Method for monitoring abnormal behavior in a computer system

• US 6,434,616 B2
• Filed: 07/25/2001
• Issued: 08/13/2002
• Est. Priority Date: 11/07/1997
• Status: Expired due to Fees

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Sato, Toshio, Hirata, Toshiaki, Urano, Akihiro, Fujino, Shuji
• Primary Examiner(s): WILEY, DAVID ARMAND
• Application Number:
  US09/911,386
• Publication Number:
  US 20010042119A1
• Time in Patent Office: 384 Days
• Field of Search: 709/224, 709/223, 709/225, 709/226
• US Class Current: 709/224
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/0817 by checking functioning

Abstract

The present invention relates to a method for monitoring a computer system in which one manager computer is connected to a plurality of agent computers over a network. The manager computer sends information on the types of log to be collected to the plurality of agent computers. In response, the plurality of agent computers collect the specified types of log. Then, the plurality of agent computers send the collected logs to the manager computer. Thus, the plurality of agent computers are able to collect the types of log specified by the manager computer.

Claims

1. A method for monitoring a computer system in which a manager computer and a plurality of agent computers are connected over a network, comprising the steps of:

sending information on types of log to be collected from said manager computer to said plurality of agent computers;

collecting said types of log on said plurality of agent computers; and

sending said collected log from said plurality of agent computers to said manager computer.

2. The method for monitoring as claimed in claim 1, wherein

when a load on said network is high, sending an instruction from said manager computer to said plurality of agent computers, said instruction requesting to send information on fewer types of log.

3. The method for monitoring as claimed in claim 1, wherein

when a load on said manager computer is high, sending an instruction from said manager computer to said plurality of agent computers, said instruction requesting to send log information on fewer types of log.

4. The method for monitoring as claimed in claim 1, whenin

when said manager computer requires more careful monitoring, sending an instruction from said manager computer to said plurality of agent computers, said instruction requesting to send information on more types of log.