JP5652238B2 - Data display program, data display device, and data display method - Google Patents

Description

  The present invention relates to a data display program for displaying data on a display device, a data display device, and a data display method.

  There is a technique for presenting information to the user by displaying points on the screen, each of which represents data. For example, in system behavior monitoring, when the operating status of a monitored system is presented to a user as a scatter diagram, points representing data indicating a part of the operating status of the monitored system are drawn on the scatter diagram. The

  A technique for diagnosing a parameter alteration detection function of a Web application by comparing a tag structure of a normal response to a normal request and a tag structure of an illegal response to an illegal request is known. Further, a technique is known in which statistical data in a normal state is constructed for a connection or transaction between a mobile phone and a base station, and an abnormal connection or transaction request is rejected in light of the statistical data.

JP 2006-338246 A JP 2005-143117 A

  In the information presentation to the user by displaying the points representing data on the screen as described above, many points representing many data are often presented as in the above scatter diagram. At this time, since the corresponding data exists at each point displayed on the screen, it is necessary to hold a large amount of data in the display device. Therefore, there is a problem that the resource load for holding data increases.

  In some cases, a device that displays a point representing data on a screen acquires data by transfer from another device. At this time, the overhead due to the transfer of a large amount of data becomes a bottleneck, and there is a problem that the screen display of the points representing data is delayed in an apparatus that displays the points representing data on the screen.

  In addition, there may be a case where the user wishes to confirm individual data by specifying a point displayed on the screen. At this time, if the amount of data is easily reduced, there is a possibility that data suitable for the user's purpose cannot be displayed on the screen.

  In one aspect, according to the present invention, when displaying points representing data, even if the amount of data corresponding to the points to be displayed on the screen is reduced, it is possible to display sufficient data suitable for the purpose of the user. The purpose is to provide technology.

  In one aspect, the program causes a computer that displays data to function as follows.

That is, the program accepts a designation operation for designating one of a plurality of points displayed on the display device to a computer in which the program is installed and executed, and the designation operation is classified into the first category. when specifying a point corresponding to the data, when the display data corresponding to the point designation operation specifies a point corresponding to the data to be classified in the second classification different from the first segment, A process of displaying data corresponding to a representative point in a group having a plurality of points including the point is executed.

  In the display of points representing data, even if the amount of data corresponding to the points displayed on the screen is reduced, it is possible to display sufficient data suitable for the purpose of the user.

It is a figure explaining the example of the scatter diagram display of the request information in system visualization. It is a figure which shows the structural example of the behavior monitoring system by this Embodiment. It is a figure explaining the example of the monitoring object system of this Embodiment. It is a figure which shows the structural example of each apparatus with which the behavior monitoring system by this Embodiment is provided. It is a figure which shows the structural example of the hardware which implement | achieves each apparatus with which the behavior monitoring system by this Embodiment is provided. It is a figure which shows the example of the data which the message log memory | storage part by this Embodiment stores. It is a message collection process flowchart by the capture apparatus of this Embodiment. It is a figure which shows the example of the tied | linking result of the message by this Embodiment. It is a figure which shows the example of the request information by this Embodiment. It is a figure explaining the attribute of the request information by this Embodiment. It is a request information generation process flowchart by the analysis apparatus of this Embodiment. It is a figure explaining the example of the classification of request information and representative request information selection by this Embodiment. It is a figure explaining the statistics of the request information in the classification of the normal request by this Embodiment. It is a figure which shows the example of the data which the analysis result data storage part by this Embodiment stores. It is a data processing flowchart classified by classification by the analysis apparatus of this Embodiment. It is a data point display processing flowchart by the data display apparatus of this Embodiment. It is a data generation process flowchart of the attribute of uniform distribution in the point generation process by the data display apparatus of this Embodiment. It is a data generation processing flowchart of the attribute of normal distribution in the point generation processing by the data display device of the present embodiment. It is a figure explaining the example of the data display according to the designated point by this Embodiment. It is a designated point corresponding | compatible data display processing flowchart by the data display apparatus of this Embodiment.

  Hereinafter, the present embodiment will be described with reference to the drawings.

  Hereinafter, the data display technique according to the present embodiment will be described mainly using data display on a display device in system visualization as an example.

  There is a technical field for monitoring the behavior of a running system. In the system behavior monitoring, for example, the behavior monitoring of a system that executes processing according to the generated request is performed.

  In the field of system behavior monitoring, there is a system visualization technique that presents the behavior of a monitored system in a human-visible form. In system visualization, the analysis result of information collected from the monitored system is presented to the user as a graph.

  For example, in visualization of a system that executes processing according to a request that has occurred, information such as messages exchanged between devices is collected, and various information related to requests can be obtained by analyzing the collected information such as messages . The information obtained as a result of the analysis is presented to the user, for example, in a graph and displayed on a dashboard screen on the display. For example, a stacked bar graph showing the processing time of each server that executed the request processing, a bar graph showing the average response time of requests and a line graph showing the frequency of occurrence, a scatter chart showing the response time of individual requests, A pie chart showing the breakdown by type is displayed.

  The user reads information from the graph displayed on the display, and performs bottleneck analysis and identification of the server where the failure occurred.

  In such system visualization, the data scatter diagram display has the advantage that the overall trend can be confirmed from the graph.

  FIG. 1 is a diagram for explaining an example of a scatter diagram display of request information in system visualization.

  FIG. 1A shows an example of a screen on which a scatter diagram showing response times of individual requests is displayed. In FIG. 1A, each point represented by a small circle represents an individual request. The time stamp indicates the generation time of the request. The response time indicates the time from when a request occurs until a series of processing in the system ends.

  The user can read the trend of the entire request such as the average or variation of the response time from the scatter diagram graph shown in FIG.

  Furthermore, when such a scatter diagram display of data is performed, it is possible to design such that individual data can be accessed from a graph by a GUI (Graphical User Interface) technique such as mouse operation.

  FIG. 1B shows an example of a screen on which individual request data is displayed. One point on the graph shown in FIG. 1A corresponds to one request. For example, it is assumed that the user can see the data display screen of the request corresponding to the designated point by designating the point on the graph shown in FIG. In the example of the data display screen shown in FIG. 1B, a request sequence diagram is displayed. For example, in the scatter diagram graph shown in FIG. 1A, when the user designates a point of time stamp: TSa and response time RTa, a sequence diagram shown in FIG. 1B is displayed.

  The sequence diagram is a diagram illustrating the exchange of messages between servers from the start to the completion of processing for a request. In system visualization, the user can read the server to which a message is exchanged and the processing time at each server from the sequence diagram displayed on the screen. Here, it is assumed that the system to be monitored is a three-tier system. In the sequence diagram shown in FIG. 1B, “Web” indicates a Web server, “AP” indicates an AP (Application) server, and “DB” indicates a DB (Database) server.

  Bar graphs and line graphs can be drawn if there are statistical results of the data. For example, a bar graph representing the average response time of requests can be drawn if there is a result of averaging the response times in the data of a plurality of requests.

  On the other hand, since each point in the scatter diagram represents data, drawing of the scatter diagram requires data for each point to be drawn. In a scatter diagram display of a large amount of data, a large amount of data is required for drawing a graph, so that the load on resources for storing the data increases.

  In addition, in a large-scale system behavior monitoring, a device that collects and analyzes messages from the system and a device that displays the analysis results may be realized by separate computers. For example, there are many cases where messages are collected and analyzed in a concentrated manner on a dedicated server, and the user accesses the server with his / her terminal and browses the analysis results. At this time, a terminal that displays a scatter diagram of a large amount of data on the screen needs to read a large amount of data from the server, and the graph display on the screen is slow. For example, in real-time monitoring of system behavior, if a large amount of data is displayed on the graph, there is a possibility that the graph drawing cannot catch up with the data collection.

  As a countermeasure against such a large amount of data in drawing a scatter diagram, for example, a method using an image file and a clickable map is assumed. In this method, an image file of a graph to be displayed is created in advance, and when the graph is displayed, the image file created in advance is displayed on the screen. Displaying graphs is faster because the amount of data read during display is reduced by converting the data into an image file. Also, by using a clickable map, access to individual data can be realized.

  However, with this method, when the user wants to change the scale, such as expanding or reducing the axis of the displayed graph, it is necessary to recreate the scaled graph image file. There's a problem.

  Further, as another countermeasure method for a large amount of data in drawing a scatter diagram, for example, a method of displaying an average value of a plurality of data is assumed. In this method, the data is divided into several groups and an average value is obtained for each group, and points representing the average value of a plurality of data are displayed on the graph. Since the number of data displayed in the graph is reduced by averaging a plurality of data, the graph is displayed faster. In addition, there is no graph drawing overhead due to scale changes.

  However, this method has a problem that it becomes impossible to access individual actual data because the data becomes averaged data. In addition, when displaying a point where a plurality of data is averaged, it is difficult for the user to read the degree of data variation from the graph. In addition, for the points displayed on the graph, the total range of the data for which the average value was obtained cannot be seen by the user.

  In the following, an example of a data display technique according to the present embodiment for solving these problems will be described.

  FIG. 2 is a diagram illustrating a configuration example of the behavior monitoring system according to the present embodiment.

  The behavior monitoring system according to the present embodiment shown in FIG. 2 monitors the behavior of the monitoring target system 50. The behavior monitoring system according to the present embodiment includes a capture device 10, an analysis device 20, and a data display device 30.

  The capture device 10 collects and records messages exchanged in the monitoring target system 50. For example, the capture device 10 collects messages that fly on the monitoring target system 50 by using the mirroring function of the switch 55 arranged between the devices in the monitoring target system 50. The analysis device 20 analyzes the message collected by the capture device 10 and records the data together as information for each request. The data display device 30 displays the analysis result by the analysis device 20 on the screen of the display device. The data display device 30 has a GUI function.

  FIG. 3 is a diagram illustrating an example of a monitoring target system according to the present embodiment.

  In the present embodiment, it is assumed that the monitoring target system 50 is a three-tier system as shown in FIG. In the three-tier system, the Web server 51, the AP server 52, and the DB server 53 process requests issued from the client 60 in a hierarchical manner. In a large-scale system, distributed processing is performed by a plurality of Web servers 51, AP servers 52, and DB servers 53, respectively.

  In FIG. 3, “Req” indicates a request message, and “Res” indicates a response message. The client 60 transmits a request message when issuing a request to the monitoring target system 50. As shown in FIG. 3, a series of processes executed while messages are exchanged in the order of client 60 → Web server 51 → AP server 52 → DB server 53 → AP server 52 → Web server 51 → client 60, Processing for issued requests.

  The capture device 10 acquires these messages exchanged between the devices from the switch 55 arranged between the devices.

  FIG. 4 is a diagram illustrating a configuration example of each device provided in the behavior monitoring system according to the present embodiment.

  The capture device 10 includes a message collection unit 11, a message processing unit 12, and a message log storage unit 13. The message collection unit 11 collects messages from the monitoring target system 50. The message processing unit 12 extracts information from the collected messages, performs processing such as adding a time stamp, and records message information in a message log. The message log storage unit 13 is a storage unit that stores a message log and is accessible by a computer.

  The analysis device 20 includes a message log reading unit 21, a message linking unit 22, a data generation unit 23, a generation data storage unit 24, a classified data processing unit 25, and an analysis result data storage unit 29.

  The message log reading unit 21 reads message log information stored in the message log storage unit 13 of the capture device 10. The message correlating unit 22 correlates messages estimated to be related from the read message log information, that is, messages presumed to be issued in a series of processing execution processes for the same request.

  The data generation unit 23 extracts necessary information from the associated message and generates data to be displayed on the data display device 30. In the example of the present embodiment, data generated from predetermined information extracted from linked messages is called request information. The data generation unit 23 stores the generated request information in the generation data storage unit 24. The generated data storage unit 24 is a storage unit accessible by a computer that stores data to be displayed, that is, request information in the example of the present embodiment.

  The classification-specific data processing unit 25 classifies the data to be displayed into a first classification and a second classification, executes processing according to each classification, and uses the obtained data as analysis result data. Store in the storage unit 29. The analysis result data storage unit 29 is a storage unit that is accessible by a computer and stores data of analysis results obtained by the analysis device 20. In the present embodiment, the analysis result data stored in the analysis result data storage unit 29 is a request information log in which data related to request information is recorded.

  The classified data processing unit 25 includes a classification unit 26, a representative data selection unit 27, and a data statistics unit 28.

  The classification unit 26 classifies data to be displayed into a first category and a second category according to a predetermined rule. In the example of the present embodiment, the classification unit 26 classifies the request information into an abnormal request and a normal request according to the response time value. In the present embodiment, abnormal requests are in the first category and normal requests are in the second category. An example of request information classification will be described later.

  The representative data selection unit 27 selects representative data from a plurality of predetermined data for the data classified in the second category. In the example of the present embodiment, the representative data selection unit 27 selects representative request information from a plurality of predetermined request information for request information classified into normal requests. An example of selection of representative request information will be described later.

  The data statistics unit 28 performs statistical analysis using a plurality of predetermined data on the data classified into the second category, and generates statistical information indicating the distribution status of the plurality of predetermined data. In the example of this embodiment, when drawing a scatter diagram for request information classified as normal requests, statistical analysis is performed on how a plurality of predetermined request information is distributed. Statistical information indicating the distribution status of a plurality of data is obtained. An example of generation of statistical information will be described later.

  The data processing unit 25 by category indicates the actual data for the data classified into the first category, and the actual data that is representative of a plurality of predetermined data and the distribution status for the data classified into the second category Statistical information is stored in the analysis result data storage unit 29.

  The data display device 30 includes a data acquisition unit 31, a data storage unit 32, a display unit 33, and an operation reception unit 37. The data display device 30 is a device that is directly used by a user, and includes devices such as a keyboard / mouse 38 that is an input device operated by the user and a display 39 that is a display device.

  The data acquisition unit 31 acquires data stored in the analysis result data storage unit 29 of the analysis device 20. The data acquired by the data acquisition unit 31 is data related to information presented to the user on the display 39 or the like in the data display device 30. In the example of the present embodiment, the acquired data is user information log data stored in the analysis result data storage unit 29. The data acquisition unit 31 stores the acquired data in the data storage unit 32. The data storage unit 32 is a computer-accessible storage unit that stores data related to information presented to the user on the display 39 or the like.

  The display unit 33 controls screen display on the display 39. For example, the display unit 33 displays a screen for presenting information to the user on the display 39 based on the data stored in the data storage unit 32. In the example of the present embodiment, the display unit 33 displays a scatter diagram screen on which points representing request information are drawn on the display 39 based on the data of the request information log acquired from the analysis device 20.

  The operation accepting unit 37 accepts an operation by a user using an input device such as a keyboard / mouse 38. For example, in the example of the present embodiment, the user operates the mouse to move the mouse pointer displayed on the display 39 and performs an operation of designating a point representing request information displayed on the display 39. At this time, the operation accepting unit 37 accepts an operation of moving a mouse pointer by a user using a mouse.

  The display unit 33 includes a classification determination unit 34, a point generation unit 35, and a designated data display unit 36.

  When displaying the points representing data on the screen of the display 39, the category determination unit 34 determines whether the category of the data displaying the points is the first category or the second category. In the example of the present embodiment, when the classification determination unit 34 displays the points representing the request information on the screen of the scatter diagram displayed on the display 39, whether the classification of the request information for displaying the points is an abnormal request. Determine if it is a normal request.

  The point generation unit 35 generates a plurality of points representing data classified into the second category from statistical information indicating the distribution information of the predetermined plurality of data. In the example of the present embodiment, when the data acquired from the request information log is normal request data, the point generation unit 35 obtains a plurality of points from statistical information indicating the distribution status of the request information included in the data. Is generated.

  The display unit 33 displays the point corresponding to the attribute value of the actual data for the point representing the data classified in the first category. In the example of the present embodiment, for the points representing the request information classified as abnormal requests, the points corresponding to the attribute values of the actual data of the request information are displayed. In addition, the display unit 33 selects a point representing data classified into the second category from a point generated from statistical information representing a distribution state of a plurality of predetermined data and the predetermined plurality of data. The points corresponding to the attribute values of the representative real data are displayed. In the example of the present embodiment, the points representing request information classified as normal requests are selected from points generated from statistical information indicating the distribution status of a plurality of predetermined request information and a plurality of predetermined request information. The point corresponding to the attribute value of the actual data of the representative request is displayed.

  A plurality of points representing a plurality of predetermined data classified in the second section form a group. The group includes points generated from statistical information indicating the distribution status of a plurality of predetermined data classified into the second category, and points corresponding to representative data selected from the predetermined plurality of data. Have.

  When the operation receiving unit 37 receives an operation for specifying the displayed point, the specified data display unit 36 displays data on the screen according to the specified point classification. When the designated point is a point representing data classified into the first category, the designated data display unit 36 displays actual data corresponding to the designated point. When the designated point is a point representing data classified in the second category, the designated data display unit 36 corresponds to a point that is representative in a group having a plurality of points including the designated point. The actual data to be displayed is displayed.

  FIG. 5 is a diagram illustrating a configuration example of hardware for realizing each device included in the behavior monitoring system according to the present embodiment.

  4 includes, for example, a central processing unit (CPU) 2, a memory 3 serving as a main memory 3, a storage device 4, a communication device 5, a medium reading / writing device 6, and an input device. 7 and the computer 1 having the output device 8 and the like. The storage device 4 is, for example, an HDD (Hard Disk Drive). The medium reading / writing device 6 is, for example, a CD-R (Compact Disc Recordable) drive or a DVD-R (Digital Versatile Disc Recordable) drive. The input device 7 is a keyboard / mouse 38, for example. The output device 8 is a display device such as a display 39, for example.

  The data display device 30 and each functional unit included in the data display device 30 illustrated in FIG. 4 can be realized by hardware such as the CPU 2 and the memory 3 included in the computer 1 and a software program. A program that can be executed by the computer 1 is stored in the storage device 4, read into the memory 3 at the time of execution, and executed by the CPU 2.

  The computer 1 can also read a program directly from a portable recording medium and execute processing according to the program. The computer 1 can also sequentially execute processing according to the received program every time the program is transferred from the server computer. Further, this program can be recorded on a recording medium readable by the computer 1.

  The capture device 10 and the analysis device 20 shown in FIG. 4 are also realized by the configuration of the computer 1 as shown in FIG.

  Hereinafter, a more specific example of the series of processing by the behavior monitoring system of the present embodiment will be described.

  First, an example of processing by the capture device 10 will be described. The capture device 10 acquires a message exchanged with the monitoring target system 50 and records information of the message in a message log.

  FIG. 6 is a diagram illustrating an example of data stored in the message log storage unit according to the present embodiment.

  A message log 130 illustrated in FIG. 6 is an example of a message log stored in the message log storage unit 13. In the message log 130 shown in FIG. 6, one record is information extracted from one message.

  Each record of the message log 130 shown in FIG. 6 has information such as a log ID (Identifier), a time stamp, a protocol type, a message type, an src (Source) address, a dst (Destination) address, and a transaction ID.

  The log ID is identification information that uniquely identifies each record of the message log 130. The time stamp is time information indicating the time of the message. The protocol type indicates the message protocol. The message type indicates whether the message is a request message or a response message.

  The src address indicates the IP (Internet Protocol) address of the message transmission source device. The dst address indicates the IP address of the message destination device. In the src address and dst address of the message log 130 shown in FIG. 6, client, Web, AP, and DB indicate the IP addresses of the client 60, Web server 51, AP server 52, and DB server 53, respectively. And

  The transaction ID is identification information for identifying the transaction to which the message belongs. A series of processes executed for one request is also called a transaction. In the present embodiment, it is assumed that the same transaction ID is assigned to messages issued in a series of processes related to the same request.

  In the example of the message log 130 illustrated in FIG. 6, information other than the log ID and the time stamp is information extracted from the acquired message by the message processing unit 12. The message has various attribute information in addition to the protocol type, the message type, the src address, the dst address, and the transaction ID, and the message processing unit 12 extracts the attribute information and displays the message log shown in FIG. 130.

  When the information extracted from the message is recorded in the message log 130 shown in FIG. 6, the message processing unit 12 acquires a time stamp and records it together. The time stamp of the message log shown in FIG. 6 is time information indicating the time when the capture device 10 acquires the message.

  FIG. 7 is a flowchart of message collection processing by the capture device according to the present embodiment.

  In the capture device 10, the message collection unit 11 acquires a message from the monitoring target system 50 (step S10). The message processing unit 12 extracts information from the acquired message (step S11). The message processing unit 12 acquires a time stamp (step S12). The message processing unit 12 adds a time stamp to the information extracted from the message and records it in the message log (step S13).

  The capture device 10 executes the process shown in FIG. 7 for each message.

  Next, an example of processing by the analysis device 20 will be described. The analysis device 20 analyzes the message information collected by the capture device 10 and generates data in which predetermined information is arranged for each request that occurs. In the present embodiment, data obtained by organizing predetermined information for each generated request is called request information.

  The message log reading unit 21 reads a message log from the capture device 10. The message association unit 22 analyzes the read message log, and associates a message that is presumed to have been issued in the course of a series of processes related to the same request.

  FIG. 8 is a diagram illustrating an example of a message linking result according to the present embodiment.

  The message linking result 220 shown in FIG. 8 is a result of extracting and linking a message with the transaction ID “tran0” from the message log 130 shown in FIG. 6.

  For example, the message linking unit 22 extracts a message having a common keyword from the message log, and links the extracted message. In the example shown in FIG. 8, a message having a common transaction ID is extracted from the message log 130 shown in FIG.

  In the present embodiment, the same transaction ID is given as attribute information to messages issued in a series of processes related to the same request. By extracting and linking messages having the same transaction ID from the message log, information related to one request can be collected. For example, in the message association result 220 shown in FIG. 8, messages exchanged among the client 60, the Web server 51, the AP server 52, and the DB server 53 are collected in a series of processes related to a certain request.

  In addition to message linking using transaction IDs, there are message linking technologies that use various attribute information of messages.

  The data generation unit 23 extracts information according to the purpose from the message association result, and generates request information from the extracted information. For example, in the present embodiment, request information for each request is generated for the purpose of displaying a scatter diagram of the time stamp TS and response time RT for each request. Note that the scatter diagram of the time stamp TS and the response time RT for each request is an example of a diagram representing the operation status of the monitoring target system 50.

  FIG. 9 is a diagram illustrating an example of request information according to the present embodiment.

The request information 240 illustrated in FIG. 9 is an example of request information generated by the data generation unit 23 in the example of the present embodiment. As shown in the request information 240 of FIG. 9, the request information of this embodiment includes a time stamp (TS), a response time (RT), a processing time (T ₁ , T ₅ ) of the Web server 51, and the AP server 52 information. It has attributes of processing time (T ₂ , T ₄ ) and processing time (T ₃ ) of the DB server 53.

  FIG. 10 is a diagram for explaining attributes of request information according to the present embodiment.

  FIG. 10 shows a flow of a series of processing relating to the generated request in the monitoring target system 50 of the present embodiment.

  Here, an example will be described in which request information is generated based on information extracted from the message linking result 220 shown in FIG. In FIG. 10, tstamp described in a thick arrow indicating message exchange is time stamp information for each message extracted from the message linking result 220 shown in FIG.

The attribute of the time stamp TS in the request information is the time stamp of the request message transmitted from the client 60 to the Web server 51. In the example shown in FIG. 10, the TS = t _00. The attribute of the time stamp TS in the request information can also be considered as the request generation time.

  As shown in the request information 240 shown in FIG. 9, the time stamp of the present embodiment is time information uniquely defined in the behavior monitoring system. For example, a time stamp value of 1 represents 1/10 second. The time stamp may be general date and time information.

The attribute of the processing time T ₁ of the Web server 51 is the processing time of processing that is performed until the Web server 51 that has received the request message from the client 60 sends the request message to the AP server 52. In the example shown in FIG. 10, T ₁ = t ₀₁ −t ₀₀ .

The attribute of the processing time T ₂ of the AP server 52 is the processing time of processing that is performed until the AP server 52 that has received the request message from the Web server 51 sends the request message to the DB server 53. In the example shown in FIG. 10, T ₂ = t ₀₂ −t ₀₁ .

The attribute of the processing time T ₃ of the DB server 53 is the processing time of processing that is performed until the DB server 53 that has received the request message from the AP server 52 returns a response message to the AP server 52. In the example shown in FIG. 10, T ₃ = t ₀₃ −t ₀₂ .

The attribute of the processing time T ₄ of the AP server 52 is the processing time of processing that is performed until the AP server 52 that has received the response message from the DB server 53 sends the response message to the Web server 51. In the example shown in FIG. 10, T ₄ = t ₀₄ −t ₀₃ .

The attribute of the processing time T ₅ of the Web server 51 is the processing time of processing that is performed until the Web server 51 that has received the response message from the AP server 52 sends the response message to the client 60. In the example shown in FIG. 10, T ₅ = t ₀₅ −t ₀₄ .

The attribute of the response time RT is a time for the monitoring target system 50 to return a response message to the client 60 after the client 60 issues a request message to the monitoring target system 50. The response time RT can also be considered as the processing time of the monitoring target system 50 for the issued request. In the example shown in FIG.
RT = T ₁ + T ₂ + T ₃ + T ₄ + T ₅ = t ₀₅ −t ₀₀
It becomes.

  FIG. 11 is a flowchart of request information generation processing by the analysis apparatus of this embodiment.

  In the analysis device 20, the message log reading unit 21 reads a message log from the capture device 10 (step S20). The message association unit 22 associates message information recorded in the message log for each request (step S21). The data generation unit 23 extracts predetermined information from the message linking result and generates request information for each request (step S22). The generated request information is stored in the generated data storage unit 24.

  From the request information generated by the processing so far, it is possible to display a scatter diagram in which the points of each request information are drawn with the time stamp TS and the response time RT as axes. However, if all the request information is held for drawing a scatter diagram, the load of resources holding the request information increases. Further, since the amount of data transferred from the analysis device 20 to the data display device 30 increases, the data transfer time becomes a bottleneck, and the time required for drawing the scatter diagram is delayed.

  The analysis apparatus 20 according to the present embodiment further reduces the amount of request information, so that even with a smaller amount of data, request information that can draw a sufficient scatter diagram of request information suitable for the purpose of the user. Generate data about. The data related to the request information generated here is called a request information log in this embodiment. In the example of the present embodiment, the request information log is data of a final analysis result by the analysis device 20.

  As shown in Fig. 1 (A), when the response time scatter chart is displayed, most of the response times of requests are concentrated in a certain time range, and requests that do not fit in the certain time range are displayed. , Very few.

  In the example of the scatter diagram shown in FIG. 1A, it can be estimated that the operation of the monitoring target system 50 is normal for the processing of requests whose response time is within a certain time range. For such a request, the user rarely confirms specific actual data individually, although the user confirms the data with a sample to confirm the operation of the monitoring target system 50. In the present embodiment, a request whose response time is within a certain time range is called a normal request.

  On the other hand, in the example of the scatter diagram shown in FIG. 1 (A), there is a possibility that an abnormality has occurred in the operation of the monitoring target system 50 for processing a request whose response time does not fall within a certain time range. . For such a request, the user often confirms individual actual data in order to confirm the operation of the monitoring target system 50. In the present embodiment, a request whose response time does not fall within a certain time range is called an abnormal request.

  As described above, the points representing the request information include a point where the user individually checks the data and a point where the user does not particularly check the data individually.

  The classification-specific data processing unit 25 classifies the request information into two categories, changes the recording format of the request information data for each category, and records the request information in the request information log. In the present embodiment, the abnormal request category is the first category, and the normal request category is the second category.

  The classification unit 26 classifies the request information into an abnormal request and a normal request. For example, the classification unit 26 classifies request information whose response time RT is equal to or less than a predetermined threshold value as a normal request, and classifies request information whose response time RT exceeds a predetermined threshold value as an abnormal request. The predetermined threshold value is a criterion for determining whether the request information data is abnormal or normal.

  Such request information classification can be arbitrarily designed according to the display format of the target data. For example, when the data display device 30 displays not only the response time scatter diagram but also the processing time scatter diagram of each server, the request is made by adding the processing time condition of each server to the response time condition. The classification of information may be determined.

  For the request information classified as an abnormal request, the classified data processing unit 25 individually records the actual data of the request information in the request information log.

  For the request information classified as normal requests, the classified data processing unit 25 performs a process for each of a plurality of predetermined request information, and obtains data for each of a plurality of predetermined request information obtained as a processing result. Record in the request information log. Hereinafter, an example of processing for request information classified as a normal request will be described.

Assume that there are M pieces of predetermined plural pieces of request information. Here, the M request information, respectively _{r 1, r 2, ...,} r i, ..., expressed as r _M. One request information is assumed to have N pieces of attribute information. Here, the value of the jth attribute in the request information r _i is represented as x _ij . At this time, the request information r _i is
r _i = (x _i1 , x _i2 , ..., x _ij , ..., x _iN )
It is expressed.

  The representative data selection unit 27 selects request information as a representative from a plurality of predetermined request information for request information classified as normal requests. In the present embodiment, representative request information selected from a plurality of predetermined request information is referred to as representative request information.

In this embodiment, the representative data selection unit 27 views the request information r _i as one point on the N-dimensional space, obtains the centroids of a plurality of predetermined request information, and requests the closest to the obtained centroids. The information is representative request information.

Let G (g ₁ , g ₂ ,..., G _j ,..., G _N ) represent the centroids of predetermined pieces of request information. At this time, g _j (j = 1 to N) is an average value for each attribute. That is, the average value g _j of each attribute is obtained by the following equation (1).

A distance d (G, r _i ) between the obtained center of gravity G and each request information r _i (i = 1 to M) is obtained by the following equation (2).

The representative data selection unit 27 sets the obtained request information having the smallest value of the distance d (G, r _i ) as representative request information.

  The design of processing for selecting representative request information from a plurality of predetermined request information is arbitrary. For example, the request information closest to the center of the area from which the plurality of predetermined request information is extracted may be used as the representative request information instead of the center of gravity of the predetermined plurality of request information.

  The data statistics unit 28 performs statistical analysis on a plurality of predetermined request information for the request information classified as normal requests, and generates statistical information indicating a distribution state of the predetermined plurality of request information.

In the present embodiment, the data statistics unit 28 generates statistical information indicating a value distribution state for each attribute of the request information. For example, for an attribute having a uniform distribution of values, information on a range that the value can take is generated as statistical information. In addition, for example, for an attribute whose value is a normal distribution, information on an average value and a standard deviation is generated. For example, the average value g _j of a plurality of predetermined request information for the j-th attribute is obtained from the above equation (1). The standard deviation σ _j of a plurality of predetermined request information for the jth attribute is obtained by the following equation (3).

  Note that the design of statistical information indicating the distribution information of a plurality of predetermined request information is arbitrary. For example, when the value distribution for an attribute is an exponential distribution, a probability function indicating the exponential distribution may be used as statistical information. Further, for example, for a certain attribute, a probability function approximating a histogram of values may be obtained and used as statistical information.

  The classified data processing unit 25 records the actual data of the representative request information and the statistical information indicating the distribution status in the request information log for each of a plurality of predetermined pieces of request information classified as normal requests. .

  FIG. 12 is a diagram for explaining an example of request information classification and representative request information selection according to the present embodiment.

In the present embodiment, as shown in FIG. 12, for example, the classification unit 26 classifies request information into an abnormal request classification and a normal request classification at a predetermined response time threshold value RT _th .

  Further, in the present embodiment, the classification-specific data processing unit 25 outputs a plurality of request information for each time interval ΔTS of a predetermined time stamp TS as shown in FIG. Process all at once.

  In addition, arbitrary design is possible about predetermined | prescribed several request information. For example, the predetermined plural pieces of request information may be obtained by collecting a predetermined number of pieces of request information in order of the value of the time stamp TS.

  Here, it is assumed that a predetermined plurality of request information areas to be processed are processing target areas shown in FIG.

  In the example shown in FIG. 12, the request information is represented as a point in a two-dimensional space with a time stamp TS and a response time RT as axes. The representative data selection unit 27 obtains the centroids of the plurality of request information included in the processing target area from the positions of the points representing the plurality of request information in the two-dimensional space of the processing target area. As illustrated in FIG. 12, the representative data selection unit 27 sets request information represented by a point closest to the obtained center of gravity as representative request information.

  Here, among the attributes of the request information, only the time stamp TS and the response time RT are the processing target attributes, but the processing time attributes of other servers may be the processing target attributes.

  FIG. 13 is a diagram for explaining the statistics of request information in the normal request classification according to the present embodiment.

  The distribution of request information shown in FIG. 13 is the same as the distribution of request information shown in FIG.

In the example shown in FIG. 13, the data statistical unit 28 assumes that the values of the time stamp TS have a uniform distribution, and the statistical information (TS _min , TS _max ). TS _min indicates the minimum value of the time stamp of the processing target area. TS _max indicates the maximum value of the time stamp of the processing target area.

In the example shown in FIG. 13, the data statistics unit 28 assumes that the values of the response time RT have a normal distribution, and the average value g ₂ of the response times RT of a plurality of request information included in the processing target area. And the standard deviation σ ₂ are obtained as statistical information. In the request information of this embodiment, the time stamp TS is the first attribute and the response time RT is the second attribute.

  FIG. 14 is a diagram illustrating an example of data stored in the analysis result data storage unit according to the present embodiment.

  The request information log 290 illustrated in FIG. 14 is an example of analysis result data stored in the analysis result data storage unit 29. The request information log 290 shown in FIG. 14 has information such as classification, request information / representative request information, and statistical data related to normal requests.

  In the request information log 290 illustrated in FIG. 14, the section indicates whether the data relates to request information classified as an abnormal request or the request information classified as a normal request. In the classification of the request information log 290 shown in FIG. 14, “0” indicates an abnormal request and “1” indicates a normal request.

  The request information / representative request information indicates actual data of the corresponding request information when the category is an abnormal request, and indicates representative request information selected from a plurality of predetermined request information when the category is a normal request. .

  The statistical data related to normal requests is statistical information indicating a distribution state of predetermined plural pieces of request information when the category is a normal request. The statistical data related to normal requests has information on the number of data and statistical information for each attribute. The number of data indicates the number of predetermined pieces of request information that is the basis of statistical information.

In the request information log shown in FIG. 14, statistical information # 1 is statistical information about the attribute of the time stamp TS. As the statistical information, statistical information (TS _min , TS _max ) in a range that the value of the time stamp TS can take is shown.

In the request information log shown in FIG. 14, statistical information # 2 is statistical information about the attribute of response time RT. As statistical information, an average value g ₂ of response times RT and a standard deviation σ ₂ in a plurality of predetermined request information are shown.

  FIG. 15 is a flowchart of data processing by category by the analysis apparatus according to the present embodiment.

The analysis device 20 determines the time stamp range to be processed (step S30). Here, the analysis device 20, from the value TS _min of the next time-stamp in the range of the time stamp of the last processed, up to the value TS _max of the time stamps after a predetermined time interval .DELTA.TS, the time stamp to be processed To do.

The classification unit 26 selects one piece of request information to be processed (step S31). Here, one piece of request information whose time stamp TS value is in the range of TS _{min to} TS _max is selected.

The classification unit 26 determines whether the response time RT of the selected request information is equal to or less than a predetermined threshold value _RTth (step S32).

If the response time RT is less than or equal to the predetermined threshold RT _th (YES in step S32), the classification unit 26 determines that the selected request information is a normal request (step S33).

If the response time RT is not less than or equal to the predetermined threshold value RT _th (NO in step S32), the classification unit 26 determines that the selected request information is an abnormal request (step S34). When it is determined that the selected request information category is an abnormal request, the category-specific data processing unit 25 records the selected request information data in the request information log (step S35).

  The classification unit 26 determines whether the classification determination has been completed for all the request information to be processed (step S36).

  If the classification determination has not been completed for all request information to be processed (NO in step S36), the classification unit 26 returns to the process in step S31 and proceeds to the process of the next request information to be processed.

  If the classification determination has been completed for all processing target request information (YES in step S36), the representative data selection unit 27 selects representative request information from a plurality of request information classified into normal request classifications. (Step S37). In addition, the data statistics unit 28 statistics the data of a plurality of request information classified into normal request categories for each attribute, and generates statistical information indicating the distribution status of the plurality of request information (step S38).

  The classification-specific data processing unit 25 records the selected representative request information data and the generated statistical information data in the request information log for a plurality of request information classified into the normal request classification (steps). S39).

  The classification-specific data processing unit 25 returns to the process of step S30 and moves to the process of the next time stamp range to be processed.

  Thus, in the analysis device 20 of the present embodiment, the amount of data transferred to the data display device 30 is reduced.

  Next, an example of processing by the data display device 30 will be described. The data display device 30 acquires analysis result data from the analysis device 20 and displays a scatter diagram of response times RT for each request on the display 39 based on the acquired data. In the present embodiment, the data of the analysis result by the analysis device 20 is request information log data.

  In the data display device 30, the display unit 33 draws points representing the request information data on the scatter diagram screen of the display 39 based on the request information log data acquired from the analysis device 20. At this time, the display unit 33 performs different processing depending on the request information classified into the abnormal request category and the request information classified into the normal request category.

  FIG. 16 is a flowchart of data point display processing by the data display device of the present embodiment.

  In the data display device 30, the data acquisition unit 31 acquires request information log data from the analysis device 20 (step S40). The data acquisition unit 31 stores the acquired request information log data in the data storage unit 32.

  The classification determination unit 34 determines whether the data classification of the acquired request information log is a normal request (step S41). For example, the category determination unit 34 determines the category by confirming the category information included in the data of the request information log.

  When the acquired data classification of the request information log is not a normal request (NO in step S41), the display unit 33 draws a point corresponding to the request information data on the screen of the scatter diagram displayed on the display 39. (Step S42). When the data classification of the acquired request information log is an abnormal request, the actual data of individual request information is included in the acquired request information log data. The data display device 30 returns to step S40 and proceeds to the processing of the next request information log data.

  When the data classification of the acquired request information log is a normal request (YES in step S41), the point generation unit 35 generates points from the statistical information included in the acquired request information log data (step S41). S43). When the data classification of the acquired request information log is a normal request, the acquired request information log data includes statistical information indicating the distribution status of a plurality of request information. The point generation unit 35 automatically generates data of points to be drawn from the statistical information. A specific example of point generation will be described later.

  The display unit 33 draws the generated points and the points according to the data of the representative request information on the screen of the scatter diagram displayed on the display 39 (step S44). If the data classification of the acquired request information log is a normal request, the data of the representative request information is included in the acquired request information log data. The data display device 30 returns to step S40 and proceeds to the processing of the next request information log data.

Here, an example will be described in which points representing data of request information into which normal requests are classified are generated from statistical information. Here, for each point representing the request information to be generated, the value x _i1 (i = 1 to M−1) of the time stamp TS as the first attribute is the second attribute from the statistical information of the uniform distribution. The value x _i2 (i = 1 to M−1) of the response time RT is determined from the statistical information of the normal distribution.

  The number of points to be automatically generated is M-1. This is the number obtained by subtracting one of the representative request information from the number M of request information that is the basis of the data of the request information log. The number of points according to the number of original request information is obtained by combining the generated points and the points according to the representative request information.

  FIG. 17 is a flowchart of data generation processing for uniformly distributed attributes in the point generation processing by the data display apparatus according to the present embodiment.

The example of uniform distribution data generation processing shown in FIG. 17 is an example of processing for generating time stamp data of points to be automatically generated from statistical information (TS _min , TS _max ) indicating the time stamp range.

  The point generation unit 35 initializes i to 1 (step S50).

The point generator 35 generates a uniform random number Ra in the sections 0 to 1 (Step S51). The uniformly distributed random numbers can be generated by a technique such as a rand () function of a programming language or a Mersenne twister. The point generation unit 35 generates the time stamp data x _i1 of the i-th point using the value of the generated random number Ra by the following equation (4) (step S52).

x _i1 = TS _min + (TS _max −TS _min ) · Ra Equation (4)
The point generation unit 35 increments the value of i (step S53). The point generation unit 35 determines whether the value of i exceeds M−1 (step S54). If the value of i does not exceed M−1 (NO in step S54), the point generation unit 35 returns to the process of step S51 and proceeds to a process of generating a time stamp value of the next point. If the value of i exceeds M−1 (YES in step S54), the point generation unit 35 ends the process.

  FIG. 18 is a flowchart of data generation processing for the attribute of normal distribution in the point generation processing by the data display device of the present embodiment.

The normal distribution data generation process shown in FIG. 18 is an example of a process for generating response time data for automatically generated points from statistical information (g ₂ , σ ₂ ) indicating the distribution state of response times.

  The point generation unit 35 initializes i to 1 (step S60).

The point generator 35 generates two uniform random numbers Ra ₀ and Ra ₁ in the sections 0 to ₁ (step S61).

Here, the point generation unit 35 obtains a normally distributed random number from a uniformly distributed random number by using the technique of the Box Mueller method. That is, the point generation unit 35 generates two normal random numbers w ₀ and w ₁ from the two uniform random numbers Ra ₀ and Ra ₁ (step S62). The expressions for obtaining the two normal random numbers w ₀ and w ₁ are the following expressions (5) and (6), respectively.

The point generation unit 35 determines whether i mod 2 = 0 (step S63). If i mod 2 = 0 (YES in step S63), that is, if i is an even number, the response time data x _i2 of the i-th point is generated by the following equation (7) (step S64).

x _i2 = g ₂ + w ₀ · σ ₂ Formula (7)
If i mod 2 = 0 is not satisfied (NO in step S63), that is, if i is an odd number, the response time data x _i2 of the i-th point is generated by the following equation (8) (step S65).

x _i2 = g ₂ + w ₁ · σ ₂ Formula (8)
The point generation unit 35 increments the value of i (step S66). The point generation unit 35 determines whether the value of i exceeds M−1 (step S67). If the value of i does not exceed M−1 (NO in step S67), the point generation unit 35 returns to the process of step S61 and proceeds to a process of generating a time stamp value of the next point. If the value of i exceeds M−1 (YES in step S67), the point generation unit 35 ends the process.

  17 and 18, data of a plurality of points having attributes of time stamp and response time can be automatically generated from statistical information indicating the distribution status of a plurality of request information.

  Further, since the automatically generated point data is generated based on statistical information indicating the distribution status of a plurality of original request information, it represents the request information classified into regular requests displayed on the display 39. The distribution of points is close to the distribution of actual data. Thereby, the user can read the tendency of the whole data from the distribution of the points representing the displayed data.

  When the data display device 30 receives an operation for designating a point on the scatter diagram screen displayed on the display 39 by the user, the data display device 30 responds to the designated point according to the classification of the request information represented by the designated point. The request information data is displayed on the display 39.

  FIG. 19 is a diagram for explaining an example of data display according to the designated point according to the present embodiment.

  FIG. 19A shows an example in which the point designated by the user's operation is a point representing request information classified into abnormal request categories. As shown in FIG. 19A, when a point representing request information classified as an abnormal request is designated by an operation, the designated data display unit 36 displays actual data of request information corresponding to the designated point. Is displayed on the display 39. The actual data of the request information corresponding to the designated point is included in the request information log data acquired by the data acquisition unit 31 and stored in the data storage unit 32.

  FIG. 19B shows an example in which the point designated by the user's operation is a point representing request information classified into the normal request category. As shown in FIG. 19B, when a point representing request information classified as a normal request by an operation is designated, the designated data display unit 36 becomes a representative in the group including the designated point. Data of representative request information corresponding to the point is displayed on the display 39. The data of the representative request information corresponding to the representative point in the group including the designated point is included in the data of the request information log acquired by the data acquisition unit 31 and stored in the data storage unit 32.

  As shown in FIG. 19B, when a point representing request information classified as a normal request by an operation is designated, the designated data display unit 36 displays the range of the group including the designated point. indicate. The range of the group including the designated point corresponds to the processing target area shown in FIGS.

  In the present embodiment, the statistical range of request information classified as a normal request can be presented to the user by displaying the range of the group including the designated point. As a result, the user can know the statistical range of the actual data for which the representative request information is selected simply by looking at the screen.

  In the example shown in FIG. 19, the point is drawn with a circle, but the shape of the point to be drawn is arbitrary. For example, the point may be drawn with a square or rhombus, or may be drawn with some character.

  FIG. 20 is a flowchart of the designated point corresponding data display processing by the data display device of the present embodiment.

  In the data display device 30, the operation accepting unit 37 accepts an operation in which the user designates one point with the keyboard / mouse 38 from the points representing the request information displayed on the display 39 (step S70).

  The designated data display unit 36 determines whether the point designated by the accepted operation is a point representing request information classified as a normal request (step S71).

  If the designated point is a point representing request information classified as a normal request (YES in step S71), the designated data display unit 36 displays request information corresponding to a point representing a group including the designated point. Data is displayed on the display 39 (step S72).

  If the designated point is not a point representing request information classified as a normal request (NO in step S71), the designated data display unit 36 displays actual data of request information corresponding to the designated point on the display 39. Displayed (step S73).

  With the data display device 30 according to the present embodiment, even if the original data amount is reduced, points representing the original data can be drawn on the screen such as the display 39. Even when the data display device 30 acquires data from another device and draws it on the screen, the amount of data to be transferred is small, so that the drawing delay due to the overhead of data transfer can be prevented.

  In addition, even if the original data is reduced, it is possible to leave enough data that matches the user's purpose. Display is possible.

  Although the present embodiment has been described above, the present invention can naturally be modified in various ways within the scope of the gist thereof.

  For example, in the example of the present embodiment, the capture device 10, the analysis device 20, and the data display device 30 are each realized by separate computers, but some of these devices may be realized by the same computer. . For example, the capture device 10 and the analysis device 20 may be realized by one computer, and the data display device 30 may be realized by another computer. Further, for example, all of the capture device 10, the analysis device 20, and the data display device 30 may be realized by a single computer.

DESCRIPTION OF SYMBOLS 10 Capture apparatus 11 Message collection part 12 Message processing part 13 Message log memory | storage part 20 Analysis apparatus 21 Message log reading part 22 Message link part 23 Data generation part 24 Generated data storage part 25 Classification data processing part 26 Classification part 27 Representative data Selection unit 28 Data statistics unit 29 Analysis result data storage unit 30 Data display device 31 Data acquisition unit 32 Data storage unit 33 Display unit 34 Classification determination unit 35 Point generation unit 36 Designated data display unit 37 Operation reception unit 38 Keyboard / mouse 39 Display 50 Monitored System 51 Web Server 52 AP Server 53 DB Server 55 Switch 60 Client

Claims (5)

Computer
Accepts a designation operation to designate one of multiple points displayed on the display device;
The specification operation, to specify the point corresponding to the data to be classified in the first section, to display the data corresponding to the point,
The specification operation, to specify the point corresponding to the data to be classified in the first section different from the second segment corresponds to a point to be represented by a group having a plurality of points including the point Lud over data display program to execute the process of displaying the data. The group includes a plurality of points generated from statistical information indicating a distribution state of a plurality of data classified in the second category, and points corresponding to representative data selected from the plurality of data. The data display program according to claim 1, further comprising: The data is data based on information obtained from a system whose behavior is to be monitored,
The point is a point corresponding to the data in the scatter diagram representing the operating status of the system whose behavior is to be monitored,
The data classified into the first category is data determined to be abnormal according to a predetermined standard,
The data display program according to claim 1 or 2, wherein the data classified into the second category is data determined to be normal according to a predetermined standard. An operation accepting unit for accepting a designation operation for designating one of a plurality of displayed points ;
The specification operation, to specify the point corresponding to the data to be classified in the first section, to display the data corresponding to the point, the designated operation, a second section that is different from the first section when specifying a point corresponding to the data to be classified, the data display characterized by comprising a display unit for displaying data corresponding to the point to be represented in the group having a plurality of points including the point apparatus. Computer
Accepts a designation operation to designate one of multiple points displayed on the display device;
The specification operation, to specify the point corresponding to the data to be classified in the first section, to display the data corresponding to the point,
The specification operation, to specify the point corresponding to the data to be classified in the first section different from the second segment corresponds to a point to be represented by a group having a plurality of points including the point A data display method characterized by executing a process of displaying data.

Images