Operation management method and operation management server
First Claim
1. An operation management method for managing a server, comprising:
- collecting event records from a plurality of target objects being monitored, the target objects being a plurality of functions executed on the server;
grouping a plurality of collected event records into an event group;
providing a database storing a plurality of pattern definition groups, each defining a pattern of a plurality of event records that would be produced by the target objects upon occurrence of a particular problem;
comparing the event records in the event group with those of each pattern definition group stored in the database to obtain a match count and a mismatch count for each pattern definition group, wherein the match count is obtained by counting matching event records, and wherein the mismatch count is obtained by counting missing event records in a pattern definition group when the event group contains more event records than the pattern definition group being compared or by counting mismatched event records when the event group contains fewer event records than the pattern definition group being compared;
sorting the pattern definition groups in descending order of match counts thereof;
sorting locally the pattern definition groups with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted pattern definition groups; and
extracting a troubleshooting record that has previously been associated with the first one of the sorted pattern definition groups, the troubleshooting record indicating which target object is considered a source of a problem.
1 Assignment
0 Petitions
Accused Products
Abstract
A method is provided to point out which software program is causing a problem. Event records are collected from target objects being monitored. An event group is then produced by grouping the collected event records. The event group is compared with a plurality of pattern definition groups in terms of occurrence patterns of event records, where each pattern definition group defines a pattern of event records that would be produced upon occurrence of a particular problem. Subsequently a troubleshooting record is extracted. This troubleshooting record has previously been associated with a pattern definition group resembling the event group in terms of occurrence patterns of event records.
66 Citations
11 Claims
-
1. An operation management method for managing a server, comprising:
-
collecting event records from a plurality of target objects being monitored, the target objects being a plurality of functions executed on the server; grouping a plurality of collected event records into an event group; providing a database storing a plurality of pattern definition groups, each defining a pattern of a plurality of event records that would be produced by the target objects upon occurrence of a particular problem; comparing the event records in the event group with those of each pattern definition group stored in the database to obtain a match count and a mismatch count for each pattern definition group, wherein the match count is obtained by counting matching event records, and wherein the mismatch count is obtained by counting missing event records in a pattern definition group when the event group contains more event records than the pattern definition group being compared or by counting mismatched event records when the event group contains fewer event records than the pattern definition group being compared; sorting the pattern definition groups in descending order of match counts thereof; sorting locally the pattern definition groups with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted pattern definition groups; and extracting a troubleshooting record that has previously been associated with the first one of the sorted pattern definition groups, the troubleshooting record indicating which target object is considered a source of a problem. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. An operation management method for managing a server, comprising:
-
collecting records of commands entered to the server; grouping a plurality of collected command records into an operation log; providing a database storing a plurality of operation patterns each defining a pattern of a plurality of commands that could lead to a problem; comparing the command records in the operation log with those of each operation pattern stored in the database to obtain a match count and a mismatch count for each operation pattern, wherein the match count is obtained by counting matching command records, and wherein the mismatch count is obtained by counting missing command records in an operation pattern when the operation log contains more command records than the operation pattern being compared or by counting mismatched command records when the operation log contains fewer command records than the operation pattern being compared; sorting the operation patterns in descending order of match counts thereof; sorting locally the operation patterns with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted operation patterns; and extracting a troubleshooting record that has previously been associated with the first one of the sorted operation patterns, the troubleshooting record indicating which target object is considered a source of a problem.
-
-
8. An operation management device for managing a server, comprising:
-
collecting means for collecting event records from a plurality of target objects being monitored, the target objects being a plurality of functions executed on the server; grouping means for grouping a plurality of collected event records into an event group; a database storing a plurality of pattern definition groups each defining a pattern of a plurality of event records that would be produced by the target objects upon occurrence of a particular problem; comparing means for comparing the event records in the event group with those of each pattern definition group stored in the database to obtain a match count and a mismatch count for each pattern definition group, wherein the match count is obtained by counting matching event records, and wherein the mismatch count is obtained by counting missing event records in a pattern definition group when the event group contains more event records than the pattern definition group being compared or by counting mismatched event records when the event group contains fewer event records than the pattern definition group being compared; first sorting means for sorting the pattern definition groups in descending order of match counts thereof; second sorting means for sorting locally the pattern definition groups with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted pattern definition groups; and extracting means for extracting a troubleshooting record that has previously been associated with the first one of the sorted pattern definition group, the troubleshooting record indicating which target object is considered a source of a problem.
-
-
9. An operation management device for managing a server, comprising:
-
collecting means for collecting records of commands entered to the server; grouping means for grouping a plurality of collected command records into an operation log; a database storing a plurality of operation patterns each defining a pattern of a plurality of commands that could lead to a problem; comparing means for comparing the command records in the operation log with those of each operation pattern stored in the database to obtain a match count and a mismatch count for each operation pattern, wherein the match count is obtained by counting matching command records, and wherein the mismatch count is obtained by counting missing command records in an operation pattern when the operation log contains more command records than the operation pattern being compared or by counting mismatched command records when the operation log contains fewer command records than the operation pattern being compared; first sorting means for sorting the operation patterns in descending order of match counts thereof; second sorting means for sorting locally the operation patterns with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted operation patterns; and extracting means for extracting a troubleshooting record that has previously been associated with the first one of the sorted operation patterns, the troubleshooting record indicating which target object is considered a source of a problem.
-
-
10. A computer-readable storage medium storing an operation management program for managing a server, the program causing a computer to perform operations comprising:
-
collecting event records from a plurality of target objects being monitored, the target objects being a plurality of functions executed on the server; grouping a plurality of collected event records into an event group; providing a database storing a plurality of pattern definition groups each defining a pattern of a plurality of event records that would be produced by the target objects upon occurrence of a particular problem; comparing the event records in the event group with those of each pattern definition group stored in the database to obtain a match count and a mismatch count for each pattern definition group, wherein the match count is obtained by counting matching event records, and wherein the mismatch count is obtained by counting missing event records in a pattern definition group when the event group contains more event records than the pattern definition group being compared or by counting mismatched event records when the event group contains fewer event records than the pattern definition group being compared; sorting the pattern definition groups in descending order of match counts thereof; sorting locally the pattern definition groups with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted pattern definition groups; and extracting a troubleshooting record that has previously been associated with the first one of the sorted pattern definition groups, the troubleshooting record indicating which target object is considered a source of a problem.
-
-
11. A computer-readable storage medium storing an operation management program for managing a server, the program causing a computer to perform operations comprising:
-
collecting records of commands entered to the server; grouping a plurality of collected command records into an operation log; providing a database storing a plurality of operation patterns each defining a pattern of a plurality of commands that could lead to a problem; comparing the command records in the operation log with those of each operation pattern stored in the database to obtain a match count and a mismatch count for each operation pattern, wherein the match count is obtained by counting matching command records, and wherein the mismatch count is obtained by counting missing command records in an operation pattern when the operation log contains more command records than the operation pattern being compared or by counting mismatched command records when the operation log contains fewer command records than the operation pattern being compared; sorting the operation patterns in descending order of match counts thereof; sorting locally the operation patterns with equal match counts in ascending order of mismatch counts thereof, thereby producing sorted operation patterns; and extracting a troubleshooting record that has previously been associated with the first one of the sorted operation patterns, the troubleshooting record indicating which target object is considered a source of a problem.
-
Specification