JP6349983B2 - Abnormality detection method, abnormality detection program, and abnormality detection device - Google Patents

Description

  The present invention relates to an abnormality detection method, an abnormality detection program, and an abnormality detection apparatus.

  Conventionally, the occurrence of an abnormality is detected from a change in the detected value. For example, in a system using a server or the like, the utilization rate of a CPU (Central Processing Unit) of the server is monitored, and when the utilization rate of the CPU exceeds a certain level, it is detected that an abnormality has occurred.

JP 2008-9610 A JP 2008-186472 A JP 2001-142708 A JP 2010-250807 A

  However, in the conventional technique, detection of the occurrence of abnormality may be delayed. For example, when it is detected that an abnormality has occurred when the CPU usage rate exceeds a certain level, the occurrence of the abnormality cannot be detected until immediately before the occurrence of the abnormality or after the occurrence of the abnormality.

  Such a problem occurs not only when the occurrence of an abnormality is detected from the usage rate of the CPU, but generally occurs when the occurrence of an abnormality is detected from a change in the detection value.

  In one aspect, an object of the present invention is to provide an abnormality detection method, an abnormality detection program, and an abnormality detection device that can detect the occurrence of an abnormality at an early stage.

  In one aspect, in the abnormality detection method, the computer executes a process of acquiring a detection value indicating the state of the monitoring target. In the abnormality detection method, for each acquired detection value, the computer executes a process of determining whether the detection value is larger than the minimum value of the detection values in a specific period before the acquisition time. In the abnormality detection method, when a determination result that the detected value is larger than the minimum value of the detected value in the specific period is continuously obtained for a predetermined time or longer, the computer executes processing for outputting an alert.

  According to one aspect of the present invention, the occurrence of abnormality can be detected at an early stage.

FIG. 1 is a diagram illustrating an example of a system configuration for detecting an abnormality. FIG. 2 is a diagram illustrating an example of a functional configuration of the abnormality detection apparatus. FIG. 3 is a diagram illustrating an example of a data configuration of the first standby set. FIG. 4 is a diagram illustrating an example of a data configuration of the first active set. FIG. 5 is a diagram illustrating an example of a data configuration of the second standby set. FIG. 6 is a diagram illustrating an example of a data configuration of the second active set. FIG. 7A is a diagram illustrating an example of a flow when detecting occurrence of a memory leak. FIG. 7B is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 7C is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 7D is a diagram illustrating an example of a flow when detecting occurrence of a memory leak. FIG. 7E is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 7F is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 7G is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 7H is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 7I is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 7J is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 7K is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 7L is a diagram illustrating an example of a flow when detecting the occurrence of a memory leak. FIG. 8 is a diagram illustrating an example of a change in the memory usage rate when a memory leak occurs. FIG. 9 is a diagram illustrating another example of a change in memory usage rate when a memory leak occurs. FIG. 10 is a flowchart illustrating an example of the procedure of the abnormality detection process. FIG. 11 is a diagram illustrating an example of a functional configuration of the abnormality detection apparatus. FIG. 12 is a diagram illustrating an example of a data configuration of the third standby set. FIG. 13 is a diagram illustrating an example of a data configuration of the third active set. FIG. 14A is a diagram illustrating an example of a flow when detecting occurrence of an abnormality of a CPU. FIG. 14B is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14C is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14D is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14E is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14F is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14G is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14H is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14I is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14J is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14K is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14L is a diagram illustrating an example of a flow for detecting occurrence of an abnormality in the CPU. FIG. 14M is a diagram illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 15 is a diagram illustrating an example of a change in the usage rate of the CPU. FIG. 16 is a diagram illustrating another example of the change in the usage rate of the CPU. FIG. 17 is a flowchart illustrating an example of the procedure of the abnormality detection process. FIG. 18 is a diagram illustrating a computer that executes an abnormality detection program.

  Hereinafter, embodiments of an abnormality detection method, an abnormality detection program, and an abnormality detection apparatus according to the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiments. Each embodiment can be appropriately combined within a range in which processing contents are not contradictory.

[System configuration]
First, an example of a system that detects an abnormality using the abnormality detection apparatus according to the first embodiment will be described. FIG. 1 is a diagram illustrating an example of a system configuration for detecting an abnormality. As illustrated in FIG. 1, the system 10 includes a server device 11 and an abnormality detection device 12. The server device 11 and the abnormality detection device 12 are communicably connected via a network 13 and can exchange various kinds of information. As an aspect of the network 13, any type of communication network such as mobile communication such as a mobile phone, Internet (Internet), LAN (Local Area Network), VPN (Virtual Private Network), etc., regardless of wired or wireless. Can be adopted.

  The server device 11 is a device on which a predetermined system operates. For example, the server device 11 is a server computer that is provided in a company or a data center and provides a basic system or provides a predetermined service. In the example of FIG. 1, the case where the number of server apparatuses 11 is one is illustrated, but the present invention is not limited to this, and the number of server apparatuses 11 can be any number. For example, the system 10 may be a cloud system that provides a cloud service with a plurality of server apparatuses 11.

  The abnormality detection device 12 is a device that detects the occurrence of an abnormality in the server device 11. The abnormality detection device 12 is, for example, a computer such as a personal computer or a server computer. The abnormality detection device 12 may be implemented as a single computer or may be implemented by a plurality of computers. Further, the abnormality detection device 12 may also serve as a management terminal that manages the system 10 or the server device 11. In this embodiment, a case where the abnormality detection device 12 is provided as one computer will be described as an example.

[Configuration of anomaly detection device]
Next, the configuration of the abnormality detection device 12 according to the first embodiment will be described. FIG. 2 is a diagram illustrating an example of a functional configuration of the abnormality detection apparatus. As shown in FIG. 2, the abnormality detection device 12 includes a communication I / F (interface) unit 20, a storage unit 21, and a control unit 22.

  The communication I / F unit 20 is an interface that controls communication with other devices. As the communication I / F unit 20, a network interface card such as a LAN card can be adopted.

  The communication I / F unit 20 transmits / receives various information to / from other apparatuses via the network 13. For example, the communication I / F unit 20 can transmit and receive various types of information to and from the server device 11, and receives various types of information indicating the state of the server device 11 from the server device 11.

  The storage unit 21 is a storage device that stores various data. For example, the storage unit 21 is a storage device such as a hard disk, an SSD (Solid State Drive), or an optical disk. Note that the storage unit 21 may be a semiconductor memory that can rewrite data, such as a random access memory (RAM), a flash memory, and a non-volatile static random access memory (NVSRAM).

  The storage unit 21 stores an OS (Operating System) executed by the control unit 22 and various programs. For example, the memory | storage part 21 memorize | stores various programs including the program which performs the abnormality detection process mentioned later. Furthermore, the storage unit 21 stores various data used in programs executed by the control unit 22. For example, the storage unit 21 stores a first standby set 30, a first active set 31, a second standby set 32, and a second active set 33.

  The first active set 31 and the second active set 33 are data areas for holding data for a period to be detected for abnormality. For example, in this embodiment, the minimum value of the detection value in a predetermined first period to be described later is obtained. Further, in this embodiment, it is determined whether or not the determination result that is larger than the minimum value of the first period is obtained continuously for a predetermined second period. This first period has a predetermined time interval from when the detection value is acquired, and is, for example, a period of 5 minutes to 30 minutes. The first period may be a period including the time when the detection value is acquired. Further, the second period is a period including the time of acquisition of the detection value, and is, for example, a period of 0 minutes to 30 minutes. The first active set 31 stores data such as detection values for the first period. Further, the second active set 33 stores data for determining whether or not the determination result that is greater than the minimum value of the first period is continued for the second period.

  The first standby set 30 and the second standby set 32 are data areas for holding data before a period to be detected for abnormality.

  FIG. 3 is a diagram illustrating an example of a data configuration of the first standby set. As shown in FIG. 3, the first standby set 30 includes items of “time” and “detection value”. The time item is an area for storing time information at which the detected value is acquired. The detection value item is an area for storing the acquired detection value. Each time a detection value is acquired, the acquired detection value is stored in the first standby set 30 together with time information.

  FIG. 4 is a diagram illustrating an example of a data configuration of the first active set. As shown in FIG. 4, the first active set 31 has the same configuration as the first standby set 30 described above, and includes items of “time” and “detected value”. In the first active set 31, among the detection values stored in the first standby set 30, a detection value whose time is within the first period is stored together with time information.

  FIG. 5 is a diagram illustrating an example of a data configuration of the second standby set. As shown in FIG. 5, the second standby set 32 includes items of “time”, “detected value”, and “flag”. The time item is an area for storing time information at which the detected value is acquired. The detection value item is an area for storing the acquired detection value. The flag item is an area for storing a flag indicating the result of determining the data state in the first period. Each time the detection value is acquired, the acquired detection value is stored in the second standby set 32 together with time information and a flag.

  FIG. 6 is a diagram illustrating an example of a data configuration of the second active set. As shown in FIG. 6, the second active set 33 has the same configuration as the second standby set 32 described above, and includes items of “time”, “detected value”, and “flag”. Of the detection values stored in the second standby set 32, the detection value whose time is within the second period is stored in the second active set 33 together with time information and a flag.

  Specific examples of data of the first standby set 30, the first active set 31, the second standby set 32, and the second active set 33 will be described later.

  Returning to FIG. 2, the control unit 22 is a device that controls the abnormality detection device 12. As the control unit 22, an electronic circuit such as a CPU or an MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array) can be used. The control unit 22 has an internal memory for storing programs defining various processing procedures and control data, and executes various processes using these. The control unit 22 functions as various processing units by operating various programs. For example, the control unit 22 includes an acquisition unit 40, a determination unit 41, and an output unit 42.

  The acquisition unit 40 performs various acquisitions. For example, the acquisition unit 40 acquires a detection value indicating the state of the monitoring target. The detection value may be periodically detected by the server device 11 and transmitted to the abnormality detection device 12. In addition, the acquisition unit 40 may periodically request the server device 11 to transmit the detection value, and the server device 11 may detect the request value and transmit the detection value to the abnormality detection device 12. In this embodiment, the monitoring target is the server device 11, and the memory usage rate of the server device 11 is acquired as a detection value indicating the state of the monitoring target.

  The acquisition unit 40 stores the acquired detection value in the first standby set 30 together with time information. In addition, the acquisition unit 40 moves detection values stored in the first standby set 30 within the first period to the first active set 31. In addition, the determination unit 41 deletes, from the first active set 31, detection values that are outside the first period among the detection values stored in the first active set 31.

  The determination unit 41 performs various determinations. For example, the determination unit 41 determines, for each detection value acquired by the acquisition unit 40, whether the detection value is larger than the minimum value of the detection value in the first period before the acquisition. For example, the determination unit 41 specifies the minimum value of the detection values in the detection values stored in the first active set 31 each time the detection value is acquired by the acquisition unit 40. The minimum value of the detection value stored in the first active set 31 is the minimum value of the detection value in the first period. Each time the detection value is acquired, the determination unit 41 compares the acquired detection value with the minimum value of the detection value in the first period, and the acquired detection value is the minimum value of the detection value in the first period. It is judged whether it is larger than. In this determination, it may be determined whether the detected value is greater than the minimum value of the detected value in the first period or more. In the present embodiment, the determination unit 41 determines whether the detected value is larger than a value obtained by adding a minimum value of the detected value in the first period and a predetermined threshold value. The threshold value is a value for determining whether or not the detected value has a generally abnormal upward tendency, and is set to a value of zero or more.

  The determination unit 41 stores the acquired detection value in the second standby set 32 together with the determination result and time information. Further, the determination unit 41 stores a flag indicating whether or not the latest detection value is larger than the minimum detection value in the first period in the second standby set 32 as a determination result.

  The output unit 42 performs various outputs. For example, the output unit 42 detects whether or not an abnormality has occurred based on the determination result in the second period. The output unit 42 outputs an alert when it is detected that an abnormality has occurred. For example, the output unit 42 assumes that an abnormality has occurred when the result of determination that the detected value is larger than the minimum value of the detected value in the first period is continuously obtained during the second period. , Output an alert. For example, the output unit 42 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In addition, the output unit 42 deletes, from the second active set 33, detection values that are out of the second period among the detection values stored in the second active set 33. And the output part 42 outputs an alert, when it determines with all the detected values memorize | stored in the 2nd active set 33 being larger than the minimum value of the nearest 1st period.

  Here, it demonstrates using a specific example. In this embodiment, a case will be described as an example in which the monitoring target is the server device 11, the memory usage rate of the server device 11 is acquired as a detection value, and the occurrence of a memory leak in the server device 11 is detected as an abnormality. In the present embodiment, the first period is a period 2 minutes to 4 minutes ago, and the second period is a period 0 minutes to 6 minutes ago. In this embodiment, a case where it is detected that a memory leak has occurred when a state where the detected value is larger than the minimum value of the first period by a threshold value “5” or more continues for the second period will be described as an example. 7A to 7L are diagrams illustrating an example of a flow when detecting the occurrence of a memory leak. In FIG. 7A to FIG. 7L, the memory usage rate detected by the server device 11 every minute and stored in the first standby set 30, the first active set 31, the second standby set 32, and the second active set 33 are stored. An example of the change in data to be performed is shown. In the example of FIGS. 7A to 7L, the time is shown with the time point of FIG. 7A as a reference (00:00) in order to make it easier to grasp the passage of time. In the example of FIGS. 7A to 7L, the memory usage rate acquired at each time is shown as an input.

  As illustrated in FIG. 7A, when the memory usage rate “11” of the server apparatus 11 is acquired at time “00:00”, the acquisition unit 40 obtains the time “00:00” and the memory usage rate “11”. One standby set 30 is stored. The first period is a period from 2 minutes to 4 minutes ago. For this reason, the acquisition unit 40 does not store data in the first active set 31. Since no data is stored in the first active set 31, the minimum value of the memory usage rate stored in the first active set 31 is undetermined. The acquired memory usage rate “11” is not larger than a value obtained by adding the minimum value of the memory usage rate stored in the first active set 31 and the threshold value “5”. For this reason, the determination unit 41 stores the time “00:00” and the memory usage rate “11” in the second standby set 32 as the flag “0”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7A, since the second period is a period from 0 minutes to 6 minutes ago, as a result of the movement, the time “00:00”, the memory usage rate “11”, and the flag “0” are the second active set. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7B, when the memory usage rate “83” of the server apparatus 11 is acquired at time “00:01”, the acquisition unit 40 acquires the time “00:01” and the memory usage rate “83”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. For this reason, the acquisition unit 40 does not store data in the first active set 31. Since no data is stored in the first active set 31, the minimum value of the memory usage rate stored in the first active set 31 is undetermined. The acquired memory usage rate “83” is not larger than a value obtained by adding the minimum value of the memory usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the determination unit 41 stores the time “00:01” and the memory usage rate “83” in the second standby set 32 as the flag “0”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7B, since the second period is a period from 0 minutes to 6 minutes ago, the time “00:01”, the memory usage rate “83”, and the flag “0” are the second active set as a result of the movement. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7C, when the memory usage rate “14” of the server device 11 is acquired at time “00:02”, the acquisition unit 40 acquires the time “00:02” and the memory usage rate “14”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:00” and the detection value “11” in the first active set 31. The acquired memory usage rate “14” is not larger than a value obtained by adding the minimum value “11” of the memory usage rate stored in the first active set 31 and the threshold value “5”. For this reason, the determination unit 41 stores the time “00:02” and the memory usage rate “14” in the second standby set 32 as the flag “0”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7C, since the second period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:02”, the memory usage rate “14”, and the flag “0” are the second active set. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7D, when the memory usage rate “77” of the server device 11 is acquired at time “00:03”, the acquisition unit 40 acquires the time “00:03” and the memory usage rate “77”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:01” and the detection value “83” in the first active set 31. The acquired memory usage rate “77” is larger than the sum of the minimum value “11” of the memory usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the determination unit 41 stores the time “00:03” and the memory usage rate “77” in the second standby set 32 as the flag “1”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7D, since the second period is a period from 0 minutes to 6 minutes ago, the time “00:03”, the memory usage rate “77”, and the flag “1” are the second active set as a result of the movement. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7E, when the memory usage rate “15” of the server apparatus 11 is acquired at time “00:04”, the acquisition unit 40 acquires the time “00:04” and the memory usage rate “15”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:02” and the detection value “14” in the first active set 31. The acquired memory usage rate “15” is not larger than a value obtained by adding the minimum value “11” of the memory usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the determination unit 41 stores the time “00:04” and the memory usage rate “15” in the second standby set 32 as the flag “0”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7E, since the second period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:04”, the memory usage rate “15”, and the flag “0” are the second active set. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7F, when the memory usage rate “53” of the server device 11 is acquired at time “00:05”, the acquisition unit 40 acquires the time “00:05” and the memory usage rate “53”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:03” and the detection value “77” in the first active set 31. In addition, since the data at time “00:00” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The acquired memory usage rate “53” is larger than the value obtained by adding the minimum value “14” of the memory usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the determination unit 41 stores the time “00:05” and the memory usage rate “53” in the second standby set 32 as the flag “1”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7F, since the second period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:05”, the memory usage rate “53”, and the flag “1” are the second active set. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7G, when the memory usage rate “42” of the server apparatus 11 is acquired at time “00:06”, the acquisition unit 40 acquires the time “00:06” and the memory usage rate “42”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:04” and the detection value “15” in the first active set 31. In addition, since the data at time “00:01” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The acquired memory usage rate “42” is larger than the value obtained by adding the minimum value “14” of the memory usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the determination unit 41 stores the time “00:06” and the memory usage rate “42” in the second standby set 32 as the flag “1”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7G, since the second period is a period from 0 minutes to 6 minutes ago, the time “00:06”, the memory usage rate “42”, and the flag “1” are the second active set as a result of the movement. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7H, when the memory usage rate “70” of the server apparatus 11 is acquired at time “00:07”, the acquisition unit 40 acquires the time “00:07” and the memory usage rate “70”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:05” and the detection value “53” in the first active set 31. In addition, since the data at time “00:02” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The acquired memory usage rate “70” is larger than the value obtained by adding the minimum value “15” of the memory usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the determination unit 41 stores the time “00:07” and the memory usage rate “70” in the second standby set 32 as the flag “1”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7H, since the second period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:07”, the memory usage rate “70”, and the flag “1” are the second active set. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7I, when the memory usage rate “21” of the server device 11 is acquired at the time “00:08”, the acquisition unit 40 acquires the time “00:08” and the memory usage rate “21”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:06” and the detection value “42” in the first active set 31. In addition, since the data at time “00:03” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The acquired memory usage rate “21” is larger than the sum of the minimum value “15” of the memory usage rate stored in the first active set 31 and the threshold value “5”. For this reason, the determination unit 41 stores the time “00:08” and the memory usage rate “21” in the second standby set 32 as the flag “1”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7I, since the second period is a period from 0 minutes to 6 minutes ago, the time “00:08”, the memory usage rate “21”, and the flag “1” are the second active set as a result of the movement. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7J, when the memory usage rate “83” of the server apparatus 11 is acquired at time “00:09”, the acquisition unit 40 acquires the time “00:09” and the memory usage rate “83”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:07” and the detection value “70” in the first active set 31. In addition, since the data at time “00:04” is out of the first period, the acquisition unit 40 deletes the data from the first active set 31. The acquired memory usage rate “83” is larger than the value obtained by adding the minimum value “42” of the memory usage rate stored in the first active set 31 and the threshold value “5”. For this reason, the determination unit 41 stores the time “00:09” and the memory usage rate “83” in the second standby set 32 as the flag “1”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7J, since the second period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:09”, the memory usage rate “83”, and the flag “1” are the second active set. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7K, when the memory usage rate “47” of the server apparatus 11 is acquired at time “00:10”, the acquisition unit 40 acquires the time “00:10” and the memory usage rate “47”. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:08” and the detection value “21” in the first active set 31. In addition, since the data at time “00:05” is outside the first period, the acquiring unit 40 deletes the data from the first active set 31. The acquired memory usage rate “47” is larger than the value obtained by adding the minimum value “21” of the memory usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the determination unit 41 stores the time “00:10” and the memory usage rate “47” in the second standby set 32 as the flag “1”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7K, since the second period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:10”, the memory usage rate “47”, and the flag “1” are the second active set. 33 and the second standby set 32 is empty.

  Next, as illustrated in FIG. 7L, when the memory usage rate “93” of the server apparatus 11 is acquired at time “00:11”, the acquisition unit 40 acquires the time “00:11” and the memory usage rate “93. Is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:09” and the detection value “83” in the first active set 31. In addition, since the data at time “00:06” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The acquired memory usage rate “93” is larger than the value obtained by adding the minimum value “21” of the memory usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the determination unit 41 stores the time “00:11” and the memory usage rate “93” in the second standby set 32 as the flag “1”. The output unit 42 moves the detected value stored in the second standby set 32 to the second active set 33 within the second period. In the example of FIG. 7L, since the second period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:11”, the memory usage rate “93”, and the flag “1” are the second active set. 33 and the second standby set 32 is empty.

  Here, all the data of the second period stored in the second active set 33 shown in FIG. The state shown in FIG. 7L is a state in which the determination result that the acquired detection value is larger than the minimum value of the detection value in the first period is obtained continuously during the second period. The output unit 42 outputs an alert when all the data flags stored in the second active set 33 are “1”.

  For example, in the server device 11, when a memory leak occurs, the memory usage rate changes according to the process, but since the entire memory storage area cannot be released, the minimum value of the memory usage rate gradually increases.

  FIG. 8 is a diagram illustrating an example of a change in the memory usage rate when a memory leak occurs. As shown in FIG. 8, the memory usage rate repeatedly increases and decreases, but increases globally. In such a case, for example, if it is detected that an abnormality has occurred when the memory usage rate exceeds a certain threshold value, the detection of the occurrence of the abnormality may be delayed.

  On the other hand, when a memory leak has occurred, the entire memory storage area cannot be released, so the memory usage rate increases and decreases, although it increases and decreases repeatedly. Therefore, the abnormality detection device 12 periodically acquires the memory usage rate of the server device 11. Then, the abnormality detection device 12 continuously obtains the determination result that the acquired detection value is larger than the minimum value of the detection value in the first period before the acquisition for the second period. If it is detected, a memory leak is detected and an alert is output. FIG. 9 is a diagram illustrating another example of a change in memory usage rate when a memory leak occurs. In the example of FIG. 9, the flag “1” is displayed in a portion where the acquired memory usage rate is higher than the minimum value of the first period before the acquisition of the memory usage rate. Thus, when the period of the flag “1” continues for the second period, the occurrence of an abnormality can be detected early by outputting an alert.

[Process flow]
A flow of an abnormality detection process in which the abnormality detection device 12 according to the present embodiment detects an abnormality will be described. FIG. 10 is a flowchart illustrating an example of the procedure of the abnormality detection process. This abnormality detection process is executed at a predetermined timing, for example, a timing at which a detection value is acquired from the server device 11.

  As illustrated in FIG. 10, when the acquisition unit 40 acquires a detection value from the server device 11, the acquisition unit 40 stores the acquired detection value in the first standby set 30 together with time information (S10). The acquisition unit 40 adds the detection value stored in the first standby set 30 within the first period to the first active set 31 (S11). The acquisition unit 40 deletes the data within the first period from the detection values stored in the first standby set 30 from the first standby set 30 (S12).

  The determination unit 41 specifies the minimum value of the detection values within the detection values stored in the first active set 31 (S13). The determination unit 41 determines whether the acquired detected value is larger than the value obtained by adding the minimum value and the threshold (S14). When the detected value is larger than the added value (Yes in S14), “1 (ON)” is set in the flag (S15). On the other hand, if the detected value is not greater than the added value (No in S14), “0 (OFF)” is set in the flag (S16).

  The determination unit 41 stores the acquired detection value, time information, and flag in the second standby set 32 (S17). The output unit 42 moves the detection value stored in the second standby set 32 within the second period to the second active set 33 (S18). Moreover, the output part 42 deletes the detection value which became out of the 2nd period among the detection values stored in the 2nd active set 33 from the 2nd active set 33 (S19). And the output part 42 determines whether all the flags of the detection value memorize | stored in the 2nd active set 33 are "1" (S20). When the flags are all “1” (Yes at S20), the output unit 42 outputs an alert (S21) and ends the process. On the other hand, if all the flags are not “1” (No at S20), the process is terminated.

[effect]
As described above, the abnormality detection device 12 according to the present embodiment acquires a detection value indicating the state of the monitoring target. The abnormality detection device 12 determines, for each acquired detection value, whether the detection value is greater than the minimum value of the detection values in a specific period (first period) before the acquisition time. The abnormality detection device 12 outputs an alert when the determination result that the detected value is larger than the minimum value of the detected value in the specific period is continuously obtained for a predetermined time (second period) or longer. Thereby, the abnormality detection device 12 can detect the occurrence of abnormality at an early stage.

  Further, the abnormality detection device 12 according to the present embodiment uses the detected value as the memory usage rate. Thereby, the abnormality detection device 12 can detect the occurrence of the memory leak at an early stage.

  Here, the abnormality detection device 12 according to the first embodiment has been described with respect to the case where it is determined whether the detection value is larger than the minimum value of the detection value in the specific period before the acquisition, but the present invention is limited to this. Not. For example, the abnormality detection device 12 according to the first embodiment determines, for each acquired detection value, whether the detection value is smaller than the maximum value of the detection values in a specific period before the acquisition time. And the abnormality detection apparatus 12 which concerns on Example 1 outputs an alert, when the determination result that a detected value is smaller than the maximum value of the detected value in a specific period is obtained continuously over predetermined time or more. Also good. In this case, the abnormality detection device 12 according to the present embodiment can detect an abnormality in which the maximum detected value tends to decrease early. As described above, examples of the detection value that can detect an abnormality from the change in the maximum value of the detection value in the first period include a memory vacancy rate. For example, when a memory leak occurs, the memory vacancy rate tends to decrease. For this reason, the occurrence of a memory leak can be detected by detecting a tendency for the memory vacancy rate to decrease.

  Next, Example 2 will be described. The configuration of the system 10 according to the second embodiment is the same as the configuration of the first embodiment illustrated in FIG.

[Configuration of anomaly detection device]
A functional configuration of the abnormality detection apparatus according to the second embodiment will be described. FIG. 11 is a diagram illustrating an example of a functional configuration of the abnormality detection apparatus. The same parts as those of the abnormality detection device 12 according to the first embodiment shown in FIG. 2 are denoted by the same reference numerals, and different parts will be mainly described. As illustrated in FIG. 11, the storage unit 23 of the abnormality detection device 12 further stores a third standby set 34 and a third active set 35.

  The third active set 35 is a data area for holding data of a period that is a target of abnormality detection. For example, in the present embodiment, in the second period, it is determined whether the determination result that the acquired detection value is larger than the maximum value in the first period is obtained at least once. In the present embodiment, in the second period, a period in which the determination result that the acquired detection value is larger than the maximum value in the first period is obtained at least once is obtained continuously for a predetermined third period. If an alert is issued, an alert is output. This first period has a predetermined time interval from when the detection value is acquired, and is, for example, a period of 5 minutes to 30 minutes. Further, the second period is a period including the time of acquisition of the detection value, and is, for example, a period of 0 minutes to 30 minutes. Further, the third period is a period including the time of acquisition of the detection value, and is, for example, a period of 0 minutes to 30 minutes. In the third active set 35, in the second period, it is determined whether or not the period in which the determination result that the acquired detection value is larger than the maximum value in the first period is obtained at least once has continued for the third period. To store data.

  The third standby set 34 is a data area for holding data before a period to be detected for abnormality.

  FIG. 12 is a diagram illustrating an example of a data configuration of the third standby set. As shown in FIG. 12, the third standby set 34 has items of “time”, “detected value”, “flag”, and “continuous flag”. The time item is an area for storing time information at which the detected value is acquired. The detection value item is an area for storing the acquired detection value. The flag item is an area for storing a flag indicating the result of determining the data state in the first period. The item of the continuous flag is an area for storing a flag indicating the result of determining the data state in the second period. Each time a detection value is acquired, the acquired detection value is stored in the third standby set 34 together with time information, a flag, and a continuous flag.

  FIG. 13 is a diagram illustrating an example of a data configuration of the third active set. As shown in FIG. 13, the third active set 35 has the same configuration as the third standby set 34 described above, and each item of “time”, “detected value”, “flag”, and “continuous flag”. Have Of the detection values stored in the third standby set 34, the detection value whose time is within the third period is stored in the third active set 35 together with time information, a flag, and a continuous flag.

  Further, as shown in FIG. 11, the control unit 22 of the abnormality detection device 12 includes a first determination unit 43 and a second determination unit 44.

  The first determination unit 43 performs various determinations on the acquired detection value. For example, the first determination unit 43 detects, for each detection value acquired by the acquisition unit 40, the detection value in the first period before the acquisition, as in the determination unit 41 of the first embodiment. It is determined whether it is larger than the maximum value. For example, each time the detection value is acquired by the acquisition unit 40, the determination unit 41 specifies the maximum value of the detection value within the detection value stored in the first active set 31. The maximum detection value stored in the first active set 31 is the maximum detection value in the first period. Each time the detection value is acquired, the determination unit 41 compares the acquired detection value with the maximum value of the detection value in the first period, and the acquired detection value is greater than the maximum value of the detection value in the first period. Is also determined to be larger.

  The first determination unit 43 stores the acquired detection value in the second standby set 32 together with time information. Further, the first determination unit 43 stores a flag indicating whether or not the latest detection value is larger than the maximum detection value in the first period in the second standby set 32 as a determination result.

  The second determination unit 44 performs various determinations using the determination results of the first determination unit 43. For example, the second determination unit 44 determines whether or not the determination result that the acquired detection value is larger than the maximum value in the first period is obtained at least once in the second period. For example, the second determination unit 44 moves the detection values stored in the second standby set 32 within the second period to the second active set 33. In addition, the second determination unit 44 deletes, from the second active set 33, detection values that are outside the second period among the detection values stored in the second active set 33. Then, every time a detection value is acquired by the acquisition unit 40, the second determination unit 44 determines whether any of the detection values stored in the second active set 33 has a flag of 1.

  The second determination unit 44 stores the acquired detection value, time information, and flag in the third standby set 34. In addition, the second determination unit 44 stores a continuous flag in the third standby set 34 indicating whether or not there is a flag of 1 in any of the detection values stored in the second active set 33.

  The output unit 42 detects whether or not an abnormality has occurred based on the determination result in the third period. The output unit 42 outputs an alert when it is detected that an abnormality has occurred. For example, in the second period, the output unit 42 continuously determines that the determination result that the detected value is larger than the maximum value in the first period is obtained at least once during the third period. If obtained, an alert is output assuming that an abnormality has occurred. For example, the output unit 42 moves the detection value within the third period among the detection values stored in the third standby set 34 to the third active set 35. In addition, the output unit 42 deletes, from the third active set 35, the detection values that are outside the third period among the detection values stored in the third active set 35. Then, each time the detection value is acquired by the acquisition unit 40, the output unit 42 determines that all the detection values stored in the third active set 35 are larger than the maximum value in the first period. If it is determined that the result is obtained at least once, an alert is output.

  Here, it demonstrates using a specific example. In the present embodiment, an example will be described in which the monitoring target is the server device 11, the CPU usage rate of the server device 11 is acquired as a detection value, and the occurrence of an abnormality in the server device 11 is detected as an abnormality. In the present embodiment, the first period is a period from 2 minutes to 4 minutes ago, the second period is a period from 0 minutes to 3 minutes ago, and the third period is a period from 0 minutes to 6 minutes ago. Further, in this embodiment, a case will be described as an example in which it is detected that an abnormality of the CPU has occurred when a state where the detected value is greater than the maximum value of the first period by a threshold value “5” or more continues for the second period. 14A to 14M are diagrams illustrating an example of a flow when detecting the occurrence of an abnormality in the CPU. FIG. 14A to FIG. 14M show an example of the CPU usage rate detected by the server device 11 every minute. 14A to 14M show data stored in the first standby set 30, the first active set 31, the second standby set 32, the second active set 33, the third standby set 34, and the third active set 35. An example of the change is shown. In the examples of FIGS. 14A to 14M, the time is shown with the time point of FIG. 14A as a reference (00:00) in order to make it easier to grasp the passage of time. In the examples of FIGS. 14A to 14M, the CPU utilization rate acquired at each time is shown as an input.

  As illustrated in FIG. 14A, when the CPU usage rate “80” of the server apparatus 11 is acquired at time “00:00”, the acquisition unit 40 acquires the time “00:00” and the CPU usage rate “80”. Are stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. For this reason, the acquisition unit 40 does not store data in the first active set 31. Since no data is stored in the first active set 31, the maximum value of the CPU usage rate stored in the first active set 31 is undetermined. The acquired CPU usage rate “80” is not larger than a value obtained by adding the maximum value of the CPU usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:00” and the CPU usage rate “80” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14A, since the second period is a period from 0 to 3 minutes ago, the time “00:00”, the CPU usage rate “80”, and the flag “0” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  In the data of the second active set 33, all the flags are “0”. Therefore, the second determination unit 44 stores the time “00:00”, the CPU usage rate “80”, and the flag “0” in the third standby set 34 as the continuous flag “0”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14A, since the third period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:00”, the CPU usage rate “80”, the flag “0”, the continuous flag “ “0” is stored in the third active set 35 and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14B, when the CPU usage rate “83” of the server apparatus 11 is acquired at time “00:01”, the acquisition unit 40 acquires the time “00:01” and the CPU usage rate. “83” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. For this reason, the acquisition unit 40 does not store data in the first active set 31. Since no data is stored in the first active set 31, the maximum value of the CPU usage rate stored in the first active set 31 is undetermined. The acquired CPU utilization rate “83” is not greater than the value obtained by adding the maximum value of the CPU utilization rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:01” and the CPU usage rate “83” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14B, since the second period is a period from 0 to 3 minutes ago, the time “00:01”, the CPU usage rate “83”, and the flag “0” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  In the data of the second active set 33, all the flags are “0”. Therefore, the second determination unit 44 stores the time “00:01”, the CPU usage rate “83”, and the flag “0” in the third standby set 34 as the continuous flag “0”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14B, since the third period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:01”, the CPU usage rate “83”, the flag “0”, the continuous flag “ “0” is stored in the third active set 35 and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14C, when the CPU usage rate “14” of the server apparatus 11 is acquired at time “00:02”, the acquisition unit 40 acquires the time “00:02” and the CPU usage rate. “14” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:00” and the detection value “80” in the first active set 31. The CPU usage rate “14” is not larger than the value obtained by adding the maximum value “80” of the CPU usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:02” and the CPU usage rate “14” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14C, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:02”, the CPU usage rate “14”, and the flag “0” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  In the data of the second active set 33, all the flags are “0”. Therefore, the second determination unit 44 stores the time “00:02”, the CPU usage rate “14”, and the flag “0” in the third standby set 34 as the continuous flag “0”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14C, since the third period is a period from 0 minutes to 6 minutes ago, as a result of the movement, the time “00:02”, the CPU usage rate “14”, the flag “0”, the continuous flag “ “0” is stored in the third active set 35 and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14D, when the CPU usage rate “38” of the server apparatus 11 is acquired at time “00:03”, the acquisition unit 40 acquires the time “00:03” and the CPU usage rate. “38” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:01” and the detection value “83” in the first active set 31. The CPU usage rate “38” is not larger than the value obtained by adding the maximum value “83” of the CPU usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:03” and the CPU usage rate “38” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14D, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:03”, the CPU usage rate “38”, and the flag “0” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  In the data of the second active set 33, all the flags are “0”. Therefore, the second determination unit 44 stores the time “00:03”, the CPU usage rate “38”, and the flag “0” in the third standby set 34 as the continuous flag “0”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14D, since the third period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:03”, the CPU usage rate “38”, the flag “0”, and the continuous flag “ “0” is stored in the third active set 35 and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14E, when the CPU usage rate “15” of the server apparatus 11 is acquired at time “00:04”, the acquisition unit 40 acquires the time “00:04” and the CPU usage rate. “15” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:02” and the detection value “14” in the first active set 31. The CPU usage rate “15” is not larger than the sum of the CPU usage rate maximum value “83” stored in the first active set 31 and the threshold value “5”. For this reason, the first determination unit 43 stores the time “00:04” and the CPU usage rate “15” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14E, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:04”, the CPU usage rate “15”, and the flag “0” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  In the data of the second active set 33, all the flags are “0”. Therefore, the second determination unit 44 stores the time “00:04”, the CPU usage rate “15”, and the flag “0” in the third standby set 34 as the continuous flag “0”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14E, since the third period is a period from 0 minutes to 6 minutes ago, as a result of the movement, the time “00:04”, the CPU usage rate “15”, the flag “0”, the continuous flag “ “0” is stored in the third active set 35 and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14F, when the CPU usage rate “53” of the server apparatus 11 is acquired at time “00:05”, the acquisition unit 40 acquires the time “00:05” and the CPU usage rate. “53” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:03” and the detection value “38” in the first active set 31. In addition, since the data at time “00:00” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The CPU usage rate “53” is not larger than the sum of the CPU usage rate maximum value “83” stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:05” and the CPU usage rate “53” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14F, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:05”, the CPU usage rate “53”, and the flag “0” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  In the data of the second active set 33, all the flags are “0”. Therefore, the second determination unit 44 stores the time “00:05”, the CPU usage rate “53”, and the flag “0” in the third standby set 34 as the continuous flag “0”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14F, since the third period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:05”, the CPU usage rate “53”, the flag “0”, the continuous flag “ “0” is stored in the third active set 35 and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14G, when the CPU usage rate “45” of the server apparatus 11 is acquired at time “00:06”, the acquisition unit 40 acquires the time “00:06” and the CPU usage rate. “45” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:04” and the detection value “15” in the first active set 31. In addition, since the data at time “00:01” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The CPU utilization rate “45” is larger than the value obtained by adding the maximum value “38” of the CPU utilization rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:06” and the CPU usage rate “45” in the second standby set 32 as the flag “1”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14G, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:06”, the CPU usage rate “45”, and the flag “1” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  The data of the second active set 33 includes a flag “1”. Therefore, the second determination unit 44 stores the time “00:06”, the CPU usage rate “45”, and the flag “1” in the third standby set 34 as the continuous flag “1”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14G, since the third period is a period from 0 minutes to 6 minutes ago, as a result of the movement, the time “00:06”, the CPU usage rate “45”, the flag “1”, the continuous flag “ 1 "is stored in the third active set 35, and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14H, when the CPU usage rate “23” of the server apparatus 11 is acquired at time “00:07”, the acquisition unit 40 acquires the time “00:07” and the CPU usage rate. “23” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:05” and the detection value “53” in the first active set 31. In addition, since the data at time “00:02” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The CPU usage rate “23” is not larger than the value obtained by adding the maximum value “53” of the CPU usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:07” and the CPU usage rate “23” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14H, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:07”, the CPU usage rate “23”, and the flag “0” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  The data of the second active set 33 includes a flag “1”. Therefore, the second determination unit 44 stores the time “00:07”, the CPU usage rate “23”, and the flag “0” in the third standby set 34 as the continuous flag “1”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14H, since the third period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:07”, the CPU usage rate “23”, the flag “0”, the continuous flag “ 1 "is stored in the third active set 35, and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14I, when the CPU usage rate “38” of the server apparatus 11 is acquired at time “00:08”, the acquiring unit 40 acquires the time “00:08” and the CPU usage rate. “38” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:06” and the detection value “45” in the first active set 31. In addition, since the data at time “00:03” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The CPU usage rate “38” is not greater than the value obtained by adding the maximum value “53” of the CPU usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:08” and the CPU usage rate “38” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14I, since the second period is a period from 0 to 3 minutes ago, as a result of the movement, the time “00:08”, the CPU usage rate “38”, and the flag “0” are the second active. It is stored in the set 33, and the second standby set 32 is empty.

  The data of the second active set 33 includes a flag “1”. Therefore, the second determination unit 44 stores the time “00:08”, the CPU usage rate “38”, and the flag “0” in the third standby set 34 as the continuous flag “1”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14I, since the third period is a period from 0 to 6 minutes ago, as a result of the movement, the time “00:08”, the CPU usage rate “38”, the flag “0”, the continuous flag “ 1 "is stored in the third active set 35, and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14J, when the CPU usage rate “18” of the server apparatus 11 is acquired at time “00:09”, the acquisition unit 40 acquires the time “00:09” and the CPU usage rate. “18” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:07” and the detection value “23” in the first active set 31. In addition, since the data at time “00:04” is out of the first period, the acquisition unit 40 deletes the data from the first active set 31. The CPU utilization rate “18” is not larger than the value obtained by adding the maximum value “53” of the CPU utilization rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:09” and the CPU usage rate “18” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14J, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:09”, the CPU utilization rate “18”, and the flag “0” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  The data of the second active set 33 includes a flag “1”. Therefore, the second determination unit 44 stores the time “00:09”, the CPU usage rate “18”, and the flag “0” in the third standby set 34 as the continuous flag “1”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14J, since the third period is a period from 0 minutes to 6 minutes ago, as a result of the movement, the time “00:09”, the CPU usage rate “18”, the flag “0”, the continuous flag “ 1 "is stored in the third active set 35, and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14K, when the CPU usage rate “85” of the server apparatus 11 is acquired at the time “00:10”, the acquiring unit 40 acquires the time “00:10” and the CPU usage rate. “85” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:08” and the detection value “38” in the first active set 31. In addition, since the data at time “00:05” is outside the first period, the acquiring unit 40 deletes the data from the first active set 31. The CPU usage rate “85” is larger than the value obtained by adding the maximum value “45” of the CPU usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the CPU usage rate “85” and the time “00:10” in the second standby set 32 as the flag “1”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14K, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:10”, the CPU usage rate “85”, and the flag “1” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  The data of the second active set 33 includes a flag “1”. Therefore, the second determination unit 44 stores the time “00:10”, the CPU usage rate “85”, and the flag “1” in the third standby set 34 as the continuous flag “1”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14J, since the third period is a period from 0 minutes to 6 minutes ago, as a result of the movement, the time “00:10”, the CPU usage rate “85”, the flag “1”, the continuous flag “ 1 "is stored in the third active set 35, and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14L, when the CPU usage rate “41” of the server apparatus 11 is acquired at time “00:11”, the acquisition unit 40 acquires the time “00:11” and the CPU usage rate. “41” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:09” and the detection value “18” in the first active set 31. In addition, since the data at time “00:06” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The CPU usage rate “41” is not larger than the value obtained by adding the maximum value “38” of the CPU usage rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:11” and the CPU usage rate “41” in the second standby set 32 as the flag “0”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14L, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:11”, the CPU usage rate “41”, and the flag “0” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  The data of the second active set 33 includes a flag “1”. Therefore, the second determination unit 44 stores the time “00:11”, the CPU usage rate “41”, and the flag “0” in the third standby set 34 as the continuous flag “1”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14L, since the third period is a period from 0 minutes to 6 minutes ago, as a result of the movement, the time “00:11”, the CPU usage rate “41”, the flag “0”, the continuous flag “ 1 "is stored in the third active set 35, and the third standby set 34 is empty.

  Next, as illustrated in FIG. 14M, when the CPU usage rate “96” of the server apparatus 11 is acquired at time “00:12”, the acquiring unit 40 acquires the time “00:12” and the CPU usage rate. “96” is stored in the first standby set 30. The first period is a period from 2 minutes to 4 minutes ago. Therefore, the acquisition unit 40 stores the time “00:10” and the detection value “85” in the first active set 31. In addition, since the data at time “00:07” is outside the first period, the acquisition unit 40 deletes the data from the first active set 31. The CPU utilization rate “96” is larger than the value obtained by adding the maximum value “85” of the CPU utilization rate stored in the first active set 31 and the threshold value “5”. Therefore, the first determination unit 43 stores the time “00:12” and the CPU usage rate “96” in the second standby set 32 as the flag “1”.

  The second determination unit 44 moves the detection value stored in the second standby set 32 within the second period to the second active set 33. In the example of FIG. 14M, since the second period is a period from 0 minutes to 3 minutes ago, the time “00:12”, the CPU usage rate “96”, and the flag “1” are the second active as a result of the movement. It is stored in the set 33, and the second standby set 32 is empty.

  The data of the second active set 33 includes a flag “1”. Therefore, the second determination unit 44 stores the time “00:12”, the CPU usage rate “96”, and the flag “1” in the third standby set 34 as the continuous flag “1”. The output unit 42 moves the detection value stored in the third standby set 34 within the third period to the third active set 35. In the example of FIG. 14M, since the third period is a period from 0 minutes to 6 minutes ago, the time “00:12”, the CPU usage rate “96”, the flag “1”, the continuous flag “ 1 "is stored in the third active set 35, and the third standby set 34 is empty.

  Here, all the data in the third period stored in the third active set 35 shown in FIG. The state shown in FIG. 14M is a state in which a period in which the result of determination that the acquired detected value is larger than the maximum value in the first period is obtained at least once is a third period. The output unit 42 outputs an alert when all the continuous flags of each data stored in the third active set 35 are “1”.

  For example, the server device 11 has a property that when the process is started, the CPU usage rate increases, and when the process is stopped, the CPU usage rate decreases instantaneously, so that the CPU usage rate increases greatly instantaneously and returns immediately.

  FIG. 15 is a diagram illustrating an example of a change in the usage rate of the CPU. As shown in FIG. 15, the usage rate of the CPU has a property that increases greatly instantaneously and quickly returns to the original state. For example, when the system 10 is a system that guarantees that the CPU usage rate of the server device 11 does not rise above a certain level, an abnormality occurs when the CPU usage rate exceeds a certain threshold value. Detection of anomalies may be delayed. For example, detection that the usage rate of the CPU has reached a certain threshold or more is the timing immediately before or after.

  Therefore, the abnormality detection device 12 periodically acquires the CPU usage rate of the server device 11. The abnormality detection device 12 determines whether the acquired CPU usage rate is larger than the maximum value of the CPU usage rate in the first period before the acquisition time. In the second period, the abnormality detection device 12 is continuously in a state where the result of determination that the detected value is larger than the maximum value of the CPU usage rate in the first period is obtained at least once during the third period. If it is obtained, an alert is output. FIG. 16 is a diagram illustrating another example of the change in the usage rate of the CPU. In the example of FIG. 16, the flag “1” is displayed in a portion where the CPU usage rate has increased from the maximum value of the first period before the CPU usage rate is acquired. In the example of FIG. 16, the continuous flag “1” is displayed in a portion where the result of determination that the CPU usage rate is larger than the maximum value of the CPU usage rate in the first period is obtained at least once. ing. In this way, when the period of the continuous flag “1” continues for the third period, by outputting an alert, the increase rate of the maximum value of the pulse data, which is increasing and decreasing rapidly as the CPU usage rate, is increased. Since it can be detected, the occurrence of an abnormality can be detected at an early stage. In the present embodiment, the first period is a predetermined time interval from the time when the detection value is acquired, and is a period before the predetermined time is not included since the acquisition time. In this way, by setting the first period to be a period spaced from the time of acquisition, it is possible to detect whether the increase is globally while suppressing the influence of the latest detection value.

[Process flow]
Next, the procedure of the abnormality detection process according to the second embodiment will be described. FIG. 17 is a flowchart illustrating an example of the procedure of the abnormality detection process. Similar to the abnormality detection process according to the first embodiment illustrated in FIG. 10, the abnormality detection process is executed at a predetermined timing, for example, a timing at which a detection value is acquired from the server device 11. In addition, the same code | symbol is attached | subjected and demonstrated about the same part as the abnormality detection process which concerns on Example 1 shown in FIG.

  As illustrated in FIG. 17, when the acquisition unit 40 acquires the detection value from the server device 11, the acquisition unit 40 stores the acquired detection value in the first standby set 30 together with time information (S10). The acquisition unit 40 adds the detection value stored in the first standby set 30 within the first period to the first active set 31 (S11). The acquisition unit 40 deletes the data within the first period from the detection values stored in the first standby set 30 from the first standby set 30 (S12).

  The 1st determination part 43 specifies the maximum value of the detected value in the detected value memorize | stored in the 1st active set 31 (S13). The first determination unit 43 determines whether the acquired detection value is larger than a value obtained by adding the maximum value and the threshold value (S14). When the detected value is larger than the added value (Yes in S14), “1 (ON)” is set in the flag (S15). On the other hand, if the detected value is not greater than the added value (No in S14), “0 (OFF)” is set in the flag (S16).

  The first determination unit 43 stores the acquired detection value, time information, and flag in the second standby set 32 (S17). The 2nd determination part 44 moves the detection value which became in the 2nd period among the detection values stored in the 2nd waiting | standby set 32 to the 2nd active set 33 (S18). Moreover, the 2nd determination part 44 deletes the detection value which became out of the 2nd period among the detection values stored in the 2nd active set 33 from the 2nd active set 33 (S19). Then, the second determination unit 44 determines whether any flag of the detection value stored in the second active set 33 is “1” (S30). If any one of the flags is “1” (Yes at S30), “1 (ON)” is set to the continuous flag (S31). On the other hand, if none of the flags is “1” (No in S30), “0 (OFF)” is set in the continuous flag (S32).

  The second determination unit 44 stores the acquired detection value, time information, flag, and continuous flag in the third standby set 34 (S33). The output unit 42 moves the detection value within the third period among the detection values stored in the third standby set 34 to the third active set 35 (S34). Moreover, the output part 42 deletes the detection value which became out of the 3rd period among the detection values stored in the 3rd active set 35 from the 3rd active set 35 (S35). And the output part 42 determines whether all the continuous flags of the detection value memorize | stored in the 3rd active set 35 are "1" (S36). If all the continuous flags are “1” (Yes at S36), the output unit 42 outputs an alert (S37) and ends the process. On the other hand, when all the continuous flags are not “1” (No in S36), the process is terminated.

[effect]
As described above, the abnormality detection device 12 according to the present embodiment acquires a detection value indicating the state of the monitoring target. The abnormality detection device 12 determines, for each acquired detection value, whether the detection value is larger than the maximum value of the detection value in a specific period (first period) before the acquisition time. The abnormality detection device 12 determines whether or not the determination result that the detected value is larger than the maximum value in the specific period is obtained at least once within the first predetermined time (second period). The abnormality detection device 12 determines that the determination result that the detection value is larger than the maximum value in the specific period is obtained at least once within the first predetermined time is the second predetermined time (third period). ) Outputs an alert if continuously obtained over the above. As a result, the abnormality detection device 12 can detect an abnormality that tends to increase the maximum value of the detected value at an early stage even when the detected value fluctuates greatly.

  Moreover, the abnormality detection apparatus 12 according to the present embodiment uses a threshold value for determination larger than the maximum value, and sets the first period as a period before the predetermined time from the acquisition. When the most recent period is included as the first period, the immediately preceding detection value may be selected as the maximum value, and even if there is a general increase trend, the difference from the immediately preceding detection value is small. The difference between the value and the maximum value may not exceed the threshold value. On the other hand, the abnormality detection apparatus 12 according to the present embodiment, since the first period is a period before the predetermined time from the acquisition time, the most recent value is not selected as the maximum value of the first period. Can be seen.

  Further, the abnormality detection device 12 according to the present embodiment uses the detected value as the CPU usage rate. Thereby, the abnormality detection apparatus 12 can detect the abnormality in which the upward trend occurs in the usage rate of the CPU at an early stage.

  Here, when the abnormality detection device 12 according to the second embodiment determines whether the determination result that the detection value is larger than the maximum value in the specific period is obtained at least once within the first predetermined time, Although described, it is not limited to this. For example, the abnormality detection device 12 according to the first embodiment determines, for each acquired detection value, whether the detection value is smaller than the minimum value of the detection value in a specific period before the acquisition time. The abnormality detection device 12 determines whether the determination result that the detected value is smaller than the minimum value in the specific period is obtained at least once within the first predetermined time. The abnormality detection device 12 determines that the determination result that the detection value is smaller than the minimum value in the specific period is obtained at least once within the first predetermined time is equal to or longer than the second predetermined time. An alert may be output if obtained continuously. In this case, the abnormality detection device 12 according to the present embodiment can detect an abnormality in which the minimum value of the detection value tends to decrease even when the detection value fluctuates greatly. As described above, examples of the detection value that can detect an abnormality from the change in the minimum value of the detection value in the first period include the number of accesses and the number of processes when the load is distributed among a plurality of servers. For example, when the load is evenly distributed among multiple servers, the number of accesses and the number of processes are almost the same, but by comparing the number of accesses and the number of processes of each server, server abnormalities and load distribution processing abnormalities The occurrence can be detected.

  Although the embodiments related to the disclosed apparatus have been described so far, the disclosed technology may be implemented in various different forms other than the above-described embodiments. Therefore, another embodiment included in the present invention will be described below.

  For example, in the above-described first embodiment, the case where an alert is output when the determination result that the detection value is larger than the minimum value of the detection value in the first period is continuously obtained for the second period has been described. However, the disclosed apparatus is not limited to this. For example, an alert may be output when a result of determination that the detected value is greater than the minimum value of the first period is greater than or equal to a predetermined ratio during the second period. Further, for example, an alert may be output when a result of determination that the detected value is smaller than the minimum value of the first period during the second period is greater than or equal to a predetermined ratio.

  In the second embodiment, the alert that the determination result that the detection value is larger than the maximum value of the second period is obtained at least once is obtained continuously for the third period. Although the case of outputting has been described, the disclosed device is not limited to this. For example, if the determination result that the detection value is greater than the maximum value in the second period is obtained at least once during the third period, an alert is output. May be. In addition, for example, when the determination result that the detection value is smaller than the minimum value of the second period is obtained at least once during the third period, the alert is generated. It may be output.

  In the above-described embodiments, the case where the occurrence of an abnormality in another device is detected has been described. However, the disclosed device is not limited thereto. For example, it may be obtained by detecting a detection value indicating the state of the own device, and the occurrence of an abnormality of the own device may be detected from the detection value.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific state of distribution / integration of each device is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the processing units of the acquisition unit 40, the determination unit 41, the output unit 42, the first determination unit 43, and the second determination unit 44 may be appropriately integrated. Further, the processing of each processing unit may be appropriately separated into a plurality of processing units. Further, all or any part of each processing function performed in each processing unit can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware by wired logic. .

[Abnormality detection program]
The various processes described in the above embodiments can also be realized by executing a program prepared in advance on a computer system such as a personal computer or a workstation. Therefore, in the following, an example of a computer system that executes a program having the same function as in the above embodiment will be described. FIG. 18 is a diagram illustrating a computer that executes an abnormality detection program.

  As shown in FIG. 18, the computer 300 includes a CPU (Central Processing Unit) 310, a HDD (Hard Disk Drive) 320, and a RAM (Random Access Memory) 340. These units 300 to 340 are connected via a bus 400.

  The HDD 320 stores in advance an abnormality detection program 320a that performs the same functions as the acquisition unit 40, the determination unit 41, the output unit 42, the first determination unit 43, and the second determination unit 44 described above. Note that the abnormality detection program 320a may be separated as appropriate.

  The HDD 320 stores various information. For example, the HDD 320 stores various data used for the OS and production plan.

  Then, the CPU 310 reads out and executes the abnormality detection program 320a from the HDD 320, thereby executing the same operation as each processing unit of the embodiment. That is, the abnormality detection program 320a performs the same operations as the acquisition unit 40, the determination unit 41, the output unit 42, the first determination unit 43, and the second determination unit 44.

  Note that the above-described abnormality detection program 320a is not necessarily stored in the HDD 320 from the beginning.

  For example, the program is stored in a “portable physical medium” such as a flexible disk (FD), a CD-ROM, a DVD disk, a magneto-optical disk, or an IC card inserted into the computer 300. Then, the computer 300 may read and execute the program from these.

  Furthermore, the program is stored in “another computer (or server)” connected to the computer 300 via a public line, the Internet, a LAN, a WAN, or the like. Then, the computer 300 may read and execute the program from these.

DESCRIPTION OF SYMBOLS 10 System 12 Abnormality detection apparatus 21 Memory | storage part 22 Control part 30 1st standby set 31 1st active set 32 2nd standby set 33 2nd active set 34 3rd standby set 35 3rd active set 40 Acquisition part 41 Determination part 42 Output Unit 43 First determination unit 44 Second determination unit

Claims (14)

Obtain a detection value that indicates the status of the monitoring target,
For each acquired detection value, determine whether the detection value is larger than the minimum value of the detection value in a specific period before the predetermined time interval from the acquisition of the detection value,
An abnormality detection method comprising: outputting an alert when a determination result that the detection value is larger than a minimum detection value in the specific period is continuously obtained for a predetermined time or more. The abnormality detection method according to claim 1, wherein the detected value is a memory usage rate. Obtain a detection value that indicates the status of the monitoring target,
For each acquired detection value, determine whether the detection value is smaller than the maximum value of the detection value in a specific period before the predetermined time interval from the acquisition of the detection value,
An abnormality detection method comprising: outputting an alert when a determination result that the detection value is smaller than a maximum value of the detection value in the specific period is continuously obtained for a predetermined time or more. Obtain a detection value that indicates the status of the monitoring target,
For each acquired detection value, determine whether the detection value is larger than the maximum value of the detection value in a specific period before the predetermined time interval from the acquisition of the detection value,
Determining whether the determination result that the detected value is larger than the maximum value in the specific period is obtained at least once within a first predetermined time;
A determination result that a determination result that the detected value is larger than the maximum value in the specific period is obtained at least once within the first predetermined time is continuously obtained over a second predetermined time or more. An abnormality detection method characterized in that a computer executes a process of outputting an alert when an error occurs. The abnormality detection method according to claim 4, wherein the detected value is a utilization rate of a CPU (Central Processing Unit). Obtain a detection value that indicates the status of the monitoring target,
For each acquired detection value, determine whether the detection value is smaller than the minimum value of the detection value in a specific period before the predetermined time interval from the acquisition of the detection value,
Determining whether the determination result that the detection value is smaller than the minimum value in the specific period is obtained at least once within a first predetermined time;
The determination result that the determination result that the detection value is smaller than the minimum value in the specific period is obtained at least once within the first predetermined time is continuously obtained over the second predetermined time or more. An abnormality detection method characterized in that a computer executes a process of outputting an alert when an error occurs. Obtain a detection value that indicates the status of the monitoring target,
For each acquired detection value, determine whether the detection value is larger than the minimum value of the detection value in a specific period before the predetermined time interval from the acquisition of the detection value,
An abnormality characterized by causing a computer to execute a process of outputting an alert when a determination result that the detected value is larger than a minimum value of the detected value in the specific period is continuously obtained for a predetermined time or more. Detection program. Obtain a detection value that indicates the status of the monitoring target,
For each acquired detection value, determine whether the detection value is smaller than the maximum value of the detection value in a specific period before the predetermined time interval from the acquisition of the detection value,
An abnormality characterized by causing a computer to execute a process of outputting an alert when a determination result that the detected value is smaller than the maximum detected value in the specific period is continuously obtained for a predetermined time or more. Detection program. Obtain a detection value that indicates the status of the monitoring target,
For each acquired detection value, determine whether the detection value is larger than the maximum value of the detection value in a specific period before the predetermined time interval from the acquisition of the detection value,
Determining whether the determination result that the detected value is larger than the maximum value in the specific period is obtained at least once within a first predetermined time;
A determination result that a determination result that the detected value is larger than the maximum value in the specific period is obtained at least once within the first predetermined time is continuously obtained over a second predetermined time or more. An abnormality detection program that causes a computer to execute a process of outputting an alert when an error occurs. Obtain a detection value that indicates the status of the monitoring target,
For each acquired detection value, determine whether the detection value is smaller than the minimum value of the detection value in a specific period before the predetermined time interval from the acquisition of the detection value,
Determining whether the determination result that the detection value is smaller than the minimum value in the specific period is obtained at least once within a first predetermined time;
The determination result that the determination result that the detection value is smaller than the minimum value in the specific period is obtained at least once within the first predetermined time is continuously obtained over the second predetermined time or more. An abnormality detection program that causes a computer to execute a process of outputting an alert when an error occurs. An acquisition unit for acquiring a detection value indicating a state of a monitoring target;
For each detection value acquired by the acquisition unit, a determination unit that determines whether the detection value is greater than the minimum value of the detection value in a specific period before a predetermined time interval from the acquisition of the detection value;
An output unit for outputting an alert when the determination result that the detection value is larger than the minimum value of the detection value in the specific period is continuously obtained for a predetermined time or more by the determination unit. An anomaly detection device. An acquisition unit for acquiring a detection value indicating a state of a monitoring target;
For each detection value acquired by the acquisition unit, a determination unit that determines whether the detection value is smaller than the maximum value of the detection value in a specific period before a predetermined time interval from the acquisition of the detection value;
An output unit for outputting an alert when the determination result that the detection value is smaller than the maximum value of the detection value in the specific period is continuously obtained for a predetermined time or more by the determination unit. An anomaly detection device. An acquisition unit for acquiring a detection value indicating a state of a monitoring target;
For each detection value acquired by the acquisition unit, a first determination unit that determines whether the detection value is greater than the maximum value of the detection value in a specific period before a predetermined time interval from the acquisition of the detection value;
A second determination unit that determines whether the determination result that the detection value is larger than the maximum value in the specific period is obtained at least once within a first predetermined time by the first determination unit;
A determination result that the determination result that the detection value is greater than the maximum value in the specific period is obtained at least once within the first predetermined time by the second determination unit is a second predetermined time or more And an output unit that outputs an alert when continuously obtained. An acquisition unit for acquiring a detection value indicating a state of a monitoring target;
For each detection value acquired by the acquisition unit, a first determination unit that determines whether the detection value is smaller than the minimum value of the detection value in a specific period before a predetermined time interval from the acquisition of the detection value;
A second determination unit that determines whether the determination result that the detection value is smaller than the minimum value in the specific period is obtained at least once within a first predetermined time by the first determination unit;
The determination result that the determination result that the detection value is smaller than the minimum value in the specific period is obtained at least once within the first predetermined time by the second determination unit is a second predetermined time or more And an output unit that outputs an alert when continuously obtained.

Images