Method and system for supporting event root cause analysis

Patent metadata

Field	Value
Publication number	US-9354961-B2
Application number	US-201213639132-A
Country	US
Kind code	B2
Filing date	Mar 23, 2012
Priority date	Mar 23, 2012
Publication date	May 31, 2016
Grant date	May 31, 2016

Abstract

A computer analyzes the root cause of an event, which has occurred in any of multiple management-target apparatuses, based on one or more rules in a storage device, that denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses and a conclusion event, which is the cause in a case where the one or more condition events have occurred. The computer, based on an event occurrence log including contents and an occurrence date and time of an event, determines a first event group, which is multiple events presumed to occur as a result of the same cause, creates a new rule in which the multiple events of the first event group are the condition events and one event of the first event group is the conclusion event, and stores the created new rule.

First claim

The invention claimed is:

1. A method for supporting an analysis of a root cause of an event, which has occurred in any of multiple management-target apparatuses which are managed by a control device, based on one or more rules in a storage device, that denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses, and a conclusion event, which is a cause in a case where the one or more condition events have occurred, the method comprising the steps, performed by the control device, of:
determining a first event group, which is multiple events presumed to occur as a result of a same cause, by calculating co-occurrence probabilities of a plurality of events which have occurred based on an event occurrence log including contents and an occurrence date and time of the plurality of events which have occurred;
creating a new rule in which one event of the first event group is the conclusion event for the new rule and a remainder of the multiple events are the condition events; and
storing the created new rule in the storage device, wherein the storage device is configured to store one or more existing rules, which denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses and a respective conclusion event, which is the cause in a case where the one or more condition events have occurred, and an analysis log, which includes information for identifying an existing rule which has been used in an analysis of a root cause.

2. A method according to claim 1 , the method further comprising:
determining, based on the event occurrence log and the analysis log and with respect to an existing rule which has been used in the analysis of the root cause, a second event group, which is one or more events that are highly likely to occur in a case where a condition event of the existing rule has occurred and that are other than the one or more condition events of the existing rule, and determining a combination of events of the one or more condition events of the existing rule and events of the second event group as the first event group.

3. A method according to claim 2 , further comprising:
creating the new rule in a case where the management-target apparatuses, which are origins of events of the first event group, have a mutual connecting relationship.

4. A method according to claim 3 , further comprising:
creating, as the new rule, a first new rule in which the conclusion event of the existing rule which has been used in the root cause is a conclusion event, and a second new rule in which one event of the second event group is a conclusion event.

5. A method according to claim 4 , further comprising:
displaying the contents of the created new rule on a prescribed display apparatus;
receiving from a user an input denoting whether or not the new rule is to be used in the root cause analysis; and
using, in a case where an input to the effect that the new rule is to be used in the root cause analysis has been received, the created new rule in the root cause analysis thereafter.

6. A method according to claim 5 , further comprising:
storing in the storage device information to the effect that a displayed third new rule is not to be used in the root cause analysis in a case where an input to the effect that the third new rule is not to be used in the root cause analysis has been received from the user; and
causing contents of a fourth new rule newly created thereafter not to be displayed on the prescribed display apparatus in a case where the fourth new rule is the same as the third new rule.

7. A method according to claim 1 , further comprising:
creating the new rule in a case where the management-target apparatuses, which are origins of events of the first event group, have a mutual connecting relationship.

8. A method according to claim 7 , further comprising:
displaying the contents of the created new rule on a prescribed display apparatus;
receiving, from a user, an input denoting whether or not the new rule is to be used in the root cause analysis; and
using, in a case where an input to the effect that the new rule is to be used in the root cause analysis has been received, the created new rule in the root cause analysis thereafter.

9. A system for supporting an analysis of a root cause of an event, which has occurred in any of multiple management-target apparatuses, based on one or more rules in a storage device, that denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses and a conclusion event, which is a cause in a case where the one or more condition events have occurred, the system comprising:
the storage device; and
a control device, which is connected to the storage device,
wherein the storage device stores an event occurrence log including contents and an occurrence date and time of a plurality of events which have occurred,
wherein the control device is configured to perform the following:
determining, a first event group, which is multiple events presumed to occur as a result of a same cause, by calculating co-occurrence probabilities of the plurality of events based on the event occurrence log; and
creating a new rule in which one event of the first event group is the conclusion event for the new rule and a remainder of the multiple events of the first event group are the condition events,
wherein the storage device is configured to store one or more existing rules, which denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses and a respective conclusion event, which is the cause in a case where the one or more condition events have occurred, and an analysis log, which includes information for identifying an existing rule which has been used in a root cause analysis.

10. A system according to claim 9 ,
wherein the control device is configured to perform the following:
determining, based on the event occurrence log and the analysis log and with respect to an existing rule which has been used in the analysis of the root cause, a second event group, which is one or more events that are highly likely to occur in a case where a condition event of the existing rule has occurred and that are other than the one or more condition events of the existing rule, and determining a combination of events of the one or more condition events of the existing rule and events of the second event group as the first event group.

11. A system according to claim 10 , wherein the control device is configured to perform the following:
creating the new rule in a case where the management-target apparatuses, which are origins of events of the first event group, have a mutual connecting relationship.

12. A system according to claim 11 , wherein the control device is configured to perform the following:
creating, as the new rule, a first new rule in which the conclusion event of the existing rule which has been used in the root cause is a conclusion event, and a second new rule in which one event of the second event group is a conclusion event.

13. A system according to claim 12 , wherein the control device is configured to perform the following:
displaying the contents of the created new rule on a prescribed display apparatus,
receiving from a user an input denoting whether or not the new rule is to be used in the root cause

Assignees

• Nagura Masataka
• Nagai Takayuki
• Murase Kaori
• Hitachi Ltd

Inventors

• Nagura Masataka
• Nagai Takayuki
• Murase Kaori

Classifications

• G06F11/0727

  in a storage system, e.g. in a DASD or network based storage system (drivers for digital recording or reproducing units G06F3/06; circuits for error detection or correction within digital recording or reproducing units G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097) · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title