System analysis program, system analysis method, and system analysis apparatus

• US 8,266,097 B2
• Filed: 12/16/2010
• Issued: 09/11/2012
• Est. Priority Date: 06/24/2004
• Status: Expired due to Fees

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Harada, Lilian, Yugami, Nobuhiro, Kobayashi, Kenichi, Otsuka, Hiroshi, Yokoyama, Ken, Take, Riichiro, Kubota, Kazumi, Hotta, Yuuji, Akaboshi, Naoki
• Primary Examiner(s): Radtke, Mark Andrew X
• Application Number:
  US12/970,291
• Publication Number:
  US 20110087630A1
• Time in Patent Office: 635 Days
• Field of Search: 707/603
• US Class Current: 707/603
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

A computer-readable, non-transitory medium stores the system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

Claims

1. A computer-readable, non-transitory medium storing a system analysis program for analyzing an operational form of a network to which a plurality of servers are connected, by using a computer, said system analysis program makes the computer execute processing comprising:

collecting a message transmitted or received through said network;

analyzing contents of said collected message;

determining a process type requested by said message and whether or not the message is a request message or a response message;

storing the message in a protocol-log storage unit as a protocol log information which indicates the determined process type;

identifying at least one process corresponding to the determined process type based on a correspondence relationship between a request message and a response message corresponding to the process type which is indicated in said protocol log when receiving an instruction for generating a model;

generating a transaction model which satisfies a limiting condition related to caller-called relationships between processes, from a set of messages selected in accordance with a selection criterion based on certainty of existence of caller-called relationships, the transaction model containing a list of messages to be transmitted until a completion of a transaction;

storing the generated transaction model in a transaction-model storage unit;

extracting from said protocol-log storage unit a record item of said protocol log conforming to a caller-called relationship indicated by said transaction model stored in said transaction-model storage unit when receiving an instruction for analyzing; and

analyzing a processing status of a transaction constituted by a message indicated by the extracted record item,

wherein the generating determines a processing time span of each transaction based on a request message which is first outputted from a client and a response message corresponding to the request message, detects a nonmultiple transaction which does not have a processing time span overlapping with a processing time span of another transaction, and generates said transaction model based on record items in said protocol log corresponding to a processing time span of the detected nonmultiple transaction.

2. The computer-readable, non-transitory medium storing the system analysis program according to claim 1, wherein the collecting collects said message through a mirror port of a switch arranged in said network.

3. The computer-readable, non-transitory medium storing the system analysis program according to claim 1, wherein the collecting collects said message from dump data of messages stored in said plurality of servers.

4. The computer-readable, non-transitory medium storing the system analysis program according to claim 1, wherein the limiting condition includes a condition that a processing time span of a caller process includes a processing time span of a called process.

5. The computer-readable, non-transitory medium storing the system analysis program according to claim 1, wherein directions of calls between the plurality of servers are defined in the limiting condition.

6. The computer-readable, non-transitory medium storing the system analysis program according to claim 1, wherein the generating calculates a time necessary for performing processing corresponding to each protocol in each of the plurality of servers, based on a time elapsed after occurrence of a request message until occurrence of a response message corresponding to each process type in a transaction, and sets the calculated time in said transaction model.

8. The computer-readable, non-transitory medium storing the system analysis program according to claim 1, wherein the generating generates one or more patterns of occurrence each indicating a combination of processes which can be called from processes of each process type, calculates a probability of each of the one or more patterns of occurrence, chooses a predetermined number of ones of the one or more patterns of occurrence having higher probabilities, and generates said transaction model based on the chosen ones of the one or more patterns of occurrence.

7. A computer-readable, non-transitory medium storing the system analysis program, said system analysis program makes the computer execute processing comprising:

collecting a message transmitted or received through said network;

analyzing contents of said collected message;

determining a process type requested by said message and whether or not the message is a request message or a response message;

storing the message in a protocol-log storage unit as a protocol log information which indicates the determined process type;

identifying at least one process corresponding to the determined process type based on a correspondence relationship between a request message and a response message corresponding to the process type which is indicated in said protocol log when receiving an instruction for generating a model;

generating a transaction model which satisfies a limiting condition related to caller-called relationships between processes, from a set of messages selected in accordance with a selection criterion based on certainty of existence of caller-called relationships, the transaction model containing a list of messages to be transmitted until a completion of a transaction;

storing the generated transaction model in a transaction model storage unit;

extracting from said protocol-log storage unit a record item of said protocol log conforming to a caller-called relationship indicated by said transaction model stored in said transaction-model storage unit when receiving an instruction for analyzing; and

analyzing a processing status of a transaction constituted by a message indicated by the extracted record item,

wherein when there are a plurality of processes which are possible to call a process to be called, the generating uniformly determines a probability of a call from each of the plurality of processes, integrates probabilities of calls from the plurality of processes to other processes into probabilities on a process type basis, and calculates the likelihoods of caller-called relationships.

9. A system analysis method for analyzing an operational form of a network to which a plurality of servers are connected, by using a computer, comprising:

collecting a message transmitted or received through said network;

analyzing contents of said message collected;

determining a process type requested by said message and whether or not the message is a request message or a response message;

storing the message in a protocol-log storage unit as a protocol log information which indicates the determined process type;

identifying at least one process corresponding to the determined process type based on a correspondence relationship between a request message and a response message corresponding to the process type which is indicated in said protocol log when receiving an instruction for generating a model;

generating a transaction model which satisfies a limiting condition related to caller-called relationships between processes, from a set of messages selected in accordance with a selection criterion based on certainty of existence of caller-called relationships, the transaction model containing a list of messages to be transmitted until a completion of a transaction;

storing the generated transaction model in a transaction-model storage unit;

extracting from said protocol-log storage unit a record item of said protocol log conforming to a caller-called relationship indicated by said transaction model stored in said transaction-model storage unit when receiving an instruction for analyzing; and

analyzing a processing status of a transaction constituted by a message indicated by the extracted record item,

wherein the generating determines a processing time span of each transaction based on a request message which is first outputted from a client and a response message corresponding to the request message, detects a nonmultiple transaction which does not have a processing time span overlapping with a processing time span of another transaction, and generates said transaction model based on record items in said protocol log corresponding to a processing time span of the detected nonmultiple transaction.

10. A system analysis apparatus for analyzing an operational form of a network to which a plurality of servers are connected, comprising:

a processor to execute a procedure comprising;

collecting a message transmitted or received through said network;

analyzing contents of said message collected;

determining a process type requested by said message and whether or not the message is a request message or a response message;

storing the message in a protocol-log storage unit as a protocol log information indicating the determined process type;

identifying at least one process corresponding to the determined process type based on a correspondence relationship between a request message and a response message corresponding to the process type which is indicated in said protocol log when receiving an instruction for generating a model;

generating a transaction model satisfying a limiting condition related to caller-called relationships between processes, from a set of messages selected in accordance with a selection criterion based on certainty of existence of caller-called relationships, the transaction model containing a list of messages to be transmitted until a completion of a transaction;

storing the generated transaction model in a transaction-model storage unit;

extracting from said protocol-log storage unit a record item of said protocol log conforming to a caller-called relationship indicated by said transaction model stored in said transaction-model storage unit when receiving an instruction for an analyzing; and

analyzing a processing status of a transaction constituted by a message indicated by the extracted record item,

wherein the generating determines a processing time span of each transaction based on a request message which is first outputted from a client and a response message corresponding to the request message, detects a nonmultiple transaction which does not have a processing time span overlapping with a processing time span of another transaction, and generates said transaction model based on record items in said protocol log corresponding to a processing time span of the detected nonmultiple transaction.