MONITORING SYSTEM AND MONITORING PROGRAM

摘要

A monitoring system performs cause analysis of an event occurring in any of a plurality of monitoring-target objects to be monitored based on a rule. In this case, the monitoring system makes a detection during the analysis time width and determines a plurality of conclusions based on an event corresponding to the condition for determining the conclusion. Moreover, the monitoring system performs one or more of (A) displaying change of certainty to be used for determination of a conclusion in a case where the analysis time width is assumed to be changed, (B) performing sort display of the determined conclusion based on an index value showing an affected range and (C) calculating the analysis time width based on the index value.

主权项

1. A non-transitory computer readable medium storing a program causing a computer to execute a monitoring process, the monitoring process is configured to perform a cause analysis of an event which occurs in any of a plurality of monitoring-target objects using at least one rule and the computer has a storage device,
displaying the sorted plurality of determined conclusions, wherein, the rule includes a necessary condition for determining a predetermined conclusion as a cause wherein the storage device stores the at least one rule, each rule associating one or more conditions, which area combination one or more types of the events and one or more of the plurality of monitoring-target objects which are a source of occurrence of the respective events, and a conclusion which is a cause of the respective events when the one or more conditions are satisfied, and the storage device further stores, for each of the conditions of the at least one rule, detection data regarding validity of detection of the one or more events of the respective conditions, and the monitoring process comprising: configuring, when an event is detected, the detection data corresponding to the detected event as valid; determining an analysis time width of the detected event based on the index value of the conclusion associated with the one or more conditions of the at least one rule corresponding to the detection event; configuring the detection data of the detected event as invalid when the determined analysis time width has elapsed from the time when the detection event is detected; and performing a cause analysis of an event which occurs in the monitoring-target objects based on the rule, wherein, in the cause analysis, for each conclusion of the at least one rule, determining a probability that the respective conclusion is a cause based on the detection data of each of the one or more events of the one or more associated conditions and determining at least one of the conclusions having a possibility of being the cause based on the determined probability.