Computer-implemented method, system, and storage medium

• US 9,632,861 B1
• Filed: 12/14/2016
• Issued: 04/25/2017
• Est. Priority Date: 12/16/2015
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Watanabe, Yukihiro, Otsuka, Hiroshi, Asaoka, Masahiro, Yokoyama, Ken
• Primary Examiner(s): Lottich, Joshua P
• Application Number:
  US15/378,916
• Time in Patent Office: 132 Days
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/0787 Storage of error reports, e.g. persistent data storage, storage using memory protection
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 7/08 Sorting, i.e. grouping record carriers in numerical or other ordered sequence according to the classification of at least some of the information they carry by merging two or more sets of carriers in ordered sequence G06F7/16
• CPC Class Codes: H04L 41/0631 using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications

Abstract

A method includes: acquiring messages output by items in the system, each of messages including an output time; referring to the messages and setting item pairs which combine two items among the items, as target item pairs; determining, for each of the item pairs, a strength of relevancy between the target item pairs based on a co-occurrence probability which indicates that a message is output from one of the target item pair within a prescribed time period before or after the output time of a message output from other of the target item pair; and determining a priority ranking for investigating one or more the items among the items other than a certain item based on the strength of relevancy of each of item pairs, as a response to an input of an investigation ranking determination instruction which designates the certain item among the items as an investigation start position.

Claims

1. A computer-implemented method comprising:

acquiring, from a system to be monitored, a plurality of messages output by a plurality of configuration items in the system, each of the plurality of messages including an output time;

referring to the plurality of messages and setting a plurality of configuration item pairs which combine two configuration items among the plurality of configuration items, as target configuration item pairs;

first determining, for each of the plurality of configuration item pairs, a strength of relevancy between the target configuration item pairs based on a first co-occurrence probability which indicates a probability that a message is output from one configuration item of a target configuration item pair within a prescribed time period before or after the output time of a message output from the other configuration item of the target configuration item pair; and

second determining, by a processor, a priority ranking for investigating one or more of the configuration items among the plurality of configuration items other than a certain configuration item based on the strength of relevancy of each of the plurality of configuration item pairs, as a response to an input of an investigation ranking determination instruction which designates the certain configuration item among the plurality of configuration items as an investigation start position.

2. The computer-implemented method according to claim 1, wherein the system includes a plurality of managed machines.

3. The computer-implemented method according to claim 1, further comprising:

receiving the input of the investigation ranking determination instruction.

4. The computer-implemented method according to claim 1, further comprising:

investigating the one or more configuration items according to the determined priority ranking of investigating.

5. The computer-implemented method according to claim 1, further comprising:

outputting a list indicating the one or more configuration items with regard to the determined priority ranking of investigating.

6. The computer-implemented method according to claim 1, wherein:

the first determining includes

extracting, from a plurality of message groups as a co-occurrence message pair, a set of two message groups for which a second co-occurrence probability, which indicates a probability that a message belonging to one message group among the plurality of message groups is output within a certain time period before or after an output time of a message belonging to another message group among the plurality of message groups, is equal to or greater than a threshold, each message group of the plurality of message groups including one or more messages for which a configuration item that output the message and the type of the output message are shared, and

the first co-occurrence probability is the co-occurrence probability of a co-occurrence message pair which is a set of message groups in which respective configuration items that configure the target configuration item pair are output origins of the message.

7. The computer-implemented method according to claim 6, wherein:

the co-occurrence message pair includes a plurality of co-occurrence message pairs, and

the first determining determines the strength of relevancy between the target configuration item pairs based on a co-occurrence probability of a highest value among the first co-occurrence probabilities of each of the plurality of co-occurrence message pairs.

8. The computer-implemented method according to claim 6, wherein:

the co-occurrence message pair includes a plurality of co-occurrence message pairs, and

the first determining determines the strength of relevancy between the target configuration item pairs based on a total value of the first co-occurrence probabilities for each of the plurality of co-occurrence message pairs.

9. The computer-implemented method according to claim 6, wherein:

the first determining determines the strength of relevancy between the target configuration item pairs based on the co-occurrence probability of the co-occurrence message pair and a frequency in which the message belonging to the one message group is output within the certain time period before and after the output time of the message belonging to the other message group.

10. The computer-implemented method according to claim 6, wherein:

the first determining determines the strength of relevancy between the target configuration item pairs based on a number of extractions of the co-occurrence message pairs extracted by the extracting, a co-occurrence probability of the co-occurrence message pair, and a frequency in which the message belonging to the one message group is output within a certain time period before and after the output time of the message belonging to the other message group for each of the co-occurrence message pairs.

11. The computer-implemented method according to claim 6, wherein:

the second determining includes

third determining, as investigation target configuration items, configuration items that can be reached by tracing relevancy of configuration item pairs having a relevancy strength equal to or greater than a predetermined value from the certain configuration item, and

fourth determining the priority ranking of the investigating of the determined investigation target configuration items.

12. The computer-implemented method according to claim 11, wherein:

the third determining includes

calculating a priority level of the investigating based on the relevancy strength traced from the certain configuration item to the investigation target configuration item, based on each of the investigation target configuration items, and

the fourth determining determines the priority ranking of the investigating in response to the calculated priority level of the investigating for each of the investigation target configuration items.

13. The computer-implemented method according to claim 12, wherein:

the extracting includes

setting, as a ranking-dependent co-occurrence message pair, a set of two message groups in which a third co-occurrence probability of a message belonging to the one message group being output within a certain time period after the output of the message belonging to the other message group, is equal to or greater than the threshold, and

setting a set of two message groups in which the second co-occurrence probability is equal to or greater than the threshold, as a ranking-independent co-occurrence message pair,

the first determining includes

calculating a directional strength of relevancy based on the ranking-dependent co-occurrence message pair and a non-directional strength of relevancy based on the ranking-independent co-occurrence message pair, for each of the plurality of configuration item pairs, and

the calculating the priority level of the investigating includes

weighting the directional strength of relevancy higher than the non-directional strength of relevancy.

14. A system comprising:

a memory; and

a processor coupled to the memory and configured to;

acquire, from a system to be monitored, a plurality of messages output by a plurality of configuration items in the system, each of the plurality of messages including an output time,

refer to the plurality of messages and setting a plurality of configuration item pairs which combine two configuration items among the plurality of configuration items, as target configuration item pairs,

determine, for each of the plurality of configuration item pairs, a strength of relevancy between the target configuration item pairs based on a first co-occurrence probability which indicates a probability that a message is output from one configuration item of a target configuration item pair within a prescribed time period before or after the output time of a message output from the other configuration item of the target configuration item pair, and

determine a priority ranking for investigating one or more of the configuration items among the plurality of configuration items other than a certain configuration item based on the strength of relevancy of each of the plurality of configuration item pairs, as a response to an input of an investigation ranking determination instruction which designates the certain configuration item among the plurality of configuration items as an investigation start position.

15. A non-transitory storage medium storing a program for causing a computer to execute a process, the process comprising:

acquiring, from a system to be monitored, a plurality of messages output by a plurality of configuration items in the system, each of the plurality of messages including an output time;

referring to the plurality of messages and setting a plurality of configuration item pairs which combine two configuration items among the plurality of configuration items, as target configuration item pairs;

first determining, for each of the plurality of configuration item pairs, a strength of relevancy between the target configuration item pairs based on a first co-occurrence probability which indicates a probability that a message is output from one configuration item of a target configuration item pair within a prescribed time period before or after the output time of a message output from the other configuration item of the target configuration item pair; and

second determining a priority ranking for investigating one or more of the configuration items among the plurality of configuration items other than a certain configuration item based on the strength of relevancy of each of the plurality of configuration item pairs, as a response to an input of an investigation ranking determination instruction which designates the certain configuration item among the plurality of configuration items as an investigation start position.