METHOD FOR MONITORING ABNORMAL BEHAVIOR IN A COMPUTER SYSTEM

• US 20020165959A1
• Filed: 06/13/2002
• Published: 11/07/2002
• Est. Priority Date: 11/07/1997
• Status: Active Grant

• Current Assignee: Akihiro Urano, Shuji Fujino, Toshiaki Hirata, Toshio Sato
• Original Assignee: Akihiro Urano, Shuji Fujino, Toshiaki Hirata, Toshio Sato
• Inventors: Sato, Toshio, Hirata, Toshiaki, Urano, Akihiro, Fujino, Shuji
• Granted Patent: US 7,136,918 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

The present invention relates to a method for monitoring a computer system in which one manager computer is connected to a plurality of agent computers over a network. The manager computer sends information on the types of log to be collected to the plurality of agent computers. In response, the plurality of agent computers collect the specified types of log. Then, the plurality of agent computers send the collected logs to the manager computer. Thus, the plurality of agent computers are able to collect the types of log specified by the manager computer.

Claims

1. A method for monitoring a computer system in which a manager computer and a plurality of agent computers are connected over a network, comprising the steps of:

sending information on types of log to be collected from said manager computer to said plurality of agent computers;

collecting said types of log on said plurality of agent computers; and

sending said collected log from said plurality of agent computers to said manager computer.

2. The method for monitoring as claimed in claim 1, wherein

when a load on said network is high, sending an instruction from said manager computer to said plurality of agent computers, said instruction requesting to send information on fewer types of log.

3. The method for monitoring as claimed in claim 1, wherein

when a load on said manager computer is high, sending an instruction from said manager computer 104 to said plurality of agent computers, said instruction requesting to send log information on fewer types of log.

4. The method for monitoring as claimed in claim 1, wherein

when said manager computer requires more careful monitoring, sending an instruction from said manager computer to said plurality of agent computers, said instruction requesting to send information on more types of log.

5. A method for monitoring a computer system in which a manager computer and a plurality of agent computers are connected over a network, comprising the steps of:

in response to an error occurring on one of said plurality of agent computers, supposing a first cause of said error on said manager computer;

sending a request from said manager computer to said plurality of agent computers, said request requesting to collect a log to prove said supposed first cause;

collecting the log to prove said supposed first cause on each of said plurality of agent computers;

sending said collected log from each of said plurality of agent computers to said manager computer;

supposing a second cause of the first cause on said manager computer; and

sending the request from said manager computer to said plurality of agent computers, said request requesting to collect the log to prove said supposed second cause.

6. The method for monitoring as claimed in claim 5, wherein at each of a step at which said manager computer supposes said first cause and a step at which said manager computer supposes said second cause, said manager computer displays an area of said computer system on a display, said area indicating a portion where the error is present.

7. A method for monitoring a computer system in which a manager computer and (n+1) agent computers are connected over a network, comprising the steps of:

dividing a log collected on said manager computer into n pieces of log information;

on said manager computer, generating appendage information to be added to the n pieces of log information;

distributing said n pieces of information and said appendage information among said (n+1) agent computers; and

on said (n+1) agent computers, encrypting and memorizing said distributed log information and said appendage information.