Abstract: A management computer stores, in a memory, configuration information which indicates, by mapping, a virtual volume recognized by a host computer and a logical volume provided by a storage apparatus, and backup history information which manages a data backup history on a per virtual volume basis. Upon receiving a data backup request designating a virtual volume, the CPU of the management computer refers to the configuration information and acquires information of the logical volume mapped with the designated virtual volume. The CPU additionally refers to the backup history information and determines whether the logical volume currently mapped with the virtual volume coincides with the logical volume associated with the stored history. When it is determined that the mapped logical volume differs from the logical volume associated with the stored history, the CPU performs control to implement a differential backup between the logical volumes.

Abstract: A management computer stores, in a memory, configuration information which indicates, by mapping, a virtual volume recognized by a host computer and a logical volume provided by a storage apparatus, and backup history information which manages a data backup history on a per virtual volume basis. Upon receiving a data backup request designating a virtual volume, the CPU of the management computer refers to the configuration information and acquires information of the logical volume mapped with the designated virtual volume. The CPU additionally refers to the backup history information and determines whether the logical volume currently mapped with the virtual volume coincides with the logical volume associated with the stored history. When it is determined that the mapped logical volume differs from the logical volume associated with the stored history, the CPU performs control to implement a differential backup between the logical volumes.

Abstract: A management computer stores, in a memory, virtual logical volume management information showing information on virtual logical volumes provided to a host computer by a storage device, and pool management information showing information related to a use status of pools. The management computer acquires performance information related to an access to the storage device from the host computer, determines whether the acquired performance related to the access satisfies a predetermined first required performance, or not, and specifies any virtual logical volume which is a cause of the state based on the virtual logical volume management information if the first required performance is not satisfied. The management computer calculates a capacity consumption trend of the real area included in each pool based on the pool management information, creates a countermeasure for satisfying the first required performance implementable after a given time, and outputs the countermeasure to an output device.

Abstract: A management system that generates a plan which is a countermeasure against an event occurring in a computer system includes: a plan generating unit configured to generate a plan according to the event; and an indicator generating unit configured to generate, as a performance change evaluation indicator of the plan, information on a change in performance of a resource of the computer system, which can occur due to other subject's process executed by the other subject different from a subject of the plan when the plan generated by the plan generating unit is executed.

Abstract: A computer management system that manages a plurality of types of managed objects according to one or more meta-rules. In the system, the one or more meta-rules are established by dividing a plurality of relationships among the managed objects into one or more groups based on a change frequency of the relations among the managed objects.

Abstract: A management system manages a plurality of management target devices. A storage device stores one or more rules, plan information, and plan history information. A control device specifies a first cause event that is a candidate of a cause of the event that has occurred in any one of the management target devices based on the one or more rules, specifies a plurality of first plans that can be executed in the case in which the first cause event is a cause based on the plan information, calculates an index value indicating a possibility of succeeding in a failure recovery in the case in which the plan is executed for each of the plurality of first plans based on the plan history information, and displays data indicating any one or more plans of the plurality of first plans according to a display mode decided based on the index value.

Abstract: A computer analyzes the root cause of an event, which has occurred in any of multiple management-target apparatuses, based on one or more rules in a storage device, that denote an association between one or more condition events corresponding to one or more events capable of occurring in any of the multiple management-target apparatuses and a conclusion event, which is the cause in a case where the one or more condition events have occurred. The computer, based on an event occurrence log including contents and an occurrence date and time of an event, determines a first event group, which is multiple events presumed to occur as a result of the same cause, creates a new rule in which the multiple events of the first event group are the condition events and one event of the first event group is the conclusion event, and stores the created new rule.

Abstract: A management system manages a computer system including multiple monitoring-target devices. A storage device of the management system stores a general rule, general plan information, unresolved information, and configuration information. A control device of the management system creates multiple expanded rules based on the general rule and the configuration information, and if an event related to any of the multiple monitoring-target devices has occurred, identifies, based on the multiple expanded rules, a first conclusion event constituting a candidate for the cause of the occurred event, creates, based on the general plan information, one or more expanded plans, which are recovery plans that can be implemented if the first conclusion event is a cause, identifies an unresolved event based on the unresolved information, identifies a risk site based on the identified unresolved event, and displays data showing the first conclusion event, expanded plan, and risk site.

Abstract: In analyzing an elaborate computer system which requires large-scale or numerous event propagation models, a law-of-causality matrix gains size, so that significant amount of storage resources has been used in a management computer. To solve such a problem, the management computer to manage the computer system stores topologies, event propagation models, and causality information including one or more causal relations in the storage resources, determines, when the management computer analyzes or detects an event, whether a causal relation has already been created for the event to be analyzed, and creates the causal relation based on a topology and event propagation models, if not yet.

Abstract: A management system manages a computer system including multiple monitoring-target devices. A storage device of the management system stores a general rule, general plan information, unresolved information, and configuration information. A control device of the management system creates multiple expanded rules based on the general rule and the configuration information, and if an event related to any of the multiple monitoring-target devices has occurred, identifies, based on the multiple expanded rules, a first conclusion event constituting a candidate for the cause of the occurred event, creates, based on the general plan information, one or more expanded plans, which are recovery plans that can be implemented if the first conclusion event is a cause, identifies an unresolved event based on the unresolved information, identifies a risk site based on the identified unresolved event, and displays data showing the first conclusion event, expanded plan, and risk site.

Abstract: To analyze the cause if an event occurred to a plurality of monitoring targets. A monitoring computer 101 includes a general rule storing part 136 configured to store a general rule, wherein the general rule previously associates a first event which can occur in any of the plurality of monitoring targets and a second event which can cause the first event, an correlation rule generating part 129 configured to generate an correlation rule, wherein the correlation rule is created based on the general rule and configuration information, and in the case where a predetermined number or more of events corresponding to the second events are detected, the correlation rule indicates that an event corresponding to the first event will occur, and an analyzing part 125 configured to analyze a cause of an event indicated by the event information based on received event information and the correlation rule.

Abstract: An exemplary event analysis method generates a topology, indicating a correlation between management objects corresponding to a correlation between events defined in selected event propagation model, from configuration management information. It generates, from the selected event propagation model and the topology, a causality indicating a correlation between the causal event identifying an identifier of the management object and the type of the event, and the derivative event sequentially taking place from the causal event. It, in generating the causality, identifies the type of the management object where the derivative event takes place and the type of the event, without identifying the identifier of the management object where the derivative event takes place, when the topology for identifying the identifier of the derivative event is ungeneratable. It performs an event analysis by comparing the generated causality and the event actually taking place at the management target apparatuses.

Abstract: A management system manages a plurality of management target devices. A storage device stores one or more rules, plan information, and plan history information. A control device specifies a first cause event that is a candidate of a cause of the event that has occurred in any one of the management target devices based on the one or more rules, specifies a plurality of first plans that can be executed in the case in which the first cause event is a cause based on the plan information, calculates an index value indicating a possibility of succeeding in a failure recovery in the case in which the plan is executed for each of the plurality of first plans based on the plan history information, and displays data indicating any one or more plans of the plurality of first plans according to a display mode decided based on the index value.

Abstract: When one of nodes performs a prescribed task, a management computer: obtains a replaceable part value group containing configuration information for components of a group that includes the node, and stores the obtained replaceable part value group in history information; receives at least one node to be evaluated; obtains a replaceable part value group containing configuration information for respective components of a group that includes said node to be evaluated, and stores the obtained replaceable part value group in history comparison target information; selects a combination of the history comparison target information and the history information having matching elements; calculates an evaluation value for the selected combination of the history comparison target information and the history information; and outputs a combination of an evaluation value and a node identifier indicating the history comparison target information and the history information having the matching elements.

Abstract: A plurality of multi-purpose diagnostic procedures are associated with a plurality of rules and defined using component types. The rules indicate an association between one or more condition events and a conclusion event. A management system specifies cause candidates based target rules associated with condition events related to the occurrence events, and specifies a multi-purpose diagnostic procedure in association with a target rule that is a basis of a selected cause candidate. The management system creates an expanded diagnostic procedure that is a diagnostic procedure to be performed on one or more management target components for specifying a more specific cause of the selected cause candidate or updating the certainty of the selected cause candidate based on the specified multi-purpose diagnostic procedure and configuration management information that is information about the configuration of a plurality of the management target components.

Abstract: Provided is a management system managing a computer system including apparatuses to be monitored. The management system holds configuration information on the computer system, analysis rules and plan execution effect rules. The analysis rules each associates a causal event that may occur in the computer system with derivative events that may occur by effects of the causal event and defines the causal event and the derivative events with types of components in the computer system. The plan execution effect rules each indicates types of components that may be affected by a computer system configuration change and specifics of the effects. The management system identifies a first event that may occur when a first plan changing the computer system configuration is executed using the plan execution effect rules and the configuration information, and identifies a range where the first event affects using the analysis rules and the configuration information.

Abstract: A management system that generates a plan which is a countermeasure against an event occurring in a computer system includes: a plan generating unit configured to generate a plan according to the event; and an indicator generating unit configured to generate, as a performance change evaluation indicator of the plan, information on a change in performance of a resource of the computer system, which can occur due to other subject's process executed by the other subject different from a subject of the plan when the plan generated by the plan generating unit is executed.

Abstract: A management computer stores, in a memory, virtual logical volume management information showing information on virtual logical volumes provided to a host computer by a storage device, and pool management information showing information related to a use status of pools. The management computer acquires performance information related to an access to the storage device from the host computer, determines whether the acquired performance related to the access satisfies a predetermined first required performance, or not, and specifies any virtual logical volume which is a cause of the state based on the virtual logical volume management information if the first required performance is not satisfied. The management computer calculates a capacity consumption trend of the real area included in each pool based on the pool management information, creates a countermeasure for satisfying the first required performance implementable after a given time, and outputs the countermeasure to an output device.

Abstract: In analyzing an elaborate computer system which requires large-scale or numerous event propagation models, a law-of-causality matrix gains size, so that significant amount of storage resources has been used in a management computer. To solve such a problem, the management computer to manage the computer system stores topologies, event propagation models, and causality information including one or more causal relations in the storage resources, determines, when the management computer analyzes or detects an event, whether a causal relation has already been created for the event to be analyzed, and creates the causal relation based on a topology and event propagation models, if not yet.

Abstract: There is provided a management computer comprising a processor and a storage resource. The processor acquires information on a type of the first management object and the second management object; traces association from the type of the second management object to the type of the first management object; generates a metarule including a condition part and a conclusion part; generates a method of acquiring information on a topology constructed by the association from the type of the second management object to the type of the first management object based on a method of the trace from the type of the second management object to the type of the first management object; acquires the information on the topology based on the generated method; generates an expanded rule from the generated metarule and the acquired information on the topology; and analyzes a detected new failure based on the generated expanded rule.