Information processing apparatus, control method, and program for flexibly managing event history

Patent metadata

Field	Value
Publication number	US-11513884-B2
Application number	US-201817279155-A
Country	US
Kind code	B2
Filing date	Sep 26, 2018
Priority date	Sep 26, 2018
Publication date	Nov 29, 2022
Grant date	Nov 29, 2022

Abstract

An information processing apparatus 2000 executes analysis for an event history set (10). The event history set (10) is a set of a plurality of event histories (12). The event history (12) is information relating to an event generated in a target computer system. The information processing apparatus 2000 selects, based on a result of the analysis, an event history (12) to be excluded from deletion targets. The information processing apparatus (2000) deletes, from the event history set (10), an event history (12) other than the event history (12) excluded from the deletion targets.

First claim

What is claimed is:

1. An information processing apparatus, comprising:
one or more memories storing instructions; and
one or more processors configured to execute the instructions to implement:
an analysis unit that executes analysis for an event history set including a plurality of event histories;
a selection unit that selects, from the event history set, an event history to be excluded from deletion targets, based on a result of the analysis; and
a deletion unit that deletes, from the event history set, an event history other than the selected event history,

wherein the analysis unit matches events represented by each event history with a feature of an abnormal event indicated by predetermined feature information to calculate an abnormal degree for each event history, obtains an abnormal score for each event history based on the abnormal degree for each event history, compares the abnormal score for each event history with a threshold score, and determines an event history with the abnormal score being equal to or more than the threshold score as an abnormal event, and
the selection unit selects the event history indicating the abnormal event.

2. The information processing apparatus according to claim 1 , wherein
the analysis unit executes a causal analysis for the event history indicating an abnormal event, and
the selection unit deletes, from deletion targets, the event history indicating an abnormal event and the event history indicating an event having a causal relation with the event indicated by the former event history.

3. The information processing apparatus according to claim 2 , wherein
the analysis unit generates a control flow graph or a data flow graph including an abnormal event, and excludes, from deletion targets, an event history relevant to each of events included in the generated control flow graph or data flow graph.

4. The information processing apparatus according to claim 1 , wherein
the deletion unit deletes an event history representing an event a predetermined period or more before, from among event histories other than the event history selected by the selection unit.

5. The information processing apparatus according to claim 1 , wherein
the analysis unit repeatedly executes the analysis at a predetermined timing.

6. A control method executed by a computer, comprising:
an analysis operation of executing analysis for an event history set including a plurality of event histories;
a selection operation of selecting, from the event history set, an event history to be excluded from deletion targets, based on a result of the analysis; and
a deletion operation of deleting, from the event history set, an event history other than the selected event history,
wherein the control method further comprises:
in the analysis operation, matching events represented by each event history with a feature of an abnormal event indicated by predetermined feature information to calculate an abnormal degree for each event history obtaining an abnormal score for each event history based on the abnormal degree for each event history, comparing the abnormal score for each event history with a threshold score, and determining an event history with the abnormal score being equal to or more than the threshold score as an abnormal event; and
selecting, in the selection operation, the event history indicating the abnormal event.

7. The control method according to claim 6 , further comprising:
executing, in the analysis operation, a causal analysis for the event history indicating an abnormal event; and
deleting, in the selection operation, from deletion targets, the event history indicating an abnormal event and the event history indicating an event having a causal relation with the event indicated by the former event history.

8. The control method according to claim 7 , further comprising
generating, in the analysis operation, a control flow graph or a data flow graph including an abnormal event, and excluding, from deletion targets, an event history relevant to each of events included in the generated control flow graph or data flow graph.

9. The control method according to claim 6 , further comprising
deleting, in the deletion operation, an event history representing an event a predetermined period or more before, from among event histories other than the event history selected by the selection operation.

10. The control method according to claim 6 , further comprising
repeatedly executing, in the analysis operation, the analysis at a predetermined timing.

11. A non-transitory computer readable medium storing a program causing a computer to execute each operation of a control method, the method comprising:
an analysis operation of executing analysis for an event history set including a plurality of event histories;
a selection operation of selecting, from the event history set, an event history to be excluded from deletion targets, based on a result of the analysis; and
a deletion operation of deleting, from the event history set, an event history other than the selected event history,
wherein the control method further comprises:
in the analysis operation, matching events represented by each event history with a feature of an abnormal event indicated by predetermined feature information to calculate an abnormal degree for each event history obtaining an abnormal score for each event history based on the abnormal degree for each event history, comparing the abnormal score for each event history with a threshold score, and determining an event history with the abnormal score being equal to or more than the threshold score as an abnormal event; and
selecting, in the selection operation, the event history indicating the abnormal event.

Assignees

• Nec Corp

Inventors

• Sakae Yoshiaki
• Isoyama Kazuhiko
• Nishioka Jun
• Ichihara Etsuko

Classifications

• G06F17/40 Primary

  Data acquisition and logging (for input to computer G06F3/00) · CPC title

• G06F11/0709

  in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/3476

  Data logging (G06F11/14, G06F11/2205 take precedence) · CPC title

• G06F11/30

  Monitoring · CPC title