US20150006960A1 - Operations management apparatus, operations management method and program thereof - Google Patents

Operations management apparatus, operations management method and program thereof Download PDF

Info

Publication number
US20150006960A1
US20150006960A1 US14488893 US201414488893A US2015006960A1 US 20150006960 A1 US20150006960 A1 US 20150006960A1 US 14488893 US14488893 US 14488893 US 201414488893 A US201414488893 A US 201414488893A US 2015006960 A1 US2015006960 A1 US 2015006960A1
Authority
US
Grant status
Application
Patent type
Prior art keywords
correlation
monitored
detecting
common
destruction
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
US14488893
Inventor
Kentarou Yabuki
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
NEC Corp
Original Assignee
NEC Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/07Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/079Root cause analysis, i.e. error or fault diagnosis
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/07Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/0703Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
    • G06F11/0751Error or fault detection not based on redundancy
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/30Monitoring
    • G06F11/34Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3466Performance evaluation by tracing or monitoring
    • G06F11/3495Performance evaluation by tracing or monitoring for systems

Abstract

An operations management apparatus, includes a correlation model storing unit which stores a correlation model including one or more correlation functions each of which indicates a correlation between pieces of sequence information out of a plural types of sequence information, for each of plural monitored objects and a correlation destruction detecting unit which detects correlation destruction related to a correlation which is included in said correlation model by applying inputted said sequence information of said monitored object to said correlation model of said monitored object which said correlation model storing unit stores; and a fault analyzing unit which determines and outputs said monitored object through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in said monitored objects which have said correlation models including said common correlation.

Description

  • The present application is a Continuation Application of U.S. patent application Ser. No. 13/579,538, filed on Aug. 16, 2012, which is based on International Application No. PCT/JP2011/079963 filed on Dec. 16, 2011 and Japanese Patent Application No. 2010-282727 filed on Dec. 20, 2010, the entire contents of which are hereby incorporated by reference.
  • TECHNICAL FIELD
  • The present invention relates to an operations management apparatus, an operations management method and a program thereof, and in particular, relates to an operations management apparatus, an operations management method and a program thereof which detect a fault of a system.
  • BACKGROUND ART
  • An example of an operations management system, which detects a fault of a system through generating a system model from time-domain sequential information on system performance and using the generated system model, is disclosed in a patent literature 1.
  • According to the operations management system which is disclosed in the patent literature 1, on the basis of measured values of plural types of performance values on the system, a correlation function for each pair of the plural types is determined, and then a correlation model including a plurality of the correlation functions is generated. Then, the operations managing system judges by use of the generated correlation model whether correlation destruction is caused in the measured performance value which is inputted newly, and identifies a cause of the fault through detecting the performance type which causes the converged correlation destruction.
  • CITATION LIST Patent Literature
    • [Patent Literature 1] Japanese Patent Application Laid-Open No. 2009-199533
    SUMMARY OF INVENTION Technical Problem
  • The operations management system disclosed in the above-mentioned patent literature 1 has a problem that it is difficult to identify the cause of the fault on the basis of the correlation destruction in the case that the fault caused in a certain processing apparatus or the like, which is a monitored object within the system, spreads to the surrounding processing apparatuses or the like, and consequently the correlation destruction is caused in a plurality of the processing apparatuses or the like.
  • An object of the present invention is to solve the problem through providing an operations management apparatus, an operations management method, and a program thereof which can identify a candidate to cause the fault even if the correlation destruction is detected in some processing apparatuses or the like due to the spread of the fault within the system.
  • Solution to Problem
  • A first operations management apparatus according to an exemplary aspect of the invention includes correlation model storing means for storing a correlation model including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects, correlation destruction detecting means for detecting correlation destruction related to a correlation which is included in the correlation model by applying inputted the performance value of the monitored object to the correlation model of the monitored object which the correlation model storing means stores, and fault analyzing means for determining and outputting the monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting the correlation destruction related to a common correlation in a plurality of the monitored objects which are connected directly or indirectly with a common apparatus or common the monitored object and which have the correlation models including the common correlation.
  • A first operations management method according to an exemplary aspect of the invention includes storing a correlation model including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects, detecting correlation destruction related to a correlation which is included in the correlation model by applying inputted the performance value of the monitored object to the correlation model of the monitored object, and determining and outputting the monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting the correlation destruction related to a common correlation in a plurality of the monitored objects which are connected directly or indirectly with a common apparatus or common the monitored object and which have the correlation models including the common correlation.
  • A computer readable storage medium according to an exemplary aspect of the invention, records thereon a program, causing a computer to perform a method including storing a correlation model including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects, detecting correlation destruction related to a correlation which is included in the correlation model by applying inputted the performance value of the monitored object to the correlation model of the monitored object, and determining and outputting the monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting the correlation destruction related to a common correlation in a plurality of the monitored objects which are connected directly or indirectly with a common apparatus or common the monitored object and which have the correlation models including the common correlation.
  • A second operations management apparatus according to an exemplary aspect of the invention includes correlation model storing means for storing a correlation mode including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects, correlation destruction detecting means for detecting correlation destruction related to a correlation which is included in the correlation model by applying inputted the performance value of the monitored object to the correlation model of the monitored object which the correlation model storing means stores, and fault analyzing means for determining and outputting the monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting the correlation destruction related to a common correlation in the plural monitored objects which provide the same function each other, the plural monitored objects receiving a request for processing issued by a common apparatus or common the monitored object or using a result of a process carried out by a common apparatus or common the monitored object.
  • A second operations management method according to an exemplary aspect of the invention includes storing a correlation mode including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects, detecting correlation destruction related to a correlation which is included in the correlation model by applying inputted the performance value of the monitored object to the correlation model of the monitored object, and determining and outputting the monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting the correlation destruction related to a common correlation in the plural monitored objects which provide the same function each other, the plural monitored objects receiving a request for processing issued by a common apparatus or common the monitored object or using a result of a process carried out by a common apparatus or common the monitored object.
  • Advantageous Effect of Invention
  • An effect of the present invention is that it is possible to identify the cause of the fault even if the correlation destruction is detected in some processing apparatuses or the like due to the spread of the fault within the system.
  • BRIEF DESCRIPTION OF DRAWINGS
  • FIG. 1 A block diagram showing a characteristic configuration according to a first exemplary embodiment of the present invention.
  • FIG. 2 A block diagram showing a configuration of an operations management system which uses an operations management apparatus 100 according to the first exemplary embodiment of the present invention.
  • FIG. 3 A diagram showing an example of connections between monitored apparatuses 200 according to the first exemplary embodiment of the present invention.
  • FIG. 4 A diagram showing an example of performance sequence information 121 according to the first exemplary embodiment of the present invention.
  • FIG. 5 A diagram showing an example of a correlation model 122 according to the first exemplary embodiment of the present invention.
  • FIG. 6 A diagram showing an example of correlation, on which correlation destruction is detected, according to the first exemplary embodiment of the present invention.
  • FIG. 7 A diagram showing an example of spread of a fault according to the first exemplary embodiment of the present invention.
  • FIG. 8 A diagram showing an example of group information 123 according to the first exemplary embodiment of the present invention.
  • FIG. 9 A flowchart showing overall processes of the operations management apparatus 100 according to the first exemplary embodiment of the present invention.
  • FIG. 10 A diagram showing a result of calculating degree of similarity on a result of judging whether detecting or not detecting the correlation destruction according to the first exemplary embodiment of the present invention.
  • FIG. 11 A diagram showing an example of a fault analysis result 130 according to the first exemplary embodiment of the present invention.
  • DESCRIPTION OF EMBODIMENTS First Exemplary Embodiment
  • Next, a first exemplary embodiment according to the present invention will be described.
  • First, a configuration according to the first exemplary embodiment of the present invention will be described. FIG. 2 is a block diagram showing a configuration of an operations management system which uses an operations management apparatus 100 according to the first exemplary embodiment of the present invention.
  • With reference to FIG. 2, the operations management system according to the first exemplary embodiment of the present invention includes the operations management apparatus (monitoring control apparatus) 100 and a plurality of monitored apparatuses 200.
  • The operations management apparatus 100, on the basis of performance information collected from the monitored apparatus 200 which is the monitored object, generates a correlation model 122 for each monitored object (monitored apparatus 200), and carries out a fault analysis on the monitored object (monitored apparatus 200) by use of the generated correlation model.
  • The monitored apparatus 200 is a component of a system which provides a user with a service. For example, a Web server, an application server (AP server), a database server (DB server) and the like are exemplified as the monitored apparatus 200.
  • FIG. 3 is a diagram showing an example of connections between the monitored apparatuses 200 according to the first exemplary embodiment of the present invention. According to the example shown in FIG. 3, the monitored apparatuses 200 compose a hierarchical system which includes a Web server layer, an AP server layer and a DB server layer. The monitored apparatuses 200 with apparatus identifiers SV1 to SV4 are the Web servers. Moreover, the monitored apparatuses 200 with apparatus identifiers SV5 to SV8 are the AP servers. Furthermore, the monitored apparatuses 200 with apparatus identifiers SV9 and SV10 are the DB servers.
  • Each of the monitored apparatuses 200 included in the Web server layer is connected with each of the monitored apparatuses 200 included in the AP server layer. Moreover, each of the monitored apparatuses 200 included in the AP server layer is connected with each of the monitored apparatuses 200 included in the DB server layer. A request from a user to the system via a network is transferred to each of the monitored apparatuses 200, which is included in the Web server layer, by a load balancer 300. Then, each of the monitored apparatuses 200 included in the Web server layer transfers the request, for example, at random to each of the monitored apparatuses 200 included in the AP server layer.
  • Moreover, each of the monitored apparatuses 200 measures performance values of plural items at a periodical interval and sends the measured data (measured value) to the operations management apparatus 100. Here, for example, a rate of using CPU (Central Processing Unit) (hereinafter, the rate is denoted as CPU_U), an amount of used memory (hereinafter, denoted as MEM_U), an amount of used disk (hereinafter, denoted as Disk_U), a rate of input/output of disk (Disk_IO), the number of received packets (Packet_R), the number of sent packets (Packet_S) or the like is measured as the item of the performance value.
  • Here, a set of the monitored apparatus 200 and the item of the performance value is defined as a type of the performance value (performance type (or abbreviated as type)), and a set of the plural types of the performance values measured at the same time is defined as the performance information.
  • The operations management apparatus 100 includes a performance information collecting unit 101, a correlation model generating unit 102, a correlation destruction detecting unit 104, a fault analyzing unit 105, a display unit 106, a performance information storing unit 111, a correlation model storing unit 112, a group information storing unit 113 and a correlation destruction storing unit 114.
  • Here, the performance information collecting unit 101 collects the performance information from the monitored apparatus 200, and makes the performance information storing unit 111 store a time-domain sequential change of the performance information as performance sequence information 121.
  • FIG. 4 is a diagram showing an example of the performance sequence information 121 according to the first exemplary embodiment of the present invention. According to the example in FIG. 4, the performance sequence information 121 includes a rate of using CPU (SV1.CPU_U), an amount of used memory (SV1.MEM_U), an amount of used disk (SV1.Disk_U) and a rate of input/output of disk (SV1.Disk_IO) of the monitored apparatus 200 with apparatus identifier SV1, a rate of using CPU (SV2.CPU_U) of the monitored apparatus 200 with apparatus identifier SV2, or the like as the performance type.
  • The correlation model generating unit 102 generates the correlation model 122 for each of the monitored apparatuses 200 on the basis of the performance sequence information 121. Here, for each of the monitored apparatuses 200, the correlation model generating unit 102 determines a correlation function (conversion function), which indicates a correlation for a pair of performance types of performance values out of the plural performance types, on the basis of the performance sequence information 121 which is collected for a predetermined period of time, and generates the correlation model 122 which includes the determined correlation function. The correlation function estimates, on the basis of a time-domain sequence of measured values of one performance type, the time-domain sequence of the performance value of the other performance type. The correlation function is determined in the system identifying process which is applied to the time-domain sequences of the measured values of a pair of performance types, as shown in the patent literature 1. The correlation model generating unit 102 may calculate a weight for each correlation function on the basis of an average value of conversion error which is caused by the correlation function. Here, the weight becomes small as the average value of the conversion error becomes large. Then, the correlation model generating unit 102 may make only the correlation function, which has the large weight, included in the correlation model 122.
  • The correlation model storing unit 112 stores the correlation model 122 generated by the correlation model generating unit 102.
  • FIG. 5 is a diagram showing an example of the correlation model 122 according to the first exemplary embodiment of the present invention. In FIG. 5, each node means the performance type, and an arrow indicated by a solid line between the nodes means the correlation from one out of two performance types to the other. According to the example in FIG. 5, the correlation model 122 related to each of the monitored apparatuses 200 with apparatus identifiers SV1 to SV4 includes the correlation from CPU_U to MEM_U, from CPU_U to Disk_U, from MEM_U to Packet_S, and from MEM_U to Packet_R. The correlation model 122 related to each of the monitored apparatuses 200 with apparatus identifiers SV5 to SV8 includes the correlation from CPU_U to MEM_U, from CPU_U to Disk_IO, from CPU_U to Packet_S, from MEM_U to Disk_U, and from Packet_S to Packet_R. Moreover, the correlation function (not shown) related to each of the correlations is determined.
  • The correlation destruction detecting unit 104 detects correlation destruction related to the correlation included in the correlation model 122 of each monitored apparatus 200 by use of the performance information which is inputted newly, and the correlation model 122 which the correlation model storing unit 112 stores. Similarly to the art disclosed in the patent literature 1, in the case that a difference between a value which is obtained through inputting a measured value of one of a pair of performance types among the plural performance types into the correlation function related to the pair of performance types and a measured value of the other of the pair of performance types is equal to or greater than a predetermined value, the correlation destruction detecting unit 104 judges that the correlation destruction for the pair of performance types is detected.
  • The correlation destruction storing unit 114 stores correlation destruction information 124 indicating the correlation on which the correlation destruction is detected by the correlation destruction detecting unit 104.
  • FIG. 6 is a diagram showing an example of the correlation on which the correlation destruction is detected, according to the first exemplary embodiment of the present invention. In FIG. 6, an arrow indicated by a dotted line means the correlation on which the correlation destruction is detected.
  • Here, the correlation destruction, which is caused due to spread of a fault, according to the first exemplary embodiment of the present invention will be described. FIG. 7 is a diagram showing an example of the spread of the fault according to the first exemplary embodiment of the present invention.
  • Here, monitored apparatuses 200 with apparatus identifiers SV1 to SV4, which belong to the Web layer, carry out a similar process each other. Moreover, monitored apparatuses 200 with apparatus identifiers SV5 to SV8, which belong to the AP layer, carry out a similar process each other. Moreover, monitored apparatuses 200 with apparatus identifiers SV9 and SV10, which belong to the DB layer, carry out a similar process each other. Consequently, influence of the fault caused in the other monitored apparatus 200, which is connected directly or indirectly with the monitored apparatuses 200 belonging to the same layer, spreads commonly to the monitored apparatuses 200 belonging to the same layer. Therefore, it is appropriate to consider that a result of judging whether detecting or not detecting the correlation destruction (place where correlation destruction is caused) related to each common correlation is similar among the correlation models 122 of the monitored apparatuses 200 of each layer.
  • Moreover, it is appropriate to consider that, in the case that the fault is caused in a certain monitored apparatus 200 belonging to a certain layer, the results of judging whether detecting or not detecting the correlation destruction related to each common correlation in the correlation models 122 are different between the monitored apparatus 200 in which the fault is caused and the other monitored apparatuses 200 belonging to the layer.
  • According to the example in FIG. 7, the fault is caused in the monitored apparatus 200 with apparatus identifier SV7, which belongs to the AP layer, in the hierarchical system shown in FIG. 3. In this case, the correlation destruction due to the fault of the monitored apparatus 200 is caused in the correlation model 122 of the monitored apparatus 200 with apparatus identifier SV7.
  • Then, influence of the fault caused in the monitored apparatus 200 with apparatus identifier SV7 spreads to the monitored apparatuses 200 with apparatus identifiers SV1 to SV4 which belong to the Web server layer and which are connected directly with the monitored apparatus 200 causing the fault. For example, due to the fault of the monitored apparatus 200 with apparatus identifier SV7, a plurality of replies to requests which the monitored apparatuses 200 with apparatus identifiers SV1 to SV4 send to the monitored apparatus 200 with apparatus identifier SV7 are delayed, and consequently congestion of the request is caused in the monitored apparatuses 200 with apparatus identifiers SV1 to SV4. In this case, the result of judging whether detecting or not detecting the correlation destruction related to each common relation is similar each other among the monitored apparatuses 200 with apparatus identifiers SV1 to SV4.
  • Furthermore, the influence of the fault caused in the monitored apparatus 200 with apparatus identifier SV7 spreads to the monitored apparatuses 200 with apparatus identifiers SV5, SV6, and SV8 which are connected indirectly, that is, which are connected via the monitored apparatuses 200 with apparatus identifiers SV1 to SV4, with the monitored apparatus 200 causing the fault. For example, delay in communication between each of the monitored apparatuses 200 with apparatus identifiers SV5, SV6 and SV8 and each of the monitored apparatuses 200 with apparatus identifiers SV1 to SV4 is caused due to the congestion of the request, which is caused in the monitored apparatuses 200 with apparatus identifiers SV1 to SV4. In this case, the results of judging whether detecting or not detecting the correlation destruction related to each common correlation are different between the monitored apparatus 200 with apparatus identifier SV7 in which the fault is caused and the monitored apparatuses 200 with apparatus identifiers SV5, SV6 and SV8 to which the fault spreads.
  • Accordingly, it is possible to identify the monitored apparatus 200, which should be a candidate to cause the fault, through comparing the results of judging whether detecting or not detecting the correlation destruction related to each common correlation in the monitored apparatuses 200 included in each layer, and extracting one monitored apparatus 200 with the different result from the results of the other monitored apparatuses 200.
  • The group information storing unit 113 stores group information 123. FIG. 8 is a diagram showing an example of the group information 123 according to the first exemplary embodiment of the present invention. The group information 123 includes a group identifier which identifies a group, and the apparatus identifier of the monitored apparatus 200 which is included in the group.
  • Each group in the group information 123 is set in such a way that the monitored apparatuses 200, which are connected directly or indirectly with another common monitored apparatus 200 and have the common correlation (correlation model 122 is similar), are included in the same group.
  • According to the first exemplary embodiment of the present invention, each layer in the hierarchical system shown in FIG. 3 is set as the group. According to the example shown in FIG. 8, the Web server layer, the AP server layer and the DB server layer of the hierarchical system shown in FIG. 3 are set by a manager or the like in advance as the groups with group identifiers GP1, GP2 and GP3.
  • The fault analyzing unit 105 identifies the monitored apparatus 200, which should be the candidate to cause the fault (fault causing candidate), through comparing the results of judging whether detecting or not detecting the correlation destruction related to each common correlation in the monitored apparatuses 200 included in each group, on the basis of the group information 123 and the correlation destruction information 124, and outputs the identification.
  • Here, the operations management apparatus 100 may include CPU (Central Processing Unit) and a storage medium, which stores a program, and works as a computer which operates with control based on the program. Moreover, the performance information storing unit 111, the correlation model storing unit 112, the group information storing unit 113 and the correlation destruction storing unit 114 may be installed in different storage media or in one storage medium.
  • Next, an operation of the operations management apparatus 100 according to the first exemplary embodiment of the present invention will be described.
  • FIG. 9 is a flowchart showing overall processes of the operations management apparatus 100 according to the first exemplary embodiment of the present invention.
  • First, the correlation model generating unit 102 of the operations management apparatus 100 generates a correlation model 122 of each of monitored apparatuses 200 on the basis of performance sequence information 121 which the performance information storing unit 111 stores. The correlation model generating unit 102 makes the correlation model storing unit 112 store the generated correlation models 122 (Step S101).
  • For example, the correlation model generating unit 102 generates the correlation models 122 of the monitored apparatuses 200 with apparatus identifiers SV1 to SV8, by use of the performance sequence information 121 shown in FIG. 4, as shown in FIG. 5.
  • Next, the correlation destruction detecting unit 104 detects correlation destruction related to a correlation included in the correlation model 122 of each of monitored apparatuses 200 by use of performance information which is inputted newly from the information collecting unit 101, and the correlation model 122 which the correlation model storing unit 112 stores. The correlation destruction detecting unit 104 generates correlation destruction information 124, which indicates the detected correlation, and makes the correlation destruction storing unit 114 store the correlation destruction information 124 (Step S102).
  • For example, as shown in FIG. 6, the correlation destruction detecting unit 104 detects the correlation destruction related to the correlation models 122 of the monitored apparatuses 200 with apparatus identifiers SV1 to SV8 shown in FIG. 5.
  • Next, the fault analyzing unit 105, through comparing the results of judging whether detecting or not detecting the correlation destruction related to each common correlation (place where the fault is detected) in the monitored apparatuses 200 which are included in each group indicated by group information 123, determines that the monitored apparatus 200 with the different result from the other results of monitored apparatuses 200 belonging to the group is a fault causing candidate (Step S103).
  • Here, the fault analyzing unit 105 calculates degree of similarity on the result of judging whether detecting or not detecting the correlation destruction related to each common correlation in the monitoring apparatuses 200 of each group, and determines that the monitored apparatus 100, whose degree of the similarity is equal to or smaller than a predetermined value, is the fault causing candidate, or determines that a predetermined number of the monitored apparatuses 200, which are selected in an order of the low degree of the similarity, are the fault causing candidates. With regard to a method for calculating the degree of the similarity, any method is applicable as far as it is possible to compare the results of judging whether detecting or not detecting the correlation destruction related to each common correlation in a plurality of the correlation models 122.
  • For example, in the case that the cosine type degree of the similarity between a vector whose element is the result of judging whether detecting or not detecting the correlation destruction related to each common correlation, and an average vector of the above-mentioned vectors related to the monitored apparatuses 200 belonging to the group is used as the degree of the similarity, the fault analyzing unit 105 calculates the degree of the similarity Si related to the monitored apparatus i, which is included in the group, by use of equation 1 shown in the following.
  • S i = B i · B avg ( B i × B avg ) wherein B i = ( b i , 1 b i , 2 b i , M ) B avg = ( i B i ) / N [ Equation 1 ]
  • correlation destruction related to correlation j of monitored apparatus i:
  • b i , j = { 0 ( in case of existence correlation destruction ) 1 ( in case of no existence of correlation destruction )
  • i=1, 2, . . . , N (number of monitored apparatuses in group)
    j=1, 2, . . . , M (number of correlations)
  • FIG. 10 is a diagram showing a result of calculating the degree of the similarity on the result of judging whether detecting or not detecting the correlation destruction according to the first exemplary embodiment of the present invention.
  • For example, the fault analyzing unit 105 calculates the degree of the similarity on the correlation destruction shown in FIG. 6, as shown in FIG. 10. Here, in the case that four monitored apparatuses 200 are selected in an order of low degree of the similarity and are determined to be the fault causing candidates, the fault analyzing unit 105 determines that the monitored apparatuses 200 with apparatus identifiers SV5 to SV8 are the fault causing candidates.
  • Note that, it may be preferable that the fault analyzing unit 105 calculates degree of coincidence, instead of the degree of the similarity, through comparing the vector, whose element is the result of judging whether detecting or not detecting the correlation destruction, with a reference vector which is calculated with a predetermined method, and the fault analyzing unit 105 determines that the monitored apparatus 200 whose degree of the coincidence is equal to or greater than a predetermined value is the fault causing candidate, or determines that a predetermined number of the monitored apparatuses 200 which are selected in an order of low degree of the coincidence are the fault causing candidates. In this case, the fault analyzing unit 105 calculates the reference vector, for example, through calculating a logical sum of the vector Bi (i=1, . . . , N), whose element is the result of judging whether detecting or not detecting the correlation destruction, in the equation 1, and calculates the degree of the coincidence on the basis of number of the coincident elements when comparing the elements of each vector Bi with the elements of the reference vector.
  • Next, the fault analyzing unit 105 outputs a fault analysis result 130 including information on the monitored apparatus 200, which is the fault causing candidate, to the display unit 106 (Step S104).
  • FIG. 11 is a diagram showing an example of the fault analysis result 130 according to the first exemplary embodiment of the present invention. For example, the fault analyzing unit 105 outputs the fault analysis result 130 shown in FIG. 11 to the display unit 106. According to FIG. 11, the fault analysis result 130 includes a fault causing candidate list 131, a correlation destruction detection result 132 and an abnormal score list 133.
  • The fault causing candidate list 131 indicates the apparatus identifier of the monitored apparatus 200 which is the fault causing candidate, and the degree of the similarity of the monitored apparatus 200 which is the fault causing candidate. The apparatus identifiers of the monitored apparatuses 200 with apparatus identifiers SV5 to SV8, which are the fault causing candidates, are shown in an order of low degree of the similarity in the example of FIG. 11.
  • The correlation destruction detection result 132 indicates the correlation on which the correlation destruction is detected, in the monitored apparatus 200 which is the fault causing candidate. According to the example in FIG. 11, the correlation on which the correlation destruction is detected is indicated on the correlation model 122 together with the performance type with regard to the monitored apparatus 200 with apparatus identifier SV7, which has the lowest degree of the similarity and which is selected out of the fault causing candidates by the manager or the like.
  • The abnormal score list 133 indicates the performance type and an abnormal score of the performance type which are related to the correlation on which the correlation destruction is detected, in the monitored apparatus 200 which is the fault causing candidate. Here, the abnormal score, which indicates degree of convergence of the correlation destruction with regard to the performance type, is calculated. The abnormal score is calculated, for example, with the same method as one described in the patent literature 1. According to the example in FIG. 11, the performance types related to the correlations on which the correlation destruction is detected in the monitored apparatus 200 with apparatus identifier SV7 are indicated in an order of high abnormal score.
  • Through referring to the fault analysis result 130 displayed by the display unit 106, the manager can identify the monitored apparatus 200 which should be the fault causing candidate and the performance type in which the convergence of the correlation destruction is caused in the monitored apparatus 200, as an object for investigating the cause of the fault.
  • For example, through referring to the fault analysis result 130 shown in FIG. 11, the manager identifies the monitored apparatus 200 with apparatus identifier SV7 as the investigation object, and consequently the manager can investigate a rate of using CPU, which has high abnormal score, with priority.
  • With that, the operation according to the first exemplary embodiment of the present invention is completed.
  • Next, a characteristic configuration of the first exemplary embodiment of the present invention will be described. FIG. 1 is a block diagram showing a characteristic configuration according to the first exemplary embodiment of the present invention.
  • Referring to FIG. 1, the operations management apparatus 100 includes a correlation model storing unit 112, a correlation destruction detecting unit 104, and a fault analyzing unit 105.
  • Here, the correlation model storing unit 112 stores a correlation model 122 including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects.
  • The correlation destruction detecting unit 104 detects correlation destruction related to a correlation which is included in the correlation model 122 by applying inputted the performance value of the monitored object to the correlation model 122 of the monitored object which the correlation model storing unit 112 stores.
  • The fault analyzing unit 105 determines and outputs the monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting the correlation destruction related to a common correlation in a plurality of the monitored objects which are connected directly or indirectly with a common apparatus or common the monitored object and which have the correlation models 122 including the common correlation.
  • According to the first exemplary embodiment of the present invention, an operations management apparatus 100, which detects a fault of a system on the basis of correlation destruction on a correlation model 122, can identify a candidate to cause the fault even if the correlation destruction is detected in a plurality of processing apparatuses or the like due to the spread of the fault of the system. The reason is that a fault analyzing unit 105 identifies a monitored apparatus 200, which should be a fault causing candidate, through comparing results of judging whether detecting or not detecting correlation destruction related to each common correlation in a plurality of the monitored apparatuses 200 which are connected directly or indirectly with a common apparatus or common other monitored apparatus 200 and which have correlation models 122 including the common correlation.
  • According to the first exemplary embodiment of the present invention, a manager or the like can identify easily a performance type which should be investigated with priority in the monitored apparatus 200 which is the candidate to cause the fault. The reason is that the fault analyzing unit 105 outputs the correlation on which the correlation destruction is detected, which is included in the correlation model 122 of the monitored apparatus 200 determined as the candidate to cause the fault, in association with a type of a performance value related to the correlation.
  • While the invention has been particularly shown and described with reference to exemplary embodiments thereof, the invention is not limited to these embodiments. It will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the claims.
  • For example, while one monitored apparatus 200 is defined as one monitored object, the correlation model 122 is generated for each monitored object, and the monitored object which should be the fault causing candidate is determined according to the first exemplary embodiment of the present invention, the present invention is not limited to the first exemplary embodiment. A plurality of the monitored apparatuses 200 may be defined as one monitored object. Moreover, a logical composition unit which can provide a function on the monitored apparatus 200, such as a virtual machine which works on the monitored apparatus 200, may be defined as one monitored object.
  • Moreover, while the manager or the like sets each layer of the hierarchical system to the group information 123 as a group according to the first exemplary embodiment of the present invention, it may be preferable that a group information generating unit (not shown in the figure) of the operations management apparatus 100 sets the group information 123 in such a way that the monitored apparatuses 200, which have the common correlation (have the similar correlation model 122), are included in the same group through comparing the correlation models 122 of the plural monitored apparatuses 200 which are connected directly or indirectly with the common apparatus or the common other monitored apparatus 200 (for example, through carrying out clustering based on clustering algorithm).
  • This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2010-282727, filed on Dec. 20, 2010, the disclosure of which is incorporated herein in its entirety by reference.
  • REFERENCE SIGNS LIST
      • 100 Operations management apparatus
      • 101 Performance information collecting unit
      • 102 Correlation model generating unit
      • 104 Correlation destruction detecting unit
      • 105 Fault analyzing unit
      • 106 Display unit
      • 111 Performance information storing unit
      • 112 Correlation model storing unit
      • 113 Group information storing unit
      • 114 Correlation destruction storing unit
      • 121 Performance sequence information
      • 122 Correlation model
      • 123 Group information
      • 124 Correlation destruction information
      • 130 Fault analysis result
      • 131 Fault causing candidate list
      • 132 Correlation destruction detection result
      • 133 Abnormal score list
      • 200 Monitored apparatus
      • 300 Load balancer

Claims (16)

    What is claimed is:
  1. 1. An operations management apparatus, comprising:
    a correlation model storing unit which stores a correlation model including one or more correlation functions each of which indicates a correlation between pieces of sequence information out of a plural types of sequence information, for each of plural monitored objects;
    a correlation destruction detecting unit which detects correlation destruction related to a correlation which is included in said correlation model by applying inputted said sequence information of said monitored object to said correlation model of said monitored object which said correlation model storing unit stores; and
    a fault analyzing unit which determines and outputs said monitored object through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in said monitored objects which have said correlation models including said common correlation.
  2. 2. The operations management apparatus according to claim 1, wherein
    said fault analyzing unit determines said monitored object having low degree of similarity on said result of judging whether detecting or not detecting said correlation destruction related to said common correlation in comparison with another monitored object.
  3. 3. The operations management apparatus according to claim 1, wherein
    said plural monitored objects are grouped into a plurality of layers, and each of said monitored objects belonging to one layer out of two adjacent said layers is connected with each of said monitored objects belonging to the other layer, and said correlation models of said monitored objects belonging to each of said plural layers include said common correlation, and
    said fault analyzing unit compares said results of judging whether detecting or not detecting said correlation destruction related to said common correlation in said monitored objects belonging to each of said plural layers.
  4. 4. The operations management apparatus according to claim 1, wherein
    said fault analyzing unit outputs a correlation on which said correlation destruction is detected, which is included in said correlation model of said determined monitored object, in association with a type of sequence information related to said correlation on which said correlation destruction is detected.
  5. 5. The operations management apparatus according to claim 1, further comprising:
    a group information generating unit which extracts a group including said monitored objects each having said correlation model including said common correlation, through comparing said correlation models in said plural monitored objects.
  6. 6. An operations management method, comprising:
    storing a correlation model including one or more correlation functions each of which indicates a correlation between pieces of sequence infoiniation out of a plural types of sequence information, for each of plural monitored objects;
    detecting correlation destruction related to a correlation which is included in said correlation model by applying inputted said sequence information of said monitored object to said correlation model of said monitored object; and
    determining and outputting said monitored object through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in said monitored objects which have said correlation models including said common correlation.
  7. 7. The operations management method according to claim 6, wherein
    said determining determines said monitored object having low degree of similarity on said result of judging whether detecting or not detecting said correlation destruction related to said common correlation in comparison with another monitored object.
  8. 8. The operations management method according to claim 6, wherein
    said plural monitored objects are grouped into a plurality of layers, and each of said monitored objects belonging to one layer out of two adjacent said layers is connected with each of said monitored objects belonging to the other layer, and said correlation models of said monitored objects belonging to each of said plural layers include said common correlation, and
    said determining compares said results of judging whether detecting or not detecting said correlation destruction related to said common correlation in said monitored objects belonging to each of said plural layers.
  9. 9. The operations management method according to claim 6, wherein
    said outputting outputs a correlation on which said correlation destruction is detected, which is included in said correlation model of said determined monitored object, in association with a type of sequence information related to said correlation on which said correlation destruction is detected.
  10. 10. The operations management method according to claim 6, further comprising:
    extracting a group including said monitored objects each having said correlation model including said common correlation, through comparing said correlation models in said plural monitored objects.
  11. 11. A non-transitory computer readable storage medium recording thereon a program, causing a computer to perform a method comprising:
    storing a correlation model including one or more correlation functions each of which indicates a correlation between pieces of sequence information out of a plural types of sequence information, for each of plural monitored objects;
    detecting correlation destruction related to a correlation which is included in said correlation model by applying inputted said sequence information of said monitored object to said correlation model of said monitored object; and
    determining and outputting said monitored object through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in said monitored objects which have said correlation models including said common correlation.
  12. 12. The non-transitory computer readable storage medium according to claim 11, recording thereon said program causing said computer to perform said method, wherein
    said determining determines said monitored object having low degree of similarity on said result of judging whether detecting or not detecting said correlation destruction related to said common correlation in comparison with another monitored object.
  13. 13. The non-transitory computer readable storage medium according to claim 11, recording thereon said program causing said computer to perform said method, wherein
    said plural monitored objects are grouped into a plurality of layers, and each of said monitored objects belonging to one layer out of two adjacent said layers is connected with each of said monitored objects belonging to the other layer, and said correlation models of said monitored objects belonging to each of said plural layers include said common correlation, and
    said determining compares said results of judging whether detecting or not detecting said correlation destruction related to said common correlation in said monitored objects belonging to each of said plural layers.
  14. 14. The non-transitory computer readable storage medium according to claim 11, recording thereon said program causing said computer to perform said method, wherein
    said outputting outputs a correlation on which said correlation destruction is detected, which is included in said correlation model of said determined monitored object, in association with a type of sequence information related to said correlation on which said correlation destruction is detected.
  15. 15. The non-transitory computer readable storage medium according to claim 11, recording thereon said program causing said computer to perform said method, further comprising:
    extracting a group including said monitored objects each having said correlation model including said common correlation, through comparing said correlation models in said plural monitored objects.
  16. 16. An operations management apparatus, comprising:
    correlation model storing means for storing a correlation model including one or more correlation functions each of which indicates a correlation between pieces of sequence information out of a plural types of sequence information, for each of plural monitored objects;
    correlation destruction detecting means for detecting correlation destruction related to a correlation which is included in said correlation model by applying inputted said sequence information of said monitored object to said correlation model of said monitored object which said correlation model storing means stores; and
    fault analyzing means for determining and outputting said monitored object through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in said monitored objects which have said correlation models including said common correlation.
US14488893 2010-12-20 2014-09-17 Operations management apparatus, operations management method and program thereof Pending US20150006960A1 (en)

Priority Applications (5)

Application Number Priority Date Filing Date Title
JP2010282727 2010-12-20
JP2010-282727 2010-12-20
PCT/JP2011/079963 WO2012086824A1 (en) 2010-12-20 2011-12-16 Operation management device, operation management method, and program
US201213579538 true 2012-08-16 2012-08-16
US14488893 US20150006960A1 (en) 2010-12-20 2014-09-17 Operations management apparatus, operations management method and program thereof

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US14488893 US20150006960A1 (en) 2010-12-20 2014-09-17 Operations management apparatus, operations management method and program thereof

Related Parent Applications (2)

Application Number Title Priority Date Filing Date
PCT/JP2011/079963 Continuation WO2012086824A1 (en) 2010-12-20 2011-12-16 Operation management device, operation management method, and program
US201213579538 Continuation 2012-08-16 2012-08-16

Publications (1)

Publication Number Publication Date
US20150006960A1 true true US20150006960A1 (en) 2015-01-01

Family

ID=46314089

Family Applications (2)

Application Number Title Priority Date Filing Date
US13579538 Active 2032-08-19 US8874963B2 (en) 2010-12-20 2011-12-16 Operations management apparatus, operations management method and program thereof
US14488893 Pending US20150006960A1 (en) 2010-12-20 2014-09-17 Operations management apparatus, operations management method and program thereof

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US13579538 Active 2032-08-19 US8874963B2 (en) 2010-12-20 2011-12-16 Operations management apparatus, operations management method and program thereof

Country Status (5)

Country Link
US (2) US8874963B2 (en)
EP (1) EP2657843A4 (en)
JP (1) JP5267749B2 (en)
CN (1) CN103262048B (en)
WO (1) WO2012086824A1 (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150026521A1 (en) * 2012-01-23 2015-01-22 Nec Corporation Operation management apparatus, operation management method, and program
US20150127987A1 (en) * 2010-06-07 2015-05-07 Nec Corporation Fault detection apparatus, a fault detection method and a program recording medium

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP5418610B2 (en) * 2010-02-15 2014-02-19 日本電気株式会社 Failure Cause extractor, failure cause extraction method and program storage medium
CN103262048B (en) * 2010-12-20 2016-01-06 日本电气株式会社 Operations management apparatus, the operation management method and a program
JP5937209B2 (en) * 2012-07-03 2016-06-22 株式会社日立製作所 Failure impact assessment system and evaluation methods
US9898525B2 (en) 2012-12-17 2018-02-20 Nec Corporation Information processing device which carries out risk analysis and risk analysis method
US20150363250A1 (en) * 2013-02-18 2015-12-17 Nec Corporation System analysis device and system analysis method
US20160117622A1 (en) * 2013-05-22 2016-04-28 Nec Corporation Shared risk group management system, shared risk group management method, and shared risk group management program
WO2014208002A1 (en) * 2013-06-25 2014-12-31 日本電気株式会社 System analysis device, system analysis method and system analysis program

Citations (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030101033A1 (en) * 2001-10-26 2003-05-29 Statoil Asa Method of combining spatial models
US20040059544A1 (en) * 2001-08-06 2004-03-25 Itzhak Smocha Software system and methods for analyzing the performance of a server
US20040123293A1 (en) * 2002-12-18 2004-06-24 International Business Machines Corporation Method and system for correlating transactions and messages
US20060294220A1 (en) * 2005-06-22 2006-12-28 Microsoft Corporation Diagnostics and resolution mining architecture
US20070177523A1 (en) * 2006-01-31 2007-08-02 Intec Netcore, Inc. System and method for network monitoring
US20080004841A1 (en) * 2006-06-30 2008-01-03 Hitachi, Ltd. Computer system and method for controlling computer system
US20090157577A1 (en) * 2007-12-18 2009-06-18 Siddharth Chauhan Method and apparatus for optimizing models for extracting dose and focus from critical dimension
US20090187412A1 (en) * 2008-01-18 2009-07-23 If Analytics Llc Correlation/relationship and forecasting generator
US20090217099A1 (en) * 2008-02-25 2009-08-27 Kiyoshi Kato Operations management apparatus, operations management system, data processing method, and operations management program
US20090216624A1 (en) * 2008-02-25 2009-08-27 Kiyoshi Kato Operations management apparatus, operations management system, data processing method, and operations management program
US7661031B2 (en) * 2006-12-28 2010-02-09 International Business Machines Corporation Correlating macro and error data for debugging program error event
US20100192226A1 (en) * 2005-03-10 2010-07-29 Noel Steven E Intrusion Event Correlation System
US20100205483A1 (en) * 2009-02-12 2010-08-12 Ken Ishiou Operation management apparatus and method thereof
US20110161743A1 (en) * 2008-09-18 2011-06-30 Kiyshi Kato Operation management device, operation management method, and operation management program
US20110214020A1 (en) * 2010-03-01 2011-09-01 Microsoft Corporation Root cause problem identification through event correlation
US20110246837A1 (en) * 2009-10-15 2011-10-06 Kiyoshi Kato System operations management apparatus, system operations management method and program storage medium
US20120123994A1 (en) * 2010-11-17 2012-05-17 Bank Of America Corporation Analyzing data quality
US20120136629A1 (en) * 2009-06-11 2012-05-31 Kenji Tamaki Apparatus abnormality monitoring method and system
US20120185737A1 (en) * 2010-06-07 2012-07-19 Ken Ishiou Fault detection apparatus, a fault detection method and a program recording medium
US8381038B2 (en) * 2009-05-26 2013-02-19 Hitachi, Ltd. Management server and management system
US20130159778A1 (en) * 2010-12-20 2013-06-20 Kentarou Yabuki Operations management apparatus, operations management method and program thereof
US20140058798A1 (en) * 2012-08-24 2014-02-27 o9 Solutions, Inc. Distributed and synchronized network of plan models
US8719636B2 (en) * 2010-02-15 2014-05-06 Nec Corporation Apparatus method, and storage medium for fault cause extraction utilizing performance values
US8954713B2 (en) * 2011-07-26 2015-02-10 International Business Machines Corporation Using predictive determinism within a streaming environment
US9148496B2 (en) * 2011-07-26 2015-09-29 International Business Machines Corporation Dynamic runtime choosing of processing communication methods
US20160306727A1 (en) * 2012-11-20 2016-10-20 Nec Corporation Operation management apparatus and operation management method

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7552447B2 (en) * 2004-05-26 2009-06-23 International Business Machines Corporation System and method for using root cause analysis to generate a representation of resource dependencies
JP4573179B2 (en) 2006-05-30 2010-11-04 日本電気株式会社 Performance abnormal load detection system, the performance load abnormality detecting method, and program
JPWO2007148562A1 (en) * 2006-06-22 2009-11-19 日本電気株式会社 Sharing management system, sharing management method and program
US7992040B2 (en) * 2009-02-20 2011-08-02 International Business Machines Corporation Root cause analysis by correlating symptoms with asynchronous changes
US8774023B2 (en) * 2010-09-22 2014-07-08 At&T Intellectual Property I, Lp Method and system for detecting changes in network performance

Patent Citations (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040059544A1 (en) * 2001-08-06 2004-03-25 Itzhak Smocha Software system and methods for analyzing the performance of a server
US20030101033A1 (en) * 2001-10-26 2003-05-29 Statoil Asa Method of combining spatial models
US20040123293A1 (en) * 2002-12-18 2004-06-24 International Business Machines Corporation Method and system for correlating transactions and messages
US20100192226A1 (en) * 2005-03-10 2010-07-29 Noel Steven E Intrusion Event Correlation System
US20060294220A1 (en) * 2005-06-22 2006-12-28 Microsoft Corporation Diagnostics and resolution mining architecture
US20070177523A1 (en) * 2006-01-31 2007-08-02 Intec Netcore, Inc. System and method for network monitoring
US20080004841A1 (en) * 2006-06-30 2008-01-03 Hitachi, Ltd. Computer system and method for controlling computer system
US7661031B2 (en) * 2006-12-28 2010-02-09 International Business Machines Corporation Correlating macro and error data for debugging program error event
US20090157577A1 (en) * 2007-12-18 2009-06-18 Siddharth Chauhan Method and apparatus for optimizing models for extracting dose and focus from critical dimension
US20090187412A1 (en) * 2008-01-18 2009-07-23 If Analytics Llc Correlation/relationship and forecasting generator
US20090217099A1 (en) * 2008-02-25 2009-08-27 Kiyoshi Kato Operations management apparatus, operations management system, data processing method, and operations management program
US20090216624A1 (en) * 2008-02-25 2009-08-27 Kiyoshi Kato Operations management apparatus, operations management system, data processing method, and operations management program
US20110161743A1 (en) * 2008-09-18 2011-06-30 Kiyshi Kato Operation management device, operation management method, and operation management program
US20100205483A1 (en) * 2009-02-12 2010-08-12 Ken Ishiou Operation management apparatus and method thereof
US8381038B2 (en) * 2009-05-26 2013-02-19 Hitachi, Ltd. Management server and management system
US20120136629A1 (en) * 2009-06-11 2012-05-31 Kenji Tamaki Apparatus abnormality monitoring method and system
US20110246837A1 (en) * 2009-10-15 2011-10-06 Kiyoshi Kato System operations management apparatus, system operations management method and program storage medium
US8719636B2 (en) * 2010-02-15 2014-05-06 Nec Corporation Apparatus method, and storage medium for fault cause extraction utilizing performance values
US20110214020A1 (en) * 2010-03-01 2011-09-01 Microsoft Corporation Root cause problem identification through event correlation
US20120185737A1 (en) * 2010-06-07 2012-07-19 Ken Ishiou Fault detection apparatus, a fault detection method and a program recording medium
US20120123994A1 (en) * 2010-11-17 2012-05-17 Bank Of America Corporation Analyzing data quality
US20130159778A1 (en) * 2010-12-20 2013-06-20 Kentarou Yabuki Operations management apparatus, operations management method and program thereof
US8954713B2 (en) * 2011-07-26 2015-02-10 International Business Machines Corporation Using predictive determinism within a streaming environment
US9148496B2 (en) * 2011-07-26 2015-09-29 International Business Machines Corporation Dynamic runtime choosing of processing communication methods
US20140058798A1 (en) * 2012-08-24 2014-02-27 o9 Solutions, Inc. Distributed and synchronized network of plan models
US20160306727A1 (en) * 2012-11-20 2016-10-20 Nec Corporation Operation management apparatus and operation management method

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150127987A1 (en) * 2010-06-07 2015-05-07 Nec Corporation Fault detection apparatus, a fault detection method and a program recording medium
US9529659B2 (en) * 2010-06-07 2016-12-27 Nec Corporation Fault detection apparatus, a fault detection method and a program recording medium
US20150026521A1 (en) * 2012-01-23 2015-01-22 Nec Corporation Operation management apparatus, operation management method, and program
US9367382B2 (en) * 2012-01-23 2016-06-14 Nec Corporation Apparatus, method, and program product for calculating abnormality based on degree of correlation destruction
US20160239366A1 (en) * 2012-01-23 2016-08-18 Nec Corporation Operation management apparatus, operation management method, and program

Also Published As

Publication number Publication date Type
CN103262048A (en) 2013-08-21 application
WO2012086824A1 (en) 2012-06-28 application
US8874963B2 (en) 2014-10-28 grant
US20130159778A1 (en) 2013-06-20 application
CN103262048B (en) 2016-01-06 grant
EP2657843A4 (en) 2015-08-12 application
JP5267749B2 (en) 2013-08-21 grant
JPWO2012086824A1 (en) 2014-06-05 application
EP2657843A1 (en) 2013-10-30 application

Similar Documents

Publication Publication Date Title
Zhang et al. Ensembles of models for automated diagnosis of system performance problems
US20080195369A1 (en) Diagnostic system and method
Shyur A stochastic software reliability model with imperfect-debugging and change-point
Leitner et al. Runtime prediction of service level agreement violations for composite services
US20100094990A1 (en) Platform-level Indicators of Application Performance
US7369967B1 (en) System and method for monitoring and modeling system performance
US20100198964A1 (en) Computer system, managing apparatus and computer system managing method
US20100205483A1 (en) Operation management apparatus and method thereof
US7376549B2 (en) System performance prediction mechanism and method based on software component performance measurements
US7082381B1 (en) Method for performance monitoring and modeling
US7243265B1 (en) Nearest neighbor approach for improved training of real-time health monitors for data processing systems
US20080097801A1 (en) Method And System For Monitoring Transaction Based System
US20060188011A1 (en) Automated diagnosis and forecasting of service level objective states
US7346803B2 (en) Anomaly detection
US20100046375A1 (en) Congestion Control Using Application Slowdown
US20120054554A1 (en) Problem isolation in a virtual environment
US20080228459A1 (en) Method and Apparatus for Performing Capacity Planning and Resource Optimization in a Distributed System
Ehlers et al. Self-adaptive software system monitoring for performance anomaly localization
Malik et al. Automatic detection of performance deviations in the load testing of large scale systems
US7197428B1 (en) Method for performance monitoring and modeling
US9135351B2 (en) Data processing method and distributed processing system
Pika et al. Predicting deadline transgressions using event logs
US20130311835A1 (en) Forecasting workload transaction response time
Misirli et al. Ai-based software defect predictors: Applications and benefits in a case study
JP2004348640A (en) Method and system for managing network