Method and system for supporting event root cause analysis

摘要

A computer analyzes the root cause of an event, which has occurred in any of multiple management-target apparatuses, based on one or more rules in a storage device, that denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses and a conclusion event, which is the cause in a case where the one or more condition events have occurred. The computer, based on an event occurrence log including contents and an occurrence date and time of an event, determines a first event group, which is multiple events presumed to occur as a result of the same cause, creates a new rule in which the multiple events of the first event group are the condition events and one event of the first event group is the conclusion event, and stores the created new rule.

主权项

1. A method for supporting an analysis of a root cause of an event, which has occurred in any of multiple management-target apparatuses which are managed by a control device, based on one or more rules in a storage device, that denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses, and a conclusion event, which is a cause in a case where the one or more condition events have occurred, the method comprising the steps, performed by the control device, of:
determining a first event group, which is multiple events presumed to occur as a result of a same cause, by calculating co-occurrence probabilities of a plurality of events which have occurred based on an event occurrence log including contents and an occurrence date and time of the plurality of events which have occurred; creating a new rule in which one event of the first event group is the conclusion event for the new rule and a remainder of the multiple events are the condition events; and storing the created new rule in the storage device, wherein the storage device is configured to store one or more existing rules, which denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses and a respective conclusion event, which is the cause in a case where the one or more condition events have occurred, and an analysis log, which includes information for identifying an existing rule which has been used in an analysis of a root cause.