JP4928848B2 - Message converter in computer system integrated management environment. - Google Patents

Description

  The present invention relates to a technique related to operation management of a computer system, and more particularly to a message management technique in a system that integrally manages messages output from various operating systems and application programs.

  In a large-scale / complex computer system, there is an integrated management tool as a means for reducing the load on the operation manager, speeding up failure response, and handling multi-vendors.

  The integrated management tool collects messages output to Windows (registered trademark) event log, UNIX (registered trademark) syslog, log files of various application programs, and displays them in a list on the console. The operation manager detects the occurrence of a failure with a patrol lamp, a buzzer, etc., checks the content of the failure with a message displayed on the console of the integrated management tool, and performs the failure response. Some recent integrated management tools include an autonomous operation function that analyzes a failure message and autonomously executes a failure response according to a predefined content. However, even if an integrated management tool with an autonomous operation function is introduced, not all events can be handled automatically, so the messages displayed on the console of the integrated management tool are not displayed. There is still a need to confirm and take action.

Note that, as known technical documents related to the present invention, there are the following Patent Documents 1 to 3. In Patent Document 1, an existing operation management tool group is unified in a site where a plurality of operation management tool groups having different operation methods are used for operation management of a computer system composed of a plurality of subsystems. A support system that functions by an interface and unifies system operation management is disclosed. In Patent Document 2, when a failure occurs, a hard log is collected, the corresponding message and the hard log are merged and stored in a transfer device file, and the message and hardware in the transfer device file are received from a personal computer at the maintenance site. A system is disclosed in which a log is taken in, processed, edited, and displayed so that a maintenance person at a maintenance base sees it and performs maintenance work such as fault isolation. Patent Document 3 discloses a computer system that performs automatic operation by extracting a character string of a console message.
Japanese Patent No. 3484718 JP-A-11-296480 JP 2003-5988 A

  In the conventional integrated management tool including the techniques of Patent Documents 1 to 3 described above, messages output from the operating system and various applications running on the monitored computer are collected, and the collected messages are almost unchanged on the console. It is displayed as a list. Due to this, when the operation manager takes a countermeasure based on the message displayed on the console of the integrated management tool, the conventional integrated management tool has the following three problems, and prompt response It is an obstacle.

  The first problem is that the format of messages output by various operating systems and applications varies, and since there is no uniformity, the message list displayed on the console of the integrated management tool is complicated and difficult to see. Also, depending on the format of the message, there is information necessary for handling the failure at the back of the message, which cannot be displayed on the console screen of the integrated management tool and cannot be confirmed unless the screen is scrolled. Due to such a problem, the load on the operation manager at the time of troubleshooting is increasing. As a solution to the problem that the list of messages displayed on the console of the integrated management tool is complicated and it is difficult to extract messages that need to be handled, the conventional integrated operation management tool has a message search function. Measures are taken such as displaying messages with high severity by changing the background color.

  The second problem is that depending on the message that is output, even if the message is written in a foreign language such as English or even in Japanese, it cannot be understood unless you have expertise in the product that output the message. Such an esoteric thing means that a considerable skill is required for the operation manager to deal with the failure.

  The third problem is that even if the same error occurs if the operating environment is different, the content of the operation manager's response will be different, but if the error is the same, the same message will be output from each application program Therefore, just looking at the message displayed on the integrated console is not immediately distinguishable. For example, if system maintenance is being performed on one of the monitoring targets, and an error that occurred during maintenance work on that monitoring target does not require troubleshooting, the operation administrator can display an error message on the integrated console. When is displayed, it is necessary to check each time whether or not it is output from a monitoring target that needs to be dealt with, and then take action.

  The present invention has been made in view of the above-mentioned problems, and it is possible to convert a message format, a sentence, and a severity on a message collected from a monitoring target based on a predefined rule. It is an object of the present invention to provide a message conversion device that can be used.

In order to achieve the above object, the invention according to claim 1 is integrated in a message monitoring means for monitoring a message generated in an electronic computer to be monitored, a message database for storing a detected message, and the message database. A message conversion device for converting a message on the message database, wherein the message format is converted for each unit that can uniquely identify the message format. A message conversion rule defining means for defining a format conversion rule that is a rule to be converted, and a message-specific conversion rule that is a rule for converting the level of message severity or message text for each individual message, and the message conversion rule definition Determined by means Message conversion rule storage means for storing the format conversion rule and the conversion rule for each message, message acquisition means for retrieving a message stored in the message database, and a format conversion rule applicable to the acquired message. A first message conversion rule search unit that searches from the storage unit and a process that converts the message acquired by the message acquisition unit into a unified format based on the searched format conversion rule. A first message conversion execution means, a second message conversion rule search means for searching the message conversion rule storage means for a message-specific conversion rule applicable to the acquired message, and the message acquisition means. To the resulting message, performs processing for converting the wording severity of height and messages of the message on the basis of the retrieved message by the conversion rule, and a second message conversion executing means, said first and second For the message registration means for storing the conversion result of the message conversion execution means in the message database and the conversion rule for each message in the message conversion rule storage means, the post-conversion severity is lowered when the maintenance start time comes It is replaced with a conversion rule for each message, and means for returning to the conversion rule for each message returned to the original post-conversion severity when the maintenance end time is reached .

The message converter according to the present invention has the following effects.
(1) Since the message format can be converted, messages that are not uniform in the format output by various operating systems and applications can be converted into a unified format and displayed on the console of the integrated management tool. it can. Therefore, the complexity of message management can be eliminated.
(2) Since the character string in the message can be replaced, the message displayed on the console of the integrated management tool can be changed to a language that is easy for the operation administrator to understand, or the message can be changed according to the system operating environment. Can be changed. In addition, by including a countermeasure instruction to be performed first in the converted message, it is possible to speed up the countermeasure.
(3) Since the severity of the message can be changed, the severity can be changed to a severity corresponding to the operating environment from which the message is generated.

  Hereinafter, an embodiment of a message conversion apparatus to which the present invention is applied will be described.

  FIG. 1 is a system configuration diagram showing an example of an embodiment of the present invention. The message conversion device includes a message conversion rule definition unit (101), a message conversion rule DB (102), and a message conversion processing unit (103). The display unit (104), message DB (105), message monitoring unit (106), monitoring target (107a, 107b,..., 107n) and monitoring content definition file (108) are conventionally known integrated management tools. Is a component of

  The message conversion rule definition unit (101) is a part for defining a rule for converting the message format, wording, and severity using a GUI (Graphical User Interface). The definition content is stored in the message conversion rule DB (102). Stored.

  The monitoring target (107a, 107b,..., 107n) corresponds to a log file or SNMP trap output by the OS or various applications. A message output as a log file or an SNMP trap is detected by the message monitoring unit (106) in accordance with the definition of the monitoring content definition file (108) and stored in the message DB (105). A message monitoring unit (106), monitoring targets (107a, 107b,..., 107n), and a monitoring content definition file (108) are arranged on each monitoring target computer. The message DB (105) is arranged on an integrated management electronic computer. In the message DB (105), messages detected by the message monitoring unit (106) arranged on the monitored computer are accumulated.

  The processing procedure of the message conversion processing unit (103) will be described in detail later, but the outline of the processing is as follows. First, messages collected in the message DB (105) are extracted by the message acquisition unit (109), and then message conversion rules corresponding to the extracted messages are extracted by the message conversion rule search unit (110). ) If there is a corresponding message conversion rule, the message conversion execution unit (111) performs message conversion processing, and the message registration unit (112) registers the converted message in the message DB (105). When the message conversion rule is searched by the message conversion rule search unit (110) and there is no corresponding message conversion rule, the message is stored in the message conversion rule DB (102) as a message conversion rule definition candidate message. sign up. In the message conversion rule definition unit (101), by referring to a message registered as a message conversion rule definition candidate, a message whose conversion rule is undefined can be confirmed, and the definition of the message conversion rule can be added. The display unit (104) displays a list of messages accumulated in the message DB (105).

  The contents of the message conversion rule defined by the message conversion rule definition unit (101) and stored in the message conversion rule DB (102) will be described with reference to FIGS. There are two types of message conversion rules. One is to define a rule to convert the message format for each unit that can uniquely identify the message format, such as for each application that outputs a message or for each type of log file. This is called “conversion rule”. Second, after applying the format conversion rule to the message and converting it, it is further specified where the output message is, and the rules for converting the severity and message text for each individual message are defined. This is called “message-specific conversion rule”.

  FIG. 2 shows a definition example of the format conversion rule. The format conversion rule includes format conversion rule ID (201), application name (202), object name (203), pre-conversion delimiter information (204), pre-conversion field type (205), post-conversion delimiter information (206), conversion It consists of a rear field type (207) and a message identification key (208). The format conversion rule ID (201) is an ID that identifies the format conversion rule, and is an ID that is automatically given when the format conversion rule is defined by the message conversion rule definition unit (101). The application name (202) and the object name (203) are information indicating the application that has output the message and the object to which the message is output, and are information that the message stored in the message DB (105) has as attributes. Used as a condition for specifying the message format. The message format is specified by the application name (202) and / or the object name (203). The pre-conversion delimiter information (204) and pre-conversion field type (205) are information defining the format of the message before conversion. The pre-conversion delimiter information (204) defines delimiter positions at which the pre-conversion message is divided into element units constituting the message, and designates delimiter character strings or delimiter column positions. The pre-conversion field type (205) defines the type of each component divided by the pre-conversion delimiter information (204). The post-conversion delimiter information (206) and post-conversion field type (207) define delimiter information and field type for the converted message. The message specifying key (208) defines a key for specifying an individual message from the message group to which the format conversion rule is applied. The value of the item specified in the message specifying key (208) is classified by message. It is for use as a search condition for conversion rules.

  FIG. 3 shows a definition example of the conversion rule for each message. FIG. 3 shows two definition examples (301) and (302). The definition content of the conversion rule for each message will be described with reference to the definition example of (301). The conversion rule for each message includes the conversion rule ID for each message (303), the format conversion rule ID (201), the message generation source (304), the message identification key value (305), the number of embedded characters (306), and the embedded character start position ( 307), an embedded character end condition (308), a message body fragment (309), an inserted character (310), and a post-conversion severity (311). The message conversion rule ID (303) is an ID for specifying the message conversion rule, and is an ID automatically assigned when the message conversion rule is defined by the message conversion rule definition unit (101). The format conversion rule ID (201) indicates which format conversion rule is a message-specific conversion rule. The message generation source (304) is information that the message stored in the message DB (105) has as an attribute, and is used to specify where the message has occurred. The message specific key value (305) is the value of the item specified as the message specific key in the corresponding format conversion rule. The number of embedded characters (306), the embedded character start position (307), and the embedded character end condition (308) define the information of the embedded characters in the message body. Here, the embedded character refers to a variable information part (a part that changes in each message) included in the message body as an embedded character. The number of embedded characters (306) specifies the number of embedded characters included in the message body. The number of bytes of the fixed character string portion between the previous embedded character and the corresponding embedded character is designated as the embedded character start position (307). In the case of the first pad character, the number of bytes of the fixed character string portion from the beginning of the message body to the corresponding pad character is specified. The fill end condition (308) includes the relative number of bytes from the start position of the fill when the fill portion is a fixed length, and the next from the end position of the corresponding fill when the fill portion is a variable length. Each of the fixed character strings up to the start position of the pad character is specified. In the case of the last padding in the message body and variable length, a fixed character string from the end position of the corresponding padding to the end of the message body is specified. In the message body piece (309), a fixed character string portion other than the pad character in the replaced message body is designated. In the insertion padding (310), the number of the padding to be inserted between the message body pieces (the number indicating the number of padding to be inserted) is designated. The post-conversion severity (311) specifies the post-conversion severity.

  The definition example (302) of the conversion rule for each message is different from the definition example (301) only in the message generation source (312) and the post-conversion severity (313). For example, when system maintenance is scheduled in the host B and no error handling is required for errors that occur during maintenance, a conversion rule for each message in which the severity after conversion is set low as in (302) during maintenance work Can be registered and returned to the normal conversion rule (301) after the completion of the maintenance work. If the maintenance time period is determined in advance, the message-specific conversion rule (301) is automatically replaced with (302) when the time period is reached, and the message-specific conversion rule is automatically reached when the maintenance end time is reached. It is better to return to (301).

  With reference to FIG. 4 to FIG. 7, the contents of the message conversion process performed by the message conversion processing unit (103) will be described.

  FIG. 4 is an example of a message acquired from the message DB (105). The message (401) acquired from the message DB (105) includes an application name (403) indicating which application has output, an object name (404) indicating the name of the output object such as a log file name, and the severity of the message ( 405), a message generation source (406) representing a device in which the message is generated, and an attribute of a message (407). The message (401) and the message (402) in FIG. 4 differ only in the message source and the time stamp in the message.

  FIG. 5 illustrates a process when the format conversion is performed by applying the format conversion rule of FIG. 2 to the message (401). The pre-format conversion message (501) has the same content as the message (407) which is the body of the message (401). This pre-format conversion message (501) is delimited according to pre-conversion delimiter information (204) and pre-conversion field type (205), and includes a time stamp (DD / MMM / YYYY hh: mm: ss) (502) and information 1 ( 503), information 2 (504), message ID (505), and message body (506), and four fields and four half-width spaces (507). Next, field rearrangement is performed in accordance with post-conversion delimiter information (206) and post-conversion field type (207), and a post-format conversion message (509) is created. At that time, the time stamp (DD / MMM / YYYY hh: mm: ss) (502) follows the definition of the post-conversion field type (207), and the time stamp (YYYY / MM / DD hh: mm: ss) (508) The format is changed. Subsequently, fields are arranged in the order of message ID (505), message body (506), information 1 (503), and information 2 (504), and a half-width space (507) is inserted between each field to convert the format. A post message (509) is constructed.

  FIG. 6 illustrates a process in the case where the message text (506) in FIG. 5 is applied and the message-specific conversion rule (301) in FIG. 3 is applied to replace the message text. Since the number of embedded characters (306) is 1, it can be seen that there is only one embedded character in the message body (506). When the embedded character start position 1 (307) is 32 and the embedded character end condition 1 (308) is ")" is applied to the message body (506), the embedded character start position is 601 and the embedded character end condition is 602. Since “)”, “5400” (603) is acquired as the padding character. Subsequently, the padding corresponding to the padding number specified by the padding (310) inserted between the message body strip 1 (604) and the message body strip 2 (605) defined in the message body strip (309). A character string for replacing the message body (506) is created by inserting and joining the character string, that is, the above-mentioned padded character string (603).

  FIG. 7 shows the result of converting the message of FIG. 4 according to the format conversion rule of FIG. 2 and the message-specific conversion rule of FIG. The message (701) is the result of converting the message (401) by applying the format conversion rule of FIG. 2 and the message-specific conversion rule (301) of FIG. The message (702) is the result of converting the message (402) by applying the format conversion rule of FIG. 2 and the message-specific conversion rule (302) of FIG. The messages (401) and (402) are messages for the same error, but different severities (703) and (704) are obtained by applying different message-specific conversion rules according to the difference in message origin. Is converted to a message with

  With reference to FIG. 8, the operation of the message conversion apparatus of the present embodiment configured as described above will be described. FIG. 8 is a flowchart showing an outline of processing of the message conversion processing unit (103).

  In the message conversion processing unit (103), the message acquisition unit (109) first acquires one message from the message DB (105) (step 801). If there is no unacquired message, this step waits for the generation of a new message. When the message is acquired, the message conversion rule search unit (110) searches the message conversion rule DB (102) to determine whether the format conversion rule (FIG. 2) corresponding to the acquired message is defined (step 802).

  If the format conversion rule corresponding to the acquired message is not defined (in the case of “N” in step 8O3), the message is registered in the message conversion rule DB (102) as a format conversion rule definition candidate in step 810, Thereafter, the process returns to step 801 to obtain the next message. If there is a format conversion rule (“Y” in step 803), the message conversion execution unit (111) executes steps 804 and 805. In step 804, the message is divided into fields based on the pre-conversion format definition defined in the format conversion rule corresponding to the acquired message. In step 805, format conversion is performed by rearranging the fields divided in step 804 based on the converted format definition. The processing example of steps 804 and 805 has been described with reference to FIG.

  When the format conversion process is completed, in step 806, the message conversion rule search unit (110) is called again to check whether a message conversion rule (FIG. 3) for each message corresponding to the message is defined. 102). If there is no message conversion rule (“N” in step 806), the message is registered in the message conversion rule DB (102) as a message conversion rule definition candidate in step 811, and then in step 809. The message registered by the message registration unit (112) is registered in the message DB (105). If there is a message conversion rule (“Y” in step 806), the message conversion execution unit (111) executes steps 807 to 809. In step 807, the message text is replaced. The replacement processing of the message text has been described with reference to FIG. In step 808, severity conversion processing is performed. The severity conversion process is a process of rewriting the message severity with the post-conversion severity of the message-specific conversion rule. Even if the severity of the message before conversion is Error, since the severity after conversion of the conversion rule for each message to be applied is Warning, an example in which the severity of the message after conversion is set to Warning is shown in FIG. explained. In step 809, the message registration unit (112) registers the message after applying the conversion rule for each message in the message DB (105). At this time, the pre-conversion message can be handled by replacing the pre-conversion message with the post-conversion message on the message DB (105), or leaving the pre-conversion message as it is and registering the post-conversion message anew. When registering a new message after conversion, an attribute for distinguishing it from the pre-conversion message is added to the post-conversion message, and then registered, and the display unit (104) filters and displays only the post-conversion message. It is good to be able to do it.

System configuration diagram showing an embodiment of the present invention Figure showing a definition example of message format conversion rules Figure showing an example of message conversion rule definition The figure which shows the example of the acquisition message from message DB Figure showing an example of message format conversion The figure which shows the Example of field character string substitution Figure showing a message example after message conversion processing Flowchart explaining message conversion operation in message conversion processing unit

Explanation of symbols

  DESCRIPTION OF SYMBOLS 101 ... Message conversion rule definition part, 102 ... Message conversion rule DB, 103 ... Message conversion process part, 104 ... Display part, 105 ... Message DB, 106 ... Message monitoring part, 107a, 107b, 107n ... Monitoring object, 108 ... Monitoring Content definition file 109 ... Message acquisition unit 110 ... Message conversion rule search unit 111 ... Message conversion execution unit 112 ... Message registration unit 201 ... Format conversion rule ID 202 ... Application name 203 ... Object name 204 ... Pre-conversion delimiter information, 205 ... Pre-conversion field type, 206 ... Post-conversion delimiter information, 207 ... Post-conversion field type, 208 ... Message identification key, 303 ... Message conversion rule ID, 304, 312 ... Message originator, 305 ... Message Specific key value, 306 ... Number of embedded characters, 307 ... Embedded character start position, 308 ... Embedded character end condition, 309 ... Message text fragment, 310 ... Inserted character, 311, 313 ... Severity after conversion, 401, 402 ... Message Message acquired from DB, 403 ... Application name, 404 ... Object name, 405 ... Severity, 406 ... Message origin, 407 ... Message, 501 ... Message before format conversion, 502 ... Time stamp (DD / MMM / YYYY hh: mm: ss), 503 ... information 1, 504 ... information 2, 505 ... message ID, 506 ... message body, 507 ... half-width space, 508 ... time stamp (YYYY / MM / DD hh: mm: ss), 509 ... format Post-conversion message, 601 ... padding start position, 602 ... padding end condition, 603 ... padding character string, 604 ... message Sage text fragment 1, 605... Message text fragment 2, 701, 702... Message after message conversion processing, 703, 704.

Claims (1)

In an integrated management system comprising message monitoring means for monitoring messages generated in a monitored computer, a message database for storing detected messages, and display means for displaying messages accumulated in the message database on a console A message conversion device for converting a message on the message database,
A format conversion rule that is a rule for converting a message format for each unit that can uniquely identify the message format, and a message-by-message conversion that is a rule for converting the level of message severity or message text for each individual message A message conversion rule defining means for defining a rule;
Message conversion rule storage means for storing a format conversion rule defined by the message conversion rule definition means and a conversion rule for each message;
Message acquisition means for retrieving messages stored in the message database;
First message conversion rule search means for searching from the message conversion rule storage means for a format conversion rule applicable to the acquired message;
First message conversion executing means for performing processing for converting the message format acquired by the message acquisition means into a unified format based on the searched format conversion rules;
A second message conversion rule search unit that searches the message conversion rule storage unit for a conversion rule for each message applicable to the acquired message;
Second message conversion executing means for performing processing for converting the level of the severity of the message and the message text based on the retrieved conversion rule for each message on the message acquired by the message acquiring means;
Message registration means for storing the conversion results of the first and second message conversion execution means in the message database ;
For the conversion rule for each message stored in the message conversion rule storage means, when the maintenance start time is reached, the message conversion rule is replaced with the conversion rule for each message with a lower severity after conversion, and when the maintenance end time is reached, the original post-conversion severity. Means for returning to the message-by-message conversion rule returned to the above .

Images