Recording medium storing system analyzing program, system analyzing apparatus, and system analyzing method

• US 8,326,977 B2
• Filed: 08/27/2009
• Issued: 12/04/2012
• Est. Priority Date: 07/16/2008
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Higuchi, Junichi, Yokoyama, Ken
• Primary Examiner(s): Lazaro, David
• Assistant Examiner(s): DRABIK, SARAH E
• Application Number:
  US12/549,040
• Publication Number:
  US 20100017401A1
• Time in Patent Office: 1,195 Days
• Field of Search: 709/203, 709/206, 709/223, 709/226, 717/104, 717/105, 717/127, 717/131, 718/102, 718/106
• US Class Current: 709/224
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A system analyzing apparatus obtains a message group including a message ID, a protocol, a type, and a transmission time of messages transmitted/received in a system where a hierarchical structure of protocols is defined. The apparatus detects pairs of a request message and a response message of the same message ID from the obtained message group. The apparatus identifies a request time and a response time of each of the detected pairs. The apparatus searches for a child-layer pair that has a request time and a response time between the request time and the response time of a parent-layer pair arbitrarily selected from among the pairs and that has a protocol in a layer lower than the protocol of the parent-layer pair on the basis of the identified result. The apparatus outputs the found child-layer pair as a candidate pair having a call relationship with the parent-layer pair.

Claims

1. A non-transitory computer-readable recording medium storing a system analyzing program containing instructions executed on a computer, the system analyzing program causing the computer to execute:

an obtaining procedure which obtains a message data group including a message ID, a protocol, a type, and a transmission time of one or more messages transmitted/received in a system where a hierarchical structure of protocols is defined;

a detecting procedure which detects one or more pairs of a request message and a response message with a same message ID from the obtained message data group;

an identifying procedure which identifies a request time and a response time of each of the detected pairs;

a searching procedure which arbitrarily selects a pair and designates the selected pair as a parent-layer pair, and the search procedure searches for one or more child-layer pairs on the basis of the response times and request times identified in the identifying procedure, each child-layer pair having a request time and a response time between a request time and a response time of the parent-layer pair, each child-layer pair further having a protocol that is lower than a protocol of the parent-layer pair, the search procedure generating a search result that indicates a call relationship between the parent-layer pair and all child-layer pairs found;

an outputting procedure which outputs the found child-layer pairs as candidate pairs having a call relationship with the parent-layer pair;

a counting procedure which counts a number of candidates of parent-layer pairs having a call relationship with a given child-layer pair on the basis of a search result generated in the searching procedure;

a first calculating procedure which calculates a response period from a request to a response of the parent-layer pair by using the identified request time and response time of the parent-layer pair, the first calculating procedure further calculating a response period from a request to a response of each child-layer pair by using the identified request time and response time of the child-layer pair; and

a second calculating procedure which calculates the processing period of the server that is the destination of the request message of the parent-layer pair by subtracting the response period of the child-layer pair from the response period of the parent-layer pair by referring to a parent-child relationship table and a response period table,

wherein when the counting procedure determines that a plurality of parent-layer pairs have a call relationship with the child-layer pair, the second calculating procedure divides the response period of the child-layer pair by the number of parent-layer pairs before performing the subtraction when calculating the processing period of the request message for each of the parent-layer pairs.

2. The non-transitory computer-readable recording medium according to claim 1, wherein the one or more child-layer pairs that are searched for in the searching procedure each have a protocol in the layer immediately under a protocol of the selected parent-layer pair.

3. The non-transitory computer-readable recording medium according to claim 1,

wherein the outputting procedure outputs the processing period of the server calculated in the second calculating procedure.

4. The non-transitory computer-readable recording medium according to claim 3, wherein, if the protocol of the child-layer pair is in a lowest layer, the outputting procedure outputs the response period of the child-layer pair as a processing period of a server that is a destination of a request message of the child-layer pair.

5. The non-transitory computer-readable recording medium according to claim 1,

wherein the searching procedure repeatedly executes a searching process until there is no parent-layer pair selected from among the remaining parent and child-layer pairs having protocols other than a protocol in a lowest layer, and

wherein the counting procedure counts the number of candidates of parent-layer pairs having a call relationship with the child-layer pair on the basis of a search result generated in the searching procedure.

6. The non-transitory computer-readable recording medium according to claim 1,

wherein the parent-layer pair is a pair arbitrarily selected from among remaining parent and child-layer pairs having protocols other than a protocol in a lowest layer.

7. The non-transitory computer-readable recording medium according to claim 3,

wherein the search procedure registers the address of the request message of one or more parent-layer pairs

wherein, for one or more addresses in one or more arbitrarily designated time slots, the second calculating procedure calculates an average processing period of the server by totaling processing periods of the server that is the destination of the request message of the parent-layer pair, each address identified by the request message having a protocol in a highest layer, and

wherein the outputting procedure outputs the average processing period of the server calculated in the second calculating procedure.

8. The non-transitory computer-readable recording medium according to claim 7,

wherein the second calculating procedure calculates the average processing period of the server by totaling the processing periods of a server that is the destination of the request message of the child-layer pair in a lowest layer of the address in the arbitrarily designated time slot.

9. The non-transitory computer-readable recording medium according to claim 8,

wherein the outputting procedure outputs, for each address, the processing period of a server that is the destination of the request message of the protocol in each layer from a highest layer to a lowest layer of the arbitrary designated address.

10. The non-transitory computer readable recording medium according to claim 7, the system analyzing program further causing the computer to execute:

a generating procedure of generating a frequency distribution indicating a relationship between a transmission time interval between messages of a same type in one or more upper and lower layers of the message data group adjacent to each other and an occurrence frequency of messages in the lower layer on the basis of the message data group; and

a setting procedure of setting a range regarding a transmission time of a message in the lower layer having a call relationship with a message in the upper layer of the generated frequency distribution,

wherein the outputting procedure outputs a result of the setting procedure.

11. The non-transitory computer-readable recording medium according to claim 10, the system analyzing program further causing the computer to execute:

a screening procedure of screening child-layer pairs that have been searched for to extract a child-layer pair in the lower layer having a call relationship with a parent-layer pair in the upper layer on the basis of the range set by the setting procedure,

wherein the second calculating procedure calculates a processing period of a server as a source of a request message of a parent-layer pair in the upper layer on the basis of a response period of the parent-layer pair and a response period of the extracted child-layer pair in the lower layer.

12. The non-transitory computer-readable recording medium according to claim 11, the system analyzing program further causing the computer to execute:

a determining procedure of determining whether a plurality of candidates of parent-layer pairs having a call relationship with a child-layer pair in the lower layer exist,

wherein the screening procedure extracts a child-layer pair in the lower layer having a call relationship with the parent-layer pair in the upper layer if the determining procedure determines that a plurality of candidates exist.

13. A system analyzing apparatus comprising:

a memory; and

a processor for executing a process comprising;

obtaining a message data group including a message ID, a protocol, a type, and a transmission time of one or more messages transmitted/received in a system where a hierarchical structure of protocols is defined;

detecting one or more pairs of a request message and a response message of a same message ID from the obtained message data group;

identifying a request time and a response time of each of the detected pairs;

searching for child-layer pairs by arbitrarily selecting a pair and designating the selected pair as a parent-layer pair, and searching for one or more child-layer pairs on the basis of the response times and request times identified in the identifying procedure, each child-layer pair having a request time and a response time between a request time and a response time of the parent-layer pair, each child-layer pair further having a protocol that is lower than a protocol of the parent-layer pair, the searching generating a search result that indicates a call relationship between the parent-layer pair and all child-layer pairs found; and

outputting the found child-layer pairs as a candidate pair having a call relationship with the parent-layer pair;

counting a number of candidates of parent-layer pairs having a call relationship with a given child-layer pair on the basis of a search result generated in the searching procedure;

calculating a response period from a request to a response of the parent-layer pair by using the identified request time and response time of the parent-layer pair, and calculating a response period from a request to a response of each child-layer pair by using the identified request time and response time of the child-layer pair; and

calculating the processing period of the server that is the destination of the request message of the parent-layer pair by subtracting the response period of the child-layer pair from the response period of the parent-layer pair by referring to a parent-child relationship table and a response period table,

wherein when the counting determines that a plurality of parent-layer pairs have a call relationship with the child-layer pair, the response period of the child-layer pair is divided by the number of parent-layer pairs before performing the subtraction when calculating the processing period of the request message for each of the parent-layer pairs.

14. A system analyzing method executed by a computer, the method comprising:

obtaining a message data group including a message ID, a protocol, a type, and a transmission time of one or more messages transmitted/received in a system where a hierarchical structure of protocols is defined;

detecting one or more pairs of a request message and a response message of a same message ID from the obtained message data group;

identifying a request time and a response time of each of the detected pairs;

arbitrarily selecting a pair and designating the selected pair as a parent-layer pair, searching for one or more child-layer pairs on the basis of the response times and request times identified in the identifying procedure, each child-layer pair having a request time and a response time between a request time and a response time of the parent-layer pair, each child-layer pair further having a protocol that is lower than a protocol of the parent-layer pair, and generating a search result that indicates a call relationship between the parent-layer pair and all child-layer pairs found; and

outputting the found child-layer pairs as candidate pairs having a call relationship with the parent-layer pair;

counting a number of candidates of parent-layer pairs having a call relationship with a given child-layer pair on the basis of a search result generated in the searching procedure;

calculating a response period from a request to a response of the parent-layer pair by using the identified request time and response time of the parent-layer pair, and calculating a response period from a request to a response of each child-layer pair by using the identified request time and response time of the child-layer pair; and

calculating the processing period of the server that is the destination of the request message of the parent-layer pair by subtracting the response period of the child-layer pair from the response period of the parent-layer pair by referring to a parent-child relationship table and a response period table,

wherein when the counting step determines that a plurality of parent-layer pairs have a call relationship with the child-layer pair, the response period of the child-layer pair is divided by the number of parent-layer pairs before performing the subtraction when calculating the processing period of the request message for each of the parent-layer pairs.