OPERATION MANAGEMENT DEVICE, OPERATION MANAGEMENT METHOD, AND OPERATION MANAGEMENT PROGRAM

• US 20100057660A1
• Filed: 03/04/2008
• Published: 03/04/2010
• Est. Priority Date: 03/14/2007
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Kato, Kiyoshi
• Granted Patent: US 8,332,344 B2
• Time in Patent Office: Days
• US Class Current: 706/47
• CPC Class Codes: G06F 11/008 Reliability or availability analysis
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 41/0604 using filtering, e.g. reduction of information by using priority, element types, position or time
• CPC Class Codes: H04L 41/147 for predicting network behaviour

Abstract

An operation management apparatus decides that newly-generated event data and previously-existing predictive event data match if the attribute values of the event data match the attribute values of the predictive event data excluding reference values. In such a case, the apparatus identifies individual filter information whose attribute values excluding reference values match the attribute values of the event data, and substitutes the attribute values of the event data for variables in each piece of individual filter information belonging to a group to which the individual filter information belongs, thereby generating predictive event data for each piece of individual filter information. The apparatus decides whether or not each piece of event data that is associated in a predictive event index with the group to which the individual filter information that matches the event data used for generating the predictive event data belongs satisfies the individual filter information of operation rule information corresponding to the group, and if satisfies, performs processing defined by the operation rule information.

Claims

1. An operation management apparatus for performing processing when event data matches a defined condition, the event data associating a name of an attribute indicating a state of a system to be managed with an attribute value of the same, the apparatus comprising:

a rule storing section that stores operation rule information that defines processing to be performed;

an individual filter information storing section that stores individual filter information which is information that constitutes conditions defined for respective pieces of operation rule information and that associates attributes and attribute values, where some of the attribute values may be written as a reference value estimated from past event data and some of the attribute values may be written as a variable;

a predictive event data storing section that stores predictive event data which is data in which an attribute value of event data generated by the system to be managed is substituted for an attribute value that is written as a variable in individual filter information;

a predictive event index storing section that stores a predictive event index which is information that associates generated event data, predictive event data generated from individual filter information that matches the event data, and a group which is a set of individual filter information corresponding to operation rule information and to which the individual filter information matching the event data belongs;

a predictive event correspondence table storing section that stores a predictive event correspondence table which is information that associates operation rule information, each piece of individual filter information that constitutes a condition defined by the operation rule information, a group to which the each piece of individual filter information belongs, and predictive event data generated from the individual filter information;

a predictive event data matching decision section that decides that newly-generated event data and previously-existing predictive event data match if the attribute values of the event data match the attribute values of the predictive event data excluding a reference value or reference values, and decides that the newly-generated event data and the previously-existing predictive event data do not match if the attribute values of the event data do not match the attribute values of the predictive event data excluding a reference value or reference values;

an individual filter information identification section that identifies individual filter information whose attribute values, excluding a reference value or reference values, match the attribute values of the event data if it is decided that the event data and the predictive event data do not match;

a predictive event data generating section that, if the individual filter information is successfully identified, substitutes the attribute value of the event data for the variable of each piece of individual filter information that belongs to a group to which the individual filter information belongs, thereby generating predictive event data for the each piece of individual filter information, stores the predictive event data into the predictive event data storing section, stores information that shows correspondence between the event data, the predictive event data, and the group to which the individual filter information matching the event data belongs into the predictive event index storing section, and stores information that shows correspondence between the predictive event data generated, the group of the individual filter information used for generating the predictive event data, the each piece of individual filter information belonging to the group, and the operation rule information having the each piece of individual filter information as a condition into the predictive event correspondence table storing section; and

a rule decision section that decides, after the predictive event data is generated by the predictive event data generating section, whether or not each piece of event data that is associated in the predictive event index with the group to which the individual filter information that matches the event data used for generating the predictive event data belongs satisfies the individual filter information of the operation rule information corresponding to the group, and if satisfies, performs the processing defined by the operation rule information.

2. The operation management apparatus according to claim 1, comprising:

a reference value matching decision section that decides whether or not the reference value included in the predictive event data matches/match the attribute value of the event data if it is decided that the event data and the predictive event data match;

a user interface section that, if it is decided that the event data and the predictive event data match and it is decided that the reference value included in the predictive event data does not/do not match the attribute value of the event data, displays the operation rule information and the event data, displays the attribute value that does not/do not match the reference value, and accepts an instruction whether or not to change the condition of the operation rule information; and

a modification section that, if an instruction not to change the condition of the operation rule information is input, deletes the reference value of the attribute of which the attribute value of the event data and the reference value of the predictive event data do not match from the individual filter information, and if an instruction to change the condition of the operation rule information is input, overwrites the attribute value of the attribute of which the attribute value of the event data and the reference value of the predictive event data do not match, the attribute value being of the individual filter information of the group to which the individual filter information used for generating the predictive event data belongs, with an attribute value or attribute values written as a variable or variables, and overwrites the reference value of the predictive event data that does not/do not match the attribute value of the event data with the attribute value other than a reference value.

3. The operation management apparatus according to claim 1, comprising

a job management section that retains a plurality of pieces of individual filter information that match a plurality of pieces of event data having a predetermined order of occurrence, and notifies the predictive event data generating section of the plurality of pieces of individual filter information in specified order, and wherein

the predictive event data generating section stores information that associates a group and the plurality of pieces of individual filter information into the predictive event correspondence table storing section with a set of the plurality of pieces of individual filter information as the group, and when generating predictive filter information from the individual filter information that is notified by the job management section and event data that matches the individual filter information, generates predictive event data in which the attribute value of the event data is/are substituted for the variable of a piece of individual filter information subsequent to the individual filter information, and adds the generated predictive event data to the information that associates the group and the plurality of pieces of individual filter information.

4. The operation management apparatus according to claim 1, comprising

a priority event data request section that, if there is predictive event data that is associated with operation rule information by the predictive event correspondence table storing section, notifies the system to be managed of the predictive event data, thereby requesting the system to be managed to notify by priority of event data that matches the predictive event data among the event data generated by the system to be managed.

5. The operation management apparatus according to claim 1, comprising:

a filter information storing section that stores filter information that associates an attribute and an attribute value other than a reference value; and

an individual filter information generating section that generates individual filter information by adding an attribute value estimated from event data that is generated in the past and matches filter information specified by operation rule information to the filter information as a reference value.

6. An operation management method to be applied to an operation management apparatus that performs processing when event data matches a defined condition, the event data associating a name of an attribute indicating a state of a system to be managed with an attribute value of the same, the apparatus comprising:

a rule storing section that stores operation rule information that defines processing to be performed;

an individual filter information storing section that stores individual filter information which is information that constitutes conditions defined for respective pieces of operation rule information and that associates attributes and attribute values, where some of the attribute values may be written as a reference value estimated from past event data and some of the attribute values may be written as a variable;

a predictive event data storing section that stores predictive event data which is data in which an attribute value of event data generated by the system to be managed is substituted for an attribute value that is written as a variable in individual filter information;

a predictive event index storing section that stores a predictive event index which is information that associates generated event data, predictive event data generated from individual filter information that matches the event data, and a group which is a set of individual filter information corresponding to operation rule information and to which the individual filter information matching the event data belongs; and

a predictive event correspondence table storing section that stores a predictive event correspondence table which is information that associates operation rule information, each piece of individual filter information that constitutes a condition defined by the operation rule information, a group to which the each piece of individual filter information belongs, and predictive event data generated from the individual filter information, and wherein

a predictive event data matching decision section decides that newly-generated event data and previously-existing predictive event data match if the attribute values of the event data match the attribute values of the predictive event data excluding a reference value or reference values, and decides that the newly-generated event data and the previously-existing predictive event data do not match if the attribute values of the event data do not match the attribute values of the predictive event data excluding a reference value or reference values,

an individual filter information identification section identifies individual filter information whose attribute values, excluding a reference value or reference values, match the attribute values of the event data if it is decided that the event data and the predictive event data do not match,

a predictive event data generating section, if the individual filter information is successfully identified, substitutes the attribute value of the event data for the variable of each piece of individual filter information that belongs to a group to which the individual filter information belongs, thereby generating predictive event data for the each piece of individual filter information, stores the predictive event data into the predictive event data storing section, stores information that shows correspondence between the event data, the predictive event data, and the group to which the individual filter information matching the event data belongs into the predictive event index storing section, and stores information that shows correspondence between the predictive event data generated, the group of the individual filter information used for generating the predictive event data, the each piece of individual filter information belonging to the group, and the operation rule information having the each piece of individual filter information as a condition into the predictive event correspondence table storing section, and

after the predictive event data is generated by the predictive event data generating section, a rule decision section decides whether or not each piece of event data that is associated in the predictive event index with the group to which the individual filter information that matches the event data used for generating the predictive event data belongs satisfies the individual filter information of the operation rule information corresponding to the group, and if satisfies, performs the processing defined by the operation rule information.

7. The operation management method according to claim 6, wherein

a reference value matching decision section decides whether or not the reference value included in the predictive event data matches/match the attribute value of the event data if it is decided that the event data and the predictive event data match;

a user interface section, if it is decided that the event data and the predictive event data match and it is decided that the reference value included in the predictive event data does not/do not match the attribute value of the event data, displays the operation rule information and the event data, displays the attribute value that does not/do not match the reference value, and accepts an instruction whether or not to change the condition of the operation rule information; and

a modification section, if an instruction not to change the condition of the operation rule information is input, deletes the reference value of the attribute of which the attribute value of the event data and the reference value of the predictive event data do not match from the individual filter information, and if an instruction to change the condition of the operation rule information is input, overwrites the attribute value of the attribute of which the attribute value of the event data and the reference value of the predictive event data do not match, the attribute value being of the individual filter information of the group to which the individual filter information used for generating the predictive event data belongs, with an attribute value or attribute values written as a variable or variables, and overwrites the reference value of the predictive event data that does not/do not match the attribute value of the event data with the attribute value other than a reference value.

8. The operation management method according to claim 6, wherein

a job management section retains a plurality of pieces of individual filter information that match a plurality of pieces of event data having a predetermined order of occurrence, and notifies the predictive event data generating section of the plurality of pieces of individual filter information in specified order;

and

the predictive event data generating section stores information that associates a group and the plurality of pieces of individual filter information into the predictive event correspondence table storing section with a set of the plurality of pieces of individual filter information as the group, and when generating predictive filter information from the individual filter information that is notified by the job management section and event data that matches the individual filter information, generates predictive event data in which the attribute value of the event data is/are substituted for the variable of a piece of individual filter information subsequent to the individual filter information, and adds the generated predictive event data to the information that associates the group and the plurality of pieces of individual filter information.

9. The operation management method according to claim 6, wherein

a priority event data request section, if there is predictive event data that is associated with operation rule information by the predictive event correspondence table storing section, notifies the system to be managed of the predictive event data, thereby requesting the system to be managed to notify by priority of event data that matches the predictive event data among the event data generated by the system to be managed.

10. An operation management program to be implemented on a computer that performs processing when event data matches a defined condition, the event data associating a name of an attribute indicating a state of a system to be managed with an attribute value of the same, the computer comprising:

a rule storing section that stores operation rule information that defines processing to be performed;

an individual filter information storing section that stores individual filter information which is information that constitutes conditions defined for respective pieces of operation rule information and that associates attributes and attribute values, where some of the attribute values may be written as a reference value estimated from past event data and some of the attribute values may be written as a variable;

a predictive event data storing section that stores predictive event data which is data in which an attribute value of event data generated by the system to be managed is substituted for an attribute value that is written as a variable in individual filter information;

a predictive event index storing section that stores a predictive event index which is information that associates generated event data, predictive event data generated from individual filter information that matches the event data, and a group which is a set of individual filter information corresponding to operation rule information and to which the individual filter information matching the event data belongs; and

a predictive event correspondence table storing section that stores a predictive event correspondence table which is information that associates operation rule information, each piece of individual filter information that constitutes a condition defined by the operation rule information, a group to which the each piece of individual filter information belongs, and predictive event data generated from the individual filter information,

the operation management program making the computer perform

predictive event data matching decision processing that decides that newly-generated event data and previously-existing predictive event data match if the attribute values of the event data match the attribute values of the predictive event data excluding a reference value or reference values, and decides that the newly-generated event data and the previously-existing predictive event data do not match if the attribute values of the event data do not match the attribute values of the predictive event data excluding a reference value or reference values,

individual filter information identification processing that identifies individual filter information whose attribute values, excluding a reference value or reference values, match the attribute values of the event data if it is decided that the event data and the predictive event data do not match,

predictive event data generating processing that, if the individual filter information is successfully identified, substitutes the attribute value of the event data for the variable of each piece of individual filter information that belongs to a group to which the individual filter information belongs, thereby generating predictive event data for the each piece of individual filter information, stores the predictive event data into the predictive event data storing section, stores information that shows correspondence between the event data, the predictive event data, and the group to which the individual filter information matching the event data belongs into the predictive event index storing section, and stores information that shows correspondence between the predictive event data generated, the group of the individual filter information used for generating the predictive event data, the each piece of individual filter information belonging to the group, and the operation rule information having the each piece of individual filter information as a condition into the predictive event correspondence table storing section, and

rule decision processing that decides, after the predictive event data is generated by the predictive event data generating processing, whether or not each piece of event data that is associated in the predictive event index with the group to which the individual filter information that matches the event data used for generating the predictive event data belongs satisfies the individual filter information of the operation rule information corresponding to the group, and if satisfies, performs the processing defined by the operation rule information.

11. The operation management program according to claim 10, making the computer perform:

reference value matching decision processing that decides whether or not the reference value included in the predictive event data matches/match the attribute value of the event data if it is decided that the event data and the predictive event data match;

display processing that, if it is decided that the event data and the predictive event data match and it is decided that the reference value included in the predictive event data does not/do not match the attribute value of the event data, displays the operation rule information and the event data, and displays the attribute value that does not/do not match the reference value; and

modification processing that, if an instruction not to change the condition of the operation rule information is input, deletes the reference value of the attribute of which the attribute value of the event data and the reference value of the predictive event data do not match from the individual filter information, and if an instruction to change the condition of the operation rule information is input, overwrites the attribute value of the attribute of which the attribute value of the event data and the reference value of the predictive event data do not match, the attribute value being of the individual filter information of the group to which the individual filter information used for generating the predictive event data belongs, with an attribute value or attribute values written as a variable or variables, and overwrites the reference value of the predictive event data that does not/do not match the attribute value of the event data with the attribute value other than a reference value.

12. The operation management program according to claim 10, making the computer perform

processing that stores information that associates a group and a plurality of pieces of individual filter information that match a plurality of pieces of event data having a predetermined order of occurrence into the predictive event correspondence table storing section with the set of individual filter information of defined order as the group, and wherein

the predictive event data generating processing, when generating predictive filter information from the individual filter information of defined order and event data that matches the individual filter information, generates predictive event data in which the attribute value of the event data is/are substituted for the variable of a piece of individual filter information subsequent to the individual filter information, and adds the generated predictive event data to the information that associates the group and the plurality of pieces of individual filter information.

13. The operation management program according to claim 10, making the computer perform

priority event data request processing that, if there is predictive event data that is associated with operation rule information by the predictive event correspondence table storing section, notifies the system to be managed of the predictive event data, thereby requesting the system to be managed to notify by priority of event data that matches the predictive event data among the event data generated by the system to be managed.

14. An operation management apparatus for performing processing in accordance with event data that associates an attribute indicating a state of a system to be managed with an attribute value of the same, the apparatus comprising:

a section that, if the attribute value of the event data generated matches the attribute value of previously-set predictive event data other than a reference value, identifies individual filter information that has the attribute value matching the attribute value of the event data from among a plurality of pieces of individual filter information that are associated with a group of previously-set individual filter information;

a section that adds the attribute value of the event data to variables of the plurality of pieces of individual filter information associated with the group to which the individual filter information identified belongs, thereby generating predictive event data for each of the plurality of pieces of individual filter information; and

a section that decides whether or not a plurality of pieces of event data previously associated with the group of the individual filter information that matches the event data used for generating the predictive event data satisfy a condition of operation rule information previously associated with the group of the individual filter information, and if satisfy, performs processing in accordance with the operation rule information.

15. An operation management method that is a method of operation of an operation management apparatus that performs processing in accordance with event data that associates an attribute indicating a state of a system to be managed with an attribute value of the same, the method comprising:

identifying, if the attribute value of the event data generated matches the attribute value of previously-set predictive event data other than a reference value, individual filter information that has the attribute value matching the attribute value of the event data from among a plurality of pieces of individual filter information that are associated with a group of previously-set individual filter information;

adding the attribute value of the event data to variables of the plurality of pieces of individual filter information associated with the group to which the individual filter information identified belongs, thereby generating predictive event data for each of the plurality of pieces of individual filter information; and

deciding whether or not a plurality of pieces of event data previously associated with the group of the individual filter information that matches the event data used for generating the predictive event data satisfy a condition of operation rule information previously associated with the group of the individual filter information, and if satisfy, performing processing in accordance with the operation rule information.

16. An operation management program that is an operation program of an operation management apparatus that performs processing in accordance with event data that associates an attribute indicating a state of a system to be managed with an attribute value of the same, the program making a computer perform:

processing that, if the attribute value of the event data generated matches the attribute value of previously-set predictive event data other than a reference value, identifies individual filter information that has the attribute value matching the attribute value of the event data from among a plurality of pieces of individual filter information that are associated with a group of previously-set individual filter information;

processing that adds the attribute value of the event data to variables of the plurality of pieces of individual filter information associated with the group to which the individual filter information identified belongs, thereby generating predictive event data for each of the plurality of pieces of individual filter information; and

processing that decides whether or not a plurality of pieces of event data previously associated with the group of the individual filter information that matches the event data used for generating the predictive event data satisfy a condition of operation rule information previously associated with the group of the individual filter information, and if satisfy, performs processing in accordance with the operation rule information.