JP7640483B2 - Information processing device, monitoring system, monitoring method, and monitoring program - Google Patents

Description

The present invention relates to an information processing device, a monitoring system, a monitoring method, and a monitoring program.

Figure 18 is an explanatory diagram showing an example of a conventional monitoring system 200. The monitoring system 200 shown in Figure 18 has an installation store 201A, a data center 202, and a security center 203. The installation store 201A is a store or the like in which an ATM (Automatic Teller Machine) 201, which is a monitored device, is installed. The data center 202 has a GW (Gateway) device 204. The GW device 204 is a monitoring device that provides business applications to the ATM 201 and remotely monitors the status of the ATM 201. The business application is an application for executing business within the ATM 201. The GW device 204 has an active GW (Gateway) device 204A and a standby GW device 204B. The security center 203 is the base of a security company that guards and maintains the ATM 201. The security center 203 has an operator terminal 203A operated by an operator.

For example, when an abnormality such as vibration is detected by a sensor in the ATM 201, the ATM 201 notifies the GW device 204 of the details of the failure by a dialing report on a telephone line and a TCP report on an Internet line. Note that a TCP report is a primary report including, for example, identification information for identifying the faulty ATM 201, the model of the faulty ATM 201, and detailed information on the failure indicating the details of the failure, whereas a dialing report is a secondary report including the telephone number of the location where the faulty ATM 201 is installed. When the GW device 204 receives a dialing report and a TCP report from the ATM 201, the GW device 204 merges the dialing report and the TCP report and reports the merged report to the operator terminal 203A in the security center 203. As a result, the operator of the security center 203 recognizes the details of the failure from the dialing report and the TCP report, and recognizes the failure or abnormality of the ATM 201. The operator can then dispatch a security guard to the faulty ATM 201.

JP 2007-323198 A JP 2007-272328 A JP 2013-175085 A JP 2019-49411 A JP 2002-7172 A

However, in the conventional monitoring system 200, even if the ATM 201 breaks down, if the GW device 204 itself freezes due to an abnormality in a business application, the GW device 204 cannot send dial or TCP reports to the security center 203. In other words, if the GW device 204 breaks down, it cannot report to the security center 203. Therefore, there is a demand for an information processing device that evaluates the status of the monitoring device itself, such as the GW device 204, which monitors the monitored device such as the ATM 201.

One aspect is to provide an information processing device etc. that can evaluate the status of the monitoring device itself that monitors the monitored device.

An information processing device of one embodiment monitors a monitoring device that monitors a monitored device. The information processing device has a determination unit, a collection unit, a comparison unit, and an evaluation unit. The determination unit determines whether log information of the monitoring device has been periodically acquired. If the log information cannot be acquired, the collection unit collects resource information of a comparison target of the monitoring device. The comparison unit compares the resource information of the comparison target collected by the collection unit with normal resource information stored in advance. The evaluation unit evaluates the state of the monitoring device based on the comparison result of the comparison unit.

One aspect is that it can evaluate the status of the monitoring device itself that monitors the monitored device.

FIG. 1 is an explanatory diagram showing an example of a monitoring system according to the present embodiment. FIG. 2 is a block diagram showing an example of the functional configuration of an ATM. FIG. 3 is a block diagram illustrating an example of a functional configuration of a GW device. FIG. 4 is a block diagram illustrating an example of a functional configuration of the server device. FIG. 5 is an explanatory diagram showing an example of a table configuration of the resource memory. FIG. 6 is an explanatory diagram showing an example of a table configuration of the target resource memory. FIG. 7 is an explanatory diagram showing an example of a table configuration of the resource memory in normal operation. FIG. 8 is an explanatory diagram showing an example of a table configuration of the threshold pattern memory. FIG. 9 is a flow chart showing an example of the processing operation of the CPU in the server device related to the first collection processing. FIG. 10 is a flow chart showing an example of the processing operation of the CPU in the server device related to the monitoring process. FIG. 11 is a flow chart showing an example of a processing operation of the CPU in the server device related to the verification processing. FIG. 12 is a flow diagram showing an example of the processing operation of the CPU in the server device related to the second collection processing. FIG. 13 is a flow chart showing an example of the processing operation of the CPU in the server device related to the evaluation processing. FIG. 14 is a flow chart showing an example of the processing operation of the CPU in the server device related to the re-verification processing. FIG. 15 is a flow diagram showing an example of a processing operation of a CPU in a server device related to a GW switching process. FIG. 16 is a flowchart showing an example of the processing operation of the CPU in the server device related to the third collection process. FIG. 17 is a block diagram showing an example of the configuration of an information processing device that executes a monitoring program. FIG. 18 is an explanatory diagram showing an example of a conventional monitoring system.

Below, examples of the information processing device and the like disclosed in the present application will be described in detail with reference to the drawings. Note that the disclosed technology is not limited to these examples. In addition, the examples shown below may be combined as appropriate to the extent that no contradiction occurs.

[Configuration of monitoring system 1]
FIG. 1 is an explanatory diagram showing an example of a monitoring system 1 of the present embodiment. The monitoring system 1 shown in FIG. 1 includes an installation store 2A, a data center 3, and a security center 4. The installation store 2A is a store or the like in which an ATM (Automatic Teller Machine) 2, which is a monitored device, is installed. The data center 3 includes a GW (Gateway) device 5 and a server device 6. The GW device 5 is a monitoring device that provides business applications to the ATM 2 and remotely monitors the state of the ATM 2. The GW device 5 includes an active GW device 5A and a standby GW device 5B. The server device 6 is an information processing device that monitors the GW device 5. The security center 4 is a base of a security company that guards and maintains the ATM 2. The security center 4 includes an operator terminal 4A operated by an operator of the security center 4.

[ATM configuration]
FIG. 2 is a block diagram showing an example of the functional configuration of the ATM 2. The ATM 2 shown in FIG. 2 has a deposit/withdrawal mechanism 11, a first communication unit 12, a second communication unit 13, a touch panel 14, a memory 15, a sensor 16, a mechanism control unit 17, and a CPU (Central Process Unit) 18. The deposit/withdrawal mechanism 11 is a mechanical mechanism for depositing and withdrawing cash. The first communication unit 12 is a communication interface for communicating with the GW device 5 by dial communication on a telephone line. The second communication unit 13 is a communication interface for communicating with the GW device 5 by TCP communication on an Internet line. The touch panel 14 is an input/output interface having a panel function for displaying various information and a touch function for inputting various commands. The memory 15 is an area for storing various information related to the ATM 2. The sensor 16 is various sensors in the ATM 2, and includes, for example, a vibration sensor for detecting external vibrations to the ATM 2. The mechanism control unit 17 is a mechanical control unit that drives and controls the deposit/withdrawal mechanism 11. The CPU 18 controls the entire ATM 2. When the ATM 2 detects the lock/unlock of the door or abnormal vibration by the sensor 16, it notifies the GW device 5 of the ATM abnormality by TCP notification and dial notification. By reporting through different communication lines for TCP notification and dial notification, even if a fault occurs in one line, the ATM 2 notifies the GW device 5 of the abnormality of the ATM 2 using the other communication line. Furthermore, the ATM 2 notifies the GW device 5A of the active system and the GW device 5B of the standby system of the abnormality of the ATM 2 by dial notification and TCP notification. Note that the TCP notification of the Internet line is the main notification of the main line, and the dial notification of the telephone line is the secondary notification of the secondary line.

[GW device]
FIG. 3 is a block diagram showing an example of the functional configuration of the GW device 5. The GW device 5 shown in FIG. 3 has a first communication unit 21, a second communication unit 22, a third communication unit 23, a server communication unit 24, a memory 25, and a CPU 26. The first communication unit 21 is a communication interface that communicates with the ATM 2 by dial communication on a telephone line. The second communication unit 22 is a communication interface that communicates with the ATM 2 by TCP communication on an Internet line. The third communication unit 23 is a communication interface that communicates with the security center 4 by a dedicated line. The server communication unit 24 is a communication interface that communicates with the server device 6. The memory 25 is an area that stores information related to the GW device 5. The CPU 26 controls the entire GW device 5. The GW device 5 in the monitoring system 1 has a GW device 5A of an active system and a GW device 5B of a standby system, but the configurations are the same. The active GW device 5A is a GW device that monitors the ATM 2, which is a monitored device. The standby GW device 5B is a GW device for switching over the active GW device 5A when the active GW device 5A fails. When the active GW device 5A receives an abnormality of the ATM 2 by dialing report and TCP report from the ATM 2, it notifies the operator terminal 4A in the security center 4 of the ATM abnormality. The operator in the security center 4 uses the operator terminal 4A that received the ATM abnormality to dispatch a security guard to the ATM 2 in the installed store 2A based on the ATM identification information in the ATM abnormality.

[Server device]
Fig. 4 is a block diagram showing an example of a functional configuration of the server device 6. The server device 6 shown in Fig. 4 has a communication unit 31, a memory 32, and a CPU 33. The communication unit 31 is a communication interface that communicates with the GW device 5. The memory 32 is an area that stores various information related to the server device 6. The CPU 33 controls the entire server device 6.

The memory 32 has a log update date and time memory 41, a setting memory 42, a resource memory 43, a target resource memory 44, a normal resource memory 45, and a threshold pattern memory 46. The log update date and time memory 41 is an area for storing the date and time of periodic log updates for the GW device 5. The setting memory 42 is an area for storing log monitoring timing 42A and resource acquisition timing 42B. The log monitoring timing 42A is the monitoring interval when periodic logs for the GW device 5 are monitored. The monitoring interval is, for example, 10 seconds and can be changed as appropriate. The resource acquisition timing 42B is the collection interval for periodically collecting resource information in the GW device 5. The collection interval is, for example, 10 seconds and can be changed as appropriate.

The resource information in the GW device 5 is, for example, resource information such as CPU usage, memory usage, DISK usage, and network usage. The CPU usage is the currently used usage rate from the maximum available usage rate (100%) of the CPU 26 in the GW device 5. The memory usage is the currently used usage rate from the maximum available usage rate (100%) of the memory 25 in the GW device 5. The DISK usage rate is the currently used usage rate from the maximum available usage rate (100%) of a DISK (not shown) in the GW device 5. The network usage rate is the currently used usage rate from the maximum available usage rate (100%) of the first communication unit 21, the second communication unit 22, and the third communication unit 23 in the GW device 5.

The resource memory 43 is an area for storing periodically collected resource information by collection date and time. FIG. 5 is an explanatory diagram showing an example of a table configuration of the resource memory 43. The resource memory 43 shown in FIG. 5 is an area for storing resource names, collection dates and times, and usage rates in association with each other. The resource name is information for identifying, for example, CPU usage rate, memory usage rate, DISK usage rate, and network usage rate. The collection date and time is the date and time when the resource information was collected. The usage rate is the usage rate related to the resource information at the collection date and time. The first collection unit 53 periodically collects resource information during execution of business applications in the GW device 5 according to the collection interval timing, and stores the collected resource information sequentially in the resource memory 43.

The target resource memory 44 is an area for storing resource information to be compared. The resource information to be compared is resource information to be compared with normal resource information described later. FIG. 6 is an explanatory diagram showing an example of a table configuration of the target resource memory 44. The target resource memory 44 shown in FIG. 6 is an area for storing resource names related to the resource information to be compared and usage rates in association with each other. The resource name is information that identifies, for example, CPU usage rate, memory usage rate, DISK usage rate, and network usage rate. The usage rate is the usage rate related to the resource information to be compared. The second collection unit 54 searches the resource memory 43 for resource information during the most recent business application execution based on the log date and time, and stores the searched resource information in the target resource memory 44 as resource information to be compared.

The normal resource memory 45 is an area in which normal resource information to be compared with the resource information to be compared is stored in advance. The normal resource information is resource information in a state in which the business application of the GW device 5 is operating normally and there is no TCP report or dial report from the ATM 2. FIG. 7 is an explanatory diagram showing an example of a table configuration of the normal resource memory 45. The normal resource memory 45 shown in FIG. 7 is an area in which the resource name related to the resource information in the normal state and the normal usage rate are stored in association with each other. The resource name is information that identifies, for example, the CPU usage rate, memory usage rate, DISK usage rate, and network usage rate. The normal usage rate is the usage rate related to the resource information in the normal state while the business application is running. For convenience of explanation, the CPU usage rate, memory usage rate, DISK usage rate, and network usage rate are normal usage rates, for example, 10%.

The threshold pattern memory 46 is an area for storing evaluation contents according to the comparison results of comparing the resource information to be compared with the resource information under normal conditions. FIG. 8 is an explanatory diagram showing an example of the table configuration of the threshold pattern memory 46. The threshold pattern memory 46 shown in FIG. 8 is an area for storing judgment expressions and comparison results in association with each other for each pattern. In pattern "1", the state of the GW device 5 is "frozen" as a comparison result. In pattern "2", the state of the GW device 5 is "not frozen" as a comparison result. In pattern "3", the state of the GW device 5 is "reverification" as a comparison result. In pattern "4", the state of the GW device 5 is "frozen" as a comparison result of the reverification. In pattern "5", the state of the GW device 5 is "not frozen" as a comparison result of the reverification.

The CPU 33 has an acquisition unit 51, a judgment unit 52, a first collection unit 53, a second collection unit 54, a third collection unit 55, a comparison unit 56, and an evaluation unit 57. The acquisition unit 51 acquires the log update date and time of the GW device 5 according to the log monitoring timing. The log monitoring timing is, for example, at 10 second intervals. The acquisition unit 51 periodically acquires the logs of business applications executed in the GW device 5 using a remote command of the server OS in the GW device 5. The log is the update date and time of the log acquired by the acquisition unit 51.

The determination unit 52 compares the log update date and time acquired by the acquisition unit 51 with the log update date and time stored in the log update date and time memory 41 to determine whether it is new. If the acquired log update date and time is new, the determination unit 52 determines that the periodic log of the GW device 5 has been successfully acquired, and stores the acquired log update date and time in the log update date and time memory 41. If the acquired log update date and time is not new, the determination unit 52 determines that the periodic log of the GW device 5 cannot be acquired.

The first collection unit 53 collects resource information during execution of a business application in the GW device 5 according to the resource collection timing, and stores the collected resource information and collection date and time in the resource memory 43. The resource information is the CPU usage rate, memory usage rate, DISK usage rate, and network usage rate of the GW device 5.

When the determination unit 52 determines that the log update date and time is not new, the second collection unit 54 searches the resource memory 43 for resource information related to the most recent collection date and time from the log update date and time, and stores this resource information in the target resource memory 44 as resource information to be compared.

If the comparison result is "re-verification," the third collection unit 55 collects resource information of the current GW device 5 during execution of the business application, and stores this resource information in the target resource memory 44 as resource information to be compared.

If the determination unit 52 determines that the log update date and time is not new, the comparison unit 56 compares the resource information to be compared with the resource information in normal times. If the comparison result is "re-verification," the comparison unit 56 compares the resource information to be compared with the resource information in normal times.

The evaluation unit 57 refers to the threshold pattern memory 46, and if the comparison result is pattern "1", evaluates the state of the GW device 5 as abnormal, for example, a frozen state. The evaluation unit 57 evaluates the state of the GW device 5 as a frozen state if the CPU usage rate under normal conditions > the CPU usage rate of the comparison target, the memory usage rate under normal conditions > the memory usage rate of the comparison target, the DISK usage rate under normal conditions > the DISK usage rate of the comparison target, and the DISK usage rate under normal conditions > the DISK usage rate of the comparison target.

The evaluation unit 57 refers to the threshold pattern memory 46, and if the comparison result is pattern "2", evaluates the state of the GW device 5 as normal, for example, a non-freezing state. The evaluation unit 57 evaluates the state of the GW device 5 as a non-freezing state if the CPU usage rate in normal state is less than or equal to the CPU usage rate of the comparison target, the memory usage rate in normal state is less than or equal to the memory usage rate of the comparison target, the DISK usage rate in normal state is less than or equal to the DISK usage rate of the comparison target, and the DISK usage rate in normal state is less than or equal to the DISK usage rate of the comparison target.

The evaluation unit 57 refers to the threshold pattern memory 46, and if the comparison result is pattern "3", evaluates the state of the GW device 5 as re-verification. If the evaluation unit 57 detects any one of the following: CPU usage under normal conditions > CPU usage of the comparison target, memory usage under normal conditions > memory usage of the comparison target, DISK usage under normal conditions > DISK usage of the comparison target, or DISK usage under normal conditions > DISK usage of the comparison target, the evaluation unit 57 evaluates the state of the GW device 5 as re-verification. Note that even if the business application of the GW device 5 is operating normally, there may be a waiting state for processing, so the re-verification process takes such a state into consideration. Then, if the comparison unit 56 evaluates the state of the GW device 5 as re-verification, it executes a re-verification process that compares the current resource information as the resource information to be compared with the resource information under normal conditions.

Then, the evaluation unit 57 refers to the threshold pattern memory 46, and if the comparison result after re-verification is pattern "4", it evaluates the state of the GW device 5 as abnormal, for example, a frozen state. If the evaluation unit 57 detects any one of the following: CPU usage rate under normal conditions > CPU usage rate of the comparison target, memory usage rate under normal conditions > memory usage rate of the comparison target, DISK usage rate under normal conditions > DISK usage rate of the comparison target, or DISK usage rate under normal conditions > DISK usage rate of the comparison target, it evaluates the state of the GW device 5 as a frozen state.

The evaluation unit 57 also refers to the threshold pattern memory 46, and if the comparison result after re-verification is pattern "5", evaluates the state of the GW device 5 as normal, for example, a non-freeze state. The evaluation unit 57 evaluates the state of the GW device 5 as a non-freeze state if the CPU usage rate in normal state is less than or equal to the CPU usage rate of the comparison target, the memory usage rate in normal state is less than or equal to the memory usage rate of the comparison target, the DISK usage rate in normal state is less than or equal to the DISK usage rate of the comparison target, and the DISK usage rate in normal state is less than or equal to the DISK usage rate of the comparison target.

When the evaluation result of the evaluation unit 57 indicates that the state of the GW device 5 is not frozen, the evaluation unit 57 determines that the state of the GW device 5 is normal and continues monitoring. When the evaluation result of the evaluation unit 57 indicates that the state of the GW device 5 is frozen, the evaluation unit 57 determines that the state of the GW device 5 is abnormal and executes GW switching processing of the GW device 5. In other words, the GW switching processing is a process of switching the active GW device 5A evaluated as abnormal to the standby GW device 5B, and at the same time outputting a command to each GW device 5 to switch the standby GW device 5B to the active GW device 5A. As a result, the business application of the abnormal GW device 5 that monitors the ATM 2 is automatically restored.

Next, we will explain the operation of the monitoring system 1 of this embodiment.

[First collection process]
Fig. 9 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the first collection process. In Fig. 9, the first collection unit 53 in the CPU 33 in the server device 6 determines whether or not the current time is a regular collection timing (step S11). The regular collection timing is the collection interval timing of the first collection unit 53. If the current time is a regular collection timing (step S11: Yes), the first collection unit 53 acquires the current date and time as the collection date and time (step S12).

After acquiring the current date and time, the first collection unit 53 collects the CPU usage rate at the collection date and time related to the GW device 5 (step S13). The first collection unit 53 stores the collected CPU usage rate at the collection date and time in the resource memory 43 (step S14).

Furthermore, the first collection unit 53 collects the memory usage rate at the collection date and time related to the GW device 5 (step S15). The first collection unit 53 stores the collected memory usage rate at the collection date and time in the resource memory 43 (step S16).

Furthermore, the first collection unit 53 collects the DISK usage rate at the collection date and time related to the GW device 5 (step S17). The first collection unit 53 stores the collected DISK usage rate at the collection date and time in the resource memory 43 (step S18).

Furthermore, the first collection unit 53 collects the network usage rate at the collection date and time related to the GW device 5 (step S19). The first collection unit 53 stores the collected network usage rate at the collection date and time in the resource memory 43 (step S20). Then, the CPU 33 determines whether or not there is a termination interrupt (step S21).

If there is an end interrupt (step S21: Yes), the CPU 33 ends the processing operation shown in FIG. 9. If there is no end interrupt (step S21: No), the CPU 33 returns to the processing of step S11 to determine whether or not it is currently the regular collection timing.

If the current time is not the regular collection time (step S11: No), the CPU 33 returns to the process of step S21 to determine whether or not there is an end interrupt.

The server device 6 that executes the first collection process periodically collects the CPU utilization rate, memory utilization rate, DISK utilization rate, and network utilization rate of the GW device 5. The server device 6 then stores the CPU utilization rate, memory utilization rate, DISK utilization rate, and network utilization rate for each collection date and time in the resource memory 43. As a result, the server device 6 can periodically collect resource information of the GW device 5. Note that, although an example has been given in which the server device 6 collects resource information of each GW device 5, for example, both the active GW device 5A and the standby GW device 5B, it is also possible to periodically collect only the resource information of the active GW device 5A, and this can be changed as appropriate.

[Monitoring process]
Fig. 10 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the monitoring process. In Fig. 10, the CPU 33 in the server device 6 sets a monitoring target, a log monitoring timing, and normal resources (step S31). The monitoring target is the GW device 5 to be monitored. The acquisition unit 51 in the CPU 33 acquires a periodic log of the active GW device 5A to be monitored (step S32). After acquiring the periodic log, the determination unit 52 in the CPU 33 refers to the log update date and time memory 41 and determines whether the log date and time of the periodic log is new or not (step S33).

If the log date and time of the periodic log is new (step S33: Yes), the determination unit 52 updates the log date and time of the current periodic log as the log update date and time in the log update date and time memory 41 (step S34). The acquisition unit 51 determines whether the current time is the log monitoring timing (step S35).

If the acquisition unit 51 determines that it is currently time to monitor the log (step S35: Yes), it returns to the process of step S32 to acquire the periodic log. If the acquisition unit 51 determines that it is not currently time to monitor the log (step S35: No), it determines whether or not there is an end interrupt (step S36).

If there is a termination interrupt (step S36: Yes), the CPU 33 ends the monitoring process shown in FIG. 9. If there is no termination interrupt (step S36: No), the determination unit 52 returns to the process of step S35 to determine whether or not it is currently the log monitoring timing.

The determination unit 52 also refers to the log update date and time memory 41, and if the log date and time of the periodic log is not new (step S33: No), determines that there is a possibility of an abnormality in the GW device 5, and executes the verification process shown in FIG. 11 (step S37). After executing the verification process, the evaluation unit 57 in the CPU 33 determines whether the verification result is a freeze or not (step S38).

If the verification result is freeze (step S38: Yes), the evaluation unit 57 executes the GW switching process shown in FIG. 15 (step S39). After executing the GW switching process, the evaluation unit 57 determines whether the GW switching is normal or not (step S40).

If the GW switching is normal (step S40: Yes), the determination unit 52 returns to the process of step S35 to determine whether or not it is currently the timing to monitor the log. If the GW switching is not normal (step S40: No), the evaluation unit 57 outputs an error log (step S41) and returns to the process of step S35 to determine whether or not it is currently the timing to monitor the log. The evaluation unit 57 notifies the operator terminal 4A of the security center 4 of the error log. As a result, the operator of the security center 4 can recognize the error of the GW device 5 from the error log. If the verification result is not a freeze (step S38: No), the determination unit 52 returns to the process of step S35 to determine whether or not it is currently the timing to monitor the log.

When the log date and time of the periodic log of the GW device 5 is not new, the server device 6 that executes the monitoring process determines that there is a possibility of an abnormality in the GW device 5 and executes a verification process to verify the status of the GW device 5. As a result, the server device 6 executes the verification process at the timing when it determines that there is a possibility of an abnormality in the GW device 5.

If the verification result is a freeze, the server device 6 automatically switches the GW device 5. As a result, the burden on operators and security guards required to restore the GW device 5 can be reduced.

In addition, the determination unit 52 refers to the log update date and time memory 41, and performs the verification process if the log date and time of the periodic log is not new. However, the verification process may be performed if the log date and time of the periodic log cannot be obtained periodically, and this can be changed as appropriate.

[Verification process]
Fig. 11 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the verification processing. In Fig. 11, the second collection unit 54 in the CPU 33 in the server device 6 executes the second collection processing shown in Fig. 12 (step S51). Furthermore, after executing the second collection processing, the comparison unit 56 in the CPU 33 executes the evaluation processing shown in Fig. 13 (step S52).

After executing the evaluation process, the evaluation unit 57 in the CPU 33 determines whether the evaluation result is freeze or not (step S53). If the evaluation result is freeze (step S53: Yes), the evaluation unit 57 outputs freeze as the verification result (step S54) and ends the verification process shown in FIG. 11.

If the evaluation result is not freeze (step S53: No), the evaluation unit 57 outputs "no freeze" as the verification result (step S55) and ends the verification process shown in FIG. 11.

If the evaluation result is freeze, the server device 6 that executes the verification process outputs freeze as the verification result. As a result, the server device 6 determines that the GW device 5 is in a frozen state, which is an abnormality.

[Second Collection Process]
Fig. 12 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the second collection process. In Fig. 12, the second collection unit 54 in the CPU 33 in the server device 6 acquires the collection date and time (step S61). After acquiring the collection date and time, the second collection unit 54 searches the resource memory 43 for the CPU usage rate related to the active system GW device 5A for the date and time immediately preceding the collection date and time (step S62). The second collection unit 54 stores the searched CPU usage rate for the date and time immediately preceding the collection date and time in the target resource memory 44 (step S63).

Furthermore, the second collection unit 54 searches the resource memory 43 for the memory usage rate related to the active system GW device 5A from the collection date and time to the most recent date and time (step S64). The second collection unit 54 stores the searched memory usage rate for the most recent date and time in the target resource memory 44 (step S65).

Furthermore, the second collection unit 54 searches the resource memory 43 for the DISK usage rate related to the active GW device 5A from the collection date and time to the most recent date and time (step S66). The second collection unit 54 stores the searched DISK usage rate for the most recent date and time in the target resource memory 44 (step S67).

Furthermore, the second collection unit 54 searches the resource memory 43 for the network usage rate related to the active GW device 5A from the collection date and time to the most recent date and time (step S68). The second collection unit 54 stores the searched network usage rate for the most recent date and time in the target resource memory 44 (step S69), and executes the second collection process shown in FIG. 12.

The server device 6 executing the second collection process searches the resource memory 43 for resource information on CPU usage, memory usage, disk usage, and network usage from the collection date and time to the most recent date and time. The server device 6 then stores the searched resource information for the most recent date and time in the target resource memory 44. As a result, the server device 6 can obtain the resource information for the most recent date and time from the collection date and time as the resource information to be judged.

[Evaluation process]
Fig. 13 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the evaluation processing. In Fig. 13, the comparison unit 56 in the CPU 33 in the server device 6 acquires normal resources including a normal CPU usage rate, a normal memory usage rate, a normal disk usage rate, and a normal network usage rate from the normal resource memory 45 (step S71).

The comparison unit 56 obtains from the target resource memory 44 the resources to be judged, including the CPU utilization rate of the target, the memory utilization rate of the target, the disk utilization rate of the target, and the network utilization rate of the target (step S72).

The comparison unit 56 compares the normal resources of step S71 with the resources to be determined of step S72 (step S73). The evaluation unit 57 in the CPU 33 refers to the threshold pattern memory 46 based on the comparison result and determines whether the comparison result is pattern "1" (step S74).

If the comparison result is pattern "1" (step S74: Yes), the evaluation unit 57 evaluates that the state of the GW device 5 is frozen, i.e., abnormal (step S75), and ends the processing operation shown in FIG. 13.

If the comparison result is not pattern "1" (step S74: No), the evaluation unit 57 refers to the threshold pattern memory 46 based on the comparison result and determines whether the comparison result is pattern "2" (step S76).

If the comparison result is pattern "2" (step S76: Yes), the evaluation unit 57 evaluates the state of the GW device 5 as being in a non-frozen state, i.e., normal (step S77), and ends the processing operation shown in FIG. 13.

If the comparison result is not pattern "2" (step S76: No), the evaluation unit 57 refers to the threshold pattern memory 46 based on the comparison result and determines that the comparison result is pattern "3" (step S78). After determining that the comparison result is pattern "3", the evaluation unit 57 executes the re-verification process shown in FIG. 14 (step S79) and ends the processing operation shown in FIG. 13.

The server device 6 that executes the evaluation process compares the resource information to be judged with the resource information in normal times, and if the comparison result is pattern "1", evaluates the state of the GW device 5 as being in a frozen state as the evaluation result. As a result, the server device 6 can recognize that the state of the GW device 5, i.e., the state of the active GW device 5A, is abnormal.

If the comparison result is pattern "2", the server device 6 evaluates the state of the GW device 5 as a non-frozen state. As a result, the server device 6 can recognize the state of the GW device 5, i.e., the state of the active GW device 5A, as normal.

If the comparison result is pattern "3", the server device 6 evaluates the state of the GW device 5 as re-verification as the evaluation result. As a result, the server device 6 can recognize that the state of the GW device 5, i.e., the state of the active GW device 5A, is re-verification.

[Re-verification process]
Fig. 14 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the re-verification process. In Fig. 14, the third collection unit 55 in the CPU 33 in the server device 6 executes the third collection process shown in Fig. 16 (step S81). After executing the third collection process, the third collection unit 55 collects current resources including the current CPU usage rate, the current memory usage rate, the current DISK usage rate, and the current network usage rate (step S82).

The comparison unit 56 in the CPU 33 compares the normal resources with the current resources in step S82 (step S83). The evaluation unit 57 in the CPU 33 refers to the threshold pattern memory 46 based on the comparison result and determines whether the comparison result is pattern "4" (step S84).

If the comparison result is pattern "4" (step S84: Yes), the evaluation unit 57 evaluates that the state of the GW device 5 is frozen, i.e., abnormal (step S85), and ends the processing operation shown in FIG. 14.

If the comparison result is not pattern "4" (step S84: No), the evaluation unit 57 refers to the threshold pattern memory 46 based on the comparison result and determines that the comparison result is pattern "5" (step S86). After determining that the comparison result is pattern "5", the evaluation unit 57 evaluates that the state of the GW device 5 is not frozen, i.e., normal (step S87), and ends the processing operation shown in FIG. 14.

The server device 6 that executes the re-verification process compares the normal resource information with the current resource information, and if the comparison result is pattern "4", evaluates the state of the GW device 5 as being frozen. As a result, the server device 6 re-verifies and can recognize that the state of the GW device 5, i.e., the state of the active GW device 5A, is abnormal.

The server device 6 compares the normal resource information with the current resource information, and if the comparison result is pattern "5", it evaluates the state of the GW device 5 as being in a non-frozen state. As a result, the server device 6 re-verifies and can recognize that the state of the GW device 5, i.e., the state of the active GW device 5A, is normal.

[GW switching process]
15 is a flow diagram showing an example of a processing operation of the CPU 33 in the server device 6 related to the GW switching process. In FIG. 15, the evaluation unit 57 in the CPU 33 in the server device 6 switches the current active GW device 5 to the standby GW device 5, and at the same time outputs a switching signal to each GW device 5 for switching the standby GW device 5 to the active GW device 5 (step S91).

After outputting the switching signal, the CPU 33 determines whether the switching of the GW device 5 is normal (step S92). If the switching of the GW device 5 is normal (step S92: Yes), the CPU 33 sets the switching to normal (step S93) and ends the processing operation shown in FIG. 15.

Furthermore, if the switching of the GW device 5 is not normal (step S92: No), the CPU 33 sets a switching abnormality (step S94) and ends the processing operation shown in FIG. 15.

The server device 6 that executes the GW switching process switches the active GW device 5A to the standby GW device 5B, and the standby GW device 5B to the active GW device 5A. The server device 6 then sets the switching to normal if the switching is normal, and sets the switching to abnormal if the switching is abnormal. As a result, the server device 6 can automatically recover the abnormal GW device 5.

[Third Collection Process]
16 is a flow diagram showing an example of the processing operation of the CPU 33 in the server device 6 related to the third collection process. In FIG. 16, the third collection unit 55 in the CPU 33 in the server device 6 collects the CPU utilization rate at the current date and time related to the active GW device 5A (step S101). The third collection unit 55 stores the collected CPU utilization rate at the current date and time in the target resource memory 44 (step S102).

Furthermore, the third collection unit 55 collects the memory usage rate at the current date and time related to the active GW device 5A (step S103). The third collection unit 55 stores the collected memory usage rate at the current date and time in the target resource memory 44 (step S104).

Furthermore, the third collection unit 55 collects the DISK usage rate for the current date and time related to the active GW device 5A (step S105). The third collection unit 55 stores the collected DISK usage rate for the current date and time in the target resource memory 44 (step S106).

Furthermore, the third collection unit 55 collects the network usage rate for the current date and time related to the active GW device 5A (step S107). The third collection unit 55 stores the collected network usage rate for the current date and time in the target resource memory 44 (step S108), and ends the third collection process shown in FIG. 16.

The server device 6 executing the third collection process collects the current date and time CPU usage, memory usage, DISK usage, and network usage of the active GW device 5A. The server device 6 stores the collected current date and time CPU usage, memory usage, DISK usage, and network usage in the resource memory 43. As a result, the server device 6 can collect current resource information of the active GW device 5A.

In this embodiment, the server device 6 collects resource information of the GW device 5 to be compared when log information of a business application executed by the GW device 5 cannot be periodically obtained. The server device 6 compares the collected resource information of the comparison target with normal resource information stored in advance, and evaluates the status of the GW device 5 based on the comparison result. As a result, the server device 6 can evaluate the status of the GW device 5 that monitors the ATM 2. For example, even if the GW device 5 that executes the business application freezes, the server device 6 can recognize an abnormality in the GW device 5.

When the server device 6 is unable to periodically obtain log information of an application executed by the active GW device 5A, it collects resource information of the comparison target of the active GW device 5A. The server device 6 compares the collected resource information of the comparison target with normal resource information stored in advance, and evaluates the status of the active GW device 5A based on the comparison result. As a result, the server device 6 can evaluate the status of the active GW device 5A. For example, even if the active GW device 5A that executes a business application freezes, the server device 6 can recognize an abnormality in the active GW device 5A.

If the utilization rate in the resource information to be compared is less than the utilization rate in the normal resource information, the server device 6 evaluates the status of the active GW device 5A as abnormal. If the utilization rate in the resource information to be compared is equal to or greater than the utilization rate in the normal resource information, the server device 6 evaluates the status of the active GW device 5A as normal. As a result, the server device 6 can evaluate the status of the active GW device 5A that monitors the ATM 2.

If all the usage rates for different types in the resource information to be compared are less than the usage rates for each type in the resource information under normal conditions, the server device 6 evaluates the status of the active GW device 5A as abnormal. Furthermore, if all the usage rates for each type in the resource information to be compared are equal to or greater than the usage rates for each type in the resource information under normal conditions, the server device 6 evaluates the status of the active GW device 5A as normal. As a result, the server device 6 can evaluate the status of the active GW device 5A that monitors the ATM 2.

The server device 6 periodically collects resource information of the active GW device 5A and stores the resource information for each collected collection date and time in the resource memory 43. Furthermore, if the server device 6 is unable to obtain log information, it searches the resource memory 43 for resource information with the collection date and time closest to the log date and time in question as resource information to be compared. As a result, the server device 6 can use the resource information with the collection date and time closest to the log date and time as resource information to be compared.

When the usage rate of a part of the different types in the resource information to be compared is less than the usage rate of each type in the resource information in normal state, the server device 6 evaluates the state of the active system GW device 5A as re-verification. When the state of the active system GW device 5A is evaluated as re-verification, the server device 6 collects the current resource information of the active system GW device 5A. The server device 6 compares the collected current resource information with the resource information in normal state, and when the usage rate of a part of the different types in the resource information to be compared is less than the usage rate of each type in the resource information in normal state, the server device 6 evaluates the state of the active system GW device 5A as abnormal. When all the usage rates of each type in the resource information to be compared are equal to or greater than the usage rate of each type in the resource information in normal state, the server device 6 evaluates the state of the active system GW device 5A as normal. As a result, the server device 6 can re-evaluate the state of the active system GW device 5A even when it is evaluated as re-verification.

In this embodiment, by using resource information on the GW device 5 on which the business application executed by the GW device 5 runs, it is possible to determine whether the business application is frozen and automatically recover it in the event of an abnormality without directly modifying the business application. Moreover, even if the implementation or architecture of the business application is old and there are few engineers who can maintain it, it is possible to automatically recover an abnormal GW device 5 to a normal state.

Conventionally, because operators were unable to detect malfunctions in business applications, they would periodically switch the GW device and take operational measures (preventative measures). In contrast, in this embodiment, abnormalities in the GW device 5 can be automatically detected, eliminating the need for periodic switching work. As a result, the burden on the operator monitoring the monitoring system 1 can be significantly reduced.

Moreover, in this embodiment, the state of the GW device 5 can be evaluated even when it is impossible to determine whether the business application of the GW device 5 has frozen or is waiting for processing under normal operation. As a result, even when it is unclear whether the GW device 5 has frozen, a re-verification process is executed without needlessly switching the GW device 5. As a result, the burden on the operator monitoring the monitoring system 1 can be significantly reduced.

In this embodiment, the example shows a case where various processes are executed on the server device 6 in the data center 3, but the processes on the server device 6 may be executed on the cloud, and can be modified as appropriate.

In addition, the monitoring system 1 is exemplified as a system that monitors the status of a GW device 5 that monitors an ATM 2 for financial operations as a monitored device. However, the monitored device is not limited to an ATM 2, and may be, for example, various devices such as a personal computer, a vending machine, a betting ticket terminal, or a payment terminal, and can be changed as appropriate.

In addition, in this embodiment, resource information for evaluating the state of the GW device 5 is exemplified by CPU utilization rate, memory utilization rate, DISK utilization rate, network utilization rate, etc., but is not limited to these, and the indices for evaluating the state of the GW device 5 can be changed as appropriate.

In the present embodiment, the acquisition unit 51 has been described as periodically acquiring log information of business applications executed by the GW device 5, but this is not limited to log information of business applications, and log information of the GW device 5 may be periodically acquired, and this can be changed as appropriate.

Furthermore, each component of each part shown in the figure does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each part is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

Furthermore, the various processing functions performed by each device may be executed in whole or in part on a CPU (Central Processing Unit), DSP (Digital Signal Processor), FPGA (Field Programmable Gate Array), etc. Also, the various processing functions may be executed in whole or in part on a program that is analyzed and executed by a CPU, etc., or on hardware using wired logic.

The area for storing various information may be configured, for example, with ROM (Read Only Memory), RAM (Random Access Memory) such as SDRAM (Synchronous Dynamic Random Access Memory), MRAM (Magnetoresistive Random Access Memory), or NVRAM (Non-Volatile Random Access Memory).

The various processes described in this embodiment can be realized by executing a prepared program in a processor such as a CPU in the information processing device. Therefore, an example of an information processing device 100 that executes a program having the same functions as the above embodiment will be described below. Figure 17 is an explanatory diagram showing an example of an information processing device 100 that executes a monitoring program.

The information processing device 100 that executes the monitoring program shown in FIG. 17 has a communication unit 101, a HDD 102, a ROM 103, a RAM 104, a processor 105, and a bus 106. The communication unit 101, the HDD 102, the ROM 103, the RAM 104, and the processor 105 are connected via the bus 106. The information processing device 100 monitors a monitoring device that monitors a monitoring target device.

The ROM 103 is pre-stored with a monitoring program that performs the same functions as the above embodiment. The ROM 103 stores a judgment program 103A, a collection program 103B, a comparison program 103C, and an evaluation program 103D as monitoring programs. The information processing program may be recorded on a computer-readable recording medium, not on the ROM 103, but on a drive (not shown). The recording medium may be, for example, a portable recording medium such as a CD-ROM, a DVD disk, or a USB memory, or a semiconductor memory such as a flash memory.

Then, the processor 105 reads out the judgment program 103A from the ROM 103, and causes it to function as the judgment process 104A on the RAM 104. Furthermore, the processor 105 reads out the collection program 103B from the ROM 103, and causes it to function as the collection process 104B on the RAM 104. Furthermore, the processor 105 reads out the comparison program 103C from the ROM 103, and causes it to function as the comparison process 104C on the RAM 104. Furthermore, the processor 105 reads out the evaluation program 103D from the ROM 103, and causes it to function as the evaluation process 104D on the RAM 104.

The processor 105 determines whether or not log information of the monitoring device has been periodically acquired. If the processor 105 is unable to acquire the log information, it collects resource information of the monitoring device to be compared. The processor 105 compares the collected resource information of the comparison target with normal resource information stored in advance. The processor 105 evaluates the status of the monitoring device based on the comparison result. As a result, it is possible to evaluate the status of the monitoring device itself that monitors the monitored device.

1. Surveillance system 2. ATM
5 GW device 6 Server device 43 Resource memory 44 Target resource memory 45 Normal resource memory 46 Threshold pattern memory 51 Acquisition unit 52 Determination unit 53 First collection unit 54 Second collection unit 55 Third collection unit 56 Comparison unit 57 Evaluation unit

Claims (9)

1. An information processing device that monitors an ATM (Automatic Teller Machine) and a monitoring device that provides a business application to the ATM ,
a determination unit that determines whether log information of the business application executed in the monitoring device is periodically acquired;
a collection unit that collects resource information of the monitoring device to be compared when the log information cannot be acquired;
a comparison unit that compares the resource information to be compared collected by the collection unit with normal resource information stored in advance;
an evaluation unit that evaluates whether or not the monitoring device has frozen based on a comparison result of the comparison unit,
The evaluation unit is
An information processing device characterized in that when the utilization rate in the resource information to be compared is less than the utilization rate in the normal resource information, the state of the monitoring device is evaluated as being in a frozen state, and when the utilization rate in the resource information to be compared is equal to or greater than the utilization rate in the normal resource information, the state of the monitoring device is evaluated as being in a non-frozen state . The evaluation unit is
The information processing device according to claim 1, characterized in that if all of the usage rates for each different type in the resource information to be compared are less than the usage rates for each type in the normal resource information, the status of the monitoring device is evaluated as abnormal, and if all of the usage rates for each type in the resource information to be compared are equal to or greater than the usage rates for each type in the normal resource information, the status of the monitoring device is evaluated as normal. a first collection unit that periodically collects resource information of the monitoring device;
a resource memory that stores the resource information for each collection date and time collected by the first collection unit,
The collecting unit includes:
3. The information processing apparatus according to claim 2, characterized in that, when the log information cannot be acquired, the resource information having the collection date and time closest to the date and time when the log information could not be acquired is searched for from the resource memory as the resource information to be compared. The evaluation unit is
4. The information processing apparatus according to claim 3, wherein when a usage rate of a part of different types in the resource information to be compared is less than a usage rate of the type in the normal resource information, the state of the monitoring apparatus is evaluated as being re -verified. a second collection unit that collects current resource information of the monitoring device when the evaluation unit evaluates the state of the monitoring device as the re-verification,
The comparison unit is
comparing the current resource information collected by the second collection unit with the resource information in the normal state;
The evaluation unit is
5. The information processing device according to claim 4, characterized in that if the usage rate of some of the different types in the resource information to be compared is less than the usage rate of each type in the normal resource information, the state of the monitoring device is evaluated as abnormal, and if the usage rates of all of the types in the resource information to be compared are equal to or greater than the usage rates of each type in the normal resource information, the state of the monitoring device is evaluated as normal. An information processing device as described in any one of claims 2 to 5, characterized in that the utilization rate in the resource information includes at least one of a CPU utilization rate indicating the utilization status of a CPU in the monitoring device, a memory utilization rate indicating the utilization status of a memory in the monitoring device, a disk utilization rate indicating the utilization status of a disk in the monitoring device, and a network utilization rate indicating the utilization status of network communication of the monitoring device. A monitoring system including an ATM (Automatic Teller Machine) , a monitoring device that monitors the ATM and provides a business application to the ATM , and an information processing device that monitors the monitoring device,
The information processing device includes:
a determination unit that determines whether log information of the business application executed in the monitoring device is periodically acquired;
a collection unit that collects resource information of the monitoring device to be compared when the log information cannot be acquired;
a comparison unit that compares the resource information to be compared collected by the collection unit with normal resource information stored in advance;
an evaluation unit that evaluates whether or not the monitoring device has frozen based on a comparison result of the comparison unit,
The evaluation unit is
A monitoring system characterized by evaluating the state of the monitoring device as being in a frozen state when the utilization rate in the resource information to be compared is less than the utilization rate in the normal resource information, and evaluating the state of the monitoring device as being in a non-frozen state when the utilization rate in the resource information to be compared is equal to or greater than the utilization rate in the normal resource information . An information processing device that monitors an ATM (Automatic Teller Machine) and a monitoring device that provides a business application to the ATM ,
determining whether log information of the business application executed in the monitoring device is periodically acquired;
When the log information cannot be acquired, resource information of the monitoring device is collected for comparison;
comparing the collected resource information to be compared with pre-stored normal resource information;
Based on the comparison result, a process of evaluating whether or not the monitoring device has frozen is executed;
The process to be evaluated is
A monitoring method characterized by evaluating the state of the monitoring device as being in a frozen state when the utilization rate in the resource information to be compared is less than the utilization rate in the normal resource information, and evaluating the state of the monitoring device as being in a non-frozen state when the utilization rate in the resource information to be compared is equal to or greater than the utilization rate in the normal resource information . A processor in an information processing device that monitors an ATM (Automatic Teller Machine) and a monitoring device that provides a business application to the ATM ,
determining whether log information of the business application executed in the monitoring device is periodically acquired;
When the log information cannot be acquired, resource information of the monitoring device is collected for comparison;
comparing the collected resource information to be compared with pre-stored normal resource information;
Executing a process for evaluating whether or not the monitoring device has frozen based on the comparison result;
The process to be evaluated is
A monitoring program characterized by evaluating the state of the monitoring device as being in a frozen state when the utilization rate in the resource information to be compared is less than the utilization rate in the normal resource information, and evaluating the state of the monitoring device as being in a non-frozen state when the utilization rate in the resource information to be compared is equal to or greater than the utilization rate in the normal resource information .

Images