JP2008015596A - Management server and repair program transmission method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To always stably operate an apparatus by predicting a fault with higher accuracy using data mining technology to prevent a possible fault. <P>SOLUTION: This management server, which is connected to communicate through a network, includes: a log information receiving means for receiving log information recorded in time series by each event in association with the operation of a computer apparatus through a network; a database cumulatively recording the read log information in association with the computer apparatus; a fault prediction means for analyzing fault tendency based on the log information recorded on a database and predicting a fault probably caused in future from the analysis result; and a repair program transmission means for transmitting a repair program for avoiding a fault prepared in association with the fault through the network to the computer apparatus when a fault is predicted in using the computer apparatus. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a management server for stable operation of a computer apparatus or the like, and more particularly to a management server that transmits a failure prediction repair program using data mining technology.

  Conventionally, many computer devices for information processing, electronic commerce, and the like have been introduced in companies and schools. A plurality of computer devices are connected by a network cable to form a network, and a system suitable for information sharing and the Internet (Intranet) is configured.

  However, since the computer device is composed of hardware and software, the failure of the hardware, the failure of the software, and the difference in specifications between the hardware and the software, or the Internet, etc. Various types of system failures have always occurred, such as failures caused by attacks from external networks that constitute the network.

  Therefore, it is known to collect and investigate log information stored in each computer device, access history from external networks, etc., as a follow-up survey of fraudulent acts related to network security ( Patent Document 1).

In addition, as a method of recovering from a system failure of a computer device, error information and alarms that occur when the operating state of the computer device becomes unstable are detected and analyzed by software developers to present the status of the failure. And methods for recovery and assistance are disclosed. (See Patent Document 2).
JP 2002-330177 A Japanese Patent Laid-Open No. 2003-085003

  However, in the invention described in Patent Document 1, in the computer device, only security management information is extracted from log information for unauthorized intrusion, and even if it is detected as fault information from log information such as error information or alarm, Since the computer apparatus recognizes that a failure in security management has occurred, there is a problem that a delay always occurs in predicting the occurrence of the failure.

  Further, in the invention described in Patent Document 2, failure status information such as error information and alarms is statistically analyzed, and a recovery method and recovery assistance after the failure has occurred, and details of the failure and recovery information are presented. It has become.

  Therefore, in the invention of Patent Document 2, since the failure status information is received after the failure of the computer apparatus is detected and the recovery method is acquired, time is required from the occurrence of the failure to the recovery operation. There was a problem that there was a possibility that the system would go down due to a delay in countermeasures against the occurrence of a failure.

  The present invention has been made in view of the above problems, and in order to solve such a problem, the occurrence of a failure with higher accuracy by utilizing data mining technology that acquires useful knowledge from a large amount of log information. It is an object of the present invention to provide a management server and a repair program transmission method capable of avoiding a failure that may occur before a failure occurs and performing a stable operation of the computer device by performing prediction.

  In the management server communicatively connected to a computer device via a network, the management server according to the present invention stores log information recorded in time series for each event related to the operation of the computer device. Log information fetching means fetched via the database, a database for cumulatively recording the fetched log information in association with the computer device, and a failure tendency of the computer device based on the log information recorded in the database A failure prediction means for predicting a failure that may occur in the future from the analysis result, and when the failure is predicted when the computer device is used, a failure avoidance prepared in advance in association with the failure A repair program for transmitting a repair program to the computer device via the network And a sending unit.

  In the management server according to the present invention, the database includes a mining database that cumulatively records past events of the computer device based on the log information, and the failure prediction means includes the mining database. The failure tendency analysis and the failure prediction may be performed.

  Further, in the management server according to the present invention, the failure prediction means analyzes, as the failure tendency, at least a correlation pattern related to the content of the log information and the order of occurrence of events using the mining database. The failure prediction may be performed based on the correlation pattern.

  The management server according to the present invention may be configured such that the failure prediction means updates the mining database according to the log information of the computer device recorded after execution of the transmitted repair program.

  Further, in the management server according to the present invention, the failure prediction means analyzes the operation of the computer device from the log information of the computer device recorded after execution of the transmitted repair program, and the failure is determined based on the analysis result. If the failure is not avoided, the failure tendency analysis and the failure prediction may be performed again using the mining database.

  A repair program transmission method according to the present invention is a repair program transmission method in a management server that is communicably connected to a computer device via a network, and is recorded in time series for each event related to the operation of the computer device. The acquired log information is fetched via the network, the fetched log information is cumulatively recorded in a database in association with the computer apparatus, and the computer apparatus is based on the log information recorded in the database. A failure prediction step of analyzing a failure tendency of the computer and predicting a failure that may occur in the future from the analysis result, and when the failure is predicted when the computer device is used, a failure prepared in advance in association with the failure An avoidance repair program is transmitted to the computer via the network. And having a repair program transmitting step of transmitting the location.

  Further, in the repair program transmission method according to the present invention, the database includes a mining database that cumulatively records past events of the computer device based on the log information, and the failure prediction step includes the mining The failure tendency analysis and the failure prediction may be performed using a database.

  Further, in the repair program transmission method according to the present invention, the failure prediction step analyzes, as the failure tendency, at least a correlation pattern regarding the content of the log information and the occurrence order of events using the mining database, The failure prediction may be performed based on the analyzed correlation pattern.

  In the repair program transmission method according to the present invention, the failure prediction step may update the mining database in accordance with the log information of the computer device recorded after execution of the transmitted repair program. good.

  Further, in the repair program transmission method according to the present invention, the failure prediction step analyzes the operation of the computer device from the log information of the computer device recorded after execution of the transmitted repair program, and based on the analysis result It is determined whether or not the failure has been avoided. If the failure has not been avoided, the failure trend analysis and the failure prediction may be performed again using the mining database.

  By realizing the repair program transmission method using the mining technology of the present invention, log information generated from some event in the computer device used in normal business is managed, and from the content of the log information and the order of occurrence of the event Necessary for predicting failures that may occur in the future during normal business operations and avoiding the predicted failure content by analyzing the tendency of failures to occur using mining technology It is possible to provide a service that achieves stable operation of the computer device by sending and executing a correct repair program.

  According to the present invention, the management server avoids a failure in the computer device by analyzing the correlation pattern using the data mining technology and predicting the failure in the contents of the log information of the computer device and the occurrence order of the event. And stable operation.

  The embodiment of the present invention relates to the prediction of failure occurrence of computer devices, electronic devices, etc., and transmits repair programs using data mining technology for the purpose of stable operation of computer devices used in normal business In the method, means for fetching log information generated by some event in the computer device into a log information management server via a network (hereinafter referred to as network) such as the Internet or an intranet (corresponding to the log information fetching means of the present invention); A data mining technique for processing for performing log prediction (corresponding to the fault prediction unit of the present invention) in the log information analysis unit by means for capturing the log information captured by the log information management server into the log information analysis unit via the network To avoid failures from the specified failure information Log information for analyzing the operation of the computer apparatus after execution of the repair program and means for transmitting the repair program to the computer apparatus via the network and executing it (corresponding to the repair program transmitting means of the present invention) Means for receiving in the analysis unit (corresponding to the log information fetching means of the present invention) and means for automatically updating the data mining database in order to improve the analysis accuracy of the tendency of failure occurrence This is a restoration program transmission method using data mining technology characterized by the above.

Next, the best mode for carrying out the invention will be described in detail with reference to the drawings.
(First embodiment)
FIG. 1 is a schematic diagram showing a configuration of a repair program transmission system by a management server having a repair program transmission method as an embodiment according to the present invention.

  The correction program transmission system shown in FIG. 1 includes a computer device 10, a log information management server 20, a log information analysis unit 30, and a repair program management server 40. The computer device 10 and the log information management server. 20, the log information analysis unit 30 and the repair program management server 40 are connected via a network 100 (hereinafter, network 100) such as the Internet or an intranet.

  Here, the log information generated by some event in the computer apparatus 10 used in normal business corresponds to a fixed disk (Hard Disk Drive (hereinafter referred to as HDD)) in the computer apparatus 10. .) To save.

  The log information management server 20 searches for log information stored in a fixed disk (such as an HDD) in the computer apparatus 10 and automatically captures the log information via the network. The acquired log information is stored in a fixed disk (HDD or the like) in the log information management server 30, and is associated with the information of the computer device 10 and managed on the database.

  The log information analysis unit 30 automatically takes in the computer device 10 information and log information stored in a fixed disk (HDD or the like) of the log information management server 20 via the network, and uses data mining technology. Analyze the tendency of failures.

  If there is a possibility that a failure will occur after the log information analysis unit 30 analyzes the tendency of the failure, the log information analysis unit 30 sends the failure prediction contents and the information of the repair program to the repair program management server 40 over the network. The repair program management server 40 transmits the failure prediction contents and the repair program for avoiding the failure to the computer apparatus 10 via the network.

  As described above, the computer apparatus 10 executes the repair program received from the repair program management server via the network.

  Then, after executing the repair program, the log information analysis 30 takes in the log information of the computer device 10 to determine whether or not a failure has occurred in order to analyze the operation of the computer device 10. In this case, the failure prediction information and the transmitted information relating to the repair program are received from the computer apparatus 10 via the network, and the failure prediction information and the transmitted information relating to the repair program are accumulated.

In this way, the log information analysis unit 30 can update the mining database that improves the analysis accuracy of the failure occurrence tendency by accumulating the information that can avoid the occurrence of the failure. It has become.
(First embodiment)
FIG. 1 is a schematic diagram showing the configuration of a repair program transmission system as a first embodiment according to the present invention.

  The correction program transmission system shown in FIG. 1 includes a computer device 10, a log information management server 20, a log information analysis unit 30, and a repair program management server 40. The computer device 10 and the log information management server. 20, the log information analysis unit 30 and the repair program management server 40 are connected via a network 100 (hereinafter, network 100) such as the Internet or an intranet.

  The computer apparatus 10 is a computer that is used for processing normal business delivered by a user. The configuration of the computer apparatus 10 is shown in FIG.

  As shown in FIG. 2, the computer device 10 includes an information transmission / reception unit 101, a control unit 102, and a log information recording unit 103.

  The computer device 10 stores log information generated by some event in a fixed disk (HDD or the like) in the computer device 10 and avoids contents and failure related to failure prediction analyzed by the log information analysis unit 30. The repair program is received from the correction program management server 40 and executed, and after the repair program is executed, the log information is transmitted to the log information analysis unit 30 in order to analyze the operation of the computer device 10.

  The information transmission / reception unit 101 is connected to the network 100 and transmits computer apparatus information and log information recorded by the log information recording unit 103 to the log information management server 20 and from the repair program management server 40. This is the part that receives the repair program.

  The control unit 102 is a part that controls the computer apparatus 10 and is a part that is executed when a repair program is received.

  The log information recording unit 103 is a part that stores log information generated by some event in the computer device 10 on a fixed disk (HDD or the like). An example of this log information is shown in FIG.

  In the log information shown in FIG. 3, the horizontal axis describes the type, date, time, source, classification, event, user, computer, and the vertical axis describes the classification corresponding to the type. Types such as information, error, and warning are described corresponding to the date and time.

  The log information management server 20 is an information processing terminal that is connected to the network 100 and includes a fixed disk (such as an HDD) for managing log information of the computer device 10.

  As illustrated in FIG. 4, the log information management server 20 includes an information transmission / reception unit 201, a control unit 202, a computer device information database 203, and a log information database 204.

  The log information management server 20 searches for log information stored on a fixed disk (HDD or the like) in the computer device 10 and automatically receives it via the network 100 to manage the log information. (Such as HDD). The acquired log information is associated with the information of the computer device 10 and has functions managed by the computer device information database 203 and the log information database 204, respectively.

  The information transmission / reception unit 201 is connected to the network 100, receives computer device information and log information related to the computer device 10, and transmits computer device information and log information related to the computer device 10 to the log information analysis unit 30. .

  The control unit 202 controls the log information management server 20 to manage and control the computer device information and log information of the computer device 10 in the computer device information database 203 and the log information database 204.

  The computer device information database 203 is a database that manages information related to the computer device 10. An example of management in the computer device information database 203 is shown in FIG.

  The example of the computer device information database 203 shown in FIG. 5 is an example of a database constructed by associating the device model number and device name of the computer device 10, and describes the device model number, device name, and remarks.

  The log information database 204 (FIG. 4) is a database that takes in log information stored on a fixed disk (HDD) in the computer apparatus 10 via the network 100 and manages the computer apparatus 10 and its log information. An example of management in this log information database 204 is shown in FIG.

  The log information database 204 shown in FIG. 6 is an example of a database constructed by associating log information with the device model number and device name of the computer device 10, and includes the device model number, device name, type, date, time, source, and event. Etc. are described according to the type of log.

  In addition to being connected to the network 100, the log information analysis unit 30 is an information processing terminal provided with a fixed disk (HDD) for managing the mining program 303 and specific information of a repair program for avoiding the occurrence of a failure. is there.

  As illustrated in FIG. 7, the log information analysis unit 30 includes an information transmission / reception unit 301, a log information analysis unit control unit 302, a mining program 303, and a mining failure prediction database 304.

  The log information analysis unit 30 receives the information of the computer device 10 managed by the fixed disk (HDD) in the log information management server 20 and the log information, and analyzes the tendency of occurrence of a failure, and the analysis result The function of transmitting the failure prediction contents and the information about the repair program for avoiding the occurrence of the failure to the repair program management server 40 via the network 100, and after executing the failure avoidance repair program on the computer device 10, A function of receiving information on occurrence via the network 100, and a function of updating a data mining database in order to improve the analysis accuracy of the tendency of occurrence of a failure from information on a repair program executed by the computer apparatus 10. I have.

  The information transmission / reception unit 301 is connected to the network 100, refers to information on the computer device 10 managed by the log information management server 20, refers to log information, and transmits information related to a repair program for avoiding a failure to the computer device 10. This is a part for receiving log information relating to the operation of the computer apparatus 10 after the execution of the repair program.

  The log information analysis unit control unit 302 is a part that controls the log information analysis unit 30 and manages data update that improves the analysis accuracy of the failure occurrence tendency with respect to the failure prediction database 304 for mining.

  The mining program 303 is an area in which a mining application program is stored. The mining application program is a program that analyzes the correlation and regularity between each data from the failure prediction information and the repair program that avoids the failure, and analyzes the tendency of the failure to occur.

  The mining failure prediction database 304 is a database extracted and processed for data mining from the log information of the computer device 10 managed by the log information management server 20. An example of information managed in the mining failure prediction database 304 is shown in FIG.

  The information shown in FIG. 8 is related to the information of the computer device 10 and the cumulative log information of past events by using the device model number or device name of the computer device 10 as a key, It is an example of the database which built.

  The repair program management server 40 is an information processing terminal that is connected to the network 100 and includes a fixed disk (such as an HDD) for managing the repair program of the computer device 10.

  As shown in FIG. 9, the repair program management server 40 includes an information transmission / reception unit 401, a control unit 402, and a repair program information database 403.

  The repair program management server 40 has a function of receiving the specific information of the repair program related to the avoidance of the failure by the log information analysis unit 30 and a function of transmitting the corresponding repair program to the computer apparatus 10.

  The information transmission / reception unit 401 is connected to the network 100, and is a part that receives the specific information of the correction program related to failure avoidance from the log information analysis unit 30 and transmits the corresponding repair program to the computer apparatus 10.

  The control unit 402 controls the correction program management server 40 to manage and control computer device information and log information of the computer device 10 in the repair program information database 403.

  The repair program information database 403 is a database that manages a repair program related to the computer apparatus 10. An example of a repair application managed in the repair program information database 403 is shown in FIG.

  The repair application shown in FIG. 10 (hereinafter also referred to as a repair program) is an example showing the correspondence of the database constructed by associating the device model number and device name of the computer device 10.

  Next, with reference to the flowchart of FIG. 11, an operation procedure related to the restoration program transmission system using the data mining technology of the present invention will be described in detail.

  In the flowchart of FIG. 11, some event occurs in the computer apparatus 10 of FIG. 1 (step A1), and log information is generated (step A2).

  The generated log information is stored in a fixed disk (such as an HDD) in the computer apparatus 10. FIG. 3 described above is an example of log information stored in the computer apparatus 10 (step A3).

  The log information management server 20 commands the transmission of information relating to the occurrence time (date and time) among all the log information stored in the computer device 10 at regular intervals via the network 100 (steps). A4).

  The computer apparatus 10 transmits information regarding the generation time (date and time) of all log information to the log information management server 20 via the network 100 (step A5).

  When the log information management server 20 receives the log information from the computer apparatus 10, the log information management server 20 compares the received log information with the occurrence time (date and time) of the log information managed in the log information database 204. As a specific comparison method, the generation time (date and time) of the latest log information transmitted from the computer device 10 and the time (date and time) of the latest log information managed in the log information database 204 Make a comparison.

  In this case, the log information management server 20 determines that the generation time (date and time) of the latest log information transmitted from the computer apparatus 10 is earlier than the date and time of the latest log information managed by the log information database 204. In this case, it is recognized that the log information stored in the computer apparatus 10 is not newer than the log information managed by the log information management server 20.

  That is, in this case, the log information management server 20 manages the latest log information for the log information of the computer apparatus 10.

  On the other hand, if the time (date and time) of the latest log information transmitted from the computer apparatus 10 is later than the date and time of the latest log information managed in the log information database 204, the computer The log information stored in the apparatus 10 is recognized as log information that is newer than the log information managed by the log information management server 20.

  In this case, the log information management server 20 does not manage the latest log information for the log information of the computer apparatus 10.

  Here, when the log information is not new (that is, when the log information management server 20 manages the latest log information), the log information management server 20 again uses the computer device 10 via the network 100 after a predetermined time. An instruction is given to transmit the stored log information, and information relating to the occurrence time (date and time) of the log information of the computer apparatus 10 is compared again (return to step A4).

  On the other hand, when the log information is newer than the log information managed by the log information management server 20 (that is, when the log information management server 20 does not manage the latest log information), the new log information is as follows. Move to operation (step A7) (step A6).

  The log information management server 20 in step A7 compares the log information stored in the computer apparatus 10 with the occurrence time (date and time) of the latest log information managed by the log information management server 204. Based on (Step A6), update processing is performed so as to obtain the latest log information.

  Specifically, the log information management server 20 acquires the latest log information in which the generation time (date and time) of the log information managed by the log information management server 20 is stored in the computer apparatus 10. Thus, step A7 to step A11 are repeated and updated until the latest log information generation time (date and time) is reached.

  The log information management server 20 uses the log information recognized as new log information stored in the computer apparatus 10 via the network 100 in order to update the log information database 204 as log information of the log information management server 20. Command to send to database 204. (Step A7).

  Next, the computer apparatus 10 transmits all the log information recognized as new log information via the network 100 to the log information management server 20 (step A8).

  In this way, the log information management server 20 can receive all of the log information recognized as new log information (step A9) and store it in the log information database 204.

  The storage format (table) includes a device model number and device name related to the computer device 10, a type (information, error, warning, etc.) related to log information stored in the computer device 10, an occurrence time (date or time), Save source or event as field name in order of occurrence time (date or time). FIG. 6 described above is an example of data stored in the log information database 204 (step A10).

  Here, the log information management server 20 compares the latest log information stored in the computer device 10 with the occurrence time (date and time) of the latest log information managed by the log information management server 204. The log information (date and time) managed by the log information management server 20 becomes the log information stored in the latest computer device 10, and an update is determined (step A11).

  At this time, if the log information of the log information management server 20 is updated to the latest log information stored in the computer apparatus 10, the process proceeds to the next step A13, and updated to the latest log information. If not, the process returns to step A7, and the latest log information stored in the computer apparatus 10 is always acquired.

  The log information analysis unit 30 issues a command to transmit the user information and log information in the log information database 204 to the log information analysis unit 30 at regular intervals via the network 100 (step A12).

  The log information management server 20 receives the command of the log information analysis unit 30 and transmits the information of the computer apparatus 10 and the log information to the log information analysis unit 30 via the network 100 (step A13).

  The log information analysis unit 30 associates the information of the computer apparatus 10 received from the log information management server 20 with the log information, and monitors the latest log information while performing the occurrence prediction of the failure. Create a database for failure analysis related to sources, events, and data using the device model number or device name of information as a key.

  As the storage format (table), the device model number and device name related to the computer device 10 and the source, event and data related to log information are stored as field names. FIG. 12 is an example of the failure analysis database (step A14).

  In FIG. 12, the device model number is AAAA-AAA, the device name is A workstation, and the source, event, data, and the like are described. In particular, the event has a code associated with the source, and the data item is generated from the monitoring target (“hardware”, “application”, “OS”, “network”, etc.) and the latest log information. Data generated by predicting the occurrence of a failure from the latest log information.

  The data generated by performing the failure occurrence prediction from the latest log information is data generated by the failure occurrence prediction predicted from the failure prediction information database 304 for mining.

  In this manner, a failure analysis database related to data such as the source and event of the A workstation is created, the latest log information of the computer device 10 is monitored, and various data are stored.

  Note that FIG. 12 only partially illustrates the monitoring target, the data generated from the latest log information, and the data on which the failure occurrence prediction is performed from the latest log information, and is limited to the description of FIG. Is not to be done.

  Next, in the log information analysis unit 30, the mining program 303 is operated, the created failure analysis database is compared with the contents of the log information in the mining failure prediction database 304, and the correlation regarding the occurrence order of events Analyze the pattern.

  Data mining technology is a technology that analyzes a large amount of accumulated data, finds a correlation pattern between items from the data, and outputs necessary information.

  As a method of using the data mining technology related to the present invention, in the computer device 10, in order to predict a failure that may occur in the future, the data is stored cumulatively from past data from the failure prediction database 304 for mining. Using data mining technology regarding the occurrence order of data and events in log information, analyze the correlation pattern regarding the tendency of failure occurrence, the contents of log information and the occurrence order of events, and generate the correlation pattern in the future This is used as a tool for predicting a failure (step A15).

  After the analysis is completed, the operation tendency pattern between the contents of the latest log information generated in the computer apparatus 10 and the event generation order is compared with the correlation pattern in which the failure occurs analyzed by the data mining technique. I do.

  Here, if the operation tendency pattern between the latest log information content of the computer device 10 and the occurrence order of the event does not match the analyzed correlation pattern in which the failure occurs, the process ends. On the other hand, when the operation tendency pattern between the contents of the latest log information of the computer device 10 and the occurrence order of the event matches the analyzed correlation pattern in which the failure occurs, the next operation (step A17). (Step A16).

  Specifically, for example, in the failure prediction database for mining in FIG. 8, when an event “3019” is acquired, and then “8021” is acquired from “3019”, the “redirector of“ 3019 ”is connected. "Warning type cannot be determined" is changed to "8021" warning "Cannot obtain server list from browser master".

  In this case, in the failure prediction database 304 for mining, an error is similarly generated from an operation tendency pattern in which an error “driver packet received from the I / O subsystem is invalid” of “6004” after “8021” is generated. Correlation patterns that have been analyzed as likely to be generated are generated.

  On the other hand, in the failure analysis database of FIG. 12, when the event is acquired from “3019” to “8021”, “6004” indicating an error “The driver packet received from the I / O subsystem is invalid” next. Log information is recorded.

  Furthermore, in the latest log information of the computer apparatus 10 shown in FIG. 12, when a change from “3019” to “8021” of the event is acquired, the log information is monitored while the occurrence of the failure is predicted. Then, it is analyzed that it is an action tendency pattern that may generate an error “6004”. Then, this behavior tendency pattern is compared with a correlation pattern in which a failure occurs based on the failure prediction database for mining, and it is determined that there is a possibility that a failure will occur if it is determined to match the correlation pattern. It is to be judged.

  The log information analysis unit 30 transmits failure prediction information to the repair program management server 40 in the case where it matches the correlation pattern in which a failure occurs (step A17).

  This failure prediction information corresponds to, for example, predicted information that the failure “driver packet received from the I / O subsystem is invalid” in the event “6004” described above may occur.

  The repair program management server 40 compares the received failure prediction information with the repair program in the repair program information database 403, and searches for a repair program corresponding to the failure prediction information (step A18).

  Here, for example, a program that avoids the failure in response to the above-described failure occurrence prediction is an Opqrst.com that repairs the network relationship shown in FIG. In the case of exe, this repair program Opqrstu. exe is searched.

  Next, the repair program management server 40 transmits the repair program corresponding to the failure prediction information (Opqrstu.exe in the above example) to the computer apparatus 10 via the network 100 (step A19).

  Then, the computer device 10 executes the repair program (Opqrstu.exe in the above example) received from the repair program management server 40 via the network 100 (step A20).

  In this case, since the computer apparatus 10 generates log information in the computer apparatus 10 by executing the repair program (Opqrstu.exe in the above example) (step A21), the latest log information generated is It transmits to the log information analysis part 30 via the network 100 (step A22).

  Here, the log information analysis unit 30 again obtains the latest log information corresponding to the failure analysis database shown in FIG.

  Then, the log information analysis unit 30 analyzes the received log information and determines whether or not the occurrence of a failure has been avoided.

  Here, when the occurrence of the failure is avoided, the log information analysis unit 30 proceeds to the next operation (step A24), assuming that the occurrence of the failure has been improved.

  On the other hand, when the occurrence of the failure cannot be avoided, the log information analysis unit 30 determines that the failure has not been improved, returns to step A14, and performs the failure analysis again (step A23).

  The specific determination as to whether or not the occurrence of the failure has been improved is determined from the latest log information of the computer apparatus 10, and changes from “3019” to “8021” in the event log information shown in FIG. If an error “6004” indicating the occurrence of a failure does not occur after the error is acquired, it is determined that the occurrence of the failure can be avoided. If an error “6004” occurs, the occurrence of a failure It has been determined that it could not be avoided.

  In the above example, the log information analysis unit 30 uses the repair program Opqrstu. exe is transmitted and the latest log information of the computer apparatus 10 is analyzed.

  When the occurrence of a failure is improved, the log information analysis unit 30 stores data relating to a correlation pattern relating to the occurrence pattern of the failure and the log information in the failure prediction information database 304 for mining, and the occurrence order of events. Is updated (step A24).

  As a result, the mining data is updated to improve the analysis accuracy regarding the failure prediction.

  In contrast, the repair program Opqrstu. If the occurrence of the failure is not improved by using exe, the process returns to step A14, and steps A14 to A23 are repeated again.

  In the above example, the repair program shown in FIG. Efghijk. exe is searched and transmitted as a program for avoiding the occurrence of a failure.

  Thereafter, similarly, the repair program Efghijk. Since exe is executed in the computer apparatus 10, it is determined again whether or not the occurrence of the failure has been improved.

  As described above, in the first embodiment according to the present invention, the failure in the computer apparatus is performed by analyzing the correlation pattern using the data mining technique and predicting the failure in the content of the log information and the occurrence order of the event. Can be prevented, and the computer apparatus can be operated stably.

In addition, since the log information analysis unit 30 reflects whether or not the failure can be avoided after applying the correction program, the analysis accuracy for the failure occurrence prediction is improved by updating the mining database. be able to.
(Second Embodiment)
In the first embodiment according to FIG. 1, the log information management server 20 manages one computer device 10, but the present invention is not limited to this, and a plurality of computer devices are used. 10 may be managed, and workstations, scanner devices, and the like may be managed via the network 100.

  In this case, as illustrated in FIG. 5, the computer apparatus 10 is a computer apparatus 10 that outputs log information, and only needs to be able to communicate log information with the log information management server 20 via the network 100. .

  Furthermore, as another embodiment, when there is one computer device 10, log information managed by the log information management server 20 only needs to be associated with information of the computer device 10, so that log information management A function for updating and managing the latest log information of the server 20 may be incorporated in the log information analysis unit 30.

  In this case, according to the embodiment of the present invention, a repair program is transmitted by the computer device 10, the log information analysis unit 30 having the log information management server 20, the repair program management server 40, and the network 100 connected to each other. The system can be configured.

  As another embodiment, the repair program management server 40 may include the log information analysis unit 30, or the log information management server 20 may include the log information analysis unit 30.

  That is, the log information management server 20, the log information analysis unit 30, and the repair program management server 40 need only be configured separately from the computer device 10, and the log information management server 20, the log information analysis unit 30, The repair program management server 40 may be integrated.

  Further, in the embodiment according to the present invention, the correlation pattern is generated from the analysis result (event log information of the computer device 10 in the embodiment) regarding the data and contents of log information and the order of occurrence of events. However, the present invention is not limited to this. Each operation (event) of an application program (software) or OS (Operating System) itself, or a network from the inside to the outside or from the outside to the inside by a network. A correlation pattern may be generated from log information of events recorded when accessed.

  In the embodiment according to the present invention, the mining failure prediction information database 304 and the failure analysis database are provided. However, the present invention is not limited to this, and the mining failure prediction information database 304 It may also be used as a failure analysis database.

  In this case, cumulative recording of past events held in the mining failure prediction information database 304 is performed, and the latest log information is monitored while predicting the occurrence of the failure monitored by the failure analysis database. This can be realized by constructing a database.

It is a block diagram in the 1st Example of this invention. It is a block diagram of the computer apparatus in 1st Example of this invention. It is a data example of the log information recording part in 1st Example of this invention. It is a block diagram of the log information management server in 1st Example of this invention. It is a data example of the computer apparatus information database in 1st Example of this invention. It is a data example of the log information database in 1st Example of this invention. It is a block diagram of the log information analysis part in 1st Example of this invention. It is a data example of the failure prediction database for mining in 1st Example of this invention. It is a block diagram of the repair program management server in 1st Example of this invention. It is a data example of the repair program information database in 1st Example of this invention. It is a flowchart in the 1st example of the present invention. It is an example of data of the database for failure analysis in the 1st example of the present invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Computer apparatus 20 Log information management server 30 Log information analysis part 40 Restoration program management server 100 Network 101 Information transmission / reception part 102 Control part 103 Log information recording part 201 Information transmission / reception part 202 Control part 203 Computer apparatus information database 204 Log information database 301 Information Transmission / reception unit 302 Control unit 303 Mining program 304 Mining failure prediction database 401 Information transmission / reception unit 402 Control unit 403 Repair program information database

Claims (10)

In a management server communicably connected to a computer device via a network,
Log information capturing means for capturing, via the network, log information recorded in time series for each event related to the operation of the computer device;
A database that cumulatively records the captured log information in association with the computer device;
Based on the log information recorded in the database, analyzing the failure tendency of the computer device, failure prediction means for predicting a failure that may occur in the future from the analysis results;
A repair program transmitting unit configured to transmit a repair program for avoiding a failure prepared in advance in association with the failure to the computer device via the network when the failure is predicted when the computer device is used; A management server comprising: The database has a mining database that cumulatively records past events of the computer device based on the log information;
The management server according to claim 1, wherein the failure prediction unit performs the failure tendency analysis and the failure prediction using the mining database.   The failure predicting means analyzes, as the failure tendency, a correlation pattern regarding at least the contents of the log information and the occurrence order of events using the mining database, and based on the analyzed correlation pattern, the failure prediction means The management server according to claim 2, wherein prediction is performed.   4. The management server according to claim 2, wherein the failure prediction unit updates the mining database according to the log information of the computer device recorded after execution of the transmitted repair program. 5. .   The failure prediction means analyzes the operation of the computer device from the log information of the computer device recorded after execution of the transmitted repair program, and determines whether or not the failure has been avoided based on the analysis result. 5. When the failure is not avoided, the failure trend analysis and the failure prediction are performed again using the mining database. 6. Management server. A repair program transmission method in a management server communicably connected to a computer device via a network,
Log information recorded in chronological order for each event related to the operation of the computer device, via the network,
The captured log information is cumulatively recorded in a database in association with the computer device,
Based on the log information recorded in the database, a failure prediction step of analyzing a failure tendency of the computer device and predicting a failure that may occur in the future from the analysis result;
A repair program transmission step of transmitting a repair program for avoiding a fault prepared in advance in association with the fault to the computer apparatus via the network when the fault is predicted when the computer apparatus is used; A repair program transmission method comprising: The database has a mining database that cumulatively records past events of the computer device based on the log information;
The repair program transmission method according to claim 6, wherein the failure prediction step performs the failure trend analysis and the failure prediction using the mining database.   The failure prediction step analyzes, as the failure tendency, a correlation pattern related to at least the content of the log information and the occurrence order of the event using the mining database, and the failure prediction based on the analyzed correlation pattern 8. The repair program transmission method according to claim 7, wherein prediction is performed.   The repair program according to claim 7 or 8, wherein the failure prediction step updates the mining database according to the log information of the computer device recorded after execution of the transmitted repair program. Transmission method.   The failure prediction step analyzes the operation of the computer device from the log information of the computer device recorded after execution of the transmitted repair program, and determines whether or not the failure has been avoided based on the analysis result. 10. When the failure is not avoided, the failure tendency analysis and the failure prediction are performed again using the mining database. Repair program transmission method.

Images