the local behavior monitoring unit 65, and behavior monitoring is performed from the behavior monitoring information of the adjacent behavior monitoring module 43a by the local algorithm. Determine the signal.

  According to the second embodiment, when the number of behavior monitoring modules 43a increases as in the case of a large-scale application 23a, the problem in the first embodiment can be solved. The problem in the first embodiment is that when the number of behavior monitoring modules 43 increases, the analysis processing of the behavior monitoring management unit 21 becomes complicated and increases, and the behavior monitoring resources cannot be allocated promptly and appropriately. That's what it means. However, in the second embodiment, even if the number of behavior monitoring modules 43a increases, the local analysis processing is simple, and processing is performed for each behavior monitoring module 43a. Does not occur. Therefore, when the number of behavior monitoring modules 43a increases, behavior monitoring resources can be allocated more quickly and appropriately than in the first embodiment.

  The preferred embodiments of the software behavior monitoring apparatus and the like according to the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea disclosed in the present application, and these naturally belong to the technical scope of the present invention. Understood.

Hardware configuration diagram of a computer realizing the software behavior monitoring apparatus 1 (1a) The block diagram which shows the outline | summary of the function of the software behavior monitoring apparatus 1 The figure which shows the behavior monitoring correspondence table 51 Diagram showing normal operation table 31 The figure which shows the module monitoring level table 37 Flow chart showing the overall flow of the software behavior monitoring device 1 Flow chart showing flow of analysis algorithm 33 A flowchart showing the flow of the control algorithm 39 The figure which shows the module monitoring level table 37 just before the 1st application execution The figure which shows the module monitoring level table 37 just before the 2nd application execution The figure which shows the module monitoring level table 37 just before the 3rd application execution Block diagram showing an outline of the functions of the software behavior monitoring device 1a Flowchart showing the overall flow of the software behavior monitoring device 1a Flow chart showing the flow of the local algorithm The figure which shows the output of the analysis algorithm 33 for every behavior monitoring module 43a, and the output of a local algorithm The figure which shows the module monitoring level table 37 just before the 1st application execution The figure which shows the module monitoring level table 37 just before the 2nd application execution The figure which shows the module monitoring level table 37 just before the 3rd application execution The figure which shows the module monitoring level table 37 just before the 4th application execution The figure which shows the module monitoring level table 37 just before the 5th application execution

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ......... Software behavior monitoring apparatus 3 ......... Control part 5 ......... Storage part 7 ......... Media input / output part 9 ......... Communication control part 11 ......... Input part 13 ......... Display part 15 ... ... Peripheral equipment I / F part 17 ......... Bus 19 ......... Network 21 ......... Behavior monitoring supervision part 23 ......... Application 25 ......... Behavior monitoring information database 27 ......... Analysis engine 29 ......... Behavior monitoring Information analysis unit 31... Normal operation table 33 ... Analysis algorithm 35 ... Behavior monitoring information amount control unit 37 ... Module monitoring level table 39 ... Control algorithm 41 ... Behavior monitoring signal transmission unit 43 ……… Behavior monitoring module 45 ……… Behavior monitoring adjustment unit 49 ……… Behavior monitoring level 51 ……… Behavior monitoring correspondence table 53 ……… Promotion 55 ……… Suppression 57 ……… App module Part 59 ......... program portion 61 ......... data unit 63 ......... behavior monitoring flag 65 ......... local behavior monitoring unit 67 ......... local analysis engine

Claims (9)

A software behavior monitoring device comprising a behavior monitoring information database for storing an application configured by a plurality of behavior monitoring modules and storing behavior monitoring information indicating behavior of monitoring items related to a monitoring part included in the behavior monitoring module. And
A behavior monitoring information analyzing means for referring to the behavior monitoring information database and analyzing the behavior monitoring information stored immediately before;
Based on the analysis result by the behavior monitoring information analysis unit, the total of the behavior monitoring resources for all the behavior monitoring modules is kept below the maximum behavior monitoring resource that is the total amount of resources that can be used for behavior monitoring. Behavior monitoring information amount control means for allocating the behavior monitoring resources for each behavior monitoring module and controlling the amount of behavior monitoring information;
Behavior monitoring signal determination means for determining a behavior monitoring signal indicating whether behavior monitoring is promoted or suppressed based on the increase / decrease result of the distributed behavior monitoring resources;
Comprising
The behavior monitoring module includes a software behavior monitoring device,
Execution means for executing the functions of the original application;
Based on the behavior monitoring signal, behavior monitoring flag setting means for setting a behavior monitoring flag of a monitoring item related to a monitoring part included in the behavior monitoring module;
Behavior monitoring information output means for outputting the behavior monitoring information in which the behavior monitoring flag is turned on to the behavior monitoring information database;
Software behavior monitoring device characterized by functioning as a function . The behavior monitoring information analyzing means, wherein the difference between the normal value of the current and the behavior monitoring information measured or predicted in advance of the behavior monitoring information is to determine whether within the tolerance The software behavior monitoring apparatus according to claim 1 . The behavior monitoring information amount control means includes the behavior monitoring resource of the behavior monitoring module in which a failure sign is detected, and the behavior monitoring module group preceding or following the behavior monitoring module in which a failure sign is detected. The software behavior monitoring apparatus according to claim 1, wherein the behavior monitoring resource is increased. A software behavior monitoring device for storing an application configured by a plurality of behavior monitoring modules,
The behavior monitoring module includes a software behavior monitoring device,
Execution means for executing the functions of the original application;
A behavior monitoring information database for storing behavior monitoring information indicating the behavior of the monitoring items related to the monitoring part included in the behavior monitoring module;
A behavior monitoring information analyzing means for referring to the behavior monitoring information database and analyzing the behavior monitoring information stored immediately before;
Based on the analysis result by the behavior monitoring information analysis unit, the total of the behavior monitoring resources for all the behavior monitoring modules is kept below the maximum behavior monitoring resource that is the total amount of resources that can be used for behavior monitoring. Behavior monitoring information amount control means for allocating the behavior monitoring resources for each behavior monitoring module and controlling the amount of behavior monitoring information;
Behavior monitoring signal determination means for determining a behavior monitoring signal indicating whether behavior monitoring is promoted or suppressed based on the increase / decrease result of the distributed behavior monitoring resources;
Based on the behavior monitoring signal, behavior monitoring flag setting means for setting a behavior monitoring flag of a monitoring item related to a monitoring part included in the behavior monitoring module;
Behavior monitoring information output means for outputting the behavior monitoring information in which the behavior monitoring flag is turned on to the behavior monitoring information database;
Software behavior monitoring device characterized by functioning as a function . The behavior monitoring information analyzing means, wherein the difference between the normal value of the current and the behavior monitoring information measured or predicted in advance of the behavior monitoring information is to determine whether within the tolerance The software behavior monitoring apparatus according to claim 4 .   The behavior monitoring information amount control means includes the behavior monitoring resource of the behavior monitoring module in which a failure sign is detected, and the behavior monitoring module group preceding or following the behavior monitoring module in which a failure sign is detected. 6. The software behavior monitoring apparatus according to claim 4, wherein the behavior monitoring resource is increased. A first computer that stores an application configured by a plurality of behavior monitoring modules; and a behavior monitoring information database that stores behavior monitoring information indicating behavior of monitoring items related to a monitoring part included in the behavior monitoring module. A software behavior monitoring system comprising two computers,
The second computer is
A behavior monitoring information analyzing means for referring to the behavior monitoring information database and analyzing the behavior monitoring information stored immediately before;
Based on the analysis result by the behavior monitoring information analysis unit, the total of the behavior monitoring resources for all the behavior monitoring modules is kept below the maximum behavior monitoring resource that is the total amount of resources that can be used for behavior monitoring. Behavior monitoring information amount control means for allocating the behavior monitoring resources for each behavior monitoring module and controlling the amount of behavior monitoring information;
A behavior monitoring signal transmitting means for determining a behavior monitoring signal indicating whether behavior monitoring is promoted or suppressed based on the increase / decrease result of the distributed behavior monitoring resource, and transmitting the behavior monitoring signal to the first computer;
Comprising
The behavior monitoring module causes the first computer to
Execution means for executing the functions of the original application;
Based on the behavior monitoring signal, behavior monitoring flag setting means for setting a behavior monitoring flag of a monitoring item related to a monitoring part included in the behavior monitoring module;
Behavior monitoring information output means for outputting the behavior monitoring information in which the behavior monitoring flag is turned on to the behavior monitoring information database;
Software behavior monitoring system characterized by functioning . The behavior monitoring information analyzing means, wherein the difference between the normal value of the current and the behavior monitoring information measured or predicted in advance of the behavior monitoring information is to determine whether within the tolerance The software behavior monitoring system according to claim 7 . The behavior monitoring information amount control means includes the behavior monitoring resource of the behavior monitoring module in which a failure sign is detected, and the behavior monitoring module group preceding or following the behavior monitoring module in which a failure sign is detected. 9. The software behavior monitoring system according to claim 7, wherein the behavior monitoring resource is increased.

Images