POLICY PROCESSING SYSTEM, METHOD, AND PROGRAM

• US 20090260051A1
• Filed: 09/27/2006
• Published: 10/15/2009
• Est. Priority Date: 09/27/2005
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Igakura, Tomohiro
• Granted Patent: US 8,707,386 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/076 by exceeding a count or rate limit, e.g. word- or bit count limit
• CPC Class Codes: G06F 11/1461 Backup scheduling policy
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 2201/88 Monitoring involving counting
• CPC Class Codes: G06F 2209/484 Precedence
• CPC Class Codes: G06F 9/4825 Interrupt from clock, e.g. time of day
• CPC Class Codes: G06F 9/4881 Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues

Abstract

In a policy handling system performing automatic execution, management, and control of a system, a policy retrieving section (102) retrieves a policy associated with a triggering condition, and notifies a policy-execution-pattern analyzing section (105) of the retrieved policy. A policy-operation-log retrieving section (106) refers to a policy-operation-log storage section (107) to acquire the number of triggering times of the retrieved policy in a predetermined history acquisition period. The policy-execution-pattern analyzing section (105) compares the number of triggering times of the retrieved policy against a predetermined threshold and causes an abnormality notifying section (108) to issue abnormality information when the number of triggering times exceeds the threshold.

Claims

1-32. -32. (canceled)

33. A policy handling system, for managing a management-targeted system based on a policy including description of a triggering condition for triggering the policy and operation to be executed after triggering, comprising an abnormality detecting unit which comprises:

a policy-operation-log retrieving section that receives a notification of a policy (first policy) having a triggering condition which is satisfied, and refers to a policy-operation-log storage section storing an operation history of policies, to acquire a triggered frequency in a time period before receiving the notification of said first policy; and

a policy-execution-pattern analyzing section that determines whether or not the first policy is abnormal based on the triggered frequency of the first policy acquired by the policy-operation-log retrieving section.

34. The policy handling system according to claim 33, wherein the policy-operation-log retrieving section acquires the number of triggering times of the first policy during a history acquisition period before receiving the notification, and the policy-execution-pattern analyzing section determines that the first policy is abnormal when the number of triggering times of the first policy during the history acquisition period exceeds a predetermined threshold.

35. The policy handling system according to claim 34, wherein the policy-operation-log retrieving section includes a history-acquisition-period acquisition section that refers to a history-acquisition-period storage section storing a policy and a history acquisition period in association with each other, to acquire the history acquisition period of the first policy.

36. The policy handling system according to claim 35, wherein the policy-operation-log retrieving section includes a history-acquisition-period calculation section that calculates average and variance of at least one of past triggered frequency and triggering time interval, to calculate the history acquisition period based on the calculated average and variance, and stores the obtained history acquisition period in the history-acquisition-period storage section.

37. The policy handling system according to claim 34, wherein the policy-execution-pattern analyzing section includes a policy-triggering-count-threshold acquisition section that refers to a policy-triggering-count-threshold storage section storing a policy and a threshold in association with each other, to acquire the threshold.

38. The policy handling system according to claim 37, wherein the policy-execution-pattern analyzing section includes a policy-triggering-count-threshold calculation section that calculates the average and variance of the number of triggering times of the first policy during a specific period, calculates the threshold based on the calculated average and variance, and stores the calculated threshold in the policy-triggering-count-threshold storage section.

39. The policy handling system according to claim 33, wherein the policy-operation-log retrieving section includes a policy-approximation-degree evaluating section that determines the degree of approximation between policies based on at least one of the triggering condition and operation to be executed, and the policy-approximation-degree evaluating section regards a policy (approximating policy) determined to be approximating the first policy as the same as the first policy, acquires, from the policy-operation-log storage section, the number of triggering times of the approximating policy determined to be approximating the first policy.

40. The policy handling system according to claim 33, wherein the policy-execution-pattern analyzing section includes a policy flag evaluating section that refers to a policy flag table storing a policy and an influence-degree flag indicating whether or not policy-operation-abnormality determination processing needs to be performed for the first policy, to determine whether or not the first policy is abnormal.

41. The policy handling system according to claim 33, further comprising a policy executing unit that includes:

an event monitoring section that monitors an event generated in a management-targeted system;

a policy retrieving section that refers to a policy database storing therein policies when the event monitoring section detects occurrence of an event corresponding to the triggering condition to retrieve the first policy and notifies the policy-operation-log retrieving section of the retrieved first policy; and

an operation executing section that executes operation of the first policy retrieved by the policy retrieving section.

42. The policy handling system according to claim 41, wherein the policy retrieving section stores the retrieved policy and a retrieval time instant of thereof in the policy-operation-log storage section in association with each other.

43. The policy handling system according to claim 41, further comprising a plurality of the policy executing unit, which are connected to the abnormality detecting unit through a communication line.

44. The policy handling system according to claim 41, wherein the policy-execution-pattern analyzing section stores a policy determined to be abnormal in a stopped-policy storage section storing a policy for which a trigger is to be stopped, and the policy retrieving section includes a policy-execution controlling section that refers to the stopped-policy storage section to determine whether or not triggering of the first policy is to be stopped.

45. The policy handling system according to any one of claims 41 to 43, wherein the policy-execution-pattern analyzing section registers a policy determined to be abnormal in a policy-chain-information storage section in association with the triggered frequency and a latest execution time instant of the policy.

46. The policy handling system according to claim 45, wherein the policy retrieving section includes a policy-execution-interval controlling section that calculates, if the retrieved policy has been registered in the policy-chain-information storage section, an estimated execution time instant of the policy based on the execution frequency and latest execution time of the policy stored in the policy-chain-information storage section, and causes the operation executing section to delay execution of the policy until the calculated estimated execution time.

47. The policy handling system according to claim 46, wherein the policy retrieving section registers the policy for which execution is stopped and estimated execution time instant of the policy in an, operation standby table in association with each other, and causes the operation executing section to execute the policy of which the execution is stopped at the estimated execution time instant registered in the operation standby table.

48. The policy handling system according to any one of claims 45 to 47, wherein the policy retrieving section includes a policy-approximation-degree evaluating section that determines the degree of approximation between policies based on at least one of the triggering condition and operation to be executed, and updates the execution frequency of the policy determined to be abnormal and execution frequency of a policy determined by the policy-approximation-degree evaluating section to be approximating the abnormal policy stored in the policy-chain-information storage section.

49. A method for detecting an abnormity of a policy in a policy handling system for managing a management-targeted system based on policies in which a triggering condition for triggering the policy and operation to be executed are associated with each other, the method comprising:

receiving a notification of a policy (first policy) having a triggering condition which is satisfied, and referring to a policy-operation-log storage section, storing the operation history of policies to acquire an triggered frequency of the first policy in a time period before the receiving the notification; and

determining whether or not the policy is abnormal based on the acquired triggered frequency of the policy.

50. The method for detecting an abnormity of a policy according to claim 49, wherein the triggered frequency acquiring acquires the number of triggering times of the first policy during a history acquisition period before receiving the notification, and the determining of whether or not the first policy is abnormal determines that the first policy is abnormal when the number of triggering times of the first policy during the history acquisition period exceeds a predetermined threshold.

51. The method for detecting an abnormity of a policy according to claim 50, wherein the triggered frequency acquiring refers to a history-acquisition-period storage section storing a policy and a history acquisition period in association with each other, to acquire the history acquisition period of the first policy.

52. The method for detecting an abnormity of a policy according to claim 53, further comprising calculating average and variance of at least one of past triggered frequency and triggering time interval, to calculate the history acquisition period of the first policy based on the calculated average and variance, and storing the obtained history acquisition period in the history-acquisition-period storage section.

53. The method for detecting an abnormity of a policy according to claim 50, wherein the determining of whether or not the policy is abnormal refers to a policy-triggering-count-threshold storage section storing a policy and a threshold in association with each other, to acquire the threshold.

54. The method for detecting an abnormity of a policy according to claim 53, further comprising:

calculating average and variance of the number of triggering times of the first policy during a specific period; and

calculating the threshold based on the calculated average and variance and storing the threshold in the policy-triggering-count-threshold storage section.

55. The method for detecting an abnormity of a policy according to claim 49, further comprising determining a degree of approximation between policies based on at least one of the triggering condition and operation to be executed, wherein the determining of the triggered frequency regards a policy determined to be approximating the first policy in the determining of the degree of approximation as the same as the first policy and acquires, from the policy-operation-log storage section, the number of triggering times of the policy determined to be approximating the first policy.

56. The method for detecting an abnormity of a policy according to claim 49, further comprising, before the step of determining whether or not the policy is abnormal, referring to a policy flag table storing a policy and an influence-degree flag indicating whether or not policy-operation-abnormality determination processing needs to be performed for the first policy to determine whether or not the first policy is abnormal.

57. A computer readable medium encoded with a computer program on which a control processing unit (CPU) is run for managing a management-targeted system based on a policy in which a triggering condition for triggering the policy and operation to be executed are associated with each other, said program being capable of causing said CPU to:

receive a notification of a policy (first policy) having a triggering condition which is satisfied, and refer to a policy-operation-log storage section storing the operation history of policies to acquire a triggered frequency in a time period before receiving the notification of the first policy; and

determine whether or not the policy is abnormal based on the acquired triggered frequency of the first policy.

58. The program according to claim 57, wherein to acquire the triggered frequency acquires the number of triggering times of the policy during a history acquisition period before receiving the notification, and to determine whether or not the first policy is abnormal determines that the first policy is abnormal when the number of triggering times of the first policy during the history acquisition period exceeds a predetermined threshold.

59. The program according to claim 58, wherein to acquire the triggered frequency refers to a history-acquisition-period storage section storing a policy and a history acquisition period in association with each other, to acquire the history acquisition period of the first policy.

60. The program according to claim 59, further being capable of causing the computer to execute processing of calculating average and variance of at least one of past triggered frequency and triggering time interval to calculate the history acquisition period based on the calculated average and variance, and store the obtained history acquisition period in the history-acquisition-period storage section.

61. The program according to any one of claims 58 to 60, wherein to determine whether or not the first policy is abnormal refers to a policy-triggering-count-threshold storage section storing a policy and a threshold in association with each other, to acquire the threshold.

62. The program according to claim 61, further being capable of causing the computer to calculate average and variance of the number of triggering times of the first policy during a specific period, calculate the threshold based on the calculated average and variance, and store the threshold in the policy-triggering-count-threshold storage section.

63. The program according to claim 57, further being capable of causing the computer to determine a degree of approximation between policies based on at least one of triggering condition and operation to be executed, wherein to determine the triggered frequency regards a policy determined to be approximating the policy having the triggering condition which is satisfied as the same as the policy having the triggering condition which is satisfied and acquires, from the policy-operation-log storage section, the number of triggering times of the policy determined to be approximating the policy having the triggering condition which is satisfied.

64. The program according to claim 59, further being capable of causing the computer to refer, before determining whether the first policy is abnormal or not, to a policy flag table storing a policy and an influence-degree flag indicating whether or not the policy-operation-abnormality determination processing needs to be performed for the policy to determine whether or not the first policy is abnormal.