摘要:
A root cause analysis engine uses event survival times and gradual deletion of events to improve analysis accuracy and reduce the number of required calculations. Certainty factors of relevant rules are recalculated every time notification of an event is received. The calculation results are held in a rule memory in the analysis engine. Each event has a survival time, and when the time has expired, that event is deleted from the rule memory. Events held in the rule memory can be deleted without affecting other events held in the rule memory. The analysis engine can then re-calculate the certainty factor of each rule by only performing the re-calculation with respect to affected rules that are related with the deleted event. The calculation cost can be reduced because analysis engine processes events incrementally or decrementally.
摘要:
A root cause analysis engine uses event durations and gradual deletion of events to improve analysis accuracy and reduce the number of required calculations. Matching ratios of relevant rules are recalculated every time notification of an event is received. The calculation results are held in a rule memory in the analysis engine. Each event has a valid duration, and when the duration has expired, that event is deleted from the rule memory. Events held in the rule memory can be deleted without affecting other events held in the rule memory. The analysis engine can then re-calculate the matching ratio of each rule by only performing the re-calculation with respect to affected rules related to the deleted event. The calculation cost can be reduced because analysis engine processes events incrementally or decrementally. Analysis engine can determine the most possible conclusion even if one or more condition elements were not true.
摘要:
A root cause analysis engine uses event durations and gradual deletion of events to improve analysis accuracy and reduce the number of required calculations. Matching ratios of relevant rules are recalculated every time notification of an event is received. The calculation results are held in a rule memory in the analysis engine. Each event has a valid duration, and when the duration has expired, that event is deleted from the rule memory. Events held in the rule memory can be deleted without affecting other events held in the rule memory. The analysis engine can then re-calculate the matching ratio of each rule by only performing the re-calculation with respect to affected rules related to the deleted event. The calculation cost can be reduced because analysis engine processes events incrementally or decrementally. Analysis engine can determine the most possible conclusion even if one or more condition elements were not true.
摘要:
An event processing system that can perform processing corresponding to event messages certainly, and improve efficiency of processing event messages.To that end, the event processing system of the present invention holds event messages, which are received owing to state transitions of an IT service system, in an event message holding unit in order of issue. Among the event messages held in the event message holding unit, the event processing system searches for an event message for which a state of the IT service system after issue of the event message in question coincides with a state of the IT service system before issue of the oldest event message in the event message holding unit. When the event processing system can retrieve the event message in question, the event processing system deletes event messages ranging from the oldest event message to the retrieved event message from the event message holding unit.
摘要:
A management apparatus and a management method that enable parsing processing to be executed efficiently by means of a working memory of a fixed size are proposed. One or more predefined rules are divided into one or more rule segments that comprise a condition and a conclusion that each form part of the rule, and the rule segments obtained through the division are stored in the secondary storage, and when an event notification from the information processing device is received, one or more related rule segments are selected and, by linking the selected one or more rule segments in the memory as required, a rule parsing network is constructed that indicates relationships between rules in the memory, an inference is derived on the basis of the constructed rule parsing network, and rule segments that are not readily used in inference derivation are deleted from the memory.
摘要:
A management apparatus and a management method that enable parsing processing to be executed efficiently by means of a working memory of a fixed size are proposed. One or more predefined rules are divided into one or more rule segments that comprise a condition and a conclusion that each form part of the rule, and the rule segments obtained through the division are stored in the secondary storage, and when an event notification from the information processing device is received, one or more related rule segments are selected and, by linking the selected one or more rule segments in the memory as required, a rule parsing network is constructed that indicates relationships between rules in the memory, an inference is derived on the basis of the constructed rule parsing network, and rule segments that are not readily used in inference derivation are deleted from the memory.
摘要:
A performance evaluating apparatus for a rule is provided, which is capable of evaluating a business value of a rule applied to the operation and management of an information system through autonomous control. The performance evaluating apparatus for a rule collects, respectively before activation processing that is prescribed by a rule and after completion of the execution of the processing, a rule execution history and a system state information indicating a state of a monitored information system that is necessary for calculation of the business value. The business value is calculated from the collected system state information and rule execution history by a given calculation formula.
摘要:
A management system, which manages an information processing system by identifying a cause location based on previously defined analysis rule information, displays a status that is a condition of the analysis rule information but is not receivable, based on acquirable status information of the apparatuses making up the information processing system or information about statuses received in the past.
摘要:
The monitoring technology capable of reducing total monitoring cost without degrading the monitoring capability in accordance with the configuration of the large-scale service system and quickly comprehending the state of the service system after the configuration change. A monitoring system in which information processing apparatuses constituting the service system are objects to be monitored has a monitoring manager program and a plurality of monitoring agent programs, and objects to be monitored having the same performance characteristics are sorted into the same groups. In each of the groups, parties where monitoring is carried out at a short monitoring interval and parties where the monitoring is carried out at a long monitoring interval are provided. The performance of objects to be monitored in the party of the long monitoring interval is estimated from the performance of the objects to be monitored in the party of the short monitoring interval.
摘要:
The monitoring technology capable of reducing total monitoring cost without degrading the monitoring capability in accordance with the configuration of the large-scale service system and quickly comprehending the state of the service system after the configuration change. A monitoring system in which information processing apparatuses constituting the service system are objects to be monitored has a monitoring manager program and a plurality of monitoring agent programs, and objects to be monitored having the same performance characteristics are sorted into the same groups. In each of the groups, parties where monitoring is carried out at a short monitoring interval and parties where the monitoring is carried out at a long monitoring interval are provided. The performance of objects to be monitored in the party of the long monitoring interval is estimated from the performance of the objects to be monitored in the party of the short monitoring interval.