System analysis program, system analysis method, and system analysis apparatus

• US 7,873,594 B2
• Filed: 11/03/2004
• Issued: 01/18/2011
• Est. Priority Date: 06/24/2004
• Status: Expired due to Fees

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Yokoyama, Ken, Akaboshi, Naoki, Harada, Lilian, Kubota, Kazumi, Kobayashi, Kenichi, Yugami, Nobuhiro, Hotta, Yuuji, Take, Riichiro, Otsuka, Hiroshi
• Primary Examiner(s): Jalil; Neveen Abel
• Assistant Examiner(s): RADTKE, MARK A
• Application Number:
  US10/980,766
• Publication Number:
  US 20050289231A1
• Time in Patent Office: 2,267 Days
• Field of Search: 707/103, 707/603
• US Class Current: 707/603
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

A system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

Claims

1. A computer-readable storage medium storing a system analysis program for analyzing an operational form of a network to which a plurality of servers that constitute a multi-layered system are connected, by using a computer, wherein the system analysis program makes the computer execute processing comprising:

collecting messages captured by a switch;

analyzing contents of the collected messages;

determining process types requested by the collected messages and message types indicating whether or not each of the collected messages is a request message or a response message;

storing the determined process types and message types in a protocol-log storage unit as a protocol log;

upon input of an instruction for generation of a model;

identifying at least one process corresponding to each process type, based on at least one correspondence relationship between at least one request message and at least one response message corresponding to each of the process types which are indicated in the protocol log;

selecting a set of messages in accordance with a selection criterion based on certainty of existence of caller-called relationships;

generating a transaction model which satisfies at least one limiting condition related to the caller-called relationships between the identified processes, based on the selected messages;

upon input of an instruction for analysis;

extracting, from the protocol-log storage unit, the protocol log corresponding to at least one caller-called relationship indicated by the transaction model;

analyzing a processing status of a transaction constituted by a message indicated by the extracted protocol log; and

outputting a result of the analyzing;

wherein the selecting determines whether, in a processing time span from a request message to a response message corresponding to an identified process executed by a server belonging to a top layer of the multi-layered system, a message corresponding to another identified process in the top layer of the multi-layered system exists or not, and when no message corresponding to another identified process exists, selects the set of messages that includes the request message, the response message corresponding to the identified processes, and all messages in the processing time span corresponding to identified processes executed by servers belonging to lower layers than the tip layer, the top layer being a layer where the request message from a client computer is received,

wherein the transaction model has the caller-called relationships and processing times,

wherein the limiting condition includes a condition that a processing time span of a caller process includes a processing time span of a called process, and directions of calls between the plurality of the servers, and

wherein the generating generates the transaction model based on the selected set of messages, generates one or more patterns of occurrence each indicating a combination of processes which can be called from processes of each process type, calculates a probability of each of the one or more patterns of occurrence, chooses a predetermined number of ones of the one or more patterns of occurrence having higher probabilities, and generates said transaction model based on the chosen ones of the one or more patterns of occurrence.

2. The computer-readable medium according to claim 1, wherein the generating calculates a time necessary for performing processing corresponding to each protocol in each of the plurality of servers, based on a time elapsed after occurrence of a request message until occurrence of a response message corresponding to each process type in a transaction, and sets the calculated time in said transaction model.

3. The computer-readable medium according to claim 1, wherein when there are a plurality of processes which can call a process to be called, the generating uniformly determines a probability of a call from each of the plurality of processes, integrates probabilities of calls from the plurality of processes to other processes into probabilities on a process type basis, and calculates the likelihoods of caller-called relationships.

4. A system analysis method for analyzing an operational form of a network to which a plurality of servers that constitute a multi-layered system are connected, by using a computer, wherein the system analysis method makes the computer execute processing comprising:

collecting messages captured by a switch;

analyzing contents of the collected messages;

determining process types requested by the collected messages and message types indicating whether or not each of the messages is a request message or a response message;

storing the determined process types and message types in a protocol-log storage unit as a protocol log;

upon input of an instruction for generation of a model;

identifying at least one process corresponding to each process type, based on at least one correspondence relationship between at least one request message and at least one response message corresponding to each of the process types which are indicated in the protocol log;

selecting a set of messages in accordance with a selection criterion based on certainty of existence of caller-called relationships;

generating a transaction model which satisfies at least one limiting condition related to the caller-called relationships between the identified processes, based on the selected messages;

upon input of an instruction for analysis;

extracting, from the protocol-log storage unit, said protocol log corresponding to at least one caller-called relationship indicated by the transaction model;

analyzing a processing status of a transaction constituted by message indicated by the extracted protocol log; and

outputting a result of the analyzing,

wherein the selecting determines whether, in a processing time span from a request message to a response message corresponding to an identified process executed by a server belonging to a top layer of the multi-layered system, a message corresponding to another identified process in the top layer of the multi-layered system exists or not, and when no message corresponding to another identified process exists, selects the set of messages that includes the request message, the response message corresponding to the identified process, and all messages in the processing time span corresponding to identified processes executed by servers belonging to lower layers than the tip layer, the top layer being a layer where the request message from a client computer is received,

wherein the transaction model has the caller-called relationships and processing times,

wherein the limiting condition includes a condition that a processing time span of a caller process includes a processing time span of a called process, and directions of calls between the plurality of the servers, and

wherein the generating generates the transaction model based on the selected set of messages, generates one or more patterns of occurrence each indicating a combination of processes which can be called from processes of each process type, calculates a probability of each of the one or more patterns of occurrence, chooses a predetermined number of ones of the one or more patterns of occurrence having higher probabilities, and generates said transaction model based on the chosen ones of the one or more patterns of occurrence.

5. A system analysis apparatus for analyzing an operational form of a network to which a plurality of servers constituting a multi-layered system are connected, comprising:

a processor further comprising;

a message monitoring unit which collects messages from a switch;

a message analyzing unit which analyzes contents of the collected messages;

a process type determining unit which determines process types requested by the collected messages and message types indicating whether or not each of the messages is a request message or a response message;

a message analysis store unit which stores the determined process types and message types in a protocol-log storage unit as a protocol log;

an identifying unit which identifies at least one process corresponding to each process type, based on at least one correspondence relationship between at least one request message and at least one response message corresponding to each of the process types indicated in the protocol log;

a selecting unit which selects a set of messages in accordance with a selection criterion based on certainty of existence of caller-called relationships;

a model generation unit which generates a transaction model which satisfies at least one limiting condition related to the caller-called relationships between the identified processes, based on the selected messages;

an extracting unit which extracts, from the protocol-log storage unit, the protocol log corresponding to at least one caller-called relationship indicated by the transaction model;

an analysis unit which analyzes a processing status of a transaction constituted by a message indicated by the extracted protocol log; and

an output unit which outputs a result obtained from the analysis unit,

wherein the selecting unit determines whether, in a processing time span from a request message to a response message corresponding to an identified process executed by a server belonging to a top layer of the multi-layered system, a message corresponding to another identified process in the top layer of the multi-layered system exists or not, and when no message corresponding to another identified process exists, selects the set of messages that includes the request message, the response message corresponding to the identified process and all messages existing in the processing time span corresponding to identified processes executed by servers belonging to lower layers than the top layer,

wherein the transaction model has the caller-called relationships and processing times,

wherein the limiting condition includes a condition that a processing time span of a caller process includes a processing time span of a called process, and directions of calls between the plurality of the servers, and wherein the model generation unit generates the transaction model based on the selected set of messages, generates one or more patterns of occurrence each indicating a combination of processes which can be called from processes of each process type, calculates a probability of each of the one or more patterns of occurrence, chooses a predetermined number of ones of the one or more patterns of occurrence having higher probabilities, and generates said transaction model based on the chosen ones of the one or more patterns of occurrence.