JP2001273172A - Computer operation data recording system and recording medium used in the system - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To provide a computer operation data recording system that records necessary operation data in a data file 4 and can reduce the recording capacity of the data file 4. SOLUTION: An operation data detection unit 1 for detecting operation data for each unit time, a memory 2 for storing operation data for each operation type, and progress of a plurality of types of operation data selected from the operation data for each first time And an operation data monitoring unit 5 for determining whether the operation data is normal or abnormal, a control unit 3, and a data file 4 for recording the operation data.
When the operation data monitoring unit 5 determines that any type of operation data is abnormal, the operation data is stored in the memory 2
When the operating data monitoring unit determines that the plurality of types of operating data selected are normal, the operating data is read from the memory 2 and the average value of the operating data is obtained for each type. The average operation data is recorded in the data file 4.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer operation data recording system and a recording medium used in the system, and more particularly to a computer operation data recording system for collecting and recording operation data necessary for performing a failure analysis when the computer is operating. The present invention relates to a system and a recording medium used for the system.

[0002]

2. Description of the Related Art In general, a client / server system is provided with a file for collecting data representing the processing status and communication status when various operations are executed, and recording the collected data, that is, a log file. . In this case, when accumulating the collected data in the log file, since the collected data is sequentially written to the log file as it is, the amount of collected data accumulated in the log file becomes enormous. Therefore, a large recording capacity is required.

As described above, the log file is required to have a large recording capacity, and in order to secure the recording capacity, in a known client / server system, a data recording system in which various measures are taken is proposed. Have been.

As one example, Japanese Patent Publication No. Sho 62-16924
The device disclosed in Japanese Patent Application Publication No. 6-66, when the amount of collected data recorded in a log file exceeds a certain amount, transfers the collected data recorded in the log file to a file server, and has a relatively small recording capacity. The log file is used to secure the recording capacity of the log file.

Another example is disclosed in Japanese Patent Application Laid-Open No. 7-2058.
No. 93 discloses a technique in which certain data of collected data is set as sampling data, this sampling data is monitored, and the collected data is recorded in a log file only when a sudden change occurs in the sampling data. In this case, a log file having a relatively small recording capacity is used, and the recording capacity of the log file is ensured.

Further, as another example, see Japanese Patent Application Laid-Open No. 9-812.
The device disclosed in Japanese Patent Publication No. 33 is configured to transfer collected data stored in a built-in memory for a certain period of time to a log file and to record the collected data when an abnormality occurs in the monitored device. A log file having a sufficient capacity is used to secure the recording capacity of the log file.

[0007]

In order to ascertain an abnormality during the operation of the computer using the operation data obtained by the computer, what is the operating state in the steady state, It is necessary to understand how the state has changed.

The technical means proposed in the above, that is, those disclosed in Japanese Patent Publication No. 62-169246,
JP-A-205893, JP-A-9-8123
Known data recording systems of this type, including the one disclosed in Japanese Patent Publication No. 3 (KOKAI) No. 3, save collected data obtained from monitored devices as they are, so that the recording capacity of log files is large. However, there are problems such as the necessity of a device or the data value of the operating state of the monitored device in a steady state, which makes it difficult to determine the abnormal state.

The present invention has been made in view of such a technical background, and an object of the present invention is to record necessary operation data in a data file for recording operation data of a computer and to record the data file. An object of the present invention is to provide a computer-operated data recording system capable of reducing the capacity.

[0010]

In order to achieve the above object, a computer operation data recording system according to the present invention comprises: an operation data detection unit for detecting operation data of a computer per unit time; A memory for temporarily storing the operation data obtained by the operation type, and monitoring the progress of a plurality of types of operation data selected from the operation data detected at every first time longer than the unit time, and An operation data monitoring unit that determines whether the operation data is normal or abnormal, a control unit that comprehensively controls each unit, and a data file that records operation data are provided. When it is determined that any type of operation data is abnormal, the entire operation data is read from the memory and recorded in a data file, and the operation data monitoring unit When it is determined that the normal operation data,
Means are provided for reading out all the operation data from the memory, obtaining an average value of the operation data for each type, and recording the obtained average operation data in a data file.

According to such means, operation data is collected from the computer for each unit time, temporarily stored in a memory, and a plurality of types of operation data are selected from the operation data for sampling and selected. The data value of the sampled data is constantly monitored, and if no data abnormality is found within a certain period of time during the monitoring, the operation data stored in the memory is read out, the average value is obtained for each type, and the obtained average operation data is obtained. Is recorded in the data file,
On the other hand, when a data abnormality is found within a certain period of time during monitoring, the operation data stored in the memory is read out and recorded in the data file, so that the recording capacity of the data file is small. In addition, since the data value of the operation data for each type of normal operation can be recorded, and all the operation data of the abnormal operation can be recorded in a data file, it is possible to analyze the operating state of the computer abnormally in detail. Can be.

In the above means, it is preferable that the control section sequentially reads out and discards the operation data recorded in the data file when a second time longer than the first time has elapsed.

[0013] By adopting such means, it is possible to further reduce the recording capacity of the data file while recording the necessary operation data in the data file.

[0014]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows one embodiment of a computer-operated data recording system according to the present invention, and is a block diagram showing a main configuration of the computer-operated data recording system.

In FIG. 1, reference numeral 1 denotes an operation data detecting unit;
Is a memory, 3 is a control unit (CPU), 4 is a data file, 5 is an operation data monitoring unit, 6 is a clock unit, 7 is an operation data average value calculation unit, 8 is a monitored computer, and 9 is a computer operation data recording system. It is.

The operation data detecting unit 1 includes a memory 2
Connected to the control unit 3 and to the monitored computer 8. The memory 2 is connected to the control unit 3, and the data file 4 is connected to the control unit 3. The control unit 3 is connected to the operation data monitoring unit 5, the timer unit 6, and the operation data average value calculation unit 7, respectively.

In this case, the operation data detection section 1 acquires the operation data detected by the monitored computer 8 every one second (unit time). In this case, the types of operation data acquired from the monitored computer 8 include load data of the control unit (CPU), data representing the number of times of disk access, data representing the amount of memory used, data representing a process being executed,
The data includes execution time data of a control unit used for the process, data indicating a memory capacity managed by an operating system (OS), data indicating the number of calls of the operating system, execution time data of the control unit in the operating system, and the like.

The memory 2 temporarily stores the operation data acquired by the operation data detector 1 for each type. Control unit 3
Causes each unit in the computer operation data recording system 9 to execute an operation according to a predetermined operation program. The data file 4 records average operation data and all operation data as described later. Operation data monitoring unit 5
Monitors the progress of a plurality of types of operation data (sampling data) selected from the operation data acquired every 20 minutes (first time), and based on the control of the control unit 3, the sampling data is normal. Alternatively, it is determined whether the abnormality is abnormal. The timer 6 is composed of a plurality of types of timers, and controls the operation state of the controller 3 temporally according to the timers. The operation data average value calculation unit 7 obtains the average value of the operation data for each type under the control of the control unit 3.

Next, FIG. 2 is a flowchart showing the main operation of the computer operation data recording system 9 shown in FIG. The operation of the computer operating data recording system 9 will be described with reference to the flowchart shown in FIG.

First, in step S1, the control unit 3
Resets the timer of the timer 6.

Next, in step S2, the control unit 3
Obtains each type of operation data detected by the monitored computer 8 every second through the operation data detection unit 1.

Next, in step S3, the control unit 3
Transfers the operation data acquired by the operation data detection unit 1 to the memory 2 and stores the operation data in the memory 2 for each type.

In the following step S4, the control unit 3
Determines whether 20 seconds have elapsed since the timer of the timer 6 was reset. When it is determined that 20 seconds have already passed (Y), the process proceeds to the next step S5,
On the other hand, when it is determined that 20 seconds have not yet elapsed (N), the process returns to the previous step S2, and the operations after step S2 are executed again.

Subsequently, in step S5, the control unit 3
Reads out the selected sampling data from the operation data stored in the memory 2 and reads the operation data monitoring unit 5
Of normal or abnormal sampling data read through the CPU. In this case, the judgment of normal or abnormal
It is performed as follows. One is that, for any type of sampled data, one of the data values of the sampled data for the current 20 seconds has a data value that is at least 50% different from the average value of the previous corresponding sampled data. When there is at least one, the abnormality is determined.In the other, the data value of a certain type of sampling data is more than a certain value compared to the data value of the corresponding sampling data at the same time of the previous day. An abnormality is determined when at least one different data value is present. In addition, the abnormality may be determined using a value according to each of the above examples. is there.

Next, in step S6, the control unit 3
Determines whether the data value of the sampling data is normal. When it is determined that the data value of the sampling data is normal (Y), the process proceeds to the next step S7. On the other hand, when it is determined that the data value of the sampling data includes an abnormal data value (N). Shifts to another step S9.

Next, in step S7, the control unit 3
Reads operation data stored in the memory 2,
An average value is obtained for each type of operation data read through the operation data average value calculation unit 7 for each type.

Subsequently, in step S8, the control unit 3
Transfers the average operation data obtained in step S7 to the data file 4 and records it in the data file 4.

In step S9, the control unit 3
Reads operation data stored in the memory 2,
The read operation data is transferred to the data file 4 and recorded in the data file 4.

Subsequently, in step S10, the control unit 3 determines whether 30 minutes have elapsed since the timer of the timer unit 6 was reset. When it is determined that 30 minutes have already passed (Y), the process proceeds to the next step S11. On the other hand, when it is determined that 30 minutes have not yet passed (N), this step S10 is repeatedly executed.

Next, in step S11, the control unit 3
Reads the earliest operation data and average operation data recorded in the data file 4, and discards the read operation data and average operation data.

Next, in step S12, the control unit 3 determines whether or not acquisition of operation data in the operation data detection unit 1 has been completed. When it is determined that the acquisition of the operation data has been completed (Y), this series of operations is terminated. On the other hand, when it is determined that the acquisition of the operation data has not been completed yet (N), the process proceeds to the previous step S2. The procedure returns to the step S2 and the subsequent steps.

In this case, a series of operations performed by the control unit 3 are performed in accordance with a control program for operating the control unit 3.
The control program may be stored in a ROM (not shown) connected thereto, or a storage medium containing the control program, such as a CD-ROM, may be stored in a computer-operated data recording system. , C
The control unit 3 is controlled by a control program obtained from the D-ROM.
May be operated.

As described above, according to this embodiment, the recording capacity of the data file 4 can be reduced, and the data value of the normal operation data for each type can be recorded in the data file 4. In addition, since all the operation data at the time of abnormality can be recorded, the operation state at the time of computer abnormality can be analyzed in detail.

According to this embodiment, the operation data recorded in the data file is stored in the second file longer than the first time.
Are sequentially read out and discarded when the time elapses, so that the recording capacity of the data file 4 can be further reduced while recording necessary operation data in the data file 4.

In the above embodiment, an example has been described in which the operation data is acquired by the operation data detection unit 1 every second (unit time). However, the unit time according to the present invention is one second. Is not limited to
Other values, for example, 1.5 seconds or 0.5 seconds may be used.

Further, in the above-described embodiment, an example has been described in which the normal or abnormal determination of the sampling data executed by the operation data monitoring unit 5 is performed every 20 seconds (determination time). The determination time according to the present invention is not limited to the case of 20 seconds, but may be another time as long as it is within the range of 15 seconds to 30 seconds.

Further, in the above embodiment, the earliest operation data and average operation data recorded in the data file 4 executed by the control section 3 are discarded every 30 minutes (discard time). However, the discarding time according to the present invention is not limited to 30 minutes, but may be any other time within a range of 30 minutes to 60 minutes.

[0039]

As described above, according to the present invention, operating data is collected from a computer for each unit time, temporarily stored in a memory, and a plurality of types of operating data are sampled from the operating data. Select and constantly monitor the data value of the selected sampling data, and if no data abnormality is found within a certain period of time during the monitoring, read the operation data stored in the memory and calculate the average value for each type, The obtained average operation data is recorded in a data file. On the other hand, when a data abnormality is found within a certain period of monitoring, the operation data stored in the memory is read out and recorded in the data file. Therefore, the recording capacity of the data file is small, and it is possible to record the data value of the operation data for each type under normal conditions. A, it is possible to record all the operation data of the abnormal data file, there is an effect that it is possible to dissect the operating state when the computer abnormal.

Further, according to the present invention, the operating data recorded in the data file is sequentially read out and discarded when the second time longer than the first time has elapsed. This has the effect that the recording capacity of the data file can be further reduced while recording data.

[Brief description of the drawings]

FIG. 1 is a block diagram showing one embodiment of a computer operation data recording system according to the present invention, showing a main configuration of the operation data recording system.

FIG. 2 is a flowchart showing a main operation process in the computer operation data recording system shown in FIG.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 operation data detection unit 2 memory 3 control unit (CPU) 4 data file 5 operation data monitoring unit 6 clock unit 7 operation data average value calculation unit 8 monitored computer 9 computer operation data recording system

Claims (3)

[Claims] 1. An operation data detection unit for detecting operation data of a computer for each unit time, a memory for temporarily storing operation data detected by the operation data detection unit for each operation type, and a memory longer than the unit time. An operation data monitoring unit that monitors the progress of a plurality of types of operation data selected from the detected operation data at intervals of one hour, and determines whether the operation data is normal or abnormal; And a data file for recording operation data, the control unit, when the operation data monitoring unit determines an abnormality of any one of the plurality of types of operation data, the operation data Are read from the memory and recorded in the data file, and when the operation data monitoring unit determines that the plurality of types of operation data are normal, the operation data Computer-operated data recording system, wherein after reading all of the data from the memory, an average value of the operation data is obtained for each type, and the obtained average operation data is recorded in the data file. 2. The control unit according to claim 1, wherein the control unit sequentially reads out and discards the operation data recorded in the data file when a second time longer than the first time has elapsed. Computer operation data recording system. 3. A recording medium on which an execution program of the computer operation data recording system according to claim 1 is recorded, wherein the operation data of the computer is detected for each unit time, and the operation data is operated by type. Storage operation for temporarily storing by type, first longer than the unit time
Monitoring the progress of a plurality of types of operation data selected from among the operation data detected for each time, determining whether the operation data is normal or abnormal, any one of the plurality of types When determining the abnormality of the operation data, read and record all of the temporarily stored operation data,
When the plurality of types of operation data are determined to be normal, all of the temporarily stored operation data is read out from the memory, and the average operation data obtained by calculating the average value of the operation data for each type is recorded. A discarding operation for sequentially reading and discarding the recorded operation data when a second time longer than the first time elapses. A recording medium on which an execution program is recorded.