Abstract: An event monitoring system includes a processor and a storage unit. The storage unit holds an event message including a character string related to an event occurring in an information system and guide information including one or more guides. The guide includes a guide message including a predetermined character string, notified in response to the event, and information regarding a coping method for the event. The processor compares the event message and the guide, associates the guide with the event in a case where the guide further includes information for identifying a variable portion of the guide message and a portion other than the variable portion of the guide message coincides with a portion other than a portion corresponding to the variable portion in the event message, and receives an input of information indicating a correct answer of a guide to be associated with the event in a case where the guide does not include the information for identifying the variable portion.

Abstract: An automation support device includes a processor and a storage unit. In this automation support device, the storage unit stores a man-hour estimation rule that is a rule for estimating man-hours for automation of a work procedure manual related to a procedure of work. Then, the processor calculates man-hours required for automation of the work procedure manual by using the man-hour estimation rule stored in the storage unit with the work procedure manual and a work execution record which is a record of execution according to the work procedure manual as inputs.

Abstract: An anomaly detection apparatus executes prediction processing to predict fluctuations of a normal range for a value of a parameter in a specified period, correction processing to identify an upper limit value at a local maximum point from fluctuating upper limit values of the predicted normal range, correct the upper limit values of the normal range, identify an upper limit value at a local minimum point from fluctuating upper limit values of the corrected normal range, and correct the upper limit values of the corrected normal range based on the upper limit value at the local minimum point identified, and anomaly detection processing to acquire a value of the parameter in the specified period, determine whether the value of the parameter acquired falls within the corrected normal range, and output predetermined information when determining that the value of the parameter acquired does not fall within the corrected normal range.

Abstract: A personnel management system includes: a storage device that stores management information and a software program; and a processor that refers to the management information and executes the software program. The management information includes job information, for each job, indicating a date and time when the job is to be executed and a skill required for the job, job performance information, for each job, recording a date and time when the job is actually executed and an execution result of the job, skill information indicating the number of necessary personnel having the skill for each skill, and personnel information indicating a skill possessed by the personnel for each skill. The processor specifies a skill in which personnel is insufficient, creates an OJT plan for the insufficient skill, and compares the execution result of the number of personnel having the insufficient skill before and after the OJT is executed.

Abstract: To improve promptness of anomaly detection after occurrence of an event, provided is an anomaly detection apparatus including a processor that executes a program and a storage device that stores the program. The processor executes a correction process of applying a scale transformation to correct second predicted data in time-series first predicted data of a monitoring target, the second predicted data including data after occurrence time of a specific event, and a detection process of detecting an anomaly of the monitoring target based on the second predicted data corrected in the correction process and based on second measured data in time-series first measured data of the monitoring target, the second measured data including data after the occurrence time of the specific event.

Abstract: The present invention aims to specify a bottlenecked resource more accurately in an IT system. In a performance analysis apparatus which includes a processing device, a storage device and an input/output interface and analyzes a performance of an IT system, the processing device creates an overall performance prediction model by using a nonlinear regression algorithm with a first overall performance value being set as an objective variable and with a first resource performance value being set as an explanatory variable, creates an explanatory model by inputting the overall performance prediction model and using an XAI technology and calculates a degree of per-resource influence on the overall performance value which is output by inputting a second resource performance value into the explanatory model.

Abstract: Execution end timing of a jobnet is predicted with stable accuracy. An information processing apparatus executes jobnet execution time prediction model generation processing for generating an execution time prediction model for predicting execution time of a jobnet to be executed on the basis of information associated with execution time of each of previously executed jobnets, a prediction model accuracy determination processing for calculating prediction accuracy for the execution time of each of jobnets by the generated execution time prediction model, and delay determination processing for determining whether to predict execution end timing of a designated jobnet among a jobnet group that is a set of a plurality of jobnets currently being executed or to be subsequently executed on the basis of the execution time prediction model, on the basis of the calculated prediction accuracy for the execution time of each of the jobnets.

Abstract: Aspects relate to determining the presence or absence of concept drift in seasonal time series data. A concept drift detection device including a data input unit for receiving a time series data set that includes a set of past time series data and a set of current time series data, a baseline model generation unit for generating a baseline model based on a subset of the set of past time series data, a feature extraction unit for extracting a set of past data features, a set of baseline data features, and a set of current data features, a distance calculation unit for calculating a baseline distance and a current distance, and a concept drift detection unit for determining, based on a baseline statistic and the current distance, presence or absence of concept drift between the set of current time series data and the set of past time series data.

Abstract: An outlier detection apparatus creates a first processing window having a designated window length and a second processing window having a designated window length, and performs sliding alignment for sliding the second processing window relative to the first processing window by a designated sliding alignment length. The apparatus performs one or more types of outlier sub-detections. The outlier sub-detection includes comparing, by a method corresponding to the type of outlier sub-detection, a real time series dataset which is a data portion corresponding to the first processing window from among real time series data which is a time series of real values, with a forecasted time series dataset which is a data portion corresponding to the second processing window after the sliding alignment from among forecasted time series data which is a time series of forecasted values. The apparatus decides whether an outlier candidate is an outlier.

Abstract: An inter-volume copy time is to be accurately predicted. An operation management system is configured to perform operation management on a storage device including a plurality of resources and a plurality of volumes. In the storage device, IO processing and copy processing are performed between a plurality of volume groups in which the plurality of volumes are collected. The operation management system includes a processor, and the processor is configured to predict an inter-pool copy speed between the plurality of volume groups belonging to a same resource pool in the storage device, and predict an inter-volume copy time based on the predicted inter-pool copy speed.

Abstract: To improve promptness of anomaly detection after occurrence of an event, provided is an anomaly detection apparatus including a processor that executes a program and a storage device that stores the program. The processor executes a correction process of applying a scale transformation to correct second predicted data in time-series first predicted data of a monitoring target, the second predicted data including data after occurrence time of a specific event, and a detection process of detecting an anomaly of the monitoring target based on the second predicted data corrected in the correction process and based on second measured data in time-series first measured data of the monitoring target, the second measured data including data after the occurrence time of the specific event.

Abstract: Provided are an event monitoring apparatus and an event monitoring method that make it possible to set a proper threshold without handling monitoring target systems on an individual basis. There are included: a threshold determination program calculating degree of similarity between a ledger guide message and an event message, regarding a maximum value of the calculated degree of similarity as a first threshold, and setting a second threshold that is greater than the first threshold by a predetermined value; a ledger allocation program associating a ledger guide message having the degree of similarity intermediate between the first threshold and the second threshold with the event message; and a threshold evaluation program reporting the degree of similarity to a manager of a monitoring target system when the degree of similarity is higher than the first threshold.

Abstract: An event monitoring system includes a processor and a storage unit. The storage unit holds an event message including a character string related to an event occurring in an information system and guide information including one or more guides. The guide includes a guide message including a predetermined character string, notified in response to the event, and information regarding a coping method for the event. The processor compares the event message and the guide, associates the guide with the event in a case where the guide further includes information for identifying a variable portion of the guide message and a portion other than the variable portion of the guide message coincides with a portion other than a portion corresponding to the variable portion in the event message, and receives an input of information indicating a correct answer of a guide to be associated with the event in a case where the guide does not include the information for identifying the variable portion.

Abstract: Provided are an event monitoring apparatus and an event monitoring method that make it possible to set a proper threshold without handling monitoring target systems on an individual basis. There are included: a threshold determination program calculating degree of similarity between a ledger guide message and an event message, regarding a maximum value of the calculated degree of similarity as a first threshold, and setting a second threshold that is greater than the first threshold by a predetermined value; a ledger allocation program associating a ledger guide message having the degree of similarity intermediate between the first threshold and the second threshold with the event message; and a threshold evaluation program reporting the degree of similarity to a manager of a monitoring target system when the degree of similarity is higher than the first threshold.

Abstract: A log labeling apparatus is configured to include a label importance DB and a similarity DB configured to store importance information between a plurality of labels and an action set and action set information identifying a first action set for calculating a second similarity with each label of a first log unit, a similarity calculation unit configured to calculate the second similarity with each label of the first log unit on the basis of the importance information, an action set of the first log unit, and the action set of the action set information, a post processor configured to detect label candidates, and an accumulation determination unit configured to determine a second action set for calculating a second similarity of a second log unit and to store action set information on the second action set in the similarity DB.

Abstract: An inter-volume copy time is to be accurately predicted. An operation management system is configured to perform operation management on a storage device including a plurality of resources and a plurality of volumes. In the storage device, IO processing and copy processing are performed between a plurality of volume groups in which the plurality of volumes are collected. The operation management system includes a processor, and the processor is configured to predict an inter-pool copy speed between the plurality of volume groups belonging to a same resource pool in the storage device, and predict an inter-volume copy time based on the predicted inter-pool copy speed.

Abstract: Execution end timing of a jobnet is predicted with stable accuracy. An information processing apparatus executes jobnet execution time prediction model generation processing for generating an execution time prediction model for predicting execution time of a jobnet to be executed on the basis of information associated with execution time of each of previously executed jobnets, a prediction model accuracy determination processing for calculating prediction accuracy for the execution time of each of jobnets by the generated execution time prediction model, and delay determination processing for determining whether to predict execution end timing of a designated jobnet among a jobnet group that is a set of a plurality of jobnets currently being executed or to be subsequently executed on the basis of the execution time prediction model, on the basis of the calculated prediction accuracy for the execution time of each of the jobnets.

Abstract: The present invention aims to specify a bottlenecked resource more accurately in an IT system. In a performance analysis apparatus which includes a processing device, a storage device and an input/output interface and analyzes a performance of an IT system, the processing device creates an overall performance prediction model by using a nonlinear regression algorithm with a first overall performance value being set as an objective variable and with a first resource performance value being set as an explanatory variable, creates an explanatory model by inputting the overall performance prediction model and using an XAI technology and calculates a degree of per-resource influence on the overall performance value which is output by inputting a second resource performance value into the explanatory model.

Abstract: Prediction of time series data can be performed while coping with a “non-equidistant event,” “extrapolation,” and a “base line shift.” An event regression section calculates event prediction data that is predicted values of metric data in an intended period including a past certain period on the basis of actual measured value data indicating values of the metric data in the past metric data. A correction section calculates, as prediction result data that is a prediction result of the time series data, data obtained by shifting each value of the event prediction data in response to a difference between the actual measured value data and the event prediction data in a same period.

Abstract: An apparatus for monitoring a computer system includes a data collecting unit that collects performance data on a plurality of performance items related to the performance of the computer system; a performance degradation cause model 30 in which a cause event and degradation performance items which are one or more performance items degraded by the cause event are associated with one another; and an outlier score calculator 50 that specifies a degree of deviation, when target performance data which is performance data of degradation performance items collected by the data collecting unit deviates from a normal range under a condition that the normal range of the performance data of the one or more degradation performance items for the cause event is predetermined, and outputs information on the cause event based on a temporal change in the degree of deviation.