Abstract: A device carries out a receiving process to receive a message transmitted or received by a server from a communication device connected to the server. The device stores the message in a message storing unit in connection with a time when the receiving process is carried out. The device extracts a message for synchronization from the message storing unit. The device produces log data including identification data to identify the message for synchronization and a time when the message for synchronization is received. The device produces log data including a time when a message other than the message for synchronization is received. The device stores the log data in a log data storing unit. The device transmits the log data stored in the log data storing unit to a log data processing device connected to a network on an opposite side of a firewall connected to the communication device.

Abstract: In determining a condition of a case under which the occurrence rate of the performance abnormality is high based on information related to a resource utilization situation acquired in a resource utilization situation acquisition step and an occurrence frequency of a request acquired in a request occurrence frequency acquisition step, and information related to the existence/nonexistence of the performance abnormality determined in a performance abnormality existence/nonexistence determination step, when branching a parent node that represents a situation of a decision tree to two child nodes using the method of decision tree, the decision tree is generated using an evaluation function which performs branching such that most of normal samples which belong to the parent node are contained in the one child node, and most of abnormal values which belong to the parent node are contained in the other child node.

Abstract: A computer-readable, non-transitory medium stores the system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

Abstract: A system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

Abstract: A scenario creating apparatus which creates a scenario for verifying operation of an information processing system in which a plurality of servers including a database server are connected, includes a collector that collects messages transmitted and received between the plurality of servers, when operation of the information processing system is being verified by a terminal apparatus that performs verification of operation; an association unit that associates the collected messages with each other; a sorter that sorts work models in ascending order of time at which access is made to the database server, the work models each being a group of the associated messages; and a scenario creating unit that creates the scenario on the basis of the sorted work models.

Abstract: An apparatus for analyzing system identifies plural combinations of downlink packet and uplink packet immediately following the downlink packet under predetermined condition, the uplink packet having a predetermined threshold value or more difference time from the received time of the downlink packet to the received time of the uplink packet. And the apparatus calculates chunk processing time by using a difference between the received time of the identified uplink packet and the received time of the identified downlink packet, which are between the time when the packet of a specific processing request to the lower-level server is received and the time when the packet of the response corresponding to the specific processing request is received, and calculates the total sum of the chunk processing times.

Abstract: A system analyzing method for analyzing a transaction system includes firstly extracting a transaction, which is processed by a plurality of servers cooperating with each other in the transaction system, from a message log in which parameters of messages have been subjected to name merge, by using a transaction model which is generated from a set of messages transmitted between the servers during processing of the transaction, and secondly extracting a transaction from a message log from which no transaction is extracted in the firstly extracting, by using a value of a parameter inherited between the servers among parameters in messages included in the message log.

Abstract: After a source address, a destination address, a source port number, and a destination port number are extracted from a communication message and a communication connection and the direction of the communication connection are specified, transmitted/received message amounts every a predetermined elapsed time are determined for each communication connection. Next, a correlation between communication connections is calculated by using the transmitted/received message amounts determined for each communication connection. A server group in which a communication connection group with a high correlation is established is specified and a multilevel system that includes specified servers is determined.

Abstract: A transmission destination of a packet to be transmitted by a web server (11) and an application server (21) incorporated in the same machine (30) is set to a loopback device (50). When a packet is received from one of the servers (11 and 21), the loopback device (50) decides whether or not a combination of a source IP address, a source port number, and a destination port number in the packet is known. If the combination is known, the source IP address and a destination IP address of the received packet are exchanged, and the packet is transmitted to the other server. Further, the packet received from the one of the servers and the packet transmitted to the one of the servers are copied, and the copied packets are transmitted to a communication state visualizing machine (90).

Abstract: A packet identification device has a reception unit that successively receives packets. The device has an obtaining unit that obtains, every time a packet is received, an interval of reception times between the received packet and a packet received immediately before the received packet, in the same connection as that of the received packet. The device has an identification unit that identifies the received packet as a packet containing a forefront segment of a plurality of segments constituting one message when the obtained reception time interval is higher than a predetermined threshold value.

Abstract: A system analyzing apparatus obtains a message group including a message ID, a protocol, a type, and a transmission time of messages transmitted/received in a system where a hierarchical structure of protocols is defined. The apparatus detects pairs of a request message and a response message of the same message ID from the obtained message group. The apparatus identifies a request time and a response time of each of the detected pairs. The apparatus searches for a child-layer pair that has a request time and a response time between the request time and the response time of a parent-layer pair arbitrarily selected from among the pairs and that has a protocol in a layer lower than the protocol of the parent-layer pair on the basis of the identified result. The apparatus outputs the found child-layer pair as a candidate pair having a call relationship with the parent-layer pair.

Abstract: A system analyzing apparatus obtains a message group including a message ID, a protocol, a type, and a transmission time of messages transmitted/received in a system where a hierarchical structure of protocols is defined. The apparatus detects pairs of a request message and a response message of the same message ID from the obtained message group. The apparatus identifies a request time and a response time of each of the detected pairs. The apparatus searches for a child-layer pair that has a request time and a response time between the request time and the response time of a parent-layer pair arbitrarily selected from among the pairs and that has a protocol in a layer lower than the protocol of the parent-layer pair on the basis of the identified result. The apparatus outputs the found child-layer pair as a candidate pair having a call relationship with the parent-layer pair.

Abstract: According to this invention, it is possible to display the overall configuration of a network and, at the same time, an important part of the network in detail according to the objective of monitoring so as to be able to grasp/monitor the important part of the network in detail, while globally grasping/monitoring the network configuration, for the purpose of an efficient monitoring operation on the network configuration. A network configuration management apparatus 100 for managing the configuration of a network 101 formed by connecting a plurality of network devices comprises a topology information acquiring section 11 for acquiring topology information on each of the network devices and a degree of importance determining section 12 for computationally determining the degree of importance of each of the network devices, using the topology information acquired by the topology information acquiring section 11.

Abstract: Apparatus for storing information about collected messages in a message storage mechanism includes a mechanism for detecting a request message and for a process suspended as a suspended process request message, a mechanism for referring to a model storage mechanism to search for a transaction model beginning with a message having the same content as that of the suspended process request message and generating a partial model resulting from exclusion of the messages corresponding to the suspended process request message and a suspension message. Also included are a mechanism for extracting a plurality of messages composing an arrangement of messages similar to that of the partial model, and a mechanism for combining a partial transaction information with at least the suspended process request message, to generate suspended transaction information.

Abstract: The present invention has been made to provide a screen generation program, a screen generation apparatus, and a screen generation method that generate a screen displayed on a client. A screen generation program allows a computer to execute: an acquisition step that acquires first data which is data sent from a server to client and which allows the client to display a first screen for receiving operation performed by a user and second data which is data sent from the client to server and which indicates the operation received by the first screen displayed on the client; and a generation step that generates, based on the first and second data acquired by the acquisition step, third data for displaying a second screen obtained by adding operation information which is based on the second data to the first screen.

Abstract: A complex rotating in the presence of ATP, which has three A subunits, three B subunits and one D subunit constituting the V1 portion of a V0V1,-ATPase.

Abstract: In determining a condition of a case under which the occurrence rate of the performance abnormality is high based on information related to a resource utilization situation acquired in a resource utilization situation acquisition step and an occurrence frequency of a request acquired in a request occurrence frequency acquisition step, and information related to the existence/nonexistence of the performance abnormality determined in a performance abnormality existence/nonexistence determination step, when branching a parent node that represents a situation of a decision tree to two child nodes using the method of decision tree, the decision tree is generated using an evaluation function which performs branching such that most of normal samples which belong to the parent node are contained in the one child node, and most of abnormal values which belong to the parent node are contained in the other child node.

Abstract: A packet processing unit and a session managing unit, which are conventionally arranged in a server, are arranged in a network connecting device, and the network connecting device performs a packet relay process based on session management. As a result, the load on a server is reduced, and a process by the server is performed faster.

Abstract: In order to measure the load on a server and perform its allotment with high efficiency, the communication from a client to a server is monitored. The communication data size per connection is measured as the load on the server, the change of the communication data size per connection is detected, the maximum is recorded, and if the communication data size decreases at the time when the maximum is detected, the load on the server is judged to be heavy.

Abstract: A complex rotating in the presence of ATP, which has three A subunits, three B subunits and one D subunit constituting the V1 portion of a V0V1,-ATPase.