JP7423271B2 - Monitoring devices, monitoring systems and monitoring programs - Google Patents

Description

The present invention relates to a monitoring device, a monitoring system, and a monitoring program.

Conventionally, methods for monitoring and evaluating an entire computer system are known. (For example, see Patent Document 1).

Japanese Patent Application Publication No. 2006-018369

In a distributed computer environment that provides a large number of application online services, host OSs run on virtual machines built using virtualization technology on many physical servers, and these are configured as virtual servers with various roles. ing. Further, the application is executed in the distributed computer environment. Performance management of such a complex computer system requires management from three perspectives: the application, the server as its operating environment, and the infrastructure that virtualizes the physical environment and hosts the server in a virtual machine. It is not easy to manage these individually, and conventionally, the correspondence between applications and servers and servers and infrastructure has been manually managed through documentation such as configuration tables.
For example, with this method, the correspondence relationships must be updated every time there is a change in the configuration of applications, servers, and infrastructure, which is time consuming and labor intensive.
That is, according to the conventional method, there is a problem in that the corporate system cannot easily identify the correspondence between the configurations managed by an application administrator, a server administrator, and an infrastructure administrator.

The present invention was made in view of the above situation, and it is possible to specify the correspondence between an application and a logical server that is its operating environment, and to identify the correspondence between the hosts that make up a logical server and the infrastructure (virtual) that runs them. The purpose is to make it easier to identify the correspondence between machines (machines and physical servers), and between applications, logical servers, and infrastructure.

A monitoring device according to one aspect of the present invention includes a first identification information acquisition unit that acquires identification information of a virtual machine running on a plurality of server devices connected to a virtual integrated environment, and a computer that includes a plurality of hosts. a second identification information acquisition unit that acquires identification information of the virtual machine on which one host in the system operates, identification information acquired by the first identification information acquisition unit, and information indicating the virtual machine; A first storage unit that stores a correspondence relationship as a first correspondence relationship, and stores a correspondence relationship between the identification information acquired by the second identification information acquisition unit and information indicating the host as a second correspondence relationship. The second storage unit compares the first correspondence relationship stored in the first storage unit and the second correspondence relationship stored in the second storage unit, and identifies the same identification information. a matching unit that identifies the virtual machine and the host having the same as matched information; an output unit that outputs matched information identified as a result of the matching performed by the matching unit; a transaction information acquisition unit that acquires transaction information that is information that identifies a transaction that is an execution unit and includes destination information that indicates an application that is a destination of the transaction and host information that identifies a host within the computer system; an application group information acquisition unit that acquires application group information indicating a correspondence relationship between destination information included in the transaction information and the application group; and a logical server group indicating a correspondence relationship between the host information included in the transaction information and the logical server group. Acquisition of the transaction information based on a logical server group information acquisition unit that acquires information, the application group information that the application group information acquisition unit acquires, and the logical server group information that the logical server group information acquisition unit acquires. a group determination unit that determines at least one of the application group or the logical server group to which the transaction indicated by the transaction information acquired by the unit belongs, and the output unit outputs the result determined by the group determination unit. Output .

Further, in the monitoring device according to one aspect of the present invention, the identification information is a UUID (Universally Unique Identification).

Furthermore, in the monitoring device according to one aspect of the present invention, the first identification information acquisition unit acquires the identification information at predetermined intervals.

Further, in the monitoring device according to one aspect of the present invention, the second identification information acquisition unit acquires the identification information when the host is started.

The monitoring device according to one aspect of the present invention further includes a matched information storage unit that stores the matched information identified as a result of the matching performed by the matching unit, and the output unit is configured to include the matched information storage unit. The matched information stored in is output.

Further, in the monitoring device according to one aspect of the present invention, the output unit may determine that if the virtual machine having the same identification information as the identification information of the host does not exist, the corresponding virtual machine does not exist. Information indicating this is output as the correspondence relationship.

A monitoring system according to one aspect of the present invention includes the above-described monitoring device, a first agent provided in the virtual integrated environment and providing the identification information to the first identification information acquisition unit, and provided in the host. and a second agent that provides the identification information to the second identification information acquisition unit.

A monitoring program according to one aspect of the present invention includes a first identification information acquisition step of acquiring identification information of a virtual machine running on a plurality of server devices connected to a virtual integrated environment in a computer, and a plurality of hosts. a second identification information acquisition step of acquiring identification information of the virtual machine on which one host of the computer systems operated, and the identification information acquired by the first identification information acquisition step and the virtual machine are shown. comparing the correspondence relationship between the information and the correspondence relationship between the identification information acquired in the second identification information acquisition step and the information indicating the host, and comparing the virtual machine and the host having the same identification information. a matching step for identifying the matched information as completed information; an output step for outputting the matched information identified as a result of the matching in the matching step; and information for identifying a transaction, which is an execution unit of information transmission exchanged within the computer system. a transaction information acquisition step of acquiring transaction information including destination information indicating an application that is a destination of the transaction and host information identifying a host in the computer system; and destination information and an application group included in the transaction information. an application group information acquisition step of acquiring application group information indicating a correspondence between the host information included in the transaction information and the logical server group; and a logical server group information acquisition step of acquiring logical server group information indicating the correspondence between the host information included in the transaction information and the logical server group. and the transaction information acquired by the transaction information acquisition step is based on the application group information acquired by the application group information acquisition step and the logical server group information acquired by the logical server group information acquisition step. and a group determination step of determining at least one of the application group and the logical server group to which the indicated transaction belongs .

According to the present invention, it is possible to identify the correspondence between an application and a logical server that is its operating environment, and to identify the correspondence between a host that constitutes a logical server and the infrastructure that runs it (virtual machine and physical server). It is possible to easily identify the correspondence between applications, logical servers, and infrastructure.

FIG. 1 is a diagram illustrating an example of an overview of a system monitoring device in an embodiment. FIG. 1 is a diagram illustrating an example of a functional configuration of a system monitoring device in an embodiment. It is a figure showing an example of a group in an embodiment. It is a figure showing an example of the functional composition of the control part which the system monitoring device in an embodiment is provided with. It is a figure showing an example of the screen composition of the system monitoring device in an embodiment. FIG. 3 is a diagram illustrating an example of transaction statistics processing operation in the embodiment. It is a figure which shows an example of the statistical information display operation of a group in embodiment. FIG. 7 is a diagram illustrating an example of an operation in which indicators for measuring system performance are compared and a warning is issued in the embodiment. FIG. 7 is a diagram illustrating an example of an overview of a monitored system and a system monitoring device in a second embodiment. FIG. 7 is a diagram illustrating an example of a functional configuration of a data center in a second embodiment. It is a figure showing an example of composition of a monitoring system in a 2nd embodiment. FIG. 7 is a diagram illustrating an example of virtual machine information stored in a virtual machine information storage unit in the second embodiment. FIG. 7 is a diagram illustrating an example of host information stored in a host information storage unit in the second embodiment. It is a figure which shows an example of the matched information which the matched information storage part in 2nd Embodiment stores. FIG. 7 is a diagram illustrating an example of timing for acquiring identification information of a virtual machine in the second embodiment. FIG. 7 is a diagram illustrating an example of timing for acquiring host identification information in the second embodiment. FIG. 7 is a diagram illustrating an example of a series of operations of the system monitoring device in the second embodiment.

Embodiments of the present invention will be described below with reference to the drawings.
[Overview of system monitoring device 1]
FIG. 1 is a diagram illustrating an example of an overview of a system monitoring device in an embodiment.
The system monitoring device 1 monitors the monitored system 2 . In this example, monitoring refers to measuring and presenting information regarding the performance of the monitored system 2 in real time or at regular intervals. The processing capacity of the monitored system 2 may change as the load on a specific host 3 or a specific application 4 changes.
For example, the processing capacity of the monitored system 2 may decrease when the load placed on a specific host 3 or a specific application 4 increases. Therefore, the system monitoring device 1 monitors the monitored system 2 in order to identify the host 3 or application 4 whose processing capacity has decreased due to an increase in the load placed on the monitored system 2. The system monitoring device 1 is also referred to as a monitoring device.

The monitored system 2 includes a host 3 and an application 4.
The host 3 is a system for operating an application 4 provided in a physical server. One host 3 may be provided for one physical server, multiple hosts 3 may be provided for one physical server, or one host 3 may be provided for multiple physical servers. You can leave it there.
The application 4 is a program or the like that runs on the host 3. One application 4 may run on one host 3, multiple applications 4 may run on one host 3, or one application 4 may run on multiple hosts 3. Good too.

In this example, the host 3 includes a web application server (hereinafter referred to as AP server), an operation system (hereinafter referred to as OS), a virtual machine (hereinafter referred to as VM), a virtual server, a physical server, a network, Includes database management systems (hereinafter referred to as DBMS), etc.
Further, in this example, the application 4 includes a WUI (web user interface), a web application, a service interface, business logic, integration logic, database resources, and the like.
That is, in this example, the monitored system 2 is configured to include a plurality of hosts 3 which are a plurality of logical servers and a plurality of applications 4 running on the hosts 3.

[Functional configuration of system monitoring device 1]
FIG. 2 is a diagram illustrating an example of the functional configuration of the system monitoring device in the embodiment.
The system monitoring device 1 includes a transaction information acquisition section 100, a group determination section 200, a control section 300, an output section 400, and an operation detection section 5.

The operation detection unit 5 includes a device (not shown) that detects a user's operation, and acquires information corresponding to the user's operation. Devices that detect user operations may include switches, keyboards, pointing devices, voice recognition devices, and the like.
Here, the user is a person who uses the system monitoring device 1, for example. The person may be an employee of the business that uses the monitored system 2, or may be a person in charge of maintenance of the monitored system 2.

The transaction information acquisition unit 100 acquires transaction information TXI from the monitored system 2. Transaction information TXI is information that identifies a transaction. A transaction is an execution unit of information exchanged within a system.
Transaction information TXI includes destination information indicating the application that is the destination of the transaction. Furthermore, the transaction information TXI includes host information that identifies one host among a plurality of hosts. In other words, a transaction is a process performed within the monitored system 2, and includes information specifying the host 3 and application 4 on which the process was performed.
The transaction information acquisition unit 100 provides the transaction information TXI acquired from the monitored system 2 to the group determination unit 200 and the control unit 300.

The group determination unit 200 includes a logical server group information acquisition unit 210, a logical server group information storage unit 220, an application group information acquisition unit 230, an application group information storage unit 240, and a determination unit 250.

Here, a group is a unit obtained by dividing the monitored system 2 based on a device unit, a function unit, or the like. In this example, the groups include logical server groups divided based on logical servers and application groups divided based on applications.
FIG. 3 is a diagram showing an example of groups in the embodiment. In the example shown in this figure, the monitored system 2 includes a server V100 and a server V200 that are divided into logical servers. The server V100 includes a host V110 and a host V120. The server V200 includes a host V210 and a host V220. In this way, the monitored system 2 is divided into hierarchies and grouped by logical server. In other words, the logical server group information VSGI includes a first logical server group in which a computer system composed of a plurality of host information is defined as one group, and a first logical server group in which a plurality of first logical server groups are defined as one group. and two logical server groups.

Further, in the example shown in this figure, the monitored system 2 includes a domain A100 and a domain A200 that are divided for each application.
The domain A100 includes a medium functional level A110 and a medium functional level A120. The medium function level 110 includes a small function level 111. The medium function level 210 includes a small function level A211 and a small function level A212. In this way, the monitored system 2 is divided into layers and grouped by application. In other words, the application group information includes a first application group in which computer systems having a plurality of destination information are defined as one group, a second application group in which a plurality of first application groups are defined as one group, It includes a third application group in which a plurality of second application groups are defined as one group, and a fourth application group in which a plurality of third application groups are defined as one group.

Returning to FIG. 2, the determination unit 250 acquires transaction information TXI from the transaction information acquisition unit 100 and provides the acquired transaction information TXI to the logical server group information acquisition unit 210 and the application group information acquisition unit 230.

The logical server group information storage unit 220 stores logical server group information indicating the correspondence between host information and a logical server group in which a plurality of pieces of host information are defined as one group. In other words, the logical server group information storage unit 220 groups host information and stores information on which group each piece of host information belongs to.

The logical server group information acquisition unit 210 acquires the logical server group to which the transaction belongs from the logical server group information storage unit 220 based on the transaction information TXI acquired from the determination unit 250. The logical server group information acquisition unit 210 provides the determining unit 250 with the logical server group to which the transaction belongs as logical server group information VSGI.

The application group information storage unit 240 stores application group information indicating the correspondence between destination information and an application group in which a plurality of pieces of destination information are defined as one group. That is, the application group information storage unit 240 groups destination information and stores information on which group each piece of destination information belongs to.

The application group information acquisition unit 230 acquires the application group to which the transaction belongs from the application group information storage unit 240 based on the transaction information TXI acquired from the determination unit 250. The application group information acquisition unit 230 provides the determination unit 250 with the application group to which the transaction belongs as application group information APGI.

The group information acquisition unit 260 includes a logical server group information acquisition unit 210 and an application group information acquisition unit 230. The group information acquisition unit 260 includes an application group information storage unit 240 that stores application group information APGI indicating a correspondence relationship between destination information and an application group in which a plurality of destination information is defined as one group, and an application group information storage unit 240 that stores application group information APGI and host information and a plurality of host information. Transaction information TXI acquired by the transaction information acquisition unit 100 from at least one of the logical server group information storage units 220 that stores logical server group information VSGI indicating the correspondence relationship with a logical server group defined as one group. Get group information about the group you belong to.

The determination unit 250 determines whether the transaction (that is, the transaction information acquisition unit 100 has acquired) is based on the application group information acquired by the application group information acquisition unit 230 and the logical server group information acquired by the logical server group information acquisition unit 210. Both the application group and the logical server group to which the transaction indicated by the transaction information TXI belongs are determined.
Specifically, the determination unit 250 determines to which application group the transaction belongs, and to which logical server group the host on which the transaction is executed belongs. The determination results of application groups and logical server groups by the determination unit 250 are also collectively referred to as group determination results.

Note that the determination unit 250 may determine only one of the application group and the logical server group.
The determination unit 250 adds information about the logical server group and application group to which the transaction belongs (that is, the group determination result) to the transaction information TXI, and provides it to the control unit 300 as transaction group information TXGI. The determination unit 250 provides the control unit 300 with logical server group information VSGI acquired from the logical server group information acquisition unit 210 and application group information APGI acquired from the application group information acquisition unit 230.
The details of the functional configuration of the control unit 300 will be described below with reference to FIG. 4.

[Functional configuration of control unit 300 included in system monitoring device 1]
FIG. 4 is a diagram illustrating an example of the functional configuration of the control unit 300 included in the system monitoring device according to the embodiment.

The control unit 300 acquires transaction information TXI from the transaction information acquisition unit 100 and acquires transaction group information TXGI from the group determination unit 200. Further, the control unit 300 provides the output unit 400 with performance information SPI, cumulative performance information ASPI, post-statistical performance information SSPI, and warning information ALI.
The control unit 300 includes a measurement unit 310, a statistics unit 320, a group selection information acquisition unit 330, a comparison unit 340, a warning unit 350, a threshold information acquisition unit 360, and a display selection unit 370.

The measurement unit 310 measures an index that measures the performance of the system.
Indices for measuring system performance include indicators for measuring system performance based on transaction information TXI and indicators for measuring system performance not based on transaction information TXI.

Indices for measuring the performance of the system based on transaction information TXI include, for example, response time and the number of transactions per unit time (hereinafter referred to as the number of TRX requests).
The measurement unit 310 measures an index for measuring the performance of the system based on the transaction information TXI.
Specifically, the measurement unit 310 acquires transaction information TXI from the transaction information acquisition unit 100. The measurement unit 310 measures performance information SPI based on the transaction indicated by the acquired transaction information TXI. Here, the performance information SPI is information about an index that measures the performance of the system. In this example, the performance information SPI includes response time, number of TRX requests, and the like.

An index that measures the performance of a system that is not based on transaction information TXI is, for example, an index that measures the performance of a system that is based on activity and resource information such as the OS and middleware (OLTP and DBMS). Indicators for measuring system performance that are not based on transaction information TXI are, for example, activity indicators such as OS paging per unit time and OLTP memory management processing, CPU usage rate, memory usage rate, etc. These are resource usage indicators, etc.

The measurement unit 310 measures an index for measuring system performance based on resource information that a resource information acquisition unit (not shown) acquires from the monitored system 2.
The resource information acquisition unit acquires resource information from the OS, middleware, applications, software, etc. included in the monitored system 2.
The resource information includes information indicating the usage status of physical resources and logical resources provided in the monitored system 2. That is, the resource information acquisition unit acquires resource information including information indicating the usage status of resources included in the monitored system 2.
Specifically, the measurement unit 310 acquires resource information from the resource information acquisition unit. The measurement unit 310 measures performance information SPI based on the acquired resource information. Here, the performance information SPI is information about an index that measures the performance of the system. In this example, the performance information SPI is CPU usage rate, memory usage rate, TPS, etc.
The measurement unit 310 provides the measured performance information SPI to the comparison unit 340 and the statistics unit 320.

The threshold information acquisition unit 360 acquires a threshold value for an index that measures the performance of the system set by the user.
Specifically, the threshold information acquisition unit 360 acquires the threshold information THI when the operation detection unit 5 detects the user's operation. Here, the threshold information THI is a threshold set by the user for an index that measures the performance of the system. The threshold information THI can be set for each index that measures the performance of the system. For example, in the case of a system where response time is an index for measuring system performance, any time can be set as the threshold information THI. Similarly, the number of TRX requests, CPU usage rate, memory usage rate, etc. can be set as threshold information THI.

It is also possible to set the threshold information THI for each group. Specifically, the threshold information THI can be set for each destination, host, application group, or logical server group. For example, if it is desired to monitor a particular application, the application can be monitored by setting threshold information THI for the application.
The threshold information acquisition unit 360 provides the comparison unit 340 with threshold information THI.

The comparison unit 340 compares the threshold value acquired by the threshold information acquisition unit 360 and the index measuring the performance of the system measured by the measurement unit 310.
Specifically, the comparison unit 340 acquires threshold information THI from the threshold information acquisition unit 360 and performance information SPI from the measurement unit 310. The comparison unit 340 compares the acquired threshold information THI and performance information SPI. For example, assume that the user sets an arbitrary time as the threshold information THI for the response time of the monitored system 2. The comparison unit 340 compares the response time measured by the measurement unit 310 and the threshold information THI acquired by the threshold information acquisition unit 360. The comparison unit 340 determines that the state is normal when the response time measured by the measurement unit 310 is within the range of the threshold information THI acquired by the threshold information acquisition unit 360. Furthermore, if the response time is outside the range of the threshold information THI, it is determined that there is an abnormal state. That is, the comparing unit 340 compares whether the performance information SPI exceeds the threshold information THI based on the performance information SPI, which is an index for measuring the performance of the system measured by the measuring unit 310.
The comparison unit 340 provides the comparison results to the warning unit 350 and the statistics unit 320 as comparative performance information CPI.

The group selection information acquisition unit 330 acquires the group selected by the user from the operation detection unit 5.

The statistics unit 320 performs statistical processing on the index for measuring the performance of the system measured by the measurement unit 310. For example, the statistics unit 320 performs statistical processing to obtain the average value for each unit time of an index that measures the performance of the system.
Specifically, the statistics unit 320 acquires comparative performance information CPI from the comparison unit 340 , performance information SPI from the measurement unit 310 , and transaction group information TXGI from the group determination unit 200 . The statistics unit 320 performs statistical processing based on the acquired information (for example, comparative performance information CPI, performance information SPI, and transaction group information TXGI).

As an example, the statistics unit 320 calculates cumulative performance information ASPI, post-statistical performance information SSPI, and group statistical information GSPI based on the performance information SPI.
The cumulative performance information ASPI is the result of performing statistical processing on the performance information SPI. More specifically, in this example, the cumulative performance information ASPI is information represented by a two-dimensional graph in which time is plotted on the X axis and performance information SPI is plotted on the Y axis.
The post-statistical performance information SSPI is the result of statistical processing based on the performance information SPI and the comparative performance information CPI. More specifically, in this example, the post-statistical performance information SSPI is represented by a two-dimensional graph in which time is plotted on the X-axis and the number of times the performance information SPI is outside the threshold range is plotted on the Y-axis. It is information.
The group statistical information GSPI is the result of performing statistical processing on the performance information SPI for each group based on the transaction group information TXGI. More specifically, in this example, the group statistical information GSPI is information represented by a two-dimensional graph in which time is plotted on the X axis and performance information SPI of a specific group is plotted on the Y axis. As described above, groups include logical server groups and application groups, and each group may include multiple groups. Therefore, the group statistical information GSPI is divided into groups stored in the logical server group information storage section 220 and the application group information storage section 240. That is, the statistics unit 320 performs statistical calculations on the transaction indicated by the transaction information TXI, based on the transaction group information TXGI determined by the group determination unit 200.
The statistics section 320 provides the display selection section 370 with performance information SPI, cumulative performance information ASPI, post-statistical performance information SSPI, and group-by-group statistical information GSPI.

The group selection information acquisition unit 330 acquires group selection information SGI when the operation detection unit 5 detects the user's operation. The group selection information SGI here is information on a group selected by the user. When the user discovers that an abnormality has occurred in the monitored system 2, he identifies the location where the abnormal condition is occurring that causes the abnormality. In the system monitoring device 1, indicators for measuring system performance can be displayed for each group. An example of the selected group will be explained with reference to FIG. 3 again.
For example, in a situation where the response time of the monitored system 2 exceeds the threshold information THI set by the user, a case will be described in which the user identifies the location where an abnormality has occurred. In this example, the user selects the server V100 through the operation detection unit 5. The group selection information acquisition unit 330 acquires the fact that the server V100 has been selected as group selection information SGI, and provides it to the display selection unit 370. The display selection unit 370 provides the output unit 400 with the response time of the server V100 selected by the user. If the response time of the server V100 exceeds the range set by the threshold information THI, similar to the response time of the monitored system 2, it is presumed that the cause lies in the server V100. Furthermore, the user can identify the location of the abnormality by selecting a group such as the host V110 or host V120 that constitutes the server V100 and checking the response time.

The user can also specify applications through the operation detection unit 5. In this example, if the response time of the monitored system 2 is outside the range of the threshold information THI, it may be difficult to determine whether the cause of the abnormality is caused by hardware or software. Therefore, in order to identify the location where an abnormality occurs due to software, by selecting an application group for each application, it is possible to identify the location where an abnormality occurs when there is a problem with the application. In this example, the user selects the domain A100 through the operation detection unit 5. The group selection information acquisition section 330 acquires the fact that domain A100 has been selected as group selection information SGI, and provides it to the display selection section 370. The display selection unit 370 causes the output unit 400 to present the response time of the domain A100 selected by the user. If the response time of the domain A100 exceeds the range set by the threshold information THI, similar to the response time of the monitored system 2, it is presumed that the cause lies in the domain A100. Furthermore, the user can identify the application in which the abnormality is occurring by selecting a group such as domain A110 or domain A120 that constitutes domain A100 and checking the response time.
In other words, the group selection information SGI is group selection information for selecting an application group or a logical server group that is selected in response to output of the result of the statistical calculation performed by the statistics unit 320 from the output unit 400.
The group selection information acquisition unit 330 provides the acquired group selection information SGI to the display selection unit 370.

The display selection unit 370 selects information to be provided to the output unit 400 regarding the results of statistical processing performed by the statistics unit 320.
Specifically, the display selection unit 370 acquires performance information SPI, cumulative performance information ASPI, post-statistical performance information SSPI, and group statistical information GSPI from the statistics unit 320, and acquires the performance information SPI, cumulative performance information ASPI, post-statistics performance information SSPI, and group statistics information GSPI from the group selection information acquisition unit 330. Obtain group selection information SGI. The display selection unit 370 selects the result of the statistical calculation to be output (by the output unit) from among the results of the statistical calculation performed by the statistics unit 320, based on the group selection information SGI. The display selection unit 370 provides performance information SPI, cumulative performance information ASPI, post-statistical performance information SSPI, and group statistical information GSPI.

The warning unit 350 issues a warning when the index for measuring the performance of the system exceeds a threshold value as a result of the comparison by the comparison unit 340.
Specifically, the warning unit 350 obtains comparative performance information CPI from the comparison unit 340. The warning unit 350 provides warning information ALI to the output unit 400 when the performance information SPI exceeds the threshold information THI. The warning unit 350 causes the output unit to present the value of the performance information SPI that exceeds the threshold indicated by the comparative performance information CPI, the destination or host, and the application group or logical server group.

Here, the performance information SPI may momentarily exceed the comparative performance information CPI. When the user is trying to identify the abnormality or cause, even if the warning threshold is exceeded, if the period is very short (for example, in the case of momentary noise), the system monitoring device 1 may not require a warning to the user. Therefore, the warning unit 350 provides warning information ALI to the output unit 400 when the time during which the performance information SPI exceeds the threshold information THI exceeds a predetermined determination time.
There are two methods for determining whether the time during which the performance information SPI exceeds the threshold information THI exceeds a predetermined determination time: a method of measuring time and a method of measuring the number of times.
The method of measuring time is to determine whether the time from the time when the performance information SPI exceeds the threshold information THI to the time when the performance information SPI becomes less than the threshold information THI exceeds a predetermined determination time. It's a method. The warning unit 350 provides warning information ALI to the output unit 400 when the time during which the performance information SPI exceeds the threshold information THI exceeds a predetermined determination time.
The method of measuring the number of times is to measure whether the performance information SPI exceeds the threshold information THI at predetermined time intervals, and determine whether the number of times the performance information SPI exceeds the threshold information THI has reached the predetermined number of times. This is a method for making this determination. The warning unit 350 provides warning information ALI to the output unit 400 when the number of times the performance information SPI exceeds the threshold information THI reaches a predetermined number of times.
Both the method of measuring time and the method of measuring number of times measure the time during which performance information SPI exceeds threshold information THI. The warning unit 350 provides warning information ALI to the output unit 400 when the predetermined determination time is exceeded.
That is, the warning unit 350 can reduce the frequency at which warnings are issued due to noise, such as when the performance information SPI deteriorates momentarily.

The output unit 400 acquires performance information SPI, cumulative performance information ASPI, post-statistical performance information SSPI, group statistical information GSPI, and warning information ALI from the display selection unit 370 of the control unit 300. The output unit 400 outputs the acquired performance information SPI, cumulative performance information ASPI, post-statistical performance information SSPI, group statistical information GSPI, and warning information ALI. As an example, the output unit 400 outputs performance information SPI, cumulative performance information ASPI, warning information ALI, post-statistical performance information SSPI, and group statistical information GSPI to a display unit (not shown). let The display section is, for example, a liquid crystal display surface. Although the display unit will be described as an image display device, it is not limited to this, and may be configured as an information output device such as a printer device or a speaker device.
That is, the output unit 400 outputs performance information SPI, cumulative performance information ASPI, post-statistical performance information SSPI, group-based statistical information GSPI, and warning information ALI.

[Screen configuration of system monitoring device 1]
FIG. 5 is a diagram showing an example of the screen configuration of the system monitoring device in the embodiment. In this example, the output unit 400 displays the dashboard screen D900 shown in the figure on a display unit (not shown). The dashboard screen D900 includes a cumulative performance information image D100, a performance information image D300, and a selection information image D500 as screen components.

The cumulative performance information image D100 includes a cumulative average response time display image D110, a cumulative TRX request number display image D120, and a cumulative CPU usage rate display image D130 as screen components. The cumulative average response time display image D110, the cumulative TRX request number display image D120, and the cumulative CPU usage rate display image D130 are displayed based on the cumulative performance information ASPI.
In this example, the cumulative average response time display image D110 has time on the horizontal axis (hereinafter referred to as the X axis) and average response time on the vertical axis (hereinafter referred to as the Y axis). In other words, the cumulative average response time display image D110 shows the average response time for each hour.
The cumulative TRX request number display image D120 has time on the X axis and the number of TRX requests on the Y axis. In other words, the cumulative number of TRX requests display image D120 shows the number of TRX requests per hour.
The cumulative CPU usage rate display image D130 has time on the X axis and CPU usage rate on the Y axis. That is, the cumulative CPU usage rate display image D130 shows the CPU usage rate for each hour.

The cumulative average response time display image D110, the cumulative TRX request number display image D120, and the cumulative CPU usage rate display image D130 may be updated as time passes. In this example, on the X axis, the left side of the screen is information at an older point in time, and the right side of the screen is information at a new point in time. In the cumulative average response time display image D110, the cumulative TRX request count display image D120, and the cumulative CPU usage rate display image D130, when the cumulative average response time display image D110, the cumulative TRX request count display image D120, and the cumulative CPU usage rate display image D130 are updated as a unit of time passes, the displayed values are entirely shifted to the left of the screen, and the displayed values are shifted to the left of the screen. The oldest information on the left side is hidden. New information will be displayed in the empty space on the right side of the screen. In other words, the values scroll over time, allowing users to monitor metrics that measure system performance in real time.

The performance information image D300 includes an average response time display image D310, a TRX request number display image D320, a CPU usage rate display image D330, a memory usage rate display image D340, and a TPS display image D350 as screen components. ing. The average response time display image D310, the TRX request count display image D320, the CPU usage rate display image D330, the memory usage rate display image D340, and the TPS display image D350 are displayed based on the performance information SPI. The average response time display image D310 shows the average value of response time per unit time. The TRX request count display image D320 shows the average value of the TRX request count per unit time. The CPU usage rate display image D330 shows the average value of the CPU usage rate per unit time. The memory usage rate display image D340 shows the average value of the memory usage rate per unit time. The TPS display image D350 shows the average value of TPS per unit time. The unit time can be set arbitrarily. The unit time in this example is the same time as the time on the X axis shown in the cumulative performance information image D100.

As another example, the performance information image D300 may show instantaneous values. In that case, the instantaneous value measurement bar included in the cumulative performance information image D100 determines which point in time the value is to be displayed. The cumulative average response time display image D110 includes an average response time instantaneous value measurement bar D111. The average response time instantaneous value measurement bar D111 is moved by the user's operation detected by the operation detection unit 5. The operation detected by the operation detection unit 5 is acquired by a measurement bar operation acquisition unit (not shown) and provided to the display selection unit 370. The display selection unit 370 outputs the instantaneous value at the time indicated by the average response time instantaneous value measurement bar D111 to the output unit 400 as the average response time display image D310.

Similar to the cumulative average response time display image D110, the cumulative TRX request number display image D120 includes a TRX request number instantaneous value measurement bar D121. The display selection unit 370 outputs the instantaneous value detected by the operation of the TRX request count instantaneous value measurement bar D121 to the output unit 400 as the TRX request count display image D320.
Similarly, the cumulative CPU usage rate display image D130 includes a CPU usage rate instantaneous value measurement bar D131. The instantaneous value at the time detected by operating the CPU usage rate instantaneous value measurement bar D131 is output to the output unit 400 as the CPU usage rate display image D330.

The selection information image D500 includes a response time distribution image D510, a CPU usage rate display image by server group D520, an application threshold violation count display image D530, and an infrastructure threshold violation count display image D540 as screen components.
The response time distribution image D510 shows the distribution of response times. The X-axis shows the time range, and the Y-axis shows the number of corresponding transactions as a percentage. The response time distribution image D510 uses information included in the cumulative performance information ASPI. The statistics section 320 performs statistical processing on the response time included in the performance information SPI and provides it to the display selection section 370 as post-statistical performance information SSPI. The user can monitor the performance of the system more statistically using the response time distribution image D510 compared to the cumulative average response time display image D110.

The server group CPU usage rate display image D520 displays the CPU usage rate and memory usage rate for each group. The group selection information acquisition unit 330 acquires the group selection information SGI that the operation detection unit 5 acquired from the user. The group selection information acquisition unit 330 provides the display selection unit 370 with group selection information SGI. The display selection unit 370 selects a group to be displayed based on the group selection information SGI. The display selection unit 370 outputs the group statistical information GSPI to the output unit 400. In this example, CPU usage rate and memory usage rate are displayed for each logical server group. The groups selected by the group selection information SGI are group 1, group 2, and group 3.
The application threshold violation count display image D530 and the infrastructure threshold violation count display image D540 display the number of cases in which the performance information SPI exceeds the threshold range acquired by the threshold information acquisition unit 360. The application threshold violation count display image D530 shows the number of cases in which a specific application group exceeds the threshold, and the infrastructure threshold violation count display image D540 shows the number of cases in which a specific logical server group exceeds the threshold.

Note that the type of image to be displayed in the selection information image D500 is selected by the display selection unit 370 when a dashboard display information acquisition unit (not shown) detects a user's operation from the operation detection unit 5. In other words, the selection information image D500 can be arbitrarily determined by the user.

[An example of transaction statistical processing operation]
FIG. 6 is a diagram illustrating an example of transaction statistical processing operation in the embodiment. With reference to FIG. 6, a flow of acquiring transaction information TXI from the monitored system 2 and performing statistical processing will be described.
(Step S110) The transaction information acquisition unit 100 acquires transaction information TXI, which is an execution unit of exchanged information transmission, in the monitored system 2 including a plurality of applications 4 running on a plurality of hosts 3. do. The transaction information TXI acquired by the transaction information acquisition unit 100 includes host information that identifies the host to which the information has been transmitted among a plurality of hosts, and destination information that identifies the application to which the information has been transmitted.
The transaction information acquisition unit 100 provides the acquired transaction information TXI to the measurement unit 310 and the determination unit 250.

(Step S120) The measurement unit 310 acquires transaction information TXI from the transaction information acquisition unit 100. The measurement unit 310 measures an index for measuring the performance of the system based on the transaction information TXI. In this example, indicators for measuring system performance include response time, number of TRX requests, CPU usage rate, memory usage rate, TPS, and the like. An index for measuring system performance is provided to the statistics unit 320 as performance information SPI.
(Step S130) On the other hand, the determination unit 250 acquires transaction information TXI from the transaction information acquisition unit 100. The determination unit 250 provides the acquired transaction information TXI to the logical server group information acquisition unit 210 and the application group information acquisition unit 230.
The logical server group information acquisition unit 210 searches the logical server group information storage unit 220 for information on the group to which the host information included in the transaction information TXI belongs. The logical server group information acquisition unit 210 provides the determination unit 250 with information on the group to which the host information included in the transaction information TXI obtained by the search belongs as logical server group information VSGI.
The application group information acquisition unit 230 searches the application group information storage unit 240 for information on the group to which the destination information included in the transaction information TXI belongs. The application group information acquisition unit 230 provides the determination unit with information about the group to which the destination information included in the transaction information TXI obtained through the search belongs, as application group information APGI.
The determination unit 250 acquires logical server group information VSGI from the logical server group information acquisition unit 210 and acquires application group information APGI from the application group information acquisition unit 230. The determining unit 250 adds the logical server group information VSGI and the application group information APGI to the transaction information TXI, and provides it to the statistics unit 320 as the transaction group information TXGI.

(Step S140) The statistics unit 320 acquires performance information SPI from the measurement unit 310, and acquires transaction group information TXGI from the determination unit 250. The statistics section 320 performs statistical processing based on the acquired information. In this example, the statistics unit 320 calculates cumulative performance information ASPI, group-by-group statistical information GSPI, and post-statistical performance information SSPI through statistical processing.
The cumulative performance information ASPI is information obtained by integrating the instantaneous values indicated by the performance information SPI.
Group-specific statistical information GSPI is information obtained by integrating instantaneous values indicated by performance information SPI for each group based on performance information SPI and transaction group information TXGI.
The post-statistical performance information SSPI is information that has been subjected to statistical processing other than the above-mentioned statistical processing. In this example, the statistics unit 320 is information obtained by integrating performance information SPI exceeding the range specified by the threshold based on the threshold information THI acquired by the threshold information acquisition unit 360.
The statistics section 320 provides the display selection section 370 with performance information SPI, cumulative performance information ASPI, post-statistical performance information SSPI, and group-specific statistical information GSPI.

(Step S150) The display selection unit 370 acquires the performance information SPI, cumulative performance information ASPI, post-statistical performance information SSPI, and group statistical information GSPI from the statistics unit 320. The display selection unit 370 outputs the acquired information to the output unit 400.

[Example of group selection operation]
FIG. 7 is a diagram illustrating an example of a group statistical information display operation in the embodiment. With reference to FIG. 7, a flow of acquiring a group selected by a user and presenting group-by-group statistical information GSPI of the selected group will be described.
(Step S210) The statistics unit 320 acquires transaction group information TXGI from the group determination unit 200 and provides it to the display selection unit 370. Display selection section 370 outputs transaction group information TXGI to output section 400.

(Step S220) The user can select group information by drilling down.
Here, the term "drill down" refers to selecting groups sequentially (for example, one hierarchy at a time) from the upper hierarchy to the lower hierarchy. For example, in the example of FIG. 3, the flow of selecting a group by drill-down will be described. It is assumed that the application group shown in the lower row is selected. The user selects domain A100 or domain A200. At this point, the hierarchy below the medium function level and the small function level is not presented. When the operation detection unit 5 detects the selection of the domain A100, the output unit 400 presents the medium function level A110 and the medium function level A120. At this point, the small function level, which is a lower hierarchy, is not presented. When the operation detection unit 5 detects selection of the medium function level A110, the output unit 400 presents the small function level A111. In this way, the user selects a group by going down the hierarchy one level at a time by drilling down.
Returning to FIG. 7, the operation detection unit 5 detects the selection operation of group information by the user, and provides the selected group to the group selection information acquisition unit 330 as group selection information SGI.

(Step S230) The display selection unit 370 acquires group selection information SGI from the group selection information acquisition unit 330, and acquires group-specific statistical information GSPI from the statistics unit 320. The display selection unit 370 provides the output unit 400 with group-by-group statistical information GSPI of the group indicated by the group selection information SGI. The output unit 400 outputs group statistical information GSPI.

[Example of comparison/warning action]
FIG. 8 is a diagram illustrating an example of an operation in which indicators for measuring system performance are compared and a warning is issued in the embodiment.
(Step S310) The threshold information acquisition unit 360 acquires the threshold information THI from the operation detection unit 5. The threshold information acquisition unit 360 provides the acquired threshold information THI to the comparison unit 340.
(Step S320) The comparison unit 340 acquires threshold information THI from the threshold information acquisition unit 360, and acquires performance information SPI from the measurement unit 310. The comparison unit 340 compares the acquired threshold information THI and performance information SPI.

(Step S330) If the performance information SPI is outside the range indicated by the threshold information THI, that is, (step S330; YES), the comparison unit 340 advances the process to step S340. If the performance information SPI is within the range indicated by the threshold information THI, that is (step S330; NO), the comparison unit 340 advances the process to step S320. The comparison unit 340 compares the performance information SPI with the threshold information THI every time the performance information SPI is acquired from the measurement unit 310.

(Step S340) The warning unit 350 obtains comparative performance information CPI from the comparison unit 340, which indicates that the performance information SPI is outside the range of the threshold information THI. The warning unit 350 provides warning information ALI to the output unit 400. Upon acquiring the warning information ALI, the output unit 400 presents the warning information ALI.
Since the purpose of the warning information ALI is to warn the user, any means may be used. For example, it can be something like a pop-up window displayed on the user's display, an event notification using a network such as SNMPTrap, an announcement by a voice device, or an email sent to the person responsible for managing the system. It's okay to be.

[Overview of system monitoring device 1 in second embodiment]
FIG. 17 is a diagram showing an example of an overview of the monitored system 2 and the system monitoring device 1 in the second embodiment. Components similar to those in FIG. 1 are given the same reference numerals and descriptions thereof will be omitted.
The system monitoring device 1 acquires identification information ID from the monitored system 2. In this example, the system monitoring device 1 specifies the correspondence between the virtual machine and the host 3 by acquiring the identification information ID from the monitored system 2 .

[Overview of data center D100]
FIG. 10 is a diagram showing an overview of the data center D100 in the second embodiment. The configuration included in the data center D100 shown in the figure is also referred to as infrastructure.
The data center D100 includes multiple virtual integrated environments D200. In this example, data center D100 includes a virtual integrated environment D210 and a virtual integrated environment D220. In the following description, if a plurality of virtual integrated environments included in the data center D100 are not distinguished, they will be referred to as a virtual integrated environment D200.
Specifically, the virtual integrated environment D200 is server management software that centrally manages multiple server devices. For example, the virtual integrated environment D210 and the virtual integrated environment D220 may be the same type of server management software, or may be different types of server management software.

The virtual integrated environment D200 manages multiple server devices D400. In this example, the virtual integrated environment D210 manages a server device D410, a server device D411, a server device D420, a server device D421, and a server device D422. Server device D410 and server device D411 are connected to virtual integrated environment D210. Server device D420, server device D421, and server device D422 have a cluster configuration. Specifically, a cluster D310 is connected to the virtual integrated environment D210. A server device D420, a server device D421, and a server device D422 are connected to the cluster D310.
Hereinafter, when each cluster is not distinguished, it will be referred to as cluster D300. If the respective server devices are not distinguished, they will be referred to as server device D400.

A plurality of virtual machines D500 operate under the environment of the server device D400. For example, in this example, virtual machine D510 and virtual machine D511 operate in the environment of server device 410. Hereinafter, when each virtual machine is not distinguished, it will be referred to as a virtual machine D500.

Each virtual machine D500 has a unique identification information ID.
For example, the identification information ID may be a UUID (Universally Unique Identification). UUID is a 128-bit identifier generated from time, MAC address, etc. In this example, in order to uniquely distinguish one virtual machine D500 from another virtual machine D500, a UUID is used that has an extremely low possibility that the identification information of the virtual machines will match. However, the present embodiment is not limited to this example, and other identification information may be used.
The identification information ID may be any identification information that can uniquely identify the virtual machine D500.

The configuration of the infrastructure provided in the data center D100 described above can also be explained from the concept of applications that operate on the infrastructure. In this example, the infrastructure provided in data center D100 is comprised of computer system C110 and computer system C120. Computer system C110 and computer system 120 are specific examples of computer system C100.
For example, the computer system C110 configures a logical server SV1 by a host 3a1, a host 3a2, and a host 3a3. Further, the computer system C110 configures a logical server SV2 by a host 3b1, a host 3b2, and a host 3b3. Hosts 3a1 to 3a3 and hosts 3b1 to 3b3 are specific examples of hosts 3.

In this example, each host 3 has a unique identification information ID. For example, the identification information ID may be a UUID.

FIG. 11 is a diagram showing an example of the configuration of the system monitoring system 70 in the second embodiment. The functional configuration of the system monitoring device 1 will be described with reference to the same figure. Hereinafter, the system monitoring system 70 will also be referred to as a monitoring system.
[Functional configuration of system monitoring device 1]
The system monitoring device 1 includes a first identification information acquisition section 10, a first storage section 11, a second identification information acquisition section 20, a second storage section 21, a comparison section 30, and an output section 40. Equipped with.

The first identification information acquisition unit 10 acquires the identification information ID of the virtual machine D500. The virtual machine D500 operates on a plurality of server devices D400 connected to the virtual integrated environment D200. That is, the first identification information acquisition unit 10 acquires the identification information ID of the virtual machine D500 operating on the plurality of server devices D400 connected to the virtual integrated environment D200.
In this case, the system monitoring system 70 may be configured to include the first agent 60 to acquire the identification information ID of the virtual machine D500.

The first agent 60 is distributed to the virtual integrated environment D200. The virtual integrated environment D200 acquires the identification information ID of each virtual machine D500 provided under the environment of the virtual integrated environment D200. The first agent 60 acquires the identification information ID of each virtual machine D500 acquired by the virtual integrated environment D200. The first agent 60 provides the acquired identification information ID of the virtual machine D500 to the first identification information acquisition unit 10. Hereinafter, the first identification information acquisition unit 10 will also be referred to as a virtual integrated environment side UUID acquisition unit, and the first agent 60 will also be referred to as a virtual integrated environment side agent.

The first identification information acquisition unit 10 stores the acquired identification information ID and the information of the virtual machine D500 in the first storage unit 11 in association with each other.
The first storage unit 11 stores the correspondence relationship between the identification information ID acquired by the first identification information acquisition unit 10 and the information indicating the virtual machine D500 as a first correspondence relationship I1. Hereinafter, the first correspondence relationship I1 will also be referred to as virtual machine information.

FIG. 12 is a diagram illustrating an example of virtual machine information stored in the virtual machine information storage unit in the second embodiment. The first storage unit 11 stores virtual machine names and UUIDs in association with each other. As an example, in the first storage unit 11, a virtual machine name "VM-0001" and a UUID "UUID-1001" are associated and stored as a first correspondence relationship I1. Hereinafter, the first storage unit 11 will also be referred to as a virtual machine information storage unit.

Returning to FIG. 11, the second identification information acquisition unit 20 acquires the identification information ID of the host 3. The computer system C100 is composed of a plurality of hosts 3. Further, the host 3 operates on the virtual machine D500. That is, the second identification information acquisition unit 20 acquires the identification information ID of the virtual machine D500 on which one host 3 operates in the computer system composed of a plurality of hosts 3. Hereinafter, the identification information ID of the virtual machine D500 on which the host 3 operates will also be referred to as the identification information ID of the host 3.
In this case, the system monitoring system 70 may be configured to acquire the identification information ID of the host 3 by including the second agent 61.

The second agent 61 is distributed to each host 3. Since the second agent 61 is distributed to each host 3, it can acquire the identification information ID of the host 3 to which it is distributed. The second agent 61 provides the acquired identification information ID of the host 3 to the second identification information acquisition unit 20 . Hereinafter, the second identification information acquisition unit 20 will also be referred to as a host-side UUID acquisition unit, and the second agent 61 will also be referred to as a host-side agent.

The second identification information acquisition unit 20 stores the acquired identification information ID and the information of the host 3 in the second storage unit 21 in association with each other.
The second storage unit 21 stores the correspondence relationship between the identification information ID acquired by the second identification information acquisition unit 20 and the information indicating the host 3 as a second correspondence relationship I2. Hereinafter, the second correspondence relationship I2 will also be referred to as host information.

FIG. 13 is a diagram illustrating an example of host information stored in the host information storage unit in the second embodiment. The second storage unit 21 stores host names and UUIDs in association with each other. As an example, in the second storage unit 21, a host name "Host-0001" and a UUID "UUID-1001" are associated and stored as a second correspondence relationship I2. Hereinafter, the second storage unit 21 will also be referred to as a host information storage unit.

The matching unit 30 matches the first correspondence relationship I1 stored in the first storage unit 11 and the second correspondence relationship I2 stored in the second storage unit 21 to determine whether they have the same identification information ID. The virtual machine D500 and the host 3 are specified as matched information I3.
The matching unit 30 provides the matched information I3 to the output unit 40.

The output unit 40 acquires the matched information I3 specified as a result of the matching performed by the matching unit 30 from the matching unit 30. The output unit 40 outputs the acquired matched information I3.
Note that in this example, the system monitoring system 70 may include a display unit 50. When the system monitoring system 70 includes the display section 50, the output section 40 outputs the matched information I3 to the display section 50.

Note that the system monitoring device 1 may include a matched information storage section 31. In that case, the matching unit 30 matches the first correspondence relationship I1 stored in the first storage unit 11 and the second correspondence relationship I2 stored in the second storage unit 21, and stores the comparison result. It is stored in the matched information storage unit 31 as matched information I3.
The matched information storage unit 31 stores matched information I3 specified as a result of the matching performed by the matching unit 30. In this case, the output unit 40 may be configured to output the matched information I3 stored in the matched information storage unit 31.

FIG. 14 is a diagram showing an example of matched information I3 stored in the matched information storage unit 31 in the second embodiment. The matched information storage unit 31 stores a UUID, a virtual machine name, and a host name in association with each other. As an example, in the matched information storage unit 31, "UUID-1001" is associated with the UUID, "VM-0001" is associated with the virtual machine name, and "Host-0001" is associated with the host name. It is stored as I3. In this case, the virtual machine D500 indicated by the virtual machine name "VM-0001" and the host 3 indicated by the host name "Host-0001" are identified as operating on the same server device D400.

On the other hand, in the matched information storage unit 31, "UUID-1004" for the UUID, "-" for the virtual machine name, and "Host-0004" for the host name are associated and stored as matched information I3. has been done. In this case, the host name "Host-0004" does not specify the corresponding virtual machine D500, so if the host name "Host-0004" is running on a physical machine or is a server that is not managed, etc. is possible.
In this way, when the virtual machine D500 corresponding to the host name "Host-0004" is not specified, the output unit 40 outputs information indicating that the corresponding virtual machine D500 does not exist.
In this way, if there is no virtual machine D500 having the same identification information ID as the identification information ID of the host 3, the output unit 40 is configured to output information indicating that the corresponding virtual machine D500 does not exist. You may.

The timing at which the first identification information acquisition unit 10 and the second identification information acquisition unit 20 acquire the identification information ID will be explained with reference to FIGS. 15 and 16.
[Timing for acquiring identification information ID]
FIG. 15 is a diagram illustrating an example of the timing at which the first identification information acquisition unit 10 acquires the identification information ID of the virtual machine D500 in the second embodiment. In the figure, the state of the virtual machine D500, the identification information ID of the virtual machine D500, and the identification information ID stored in the first storage unit 11 are shown with time as the horizontal axis. In the figure, "virtual machine state" indicates whether the virtual machine D500 is in a running state or a stopped state, and "virtual machine UUID" indicates the value of the identification information ID possessed by the virtual machine D500. “UUID” of the machine information storage unit indicates the identification information ID stored in the first storage unit 11.

For example, when the first agent 60 is distributed to the virtual integrated environment D200, the first agent 60 acquires the identification information ID of each virtual machine D500 existing under the virtual integrated environment D200.
In this case, the first identification information acquisition unit 10 may be configured to acquire the identification information ID at predetermined intervals in accordance with the cycle at which the virtual integrated environment D200 acquires the identification information ID of the virtual machine D500. The period for acquiring the identification information ID referred to here is, for example, the period T1 shown in FIG. 15.
In the example shown in FIG. 15, the first agent 60 acquires the identification information ID of each virtual machine D500 existing in the virtual integrated environment D200 at times ta1, ta2, ta3, and ta4. Note that the cycle T1 in which the first agent 60 acquires the identification information ID of the virtual machine D500 in this case may be set to, for example, 5 minutes to 10 minutes.

In the example shown in the figure, the state of the virtual machine D500 is in the "starting" state before time t11. The identification information ID of the virtual machine D500 is "UUID11" before time t11.
The state of the virtual machine D500 switches from the "starting" state to the "stopping" state at time t11. In this example, the virtual machine D500 is replaced between time t11 and time t12. The task of replacing the virtual machine D500 is, for example, the task of changing the server device D400 to which the virtual machine D500 is connected.
The figure shows a case where the virtual machine D500 is recreated when replaced. When virtual machine D500 is recreated, a new UUID is issued. Re-creation of the virtual machine D500 is a case where the server device D400 and the virtual machine D500 are deleted and a virtual machine D500 with the same name is created again. When the virtual machine D500 is recreated, the identification information ID of the virtual machine D500 is changed. Note that if the virtual machine is not recreated but simply stopped and started, the UUID will not be changed. Further, in this embodiment, a case has been described in which a virtual machine is recreated when replaced, but the present invention is not limited to this, and a new UUID is issued each time a virtual machine is recreated.

The state of the virtual machine D500 switches from the "stopped" state to the "started" state at time t12. The identification information ID of the virtual machine D500 is changed to "UUID12" when the virtual machine D500 is started at time t12.
The identification information ID of the virtual machine D500 that the first agent 60 acquires at time ta4 is "UUID12." The first agent 60 provides "UUID12", which is the identification information ID of the virtual machine D500, to the first identification information acquisition unit 10 at time ta4. The first identification information acquisition unit 10 acquires “UUID12”, which is the identification information ID of the virtual machine D500, from the first agent 60, and stores it in the first storage unit 11.
Therefore, the identification information ID stored in the first storage unit 11 is changed from "UUID11" to "UUID12" at time ta4.

As another example, when the virtual integrated environment D200 detects that the identification information ID of the virtual machine D500 has changed, the first agent 60 detects the change in the identification information ID of the virtual machine D500. The configuration may be such that the identification information ID is provided to the identification information acquisition unit 10.

FIG. 16 is a diagram illustrating an example of the timing at which the second identification information acquisition unit 20 acquires the identification information ID of the host 3 in the second embodiment. In the figure, the state of the host 3, the identification information ID of the host 3, and the identification information ID stored in the second storage unit 21 are shown with time as the horizontal axis. In the same figure, "Host status" indicates whether the host 3 is activated or stopped, "Host UUID" indicates the value of the identification information ID possessed by the host 3, "Host information storage section “UUID” indicates identification information ID stored in the second storage unit 21.
Note that, similarly to the case of FIG. 15, this figure also shows a case where the virtual machine D500 is recreated when replaced.

The host 3 operates on the virtual machine D500. Therefore, when the combination of the identification information ID of the host 3 and the identification information ID of the virtual machine D500 is changed, the host 3 is restarted. Therefore, the second agent 61 may be configured to acquire the identification information ID when the host 3 is started. In that case, the second identification information acquisition unit 20 acquires the identification information ID when the host 3 is started.
In the example shown in FIG. 16, the second agent 61 acquires the identification information ID at time t22 when the host 3 is started.

In the example shown in the figure, the state of the host 3 is in the "startup" state before time t21. The identification information ID of the host 3 is "UUID21" before time t21.
The state of the host 3 switches from the "start" state to the "stop" state at time t21. In this example, the host 3 is replaced between time t21 and time t22. The task of replacing the host 3 is, for example, the task of replacing the virtual machine D500 in which the host 3 is installed.
Here, if you delete host 3 and create host 3 with the same name on another virtual machine D500, the virtual machine D500 where host 3 is installed will be changed, so the identification information ID of host 3 will be changed. Be changed.

The state of the host 3 switches from the "stopped" state to the "started" state at time t22. The identification information ID of the host 3 is changed to "UUID22" when it is activated at time t22.
The second agent 61 acquires the identification information ID of the host 3 at time t22 when the host 3 is restarted. At time t22, the identification information ID of the host 3 acquired by the second agent 61 is "UUID22". The second agent 61 provides “UUID22”, which is the identification information ID of the host 3, to the second identification information acquisition unit 20 at time t22. The second identification information acquisition unit 20 acquires “UUID22”, which is the identification information ID of the virtual machine D500, from the second agent 61, and stores it in the second storage unit 21.
Therefore, the identification information ID stored in the second storage unit 21 is changed from "UUID21" to "UUID22" at time 22.

FIG. 17 is a diagram showing an example of a series of operations of the system monitoring device 1 in the second embodiment. A series of operations performed by the system monitoring device 1 will be explained with reference to the same figure.
[Series of operations performed by system monitoring device 1]
(Step S10) The first identification information acquisition unit 10 acquires the identification information ID of the virtual machine D500. Note that, as described above, the first identification information acquisition unit 10 may be configured to acquire the identification information ID at predetermined intervals.
(Step S20) The second identification information acquisition unit 20 acquires the identification information ID of the host 3. Note that, as described above, the second identification information acquisition unit 20 may be configured to acquire the identification information ID when the host 3 is started.

(Step S30) The matching unit 30 matches the identification information ID of the virtual machine D500 and the identification information ID of the host 3. Specifically, the matching unit 30 matches the identification information ID of the virtual machine D500 stored in the first storage unit 11 and the identification information ID of the host 3 stored in the second storage unit 21. may be configured.
(Step S40) If the identification information ID of the virtual machine D500 and the identification information ID of the host 3 match as a result of the comparison (step S40; YES), the matching unit 30 identifies the same identification information ID as that of the host 3. Assuming that the virtual machine D500 exists, the process advances to step S50.
As a result of the comparison, if the identification information ID of the virtual machine D500 and the identification information ID of the host 3 do not match (step S40; NO), the matching unit 30 selects a virtual machine having the same identification information ID as the host 3. Assuming that D500 does not exist, the process advances to step S60.

(Step S50) The output unit 40 outputs information indicating the correspondence between the virtual machine D500 and the host 3, and ends the process.
(Step S60) The output unit 40 outputs information indicating that the virtual machine D500 corresponding to the host 3 does not exist, and ends the process. Note that in this case, the output unit 40 may be configured to output information indicating that the host 3 for which the corresponding virtual machine D500 does not exist is operating on a physical machine.

[Summary of effects of embodiment]
As explained above, the system monitoring device 1 of this embodiment includes the first identification information acquisition unit 10 and the second identification information acquisition unit 20, so that Obtain identification information ID. The matching unit 30 identifies the relationship between the virtual machine D500 and the host 3 by comparing both identification information IDs.
Therefore, according to the system monitoring device 1 of this embodiment, the relationship between the virtual machine D500 and the host 3 can be easily specified.

Further, according to the embodiment described above, the identification information ID is a UUID. The system monitoring device 1 identifies each virtual machine D500 and each host 3 using the UUID. UUID can uniquely distinguish other virtual machines from each other because the possibility that the identification information of virtual machines will match is extremely small.
Therefore, according to the system monitoring device 1 of this embodiment, the relationship between the virtual machine D500 and the host 3 can be uniquely specified.

Further, according to the embodiment described above, the first identification information acquisition unit 10 acquires the identification information ID every predetermined period.
The first identification information acquisition unit 10 can acquire the identification information IDs of the respective virtual machines D500 operating in the virtual integrated environment D200 at once by acquiring the identification information IDs at predetermined intervals. can.

Further, according to the embodiment described above, the second identification information acquisition unit 20 acquires the identification information ID when the host 3 is started.
Since the host 3 operates on the virtual machine D500, if the combination of the identification information ID of the host 3 and the identification information ID of the virtual machine D500 is changed, the host 3 is restarted. In other words, since the combination of the identification information ID of host 3 and the identification information ID of virtual machine D500 is only changed when host 3 is restarted, only the case where host 3 is restarted is detected. I wish I could.
Therefore, the second identification information acquisition unit 20 can reduce the number of times the second identification information acquisition unit 20 acquires the identification information ID by acquiring the identification information ID of the host 3 when the host 3 is started.

Further, according to the embodiment described above, the system monitoring device 1 compares the virtual machine information stored in the first storage unit 11 with the host information stored in the second storage unit 21. It further includes a matched information storage section 31 that stores matched information I3.
The system monitoring device 1 stores the combination of the virtual machine D500 and the host 3 by including the matched information storage unit 31. Therefore, according to the system monitoring device 1 of this embodiment, it is possible to detect that the combination of the virtual machine D500 and the host 3 has changed.

Further, according to the embodiment described above, when there is no virtual machine D500 having the same identification information ID as the identification information ID of the host 3, the output unit 40 indicates that the corresponding virtual machine D500 does not exist. The information shown is output as a correspondence.
Here, the host 3 that is not operating on the virtual machine D500 may be operating on a physical machine. Therefore, according to the system monitoring device 1 of this embodiment, the host 3 running on the physical machine can be identified by outputting information indicating that the virtual machine D500 corresponding to the host 3 does not exist. can.

Further, according to the embodiment described above, the system monitoring device 1 further includes a transaction information acquisition section 100, an application group information acquisition section 230, a logical server group information acquisition section 220, and a group determination section 200.
The group determination unit 200 can identify the correspondence between an application and a logical server that is its operating environment by determining at least one of the application group and the logical server group of the acquired transaction information TXI. .
Further, by including the matching unit 30, the system monitoring device 1 can specify the relationship between the virtual machine D500 and the host 3. Therefore, according to the system monitoring device 1 of this embodiment, it is possible to specify the correspondence between the hosts that constitute a logical server and the infrastructure (virtual machines and physical servers) that operate them.
Therefore, the system monitoring device 1 can specify the correspondence between applications, logical servers, and infrastructure.

Further, according to the embodiment described above, the system monitoring system 70 includes the first agent 60 and the second agent 61. The first agent 60 provides the first identification information acquisition unit 10 with the identification information ID of the virtual machine D500 that is distributed to the virtual machine D500 and operates under the virtual integrated environment D200. The second agent 61 is distributed to the host 3 and provides the second identification information acquisition unit 20 with the identification information ID of the host 3 .
By configuring the system monitoring system 70 to include a first agent 60 and a second agent 61, the configuration of the server device D400, cluster D300, or virtual machine D500 connected to the virtual integrated environment D200 has changed. This can be easily handled in any case.

Note that all or part of the functions of each part of the system monitoring device 1 in the embodiment described above can be realized by recording programs for realizing these functions on a computer-readable recording medium. It may also be realized by having a computer system read and execute a program recorded on a medium. Note that the "computer system" herein includes hardware such as an OS and peripheral devices.

Furthermore, the term "computer-readable recording medium" refers to a storage unit such as a portable medium such as a magneto-optical disk, ROM, or CD-ROM, or a hard disk built into a computer system. Furthermore, a "computer-readable recording medium" refers to a medium that dynamically stores a program for a short period of time, such as a communication line when transmitting a program via a network such as the Internet. It may also include a device that retains a program for a certain period of time, such as a volatile memory inside a computer system that is a server or a client. Further, the above program may be for realizing a part of the above-mentioned functions, or may be one that can realize the above-mentioned functions in combination with a program already recorded in the computer system. .

Although the mode for implementing the present invention has been described above using embodiments, the present invention is not limited to these embodiments in any way, and various modifications and substitutions can be made without departing from the spirit of the present invention. can be added.

DESCRIPTION OF SYMBOLS 1... System monitoring device, 2... Monitored system, 3... Host, 4... Application, 5... Operation detection unit, 100... Transaction information acquisition unit, 200... Group determination unit, 300... Control unit, 400... Output unit, 210 ...Logical server group information acquisition unit, 220...Logical server group information storage unit, 230...Application group information acquisition unit, 240...Application group information storage unit, 250...Determination unit, 310...Measurement unit, 320...Statistics unit, 330... Group selection information acquisition section, 340... Comparison section, 350... Warning section, 360... Threshold information acquisition section, 370... Display selection section, TXI... Transaction information, TXGI... Transaction group information, VSGI... Logical server group information, APGI... Application Group information, SGI...group selection information, SPI...performance information, SSPI...post-statistical performance information, THI...threshold information, CPI...comparative performance information, ALI...warning information, 10...first identification information acquisition section, 11...th 1 storage section, 20... second identification information acquisition section, 21... second storage section, 30... matching section, 31... matched information storage section, 40... output section, 50... display section, 60... first agent, 61...second agent, 70...system monitoring system, ID...identification information

Claims (8)

a first identification information acquisition unit that acquires identification information of a virtual machine running on a plurality of server devices connected to the virtual integrated environment;
a second identification information acquisition unit that acquires identification information of the virtual machine in which one host operates in a computer system composed of a plurality of hosts;
a first storage unit that stores a correspondence relationship between the identification information acquired by the first identification information acquisition unit and information indicating the virtual machine as a first correspondence relationship;
a second storage unit that stores a correspondence relationship between the identification information acquired by the second identification information acquisition unit and information indicating the host as a second correspondence relationship;
The first correspondence relationship stored in the first storage unit and the second correspondence relationship stored in the second storage unit are compared, and the virtual machine and the host having the same identification information are identified. a matching unit that identifies the information as matched information;
an output unit that outputs matched information identified as a result of the matching performed by the matching unit ;
Transaction information that identifies a transaction that is an execution unit of information transmission exchanged within a computer system, and includes destination information that indicates an application that is the destination of the transaction and host information that identifies a host within the computer system. a transaction information acquisition unit that acquires the
an application group information acquisition unit that acquires application group information indicating a correspondence relationship between destination information included in the transaction information and application groups;
a logical server group information acquisition unit that acquires logical server group information indicating a correspondence relationship between host information included in the transaction information and the logical server group;
Based on the application group information acquired by the application group information acquisition unit and the logical server group information acquired by the logical server group information acquisition unit, the transaction indicated by the transaction information acquired by the transaction information acquisition unit belongs. a group determination unit that determines at least one of the application group or the logical server group;
The output unit outputs the result determined by the group determination unit.
Monitoring equipment. The monitoring device according to claim 1, wherein the identification information is a UUID (Universally Unique Identification). The monitoring device according to claim 1 or 2, wherein the first identification information acquisition unit acquires the identification information at predetermined intervals. The monitoring device according to any one of claims 1 to 3, wherein the second identification information acquisition unit acquires the identification information when the host is started. further comprising a matched information storage unit that stores the matched information specified as a result of the matching performed by the matching unit,
The monitoring device according to any one of claims 1 to 4, wherein the output unit outputs the matched information stored in the matched information storage unit. The output section is
If the virtual machine having the same identification information as the identification information of the host does not exist, information indicating that the corresponding virtual machine does not exist is output as the correspondence relationship. The monitoring device according to any one of the above. A monitoring device according to any one of claims 1 to 6 ,
a first agent provided in the virtual integrated environment and providing the identification information to the first identification information acquisition unit;
a second agent provided in the host and providing the identification information to the second identification information acquisition unit. to the computer ,
a first identification information acquisition step of acquiring identification information of a virtual machine running on a plurality of server devices connected to the virtual integrated environment;
a second identification information acquisition step of acquiring identification information of the virtual machine on which one host operates in a computer system composed of a plurality of hosts;
A correspondence between the identification information acquired in the first identification information acquisition step and information indicating the virtual machine, and a correspondence between the identification information acquired in the second identification information acquisition step and information indicating the host. a matching step of comparing the relationships and identifying the virtual machine and the host having the same identification information as matched information;
an output step of outputting matched information identified as a result of the matching in the matching step ;
Transaction information that identifies a transaction that is an execution unit of information transmission exchanged within a computer system, and includes destination information that indicates an application that is the destination of the transaction and host information that identifies a host within the computer system. a transaction information acquisition step for acquiring the transaction information;
an application group information acquisition step of acquiring application group information indicating a correspondence relationship between destination information included in the transaction information and application groups;
a logical server group information acquisition step of acquiring logical server group information indicating a correspondence relationship between the host information included in the transaction information and the logical server group;
Based on the application group information acquired by the application group information acquisition step and the logical server group information acquired by the logical server group information acquisition step, the transaction indicated by the transaction information acquired by the transaction information acquisition step a group determination step of determining at least one of the application group or the logical server group to which the
A monitoring program that runs

Images