JP5549534B2 - Message monitoring system, message monitoring apparatus, message filter category classification method and program - Google Patents

Description

  The present invention relates to a message monitoring system, a message monitoring apparatus, a message filter category classification method, and a program, and in particular, when a system message that does not correspond to an existing filter is generated, the system administrator can appropriately and appropriately not miss the message. The present invention relates to a message monitoring system and the like that can respond.

  In the present age when information service systems based on computer networks are established as socially important infrastructures, networks are becoming larger and more complex. As a result, the importance of monitoring whether or not each computer constituting the system is operating normally is increasing, so the use of operation management systems, especially message monitoring systems, for the information service system has expanded. doing.

  The message monitoring system referred to here is configured by connecting a monitoring target device, which is a plurality of computer devices, and a monitoring device, which is a computer device that monitors the monitoring target devices, to each other. On the monitoring target device side, a system message (hereinafter simply referred to as a message) is generated from information corresponding to its own operation status (hereinafter referred to as an event), and this is transmitted to the monitoring device.

  In the monitoring device, the message is filtered by a message filter (hereinafter simply referred to as “filter”) defined in advance by a system administrator (hereinafter simply referred to as “administrator”), and only the messages that meet the conditions set for each filter. Display on the display device. Thereby, the administrator can easily know whether or not each monitoring target device is operating normally.

  FIG. 18 is an explanatory diagram showing an example of a message monitoring system 901 that is generally used. In the message monitoring system 901, a plurality of monitoring target devices 910a, 910b, 910c,..., A monitoring device 920 that is a computer device, and client terminals 940a, 940b, 940c,. It is configured to be communicable with each other. Hereinafter, the monitoring target devices 910a, 910b, 910c,... Are collectively referred to as the monitoring target device 910. The number of monitoring target devices 910 is arbitrary.

  The monitoring target device 910 uses, as a service, its own functions and data for client terminals 940a, 940b, 940c,... Connected via the network 930, such as a web server, database server, application server, etc. A computer device to be provided. In the monitoring target device 910, in parallel with these services, a monitoring function for monitoring its own operating state is simultaneously operating.

  This monitoring function acquires information related to the operation state of the monitoring target device 910 and transmits it to the monitoring device 920 as a message. The monitoring device 920 processes and analyzes the message received from the monitoring function of each monitoring target device 910, and presents the processing result to the administrator of the message monitoring system 901. During the process, the monitoring device 920 applies a filter to the received message by an administrator's operation, and presents only the message corresponding to the filter definition.

  When defining the filter, the administrator can easily determine which application and which object the message of which monitored machine (hereinafter referred to as a node) has been issued. Each filter is included in one specific filter group depending on the tendency of the condition of each item such as an object name. The definition for this particular filter group is referred to herein as a category.

  As a category, the administrator can set an arbitrary condition for an arbitrary item. However, in general, the administrator often sets conditions relating to a specific node name or application name as a category, such as “message about a specific node” and “message about a specific application”. This is because it is easier to manage the system.

  FIG. 19 is an explanatory diagram showing the configuration of each monitoring target device 910 that is the target monitored by the monitoring device 920 shown in FIG. 18 and its category. For example, for an organization such as a company operating on a global scale, the information system used by that organization will also be global. The message monitoring system 901 can display all the monitoring target devices 910 operated by the organization in a tree view format according to the location (country name, place name, business office name, building name), device type, and the like of the device. it can.

  In the example shown in FIG. 19, the node names “ApServer1”, “ApServer2”, “ApServer3” of multiple application servers existing in Japan / Tokyo / No. 1 building and the node name “DBServer1” of the database server are displayed. In this example, application names “WebServer” and “Router” are running on “ApServer1”. To display a message about “ApServer1”, the administrator sets the node name “ApServer1” as a category. Also, if you want to display a message about "WebServer" regardless of the node name, the administrator sets the application name "WebServer" as a category. It is also possible to set a category in which a plurality of conditions are arbitrarily combined with AND or OR.

  By selecting a filter to be used from among filters belonging to a specific category, the system administrator can preferentially display a message to be focused on and check which node or application from the category to which the filter belongs. It is possible to easily understand whether the event has occurred.

  Patent documents related to the message monitoring system include the following. Among them, Patent Document 1 describes a technique of counting the number of corresponding messages for each filter and rearranging the use order of the filters in descending order of the number of messages. According to Patent Document 2, when a predetermined number of messages that do not correspond to an existing filter are generated, the administrator is prompted to set a new filter, and the content of the detected message is set as a new filter as it is. A technology called technology is described. Patent Document 3 describes a technique for detecting an unnecessary filter and prompting an administrator to correct the filter.

JP 2006-260056 A JP 2009-064098 A JP 2009-217392 A

  However, as described above, information service systems are becoming larger and more complex. Along with this, the number of devices and software to be monitored by the message monitoring system is increasing, and the types of messages detected, the number of filters to be set by the administrator, and the number of categories into which the filters are classified. Is increasing. Since filters and categories are arbitrarily set by the administrator, the administrator is burdened with these settings.

  In particular, when new hardware or software to be monitored is added to the information service system, the administrator sets a filter for the new hardware or software message and sets the corresponding category. Must. The labor required for this is tremendous. There is also a high risk that an administrator may miss an important message due to insufficient or inappropriate settings such as missing settings.

  The above-described Patent Documents 1 to 3 do not describe a technique that can solve the problem. Japanese Patent Application Laid-Open No. 2004-228561 describes a technique of prompting an administrator to set a new filter by detecting a message that does not correspond to an existing filter, and setting the content of the detected message as it is as a new filter. . However, since none of Patent Documents 1 to 3 is mentioned regarding the classification of categories, it is obvious that these techniques cannot solve the problem of classification of categories.

  An object of the present invention is to create a new filter corresponding to a message that does not correspond to an existing filter, classify the filter into an appropriate category, and the system administrator misses the message. It is an object of the present invention to provide a message monitoring system, a message monitoring apparatus, a message filter category classification method, and a program that can appropriately cope with each other.

  In order to achieve the above object, a message monitoring system according to the present invention is configured by interconnecting a plurality of monitoring target devices and a monitoring device that receives and displays a system message transmitted from the monitoring target device. A message monitoring system, in which a monitoring device receives a message receiving unit that receives a system message from a monitoring target device, and one or more filters that describe conditions for selecting what should be displayed from the system messages in a plurality of categories A filter storage unit that is stored in advance, a message analysis unit that determines whether or not a received system message satisfies a condition described in the filter, and a system message that satisfies the condition described in the filter belongs to the filter Message processing section that distributes by category, and distribution by category An automatic filter generation unit that generates a new filter from the content of a system message that does not correspond to an existing filter, and the content of the generated new filter is stored in the filter storage unit. A storage category analysis unit that compares existing filters for each category, and an automatically generated filter display unit that displays a comparison result by the storage category analysis unit. The similarity is calculated from the number of items common to each category with the existing filter stored in the filter storage unit, and the similarity for each category is displayed on the automatically generated filter display unit.

  In order to achieve the above object, a message monitoring apparatus according to the present invention is a message monitoring apparatus that receives and displays a system message transmitted from a plurality of monitoring target devices, and a message that receives a system message from the monitoring target device. A receiving unit, a filter storing unit storing in advance one or more filters describing conditions for selecting what should be displayed from system messages, and a received system message are described in the filter. A message analysis unit that determines whether or not a specific condition is satisfied, a message processing unit that distributes a system message that satisfies the conditions described in the filter, to a category to which the filter belongs, and a message that displays a system message distributed to each category As well as existing display units. An automatic filter generation unit that generates a new filter from the contents of a system message that does not correspond to a filter, and a storage category analysis unit that compares the content of the generated new filter with an existing filter stored in the filter storage unit for each category And an automatically generated filter display unit that displays a comparison result by the storage category analysis unit, and the storage category analysis unit selects a category between the generated new filter and the existing filter stored in the filter storage unit. The similarity is calculated from the number of items common to each, and the similarity for each category is displayed on the automatic generation filter display unit.

  In order to achieve the above object, a message filter category classification method according to the present invention includes a plurality of monitoring target devices and a monitoring device that receives and displays a system message transmitted from the monitoring target device. In the message monitoring system configured, a message receiving unit of a monitoring device receives a system message from a monitoring target device, and the received system message is stored in advance in a filter storage unit of the monitoring device, and filters for each of a plurality of categories The message analysis unit of the monitoring device determines whether or not the conditions described in the above conditions are satisfied, and the message processing unit of the monitoring device sorts the system messages that satisfy the conditions described in the filter for each category to which the filter belongs. The message display section of the monitoring device displays the distributed system messages. At the same time, the automatic filter generation unit of the monitoring device generates a new filter from the content of the system message that does not correspond to the existing filter, and monitors the content of the generated new filter and the existing filter stored in the filter storage unit The storage category analysis unit of the device compares and calculates the similarity from the number of items common to each category, and the automatic generation filter display unit of the monitoring device displays the similarity for each category.

  To achieve the above object, a message filter category classification program according to the present invention includes a plurality of monitoring target devices and a monitoring device that receives and displays a system message transmitted from the monitoring target device. In the message monitoring system configured, the computer included in the monitoring device receives a system message from the monitoring target device, and the received system message is stored for each of a plurality of categories stored in advance in the filter storage unit of the monitoring device. Procedures for determining whether or not the conditions described in the filter are satisfied, procedures for distributing system messages that satisfy the conditions described in the filter by category to which the filter belongs, procedures for displaying system messages distributed by category, existing System messages that do not fall under any of the filters A procedure for generating a new filter from the content, a procedure for calculating the similarity from the number of items common to each category by comparing the content of the generated new filter with an existing filter stored in the filter storage unit, and a category The automatic display filter display unit of the monitoring device executes a procedure for displaying the similarity for each.

  In the present invention, since the similarity is calculated for each category between the automatically generated filter and the existing filter as described above and this similarity is displayed, the message does not correspond to the existing filter. In the event of occurrence, it is possible to create a new filter corresponding to the message and classify the filter into an appropriate category. Accordingly, it is possible to provide a message monitoring system, a message monitoring apparatus, a message filter category classification method, and a program that enable a system administrator to appropriately respond without overlooking the message.

It is explanatory drawing which shows the more detailed structure of the monitoring object apparatus and monitoring apparatus which were shown in FIG. It is explanatory drawing which shows an example of the schematic structure of the whole message monitoring system which concerns on the 1st Embodiment of this invention. It is explanatory drawing which shows the example of the content of the existing filter memorize | stored in the filter storage part of the monitoring apparatus with the message monitoring system shown to FIGS. It is explanatory drawing which shows the example of the message transmitted to the monitoring apparatus from the monitoring object apparatus by the message monitoring system shown to FIGS. It is a flowchart showing the process which the message analysis part shown in FIG. 1 performs with respect to the message passed from the message receiving part. 6 is an explanatory diagram illustrating an example of the content of a new filter generated by an automatic filter generation unit in the operation of step S254 of FIG. 5 in the message monitoring system illustrated in FIGS. It is a flowchart showing the process which the storage category analysis part and automatic generation filter display part shown in FIG. 1 perform with respect to the new filter which the automatic filter generation part produced | generated. 8 is an explanatory diagram illustrating an example of a similarity list for each category name displayed on the display unit after the process illustrated in FIG. 7 is completed in the message monitoring system illustrated in FIGS. It is explanatory drawing which shows an example of the schematic structure of the whole message monitoring system which concerns on the 2nd Embodiment of this invention. It is explanatory drawing which shows the more detailed structure of the monitoring object apparatus and monitoring apparatus which were shown in FIG. It is a flowchart showing the process which the storage category analysis part and automatic generation filter display part shown in FIG. 10 perform with respect to the new filter which the automatic filter generation part produced | generated. FIG. 12 is an explanatory diagram illustrating an example of distribution information used when the storage category analysis unit illustrated in FIG. 10 performs the operation of Step S604 in FIG. FIG. 12 is an explanatory diagram illustrating an example of a similarity list for each category name displayed on the display unit after the process illustrated in FIG. 11 is completed in the message monitoring system illustrated in FIGS. It is explanatory drawing which shows an example of the schematic structure of the whole message monitoring system which concerns on the 3rd Embodiment of this invention. It is explanatory drawing which shows the more detailed structure of the monitoring object apparatus and monitoring apparatus which were shown in FIG. 16 is a flowchart illustrating an operation of a filter edit determination unit illustrated in FIG. 15. It is explanatory drawing shown about the example of the total result list which a filter edit determination part displays at step S853 of FIG. It is explanatory drawing shown about the example of the message monitoring system generally utilized. It is explanatory drawing shown about each monitoring object apparatus which is the object which the monitoring apparatus shown in FIG. 18 monitors, and the structure of the category.

(First embodiment)
Hereinafter, the structure of the 1st Embodiment of this invention is demonstrated based on attached FIGS. 1-2.
First, the basic content of the present embodiment will be described, and then more specific content will be described.
The message monitoring system 1 according to the present embodiment is a message monitoring system configured by connecting a plurality of monitoring target devices 10 and a monitoring device 20 that receives and displays a system message transmitted from the monitoring target devices. It is. The monitoring device 20 includes a message receiving unit 201 that receives a system message from a monitoring target device, and a (first) filter that describes a condition for selecting what should be displayed from the system messages for each of a plurality of categories. (First) filter storage unit 211 stored in advance, (first) message analysis unit 202 for determining whether or not the received system message satisfies the conditions described in the (first) filter, A message processing unit 203 that distributes system messages that satisfy the conditions described in the (first) filter for each category to which the filter belongs, and a message display unit 204 that displays system messages distributed for each category, Generate a new filter from the contents of a system message that does not correspond to an existing filter The automatic filter generation unit 205, the storage category analysis unit 206 for comparing the content of the generated new filter with the existing filter stored in the filter storage unit for each category, and the comparison result by the storage category analysis unit are displayed. And an automatically generated filter display unit 207. The storage category analysis unit 206 calculates the similarity from the number of items common to each category between the generated new filter and the existing filter stored in the filter storage unit, and automatically calculates the similarity for each category. Display on the generation filter display.

  The category includes at least one of a node name, an application name, and an object name where an event that is a target of the system message occurs. Further, the storage category analysis unit 206 displays the similarity for each category of the new filter on the automatically generated filter display unit in descending order of similarity.

  In addition, the monitoring target device 10 includes an information acquisition unit 101 that collects information about its own operation status, a message generation unit 102 that generates a system message from the collected information about the operation status, and a system message for primary selection A (second) filter storage unit 111 preliminarily storing a (second) filter describing a condition, and whether the generated system message satisfies a condition described in the second filter A (second) message analysis unit 103 and a message transmission unit 104 that transmits a system message that satisfies the conditions described in the (second) filter to the monitoring apparatus.

With the above configuration, when a message that does not correspond to an existing filter occurs, the message monitoring system 1 of the present embodiment newly creates a filter corresponding to the message, and puts the filter into an appropriate category. It becomes possible to classify.
Hereinafter, this will be described in more detail.

  FIG. 2 is an explanatory diagram showing an example of the overall schematic configuration of the message monitoring system 1 according to the first embodiment of the present invention. The message monitoring system 1 according to the present embodiment includes a plurality of monitoring target devices 10a, 10b, 10c,..., A monitoring device 20 that is a computer device, and client terminals 40a, 40b, 40c,. The network 30 is configured to be communicable with each other. Hereinafter, the monitoring target devices 10a, 10b, 10c,... Are collectively referred to as the monitoring target device 10. The number of monitoring target devices 10 is arbitrary.

  The monitoring target device 10 uses its own functions and data as services for the client terminals 40a, 40b, 40c,... Connected via the network 30, such as a web server, a database server, and an application server. A computer device to be provided. Hereinafter, the client terminals 40a, 40b, 40c,... Are collectively referred to as the client terminal 40.

  In the monitoring target apparatus 10, in parallel with these services, a monitoring function for monitoring its own operating state is simultaneously operating. This monitoring function acquires information related to the operating state of the monitoring target device 10 and transmits this to the monitoring device 20 as a message.

  The monitoring device 20 processes and analyzes the message received from the monitoring function of each monitoring target device 10 and presents the processing result to the administrator of the message monitoring system 1. Communication between the monitoring target device 10 and the monitoring device 20 may be performed via the network 30 or may be performed via a network dedicated to management that is separate from the network 30.

  FIG. 1 is an explanatory diagram showing a more detailed configuration of the monitoring target device 10 and the monitoring device 20 shown in FIG. The monitoring target device 10 is a general computer device, and is connected to a main processing control means (CPU: Central Processing Unit) 11 that is a main body that executes a computer program, a storage means 12 that stores data, and a network 30. And communication means 13 for performing data communication with other computers.

  In the main arithmetic control means 11 of the monitoring target device 10, the monitoring function 100 operates as a computer program. The monitoring function 100 includes an information acquisition unit 101, a message generation unit 102, a message analysis unit 103, and a message transmission unit 104. In the storage unit 12, a filter storage unit 111 is secured as a storage area.

  The information acquisition unit 101 acquires information about information related to the operation state of the monitoring target device 10 (for example, specific examples of details such as activation, stop, data addition, data deletion, and error occurrence will be described later). This is passed to the message generator 102. The message generation unit 102 generates a message from the information passed from the information acquisition unit 101 and passes it to the message analysis unit 103.

  The filter storage unit 111 stores in advance a filter that is information about message conditions set by the administrator. The message analysis unit 103 determines whether the message passed from the message generation unit 102 matches the condition described in the filter stored in the filter storage unit 111, and sends the matching message to the message transmission unit 104. hand over.

  The processing by the message analysis unit 103 is performed by, for example, checking the content of the message against the conditions described in the filter, and assigning importance according to the content and conditions, or sending a less important message to the monitoring device 20. It ’s like destroying it. A large number of messages are sent to the monitoring device 20 from many monitoring target devices 10, and a huge load is often applied to the processing, so that the primary filtering is performed on the monitoring target device 10 side and the importance is high. Only possible messages are sent to the monitoring device 20.

  The message transmission unit 104 transmits the message passed from the message analysis unit 103 to the message reception unit 201 of the monitoring device 20. Hereinafter, a message transmitted by the message transmission unit 104 is referred to as a message 121 with a reference number.

  The monitoring device 20 is also a general computer device, and is a main arithmetic control means (CPU) 21 that is a main body that executes a computer program, a storage means 22 that stores data, and another computer via a network 30. Communication means 23 for performing the data communication, input means 24 for accepting an operation from the administrator, and display means 25 for presenting the processing result to the administrator.

  Note that the monitoring device 20 may be configured by a plurality of computers. In particular, the input unit 24 and the display unit 25 may be other computers connected via the network 30.

  In the main calculation control means 21 of the monitoring device 20, the management function 200 operates as a computer program. The management function 200 includes a message reception unit 201, a message analysis unit 202, a message processing unit 203, a message display unit 204, an automatic filter generation unit 205, a storage category analysis unit 206, and an automatic generation filter display unit 207. In the storage unit 12, a filter storage unit 211 is secured as a storage area.

  The message reception unit 201 receives a message from the monitoring target device 10 and passes it to the message analysis unit 202. The filter storage unit 211 stores in advance a filter that is information about message conditions set by the administrator.

  The message analysis unit 202 determines whether or not the message passed from the message reception unit 201 matches the conditions described in the filter stored in the filter storage unit 211. To the unit 203. If none of the filter conditions match, the message is passed to the automatic filter generation unit 205.

  The message processing unit 203 determines to which category the filter set in advance by the administrator stored in the filter storage unit 211 belongs, sorts the received message for each category, and sends the message via the message display unit 204. This is displayed on the display means 25.

  The message display unit 204 displays a message corresponding to the filter definition on the display unit 25 in accordance with an instruction from the message processing unit 203 and an operation of the administrator from the input unit 24.

  The automatic filter generation unit 205 generates a filter (hereinafter referred to as a new filter 221) from the received message, and passes the generated new filter 221 to the storage category analysis unit 206. The storage category analysis unit 206 uses information on a filter (hereinafter referred to as an existing filter 222) that is set in advance by the administrator and stored in the filter storage unit 211, and information on a new filter received from the automatic filter generation unit 205. Compare.

  A comparison is made between the items of both the new filter 221 and the existing filter 222, and the ratio between the new filter 221 and the existing filter 222 is determined based on the proportion of the content that matches the two in the category (hereinafter referred to as weight). Analyze the similarity of each category. Thereafter, the new filter and the similarity list of each category are transferred to the automatically generated filter display unit 207 and displayed on the display means 25.

  FIG. 3 is an explanatory diagram showing an example of the contents of the existing filter 222 stored in the filter storage unit 211 of the monitoring device 20 in the message monitoring system 1 shown in FIGS. The existing filter 222 includes items such as a node (device name) 222a, an application 222b, an object 222c, a message body 222d, and a creation date and time 222e of each filter in which the target operation of the message has occurred.

  FIG. 3 shows an example in which the category setting condition 222f that the node (device name) 222a is “ApServer1” is set as the category, and “ApServer1” is added as the category name 222g. Many other categories are set in the filter storage unit 211, and one or more filters are stored in each category.

  “Web Server” of the application 222b is web server software such as Apache, for example. The “Router” of the application 222b is software that relays data (so-called routing) between a plurality of different networks.

  The “Web Server” of the application 222b is further divided into “WEBSOURCE” and “WEBCONNECT” objects 222c, each of which has a message body 222d indicating a specific operation state. Some items of the message body 222d are set with a so-called wild card (*), which means “any character string of one or more characters” as a condition. The creation date and time 222e is the date and time when the filter is newly generated or manually created by the administrator. Although not particularly used in the operation according to the present embodiment, the administrator uses the creation date and time 222e in managing the setting conditions of each filter such as “extract filters created before a specific date and time”. Sometimes.

  FIG. 4 is an explanatory diagram illustrating an example of a message 121 transmitted from the monitoring target device 10 to the monitoring device 20 in the message monitoring system 1 illustrated in FIGS. Similarly to the existing filter 222 shown in FIG. 3, the message 121 includes items such as a node (device name) 121a, an application 121b, an object 121c, and a message body 121d. The definition of each item is the same as the item having the same name in the filter shown in FIG. The importance 121e assigned by the message analysis unit 103 is also included.

  FIG. 5 is a flowchart illustrating processing performed by the message analysis unit 202 illustrated in FIG. 1 for the message 121 passed from the message reception unit 201. The content of the message 121 and the content of the existing filter 222 are compared (step S251), and it is determined whether or not the existing filter 222 corresponding to the content of the message 121 exists (step S252). If it exists, it is passed to the message processing unit 203, and the content of the message 121 is displayed to the administrator via the message display unit 204 and the display means 25 (step S253).

  If there is no existing filter 222 corresponding to the content of the message 121 in step S252, the message 121 is passed to the automatic filter generation unit 205 to generate a new filter 221 corresponding to the content of the message 121 (step S254).

  The message 121 shown in FIG. 4 has a node (device name) 121a “ApServer1”, and the application 121b “Web Server” has some contents in common with the existing filter 222 in FIG. 3, but the object 121c “WEBDOMAIN” and the message body 121d “Error occurred by StartModule.dll” has no common content with the existing filter 222. Accordingly, the process proceeds to the operation of step S254, and the content of the message 121 becomes the new filter 221 as it is.

  FIG. 6 is an explanatory diagram showing an example of the contents of the new filter 221 generated by the automatic filter generation unit 205 in the operation of step S254 of FIG. 5 in the message monitoring system 1 shown in FIGS. The new filter 221 also includes the same items as the message 121 and the existing filter 222, that is, items such as a node (device name) 221a, an application 221b, an object 221c, a message body 221d, and a creation date 221e. Each of the contents is the contents described in each item of the same name in the message 121.

  FIG. 7 is a flowchart illustrating processing performed by the storage category analysis unit 206 and the automatic generation filter display unit 207 illustrated in FIG. 1 for the new filter 221 generated by the automatic filter generation unit 205. First, the storage category analysis unit 206 checks whether or not the similarity is calculated between the new filter 221 and the existing filter 222 for all categories (step S301). If there is an unconfirmed category, the process proceeds to step S302, and if not, the process proceeds to step S307.

  Hereinafter, assuming that the category (node (device name) 221a) “ApServer1” is unconfirmed, the process proceeds to step S302, and whether there is an item common between the new filter 221 and the existing filter 222 for the category. Confirmation (steps S302 to 303). If there is no common item, the similarity in the category = 0 is calculated (step S306).

  If there is a common item in step S303, the number of matching items is counted and its "weight" is calculated (step S304). In the case of the existing filter 222 and the new filter 221 shown in FIGS. 3 and 6, since all 10 records correspond to the node (device name) 221a (222a), weight = 10/10 = 1 and the application 221b (222b) Is the seventh record out of 10 records, so weight = 7/10 = 0.7, and the object 221c (222c) and the message body 221d (222d) do not correspond to any 10 records, so the weight = 0/10 = 0 Become.

  Then, the weights of all items are summed up, and this is used as the similarity of the category (step S305). In the case of the existing filter 222 and the new filter 221 shown in FIGS. 3 and 6, the similarity for the category “ApServer1” = 1.0 + 0.7 + 0 + 0 = 1.7 can be calculated.

  When the process of step S305 or 306 ends, the process returns to step S301, and the same process is repeated until there are no unconfirmed categories. If there are no unconfirmed categories, the list of category names and their similarities for all categories is displayed to the administrator via the automatically generated filter display unit 207 and the display means 25 (step S307).

  FIG. 8 is an explanatory diagram showing an example of the similarity list 241 for each category name displayed on the display unit 25 after the processing shown in FIG. 7 is completed in the message monitoring system 1 shown in FIGS. The similarity list 241 shows the category name 241a and the similarity 241b calculated for each category in order from the highest similarity 241b. The category name 241a “ApServer1” has a similarity 241b = 1.7, which is the highest similarity.

(Overall operation of the first embodiment)
Next, the overall operation of the above embodiment will be described. The message filter category classification method according to the present embodiment includes a message monitoring system in which a plurality of monitoring target devices and a monitoring device that receives and displays a system message transmitted from the monitoring target device are connected to each other. In this method, the message filter is classified into categories. Whether the message receiver of the monitoring device receives a system message from the monitoring target device, and whether the received system message satisfies the conditions described in the filters for each of the categories stored in advance in the filter storage unit of the monitoring device Is determined by the message analysis unit of the monitoring device (FIG. 5, steps S251 to 252), and the system message processing unit that satisfies the condition described in the filter is distributed to each category to which the filter belongs, and is distributed to each category. The message display unit of the monitoring device displays the received system message (step S253 in FIG. 5), and the automatic filter generation unit of the monitoring device generates a new filter from the contents of the system message not corresponding to the existing filter (FIG. 5). Step S254), the generated new filter The storage category analysis unit of the monitoring device compares the existing filter stored in the filter storage unit and calculates the similarity from the number of items common to each category (steps S302 to S306 in FIG. 7). The automatic generation filter display unit of the monitoring device displays the similarity for each (FIG. 7, step S307).

Here, each of the above-described operation steps may be programmed to be executable by a computer, and may be executed by the monitoring device 20 which is a computer that directly executes each of the steps. The program may be recorded on a non-temporary recording medium, such as a DVD, a CD, or a flash memory. In this case, the program is read from the recording medium by a computer and executed.
By this operation, this embodiment has the following effects.

  According to the present embodiment, by presenting the administrator with a category suitable for the automatically generated filter, the load on the administrator who uses the mechanism for automatically generating the filter can be reduced. The reason for this is that each item of the generated filter and the filter already set in the category is compared and the proportion matched is used as the weight, so that it can be presented to the administrator in descending order of similarity of each category. Because it becomes.

(Second Embodiment)
In the second embodiment of the present invention, in addition to the configuration of the first embodiment, the monitoring apparatus 420 includes a score information storage unit 512 that stores a score for each item name in advance, and a storage category analysis unit. 506 is configured to calculate the similarity by multiplying the number of items common to each category between the new filter and the existing filter by the score stored in the score information storage unit 512.

Even with this configuration, in addition to obtaining the same effect as in the first embodiment, a higher similarity is calculated for the item that the administrator wants to emphasize, so the information system based on the administrator's intention Management can be performed.
Hereinafter, this will be described in more detail.

  FIG. 9 is an explanatory diagram showing an example of the overall schematic configuration of the message monitoring system 401 according to the second exemplary embodiment of the present invention. The message monitoring system 401 according to the present embodiment includes a plurality of monitoring target devices 10a, 10b, 10c,..., A monitoring device 420 that is a computer device, and client terminals 40a, 40b, 40c,. The network 30 is configured to be communicable with each other. The monitoring target device 10, the network 30, and the client terminal 40 are the same as those in the first embodiment.

  FIG. 10 is an explanatory diagram showing a more detailed configuration of the monitoring target device 10 and the monitoring device 420 shown in FIG. The monitoring device 420 has the same hardware configuration as the monitoring device 20 of the first embodiment. A management function 500, which is a computer program that operates on the main arithmetic control means 21, is partially different from that of the first embodiment.

  The management function 500 includes a message reception unit 201, a message analysis unit 202, a message processing unit 203, a message display unit 204, an automatic filter generation unit 205, a storage category analysis unit 506, and an automatic generation filter display unit 207. In addition to the filter storage unit 211, the storage unit 12 has a score information storage unit 512 that stores in-hand information, which will be described later, as a storage area. That is, among these elements, except for the storage category analysis unit 506 and the scoring information storage unit 512, all are the same as those in the first embodiment, and hence are referred to by the same reference numbers.

  FIG. 11 is a flowchart illustrating processing performed by the storage category analysis unit 506 and the automatic generation filter display unit 207 illustrated in FIG. 10 for the new filter 221 generated by the automatic filter generation unit 205. The operations shown here are generally the same as those of the storage category analysis unit 206 and the automatic generation filter display unit 207 described with reference to FIG. 7 of the first embodiment. The only difference is the expression relating to the calculation of the similarity corresponding to step S304 in FIG. This operation is referred to as step S604. All other operations are the same as in FIG.

  The calculation of the similarity shown in step S604 of FIG. 11 will be described. Here, a score is set for each item according to the importance of each item. The scoring information stored in the scoring information storage unit 512 is information on the scoring used in the process shown in step S604. FIG. 12 is an explanatory diagram showing an example of the score information stored in the score information storage unit 512 used when the storage category analysis unit 506 shown in FIG. 10 performs the operation of step S604 in FIG.

  In the example shown in FIG. 11, the highest number of points is set in the node (device name), where the number of matched items is 4 for each item. The application sets the number of matched items to 3 points per item, the object sets the number of matched items to 2 points per item, and the message body sets the number of matched items to 1 point per item.

  When this is applied to the existing filter 222 and the new filter 221 shown in FIGS. 3 and 6, since all 10 records correspond to the node (device name) 221a (222a), the score = 4 × 10/10 = 4 Since the seventh record of the 10 records corresponds to the application 221b (222b), the score = 3 × 7/10 = 2.1, and none of the 10 records corresponds to the object 221c (222c), so the score = 2 × 0 / Similarly, 10 = 0 and the message body 221d (222d) also have a score = 1 × 0/10 = 0.

  These scores are summed up in step S305 to calculate the similarity. In the case of the existing filter 222 and the new filter 221 shown in FIGS. 3 and 6, it can be calculated as similarity for the category “ApServer1” = 4.0 + 2.1 + 0 + 0 = 6.1. This process is repeated in the same manner for all categories.

  FIG. 13 is an explanatory diagram illustrating an example of the similarity list 541 for each category name displayed on the display unit 25 after the processing illustrated in FIG. 11 is completed in the message monitoring system 401 illustrated in FIGS. The similarity list 541 shows the category name 541a and the similarity 541b calculated for each category in order from the highest similarity 541b. The category name 241a “ApServer1” has the similarity 541b = 6.1, which is the highest similarity.

  According to the present embodiment, when the administrator sets each category with emphasis on specific items, a more optimal category can be presented to the administrator. The reason is that by setting the importance of the weight of each item, the weight of the item with high importance is further increased when calculating the weight, and the similarity of the category that matches the item that the result manager thinks is important It is because it is made higher and presented to the administrator.

(Third embodiment)
In the third embodiment of the present invention, in addition to the configuration of the first embodiment, the monitoring device 720 calculates the number of filters newly generated within a predetermined period among the filters stored in the filter storage unit. A filter edit determination unit 808 is provided that counts up for each category to which the filter belongs and displays this number for each category.

With this configuration, in addition to being able to obtain the same effect as in the first embodiment, it is possible to further prevent the number of newly generated filters from being inadvertently increased and to increase the processing load. It becomes possible to suppress.
Hereinafter, this will be described in more detail.

  FIG. 14 is an explanatory diagram showing an example of the overall schematic configuration of a message monitoring system 701 according to the third embodiment of the present invention. The message monitoring system 701 according to the present embodiment includes a plurality of monitoring target devices 10a, 10b, 10c,..., A monitoring device 720 that is a computer device, and client terminals 40a, 40b, 40c,. The network 30 is configured to be communicable with each other. The monitoring target device 10, the network 30, and the client terminal 40 are the same as those in the first embodiment.

  FIG. 15 is an explanatory diagram illustrating more detailed configurations of the monitoring target device 10 and the monitoring device 720 illustrated in FIG. 14. The monitoring device 720 has the same configuration as the monitoring device 20 of the first embodiment in terms of hardware. A management function 800, which is a computer program that operates on the main arithmetic control means 21, is partially different from that of the first embodiment.

  The management function 800 includes a message reception unit 201, a message analysis unit 202, a message processing unit 203, a message display unit 204, an automatic filter generation unit 205, a storage category analysis unit 206, an automatic generation filter display unit 207, and a filter edit determination unit 808. Consists of In the storage unit 12, a filter storage unit 211 is secured as a storage area. That is, the management function 800 is obtained by adding a filter edit determination unit 808 to the management function 200 of the first embodiment. All other elements are the same as in the first embodiment, and are therefore referred to by the same reference numbers.

  FIG. 16 is a flowchart showing the operation of the filter edit determination unit 808 shown in FIG. The filter edit determination unit 808 starts operation periodically at a preset operation interval, for example, about once every few days (step S851), and among the filters stored in the filter storage unit 211, For the filter newly created within the period in which the creation date and time 222e is determined in advance, the number of cases is totaled for each category (step S852), and the total result is displayed on the display means 25 (step S853). In addition to performing the processing of step S852 for each category, the number of cases can be totaled for each node (device name) or for each application.

  FIG. 17 is an explanatory diagram illustrating an example of a summary result list displayed by the filter editing determination unit 808 in step S853 of FIG. The administrator can see the display and edit the conditions of the filter so that the generated message can be displayed more appropriately particularly for a category (node, application, etc.) in which many new filters are created.

  In particular, immediately after hardware or software to be monitored is newly added to the message monitoring system 701, for messages related to the new hardware or software, the administrator sets a filter from the beginning and sets a corresponding category. Must.

  In the first and second embodiments, for a while, every time this new hardware or software performs an operation, a large number of filters are continuously generated. Most of them are not so high in importance. For example, a part of the message body is set to * (wild card), and there is no particular problem in system management. As the number of filters increases, a processing load is applied to the monitoring apparatus.

  Therefore, in the third embodiment, the administrator is urged to periodically review the settings of the newly generated filter. By reviewing the settings of unimportant filters and collecting the number of filters, it is possible to suppress an increase in the number of filters and a load on processing.

  The present invention has been described with reference to the specific embodiments shown in the drawings. However, the present invention is not limited to the embodiments shown in the drawings, and any known hitherto provided that the effects of the present invention are achieved. Even if it is a structure, it is employable.

  About each embodiment mentioned above, it is as follows when the summary of the novel technical content is put together. In addition, although part or all of the said embodiment is summarized as follows as a novel technique, this invention is not necessarily limited to this.

(Additional remark 1) It is a message monitoring system comprised by mutually connecting the some monitoring object apparatus and the monitoring apparatus which receives and displays the system message transmitted from the said monitoring object apparatus,
The monitoring device is
A message receiving unit that receives the system message from the monitoring target device, and a first filter that describes a condition for selecting one to be displayed from the system messages is stored in advance for each of a plurality of categories. A first filter storage unit; a first message analysis unit that determines whether or not the received system message satisfies a condition described in the first filter; and a condition described in the first filter. A message processing unit that distributes the system message to be satisfied for each category to which the first filter belongs, and a message display unit that displays the system message distributed for each category;
An automatic filter generation unit that generates a new filter from the contents of the system message not corresponding to the existing filter;
A storage category analysis unit that compares the content of the generated new filter with the existing filter stored in the filter storage unit for each category;
An automatically generated filter display unit for displaying a comparison result by the storage category analysis unit,
The storage category analysis unit calculates a similarity from the number of items common to each category between the generated new filter and the existing filter stored in the filter storage unit, and the similarity for each category A message monitoring system, wherein the degree is displayed on an automatically generated filter display unit.

(Supplementary note 2) The message monitoring according to supplementary note 1, wherein the category includes any one or more of a node name, an application name, and an object name in which an event as a target of the system message occurs. system.

(Additional remark 3) The said storage category analysis part displays the said similarity for every said category of the said new filter on the said automatic generation filter display part in order of the said high similarity, The additional remark 1 characterized by the above-mentioned. Message monitoring system.

(Appendix 4) The monitoring target device is
An information acquisition unit that collects information about its own operating status;
A message generator that generates the system message from the collected information on the operation status;
A second filter storage unit preliminarily storing a second filter describing conditions for primarily selecting the system message;
A second message analyzer that determines whether the generated system message satisfies a condition described in the second filter;
The message monitoring system according to appendix 1, further comprising: a message transmission unit that transmits the system message that satisfies the condition described in the second filter to the monitoring device.

(Additional remark 5) While the said monitoring apparatus has the score memory | storage part which memorize | stored the score for every item name previously,
The storage category analysis unit calculates the similarity by multiplying the number of items common to each category between the new filter and the existing filter by the score stored in the score storage unit. The message monitoring system according to claim 1, wherein the message monitoring system is characterized.

(Additional remark 6) The said monitoring apparatus totals the number of the filters newly produced | generated within the predetermined period in the filter memorize | stored in the said filter storage part for every category to which the filter belongs, and this number is the said category. The message monitoring system according to claim 1, further comprising: a filter editing determination unit that displays each of the messages.

(Supplementary note 7) A message monitoring device that receives and displays system messages transmitted from a plurality of devices to be monitored,
A filter that stores in advance, for each of a plurality of categories, a message receiver that receives the system message from the monitoring target device, and one or more filters that describe conditions for selecting what should be displayed from the system messages A storage unit; a message analysis unit that determines whether the received system message satisfies a condition described in the filter; and a system message that satisfies the condition described in the filter for each category to which the filter belongs. A message processing unit that distributes the message, and a message display unit that displays the system message distributed for each category;
An automatic filter generation unit that generates a new filter from the contents of the system message not corresponding to the existing filter;
A storage category analysis unit that compares the content of the generated new filter with the existing filter stored in the filter storage unit for each category;
An automatically generated filter display unit for displaying a comparison result by the storage category analysis unit,
The storage category analysis unit calculates a similarity from the number of items common to each category between the generated new filter and the existing filter stored in the filter storage unit, and the similarity for each category A message monitoring apparatus that displays the degree on an automatically generated filter display unit.

(Additional remark 8) In the message monitoring system comprised by mutually connecting the some monitoring object apparatus and the monitoring apparatus which receives and displays the system message transmitted from the said monitoring object apparatus,
The message receiver of the monitoring device receives the system message from the monitoring target device,
The message analysis unit of the monitoring device determines whether the received system message satisfies a condition described in a filter for each of a plurality of categories stored in advance in the filter storage unit of the monitoring device,
The message processing unit of the monitoring device sorts the system messages that satisfy the conditions described in the filter into categories to which the filter belongs,
The message display unit of the monitoring device displays the system message sorted for each category,
The automatic filter generation unit of the monitoring device generates a new filter from the content of the system message that does not correspond to the existing filter,
The storage category analysis unit of the monitoring device compares the content of the generated new filter with the existing filter stored in the filter storage unit, and calculates the similarity from the number of items common to each category,
A category classification method, wherein the similarity for each category is displayed by an automatically generated filter display unit of the monitoring device.

(Additional remark 9) In the message monitoring system comprised by mutually connecting the some monitoring object apparatus and the monitoring apparatus which receives and displays the system message transmitted from the said monitoring object apparatus,
In the computer provided in the monitoring device,
Receiving the system message from the monitored device;
A procedure for determining whether or not the received system message satisfies a condition described in a filter for each of a plurality of categories stored in advance in the filter storage unit of the monitoring device;
A procedure for distributing the system messages satisfying the conditions described in the filter for each category to which the filter belongs;
A procedure for displaying the system messages sorted by the category;
Generating a new filter from the contents of the system message not corresponding to the existing filter;
A procedure for calculating the similarity from the number of items common to each category by comparing the content of the generated new filter with the existing filter stored in the filter storage unit;
And a category classification program that causes the automatic generation filter display unit of the monitoring device to display the similarity for each category.

  The present invention can be widely applied to information service systems including message monitoring systems.

DESCRIPTION OF SYMBOLS 1,401,701 Message monitoring system 10, 10a, 10b, 10c Monitoring object apparatus 11, 21 Main operation control means 12, 22 Storage means 13, 23 Communication means 20, 420, 720 Monitoring device 24 Input means 25 Display means 30 Network 40, 40a, 40b, 40c Client terminal 100 Monitoring function 101 Information acquisition unit 102 Message generation unit 103 Message analysis unit 104 Message transmission unit 111 Filter storage unit 121 Message 200, 500, 800 Management function 201 Message reception unit 202 Message analysis unit 203 Message processing unit 204 Message display unit 205 Automatic filter generation unit 206, 506 Storage category analysis unit 207 Automatic generation filter display unit 211 Filter storage unit 221 New filter 222 Existing filters 241, 541 Similarity list 512 Scoring information storage unit 808 Filter edit determination unit

Claims (9)

A message monitoring system configured by mutually connecting a plurality of monitoring target devices and a monitoring device that receives and displays a system message transmitted from the monitoring target device,
The monitoring device is
A message receiving unit that receives the system message from the monitoring target device, and a first filter that describes a condition for selecting one to be displayed from the system messages is stored in advance for each of a plurality of categories. A first filter storage unit; a first message analysis unit that determines whether or not the received system message satisfies a condition described in the first filter; and a condition described in the first filter. A message processing unit that distributes the system message to be satisfied for each category to which the first filter belongs, and a message display unit that displays the system message distributed for each category;
An automatic filter generation unit that generates a new filter from the contents of the system message not corresponding to the existing filter;
A storage category analysis unit that compares the content of the generated new filter with the existing filter stored in the filter storage unit for each category;
An automatically generated filter display unit for displaying a comparison result by the storage category analysis unit,
The storage category analysis unit calculates a similarity from the number of items common to each category between the generated new filter and the existing filter stored in the filter storage unit, and the similarity for each category A message monitoring system, wherein the degree is displayed on an automatically generated filter display unit.   The message monitoring system according to claim 1, wherein the category includes at least one of a node name, an application name, and an object name in which an event that is a target of the system message occurs.   The message monitoring system according to claim 1, wherein the storage category analysis unit displays the similarity for each category of the new filter on the automatically generated filter display unit in descending order of the similarity. . The monitored device is
An information acquisition unit that collects information about its own operating status;
A message generator that generates the system message from the collected information on the operation status;
A second filter storage unit preliminarily storing a second filter describing conditions for primarily selecting the system message;
A second message analyzer that determines whether the generated system message satisfies a condition described in the second filter;
2. The message monitoring system according to claim 1, further comprising: a message transmission unit configured to transmit the system message satisfying a condition described in the second filter to the monitoring device. The monitoring device has a score information storage unit that stores a score for each item name in advance,
The storage category analysis unit calculates the similarity by multiplying the number of items common to each category between the new filter and the existing filter by the score stored in the score information storage unit. The message monitoring system according to claim 1, wherein:   The monitoring device counts the number of filters newly generated within a predetermined period among the filters stored in the filter storage unit for each category to which the filter belongs, and displays the number for each category. The message monitoring system according to claim 1, further comprising a filter edit determination unit. A message monitoring device that receives and displays system messages transmitted from a plurality of devices to be monitored,
A filter that stores in advance, for each of a plurality of categories, a message receiver that receives the system message from the monitoring target device, and one or more filters that describe conditions for selecting what should be displayed from the system messages A storage unit; a message analysis unit that determines whether the received system message satisfies a condition described in the filter; and a system message that satisfies the condition described in the filter for each category to which the filter belongs. A message processing unit that distributes the message, and a message display unit that displays the system message distributed for each category;
An automatic filter generation unit that generates a new filter from the contents of the system message not corresponding to the existing filter;
A storage category analysis unit that compares the content of the generated new filter with the existing filter stored in the filter storage unit for each category;
An automatically generated filter display unit for displaying a comparison result by the storage category analysis unit,
The storage category analysis unit calculates a similarity from the number of items common to each category between the generated new filter and the existing filter stored in the filter storage unit, and the similarity for each category A message monitoring apparatus that displays the degree on an automatically generated filter display unit. In a message monitoring system configured by interconnecting a plurality of monitoring target devices and a monitoring device that receives and displays a system message transmitted from the monitoring target device,
The message receiver of the monitoring device receives the system message from the monitoring target device,
The message analysis unit of the monitoring device determines whether the received system message satisfies a condition described in a filter for each of a plurality of categories stored in advance in the filter storage unit of the monitoring device,
The message processing unit of the monitoring device sorts the system messages that satisfy the conditions described in the filter into categories to which the filter belongs,
The message display unit of the monitoring device displays the system message sorted for each category,
The automatic filter generation unit of the monitoring device generates a new filter from the content of the system message that does not correspond to the existing filter,
The storage category analysis unit of the monitoring device compares the content of the generated new filter with the existing filter stored in the filter storage unit, and calculates the similarity from the number of items common to each category,
A category classification method, wherein the similarity for each category is displayed by an automatically generated filter display unit of the monitoring device. In a message monitoring system configured by interconnecting a plurality of monitoring target devices and a monitoring device that receives and displays a system message transmitted from the monitoring target device,
In the computer provided in the monitoring device,
Receiving the system message from the monitored device;
A procedure for determining whether or not the received system message satisfies a condition described in a filter for each of a plurality of categories stored in advance in the filter storage unit of the monitoring device;
A procedure for distributing the system messages satisfying the conditions described in the filter for each category to which the filter belongs;
A procedure for displaying the system messages sorted by the category;
Generating a new filter from the contents of the system message not corresponding to the existing filter;
A procedure for calculating the similarity from the number of items common to each category by comparing the content of the generated new filter with the existing filter stored in the filter storage unit;
And a category classification program that causes the automatic generation filter display unit of the monitoring device to display the similarity for each category.

Images