Computer program and monitoring apparatus

Patent metadata

Field	Value
Publication number	US-9246777-B2
Application number	US-201213634779-A
Country	US
Kind code	B2
Filing date	Feb 14, 2012
Priority date	Feb 14, 2012
Publication date	Jan 26, 2016
Grant date	Jan 26, 2016

Abstract

To analyze the cause if an event occurred to a plurality of monitoring targets. A monitoring computer 101 includes a general rule storing part 136 configured to store a general rule, wherein the general rule previously associates a first event which can occur in any of the plurality of monitoring targets and a second event which can cause the first event, an correlation rule generating part 129 configured to generate an correlation rule, wherein the correlation rule is created based on the general rule and configuration information, and in the case where a predetermined number or more of events corresponding to the second events are detected, the correlation rule indicates that an event corresponding to the first event will occur, and an analyzing part 125 configured to analyze a cause of an event indicated by the event information based on received event information and the correlation rule.

First claim

The invention claimed is:

1. A non-transitory computer readable medium with an executable program stored thereon, where the executable program causes a computer to function as a monitoring apparatus for monitoring a computer system including a plurality of monitoring targets, the monitoring apparatus performing acts comprising:
storing configuration information of the plurality of monitoring targets;
storing a general rule, where the general rule previously associates a first event which can occur in any of the plurality of monitoring targets and a second event which can cause the first event, and in the case where a previously configured predetermined number or more of the second events occurred in a previously grouped plurality of predetermined monitoring targets among the plurality of monitoring targets, the general rule leads to an estimate that the second events would have caused the first event;
storing event information of an event which occurred in the plurality of monitoring targets;
generating a correlation rule, where the correlation rule is created based on the general rule and the configuration information;
analyzing a cause of an event indicated by the received event information based on the received event information and the correlation rule;
upon detecting the predetermined number or more of events corresponding to the second events in events indicated by the event information, indicating, based on the correlation rule, that an event corresponding to the first event of the events indicated by the event information will occur;
outputting an analysis result that an event corresponding to the first event of the events indicated by the event information will occur;
generating the correlation rule related to the received event information and stored in a memory of the monitoring apparatus;
before generating the correlation rule related to the received event information, determining whether the correlation rule is stored in the memory, and in the case where the correlation rule is stored in the memory;
not generating another correlation rule;
calculating a matching ratio which indicates a ratio of the occurrence number of the event corresponding to the first event of the events indicated by the event information to the number of the predetermined monitoring targets; and
saving the matching ratio.

2. The non-transitory computer readable medium according to claim 1 , for further causing the computer to perform:
outputting the second events which are estimated to be a cause of the event indicated by the event information in a descending order according to the matching ratio.

3. The non-transitory computer readable medium according to claim 2 , wherein a predetermined term of validity is configured to the received event information, and
wherein the computer is further caused to perform:
estimating a cause of an event indicated by the event information by configuring a predetermined weight value to the received event information; and
decreasing a weight value of the event indicated by the event information, the term of validity of which elapsed.

4. The non-transitory computer readable medium according to claim 3 , wherein the weight value of the event indicated by the event information, the term of validity of which elapsed, is configured to a minimum value so that the event is treated as if it did not occur.

5. The non-transitory computer readable medium according to claim 4 , wherein the general rule includes topology condition information indicating a topology condition wherein the topology condition defines connection between a monitoring target, in which an event corresponding to the first event occurred among the plurality of monitoring targets, and the predetermined monitoring targets, and
wherein the correlation rule is generated based on the configuration information corresponding to the topology condition information and the general rule by searching for the configuration information based on the topology condition information corresponding to the event indicated by the event information.

6. The non-transitory computer readable medium according to claim 5 , wherein the correlation rule is generated for a case where each of the predetermined monitoring targets causes an event corresponding to the first event.

7. The non-transitory computer readable medium according to claim 6 , wherein the correlation rule is generated for each of the predetermined number of possible combinations of the predetermined monitoring targets.

8. The non-transitory computer readable medium according to claim 7 , wherein the correlation rule is generated such that correlation rules which have the predetermined monitoring targets in common among all the monitoring targets of the predetermined number of combinations are generated as one correlation rule.

9. A monitoring apparatus for monitoring a computer system including a plurality of monitoring targets, comprising:
a microprocessor for executing a predetermined computer program, a memory to be used by the microprocessor, and a communication interface part for the microprocessor to acquire information from the plurality of monitoring targets,
wherein the monitoring apparatus executes:
a configuration information storing step for the microprocessor to acquire configuration information of the plurality of monitoring targets and cause the memory to store the configuration information by executing the predetermined computer program;
a general rule storing step of storing a general rule, wherein the general rule previously associates a first event which can occur in any of the plurality of monitoring targets and a second event which can cause the first event, and in the case where a previously configured predetermined number or more of the second events occurred in a previously grouped plurality of predetermined monitoring targets among the plurality of monitoring targets, the general rule leads to an estimate that the second events would have caused the first event;
an event information storing step of receiving, via the communication interface part, event information of an event which occurred in the plurality of monitoring targets and causing the memory to store the event information;
an correlation rule generating step of generating an correlation rule, wherein the correlation rule is created based on the general rule and the configuration information, and in the case where the predetermined number or more of events corresponding to the second events are detected in events indicated by the event information, the correlation rule indicates that an event corresponding to the first event of the events indicated by the event information will occur;
an analyzing step for analyzing a cause of an event indicated by the received event information based on the received event information and the correlation rule, and
an outputting step for displaying an analysis result made by the analyzing step on a display units;
wherein when the event information is received, the correlation rule generating step generates an correlation rule related to the received event information and stores the correlation rule in the memory; and
wherein the analyzing step calculates a matching ratio which indicates a ratio of the occurrence number of the event corresponding to the first event of the events indicated by the event information to the number of the predetermined monitoring targets.

10. A monitoring apparatus according to claim 9 wherein the analyzing step
causes the second events which are estimated to be a cause of the event indicated by the event information to be displayed on the display unit in the descending order of the matching ratio.

Assignees

• Murase Kaori
• Nagura Masataka
• Nagai Takayuki
• Kuroda Takaki
• Hoshino Kazuyoshi
• Hitachi Ltd

Inventors

• Murase Kaori
• Nagura Masataka
• Nagai Takayuki
• Kuroda Takaki
• Hoshino Kazuyoshi

Classifications

• H04L41/065 Primary

  involving logical or physical relationship, e.g. grouping and hierarchies · CPC title

• H04L41/0631

  using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis · CPC title

• H04L43/00 Primary

  Arrangements for monitoring or testing data switching networks · CPC title