Operation management method and operation management server

• US 7,506,195 B2
• Filed: 01/28/2005
• Issued: 03/17/2009
• Est. Priority Date: 12/26/2002
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Ono, Hitoshi, Takahashi, Daisaku, Kaku, Yoshiaki, Kawashima, Chiaki, Yoshii, Yukiko, Suzuki, Hiroshi
• Primary Examiner(s): McCarthy; Christopher S
• Application Number:
  US11/044,227
• Publication Number:
  US 20050172162A1
• Time in Patent Office: 1,509 Days
• Field of Search: None
• US Class Current: 714/4.4
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/3447 Performance evaluation by modeling
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: Y10S 707/99953 Recoverability

Abstract

A method is provided to point out which software program is causing a problem. Event records are collected from target objects being monitored. An event group is then produced by grouping the collected event records. The event group is compared with a plurality of pattern definition groups in terms of occurrence patterns of event records, where each pattern definition group defines a pattern of event records that would be produced upon occurrence of a particular problem. Subsequently a troubleshooting record is extracted. This troubleshooting record has previously been associated with a pattern definition group resembling the event group in terms of occurrence patterns of event records.

Claims

1. An operation management method for managing a server, comprising:

collecting event records from a plurality of target objects being monitored, the target objects being a plurality of functions executed on the server;

grouping a plurality of collected event records into an event group;

providing a database storing a plurality of pattern definition groups, each defining a pattern of a plurality of event records that would be produced by the target objects upon occurrence of a particular problem;

comparing the event records in the event group with those of each pattern definition group stored in the database to obtain a match count and a mismatch count for each pattern definition group, wherein the match count is obtained by counting matching event records, and wherein the mismatch count is obtained by counting missing event records in a pattern definition group when the event group contains more event records than the pattern definition group being compared or by counting mismatched event records when the event group contains fewer event records than the pattern definition group being compared;

sorting the pattern definition groups in descending order of match counts thereof;

sorting locally the pattern definition groups with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted pattern definition groups; and

extracting a troubleshooting record that has previously been associated with the first one of the sorted pattern definition groups, the troubleshooting record indicating which target object is considered a source of a problem.

2. The operation management method according to claim 1, wherein the event records are collected from a plurality of servers.

3. The operation management method according to claim 1, wherein the collected event records have different formats depending of the target objects, and said collecting converts the different formats of the collected event records into a unified data format.

4. The operation management method according to claim 1, wherein said event group combines event records produced from interrelated target objects by consulting a database that defines relationships between the plurality of target objects.

5. The operation management method according to claim 1, wherein said event group combines event records collected in a predetermined period.

6. The operation management method according to claim 1, wherein the troubleshooting record includes information about the cause of the problem, as well as countermeasure information that suggests how to solve the problem.

7. An operation management method for managing a server, comprising:

collecting records of commands entered to the server;

grouping a plurality of collected command records into an operation log;

providing a database storing a plurality of operation patterns each defining a pattern of a plurality of commands that could lead to a problem;

comparing the command records in the operation log with those of each operation pattern stored in the database to obtain a match count and a mismatch count for each operation pattern, wherein the match count is obtained by counting matching command records, and wherein the mismatch count is obtained by counting missing command records in an operation pattern when the operation log contains more command records than the operation pattern being compared or by counting mismatched command records when the operation log contains fewer command records than the operation pattern being compared;

sorting the operation patterns in descending order of match counts thereof;

sorting locally the operation patterns with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted operation patterns; and

extracting a troubleshooting record that has previously been associated with the first one of the sorted operation patterns, the troubleshooting record indicating which target object is considered a source of a problem.

8. An operation management device for managing a server, comprising:

collecting means for collecting event records from a plurality of target objects being monitored, the target objects being a plurality of functions executed on the server;

grouping means for grouping a plurality of collected event records into an event group;

a database storing a plurality of pattern definition groups each defining a pattern of a plurality of event records that would be produced by the target objects upon occurrence of a particular problem;

comparing means for comparing the event records in the event group with those of each pattern definition group stored in the database to obtain a match count and a mismatch count for each pattern definition group, wherein the match count is obtained by counting matching event records, and wherein the mismatch count is obtained by counting missing event records in a pattern definition group when the event group contains more event records than the pattern definition group being compared or by counting mismatched event records when the event group contains fewer event records than the pattern definition group being compared;

first sorting means for sorting the pattern definition groups in descending order of match counts thereof;

second sorting means for sorting locally the pattern definition groups with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted pattern definition groups; and

extracting means for extracting a troubleshooting record that has previously been associated with the first one of the sorted pattern definition group, the troubleshooting record indicating which target object is considered a source of a problem.

9. An operation management device for managing a server, comprising:

collecting means for collecting records of commands entered to the server;

grouping means for grouping a plurality of collected command records into an operation log;

a database storing a plurality of operation patterns each defining a pattern of a plurality of commands that could lead to a problem;

comparing means for comparing the command records in the operation log with those of each operation pattern stored in the database to obtain a match count and a mismatch count for each operation pattern, wherein the match count is obtained by counting matching command records, and wherein the mismatch count is obtained by counting missing command records in an operation pattern when the operation log contains more command records than the operation pattern being compared or by counting mismatched command records when the operation log contains fewer command records than the operation pattern being compared;

first sorting means for sorting the operation patterns in descending order of match counts thereof;

second sorting means for sorting locally the operation patterns with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted operation patterns; and

extracting means for extracting a troubleshooting record that has previously been associated with the first one of the sorted operation patterns, the troubleshooting record indicating which target object is considered a source of a problem.

10. A computer-readable storage medium storing an operation management program for managing a server, the program causing a computer to perform operations comprising:

collecting event records from a plurality of target objects being monitored, the target objects being a plurality of functions executed on the server;

grouping a plurality of collected event records into an event group;

providing a database storing a plurality of pattern definition groups each defining a pattern of a plurality of event records that would be produced by the target objects upon occurrence of a particular problem;

comparing the event records in the event group with those of each pattern definition group stored in the database to obtain a match count and a mismatch count for each pattern definition group, wherein the match count is obtained by counting matching event records, and wherein the mismatch count is obtained by counting missing event records in a pattern definition group when the event group contains more event records than the pattern definition group being compared or by counting mismatched event records when the event group contains fewer event records than the pattern definition group being compared;

sorting the pattern definition groups in descending order of match counts thereof;

sorting locally the pattern definition groups with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted pattern definition groups; and

extracting a troubleshooting record that has previously been associated with the first one of the sorted pattern definition groups, the troubleshooting record indicating which target object is considered a source of a problem.

11. A computer-readable storage medium storing an operation management program for managing a server, the program causing a computer to perform operations comprising:

collecting records of commands entered to the server;

grouping a plurality of collected command records into an operation log;

providing a database storing a plurality of operation patterns each defining a pattern of a plurality of commands that could lead to a problem;

comparing the command records in the operation log with those of each operation pattern stored in the database to obtain a match count and a mismatch count for each operation pattern, wherein the match count is obtained by counting matching command records, and wherein the mismatch count is obtained by counting missing command records in an operation pattern when the operation log contains more command records than the operation pattern being compared or by counting mismatched command records when the operation log contains fewer command records than the operation pattern being compared;

sorting the operation patterns in descending order of match counts thereof;

sorting locally the operation patterns with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted operation patterns; and

extracting a troubleshooting record that has previously been associated with the first one of the sorted operation patterns, the troubleshooting record indicating which target object is considered a source of a problem.