Event monitoring system and event monitoring method

Patent metadata

Field	Value
Publication number	US-2022300320-A1
Application number	US-202117477401-A
Country	US
Kind code	A1
Filing date	Sep 16, 2021
Priority date	Mar 17, 2021
Publication date	Sep 22, 2022
Grant date	—

Abstract

An event monitoring system includes a processor and a storage unit. The storage unit holds an event message including a character string related to an event occurring in an information system and guide information including one or more guides. The guide includes a guide message including a predetermined character string, notified in response to the event, and information regarding a coping method for the event. The processor compares the event message and the guide, associates the guide with the event in a case where the guide further includes information for identifying a variable portion of the guide message and a portion other than the variable portion of the guide message coincides with a portion other than a portion corresponding to the variable portion in the event message, and receives an input of information indicating a correct answer of a guide to be associated with the event in a case where the guide does not include the information for identifying the variable portion.

First claim

What is claimed is:

1 . An event monitoring system comprising:
a processor; and a storage unit, wherein the storage unit holds an event message including a character string related to an event occurring in an information system and guide information including one or more guides, the guide includes a guide message including a predetermined character string, notified in response to the event, and information regarding a coping method for the event, the processor compares the event message and the guide, associates the guide with the event in a case where the guide further includes information for identifying a variable portion of the guide message and a portion other than the variable portion of the guide message coincides with a portion other than a portion corresponding to the variable portion in the event message, and receives an input of information indicating a correct answer of a guide to be associated with the event in a case where the guide does not include the information for identifying the variable portion.

2 . The event monitoring system according to claim 1 , wherein
the processor compares a guide message included in the correct answer of the guide to be associated with the event and the event message to identify a variable portion of the guide message when the information indicating the correct answer of the guide to be associated with the event is input, and updates the guide information to include the information for identifying the variable portion of the guide message.

3 . The event monitoring system according to claim 2 , wherein
the processor compares a character string of the guide message included in the correct answer of the guide to be associated with the event and the character string of the event message, and identifies a different portion between the character string of the guide message and the character string of the event message as the variable portion.

4 . The event monitoring system according to claim 1 , wherein
the storage unit holds a threshold of a similarity between the event message and the guide message, and the processor calculates the similarity between the event message and the guide message included in the guide, causes the storage unit to hold the guide including the guide message of which the similarity exceeds the threshold as a candidate guide, determines whether the candidate guide includes the information for identifying the variable portion, outputs the candidate guide in a case where the candidate guide does not include the information for identifying the variable portion, and receives information for selecting the candidate guide as the input of the information indicating the correct answer of the guide to be associated with the event in a case where the information for selecting the candidate guide is input.

5 . The event monitoring system according to claim 4 , wherein
the processor does not select any of the guides including the guide messages each having the similarity exceeding the threshold as the correct answer of the guide to be associated with the event, and changes the threshold to a value lower than a similarity between the event message and a guide message included in the correct answer of the guide to be associated with the event when any of the guides including the guide messages each having the similarity that does not exceed the threshold is input as the information indicating the correct answer of the guide to be associated with the event.

6 . The event monitoring system according to claim 4 , wherein
the processor holds the guide as a candidate guide to be associated with the event when the guide does not include the information for identifying the variable portion and the guide message included in the guide coincides with the event message, holds the guide as a candidate guide to be associated with the event when the guide includes the information for identifying the variable portion and the portion other than the variable portion in the guide message included in the guide coincides with the portion other than the portion corresponding to the variable portion in the event message, and associates the candidate guides to be associated with the event with the event.

7 . The event monitoring system according to claim 6 , wherein
the guide information includes information indicating a notification destination of the guide message, and includes information indicating an allowable range of a character string of the variable portion for a guide including the information for identifying the variable portion, and when a plurality of candidate guides to be associated with the event are held, the processor does not associate a first candidate with the event in a case where a notification destination of the first candidate among the plurality of candidate guides to be associated with the event is similar to a notification destination of a second candidate and variable portions of the second candidate are fewer than variable portions of the first candidate, and does not associate the first candidate with the event in a case where the notification destination of the first candidate is similar to the notification destination of the second candidate, the variable portions of the first candidate are similar to the variable portions of the second candidate, and a portion corresponding to the variable portion in the event message is out of the allowable range set for the first candidate.

8 . The event monitoring system according to claim 6 , wherein
the processor identifies a word included in only one guide among words, included in a plurality of guides identified as the candidate guides, as a unique keyword, and associates the guide with the event when the guide includes the unique keyword and a character string similar to the unique keyword is included in the event message.

9 . The event monitoring system according to claim 8 , wherein
the processor causes the storage unit to hold information indicating that the unique keyword is not used to associate the guide with the event when information indicating that the guide is not correct is input after associating the guide including the unique keyword with the event that has the event message including the unique keyword, and associates the guide with the event when the guide includes the unique keyword, the unique keyword is included in the event message, and information indicating that the unique keyword is not used is not held.

10 . The event monitoring system according to claim 8 , wherein
the processor outputs at least any of a guide associated with the event and a reason why the guide is associated with the event in a case where a candidate guide to be associated with the event is associated with the event, and a guide not associated with the event and a reason why the guide is not associated with the event in a case where a candidate guide to be associated with the event is not associated with the event, the reason why the guide is associated with the event and the reason why the guide is not associated with the event include at least any of information indicating whether the guide includes the unique keyword and the unique keyword is included in the event message, information indicating whether the guide message coincides with the event message, and information indicating whether the portion other than the variable portion in the guide message coincides with the portion other than the portion corresponding to the variable portion in the event message.

11 . The event monitoring system according to claim 1 , wherein
the guide information includes information indicating an allowable range of a character string of the va

Assignees

• Hitachi Ltd

Inventors

• Okamura Taku
• Tameshige Takashi
• Nagata Mitsuhiro
• Kurose Hideto
• Masuda Mineyoshi

Classifications

• G06F9/546

  Message passing systems or structures, e.g. queues · CPC title

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• G06F9/4881 Primary

  Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues · CPC title

• G06F11/0751 Primary

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F2201/86

  Event-based monitoring · CPC title