Abstract: Provided are an event monitoring apparatus and an event monitoring method that make it possible to set a proper threshold without handling monitoring target systems on an individual basis. There are included: a threshold determination program calculating degree of similarity between a ledger guide message and an event message, regarding a maximum value of the calculated degree of similarity as a first threshold, and setting a second threshold that is greater than the first threshold by a predetermined value; a ledger allocation program associating a ledger guide message having the degree of similarity intermediate between the first threshold and the second threshold with the event message; and a threshold evaluation program reporting the degree of similarity to a manager of a monitoring target system when the degree of similarity is higher than the first threshold.

Abstract: A log labeling apparatus is configured to include a label importance DB and a similarity DB configured to store importance information between a plurality of labels and an action set and action set information identifying a first action set for calculating a second similarity with each label of a first log unit, a similarity calculation unit configured to calculate the second similarity with each label of the first log unit on the basis of the importance information, an action set of the first log unit, and the action set of the action set information, a post processor configured to detect label candidates, and an accumulation determination unit configured to determine a second action set for calculating a second similarity of a second log unit and to store action set information on the second action set in the similarity DB.

Abstract: An inter-volume copy time is to be accurately predicted. An operation management system is configured to perform operation management on a storage device including a plurality of resources and a plurality of volumes. In the storage device, IO processing and copy processing are performed between a plurality of volume groups in which the plurality of volumes are collected. The operation management system includes a processor, and the processor is configured to predict an inter-pool copy speed between the plurality of volume groups belonging to a same resource pool in the storage device, and predict an inter-volume copy time based on the predicted inter-pool copy speed.

Abstract: Execution end timing of a jobnet is predicted with stable accuracy. An information processing apparatus executes jobnet execution time prediction model generation processing for generating an execution time prediction model for predicting execution time of a jobnet to be executed on the basis of information associated with execution time of each of previously executed jobnets, a prediction model accuracy determination processing for calculating prediction accuracy for the execution time of each of jobnets by the generated execution time prediction model, and delay determination processing for determining whether to predict execution end timing of a designated jobnet among a jobnet group that is a set of a plurality of jobnets currently being executed or to be subsequently executed on the basis of the execution time prediction model, on the basis of the calculated prediction accuracy for the execution time of each of the jobnets.

Abstract: The present invention aims to specify a bottlenecked resource more accurately in an IT system. In a performance analysis apparatus which includes a processing device, a storage device and an input/output interface and analyzes a performance of an IT system, the processing device creates an overall performance prediction model by using a nonlinear regression algorithm with a first overall performance value being set as an objective variable and with a first resource performance value being set as an explanatory variable, creates an explanatory model by inputting the overall performance prediction model and using an XAI technology and calculates a degree of per-resource influence on the overall performance value which is output by inputting a second resource performance value into the explanatory model.

Abstract: Prediction of time series data can be performed while coping with a “non-equidistant event,” “extrapolation,” and a “base line shift.” An event regression section calculates event prediction data that is predicted values of metric data in an intended period including a past certain period on the basis of actual measured value data indicating values of the metric data in the past metric data. A correction section calculates, as prediction result data that is a prediction result of the time series data, data obtained by shifting each value of the event prediction data in response to a difference between the actual measured value data and the event prediction data in a same period.

Abstract: An apparatus for monitoring a computer system includes a data collecting unit that collects performance data on a plurality of performance items related to the performance of the computer system; a performance degradation cause model 30 in which a cause event and degradation performance items which are one or more performance items degraded by the cause event are associated with one another; and an outlier score calculator 50 that specifies a degree of deviation, when target performance data which is performance data of degradation performance items collected by the data collecting unit deviates from a normal range under a condition that the normal range of the performance data of the one or more degradation performance items for the cause event is predetermined, and outputs information on the cause event based on a temporal change in the degree of deviation.

Abstract: An operation assistance system receives selection of a first procedure in a procedure manual including a plurality of procedures relating to an operation of an operation target. The operation assistance system displays an estimation structure obtained by structuring at least part of the first procedure based on an abstraction structure obtained by structuring a second abstraction procedure included in a first abstraction procedure corresponding to the first procedure and the selected first procedure.

Abstract: In a system where resources are used in a varying manner, when performances are monitored based on detected past behavior when the system was operating normally, if performance behavior is detected that is different, it is difficult to determine whether the detected performance behavior results from resources being used differently than when the system was operating normally. According to the present invention, monitoring accuracy is improved by determining whether performance behavior results from change in characteristics relating to the usage of the system by using means for measuring performances when the system is in operation and detecting a performance different from when the system was operating normally, means for measuring characteristics relating to the usage of the system and detecting whether the characteristics are different from when the system was operating normally, and means for comparing performance information with characteristic information relating to the usage of the system.

Abstract: It is necessary to allocate sufficient surplus resources to each service in order to maintain a service level of each service, but, as a result, many resources which are not used may be necessary. A resource allocation optimizing system performs, with respect to each of a plurality of services, a predictive judgement which is a determination of whether or not accurate prediction of a workload of the service is able to be anticipated, and controls allocation of a resource to the service on the basis of a result of the predictive judgement. With respect to each service, the predictive judgement is performed on the basis of at least one of (x) time-series measured workloads and time-series predicted workloads in a predefined period for the service and (y) at least one of a measured service level and a predicted service level in the predefined period for the service.

Abstract: A management device managing a storage device having a plurality of logical storage areas accessed by a computer has a monitor module for determining whether a setting is made by which the computer uniformly accesses the plurality of logical storage areas, obtaining respective access counts of the plurality of logical storage areas when it is determined that the setting is made, and comparing the obtained plurality of access counts, thereby determining whether a logical storage area having a problem exists; an analysis module for obtaining, when the problem exists, configuration information of the storage device assigned to the logical storage area having the problem, and identifying a configuration in the storage device as a bottleneck on the basis of the obtained configuration information; a creation module for creating a countermeasure of changing an access route passing through the configuration as the identified bottleneck.

Abstract: A log labeling apparatus is configured to include a label importance DB and a similarity DB configured to store importance information between a plurality of labels and an action set and action set information identifying a first action set for calculating a second similarity with each label of a first log unit, a similarity calculation unit configured to calculate the second similarity with each label of the first log unit on the basis of the importance information, an action set of the first log unit, and the action set of the action set information, a post processor configured to detect label candidates, and an accumulation determination unit configured to determine a second action set for calculating a second similarity of a second log unit and to store action set information on the second action set in the similarity DB.

Abstract: A technique for improving determination of handling of guides to events generated in an information system is provided. An event monitoring apparatus for monitoring an event including an event message indicated by a character string related to a phenomenon occurring in an information system includes a guide storage unit that stores a plurality of guides including guide messages indicated by a character string and indicating a method of handling the event and a threshold relating to similarity between the guide messages of the guides and event messages in association with each other; an event storage unit that records the event from the information system; and a guide provision unit that calculates the similarity between the event messages included in the event and the guide messages of the guide and associates a guide whose similarity exceeds a threshold with the event.

Abstract: An operation assistance system receives selection of a first procedure in a procedure manual including a plurality of procedures relating to an operation of an operation target. The operation assistance system displays an estimation structure obtained by structuring at least part of the first procedure based on an abstraction structure obtained by structuring a second abstraction procedure included in a first abstraction procedure corresponding to the first procedure and the selected first procedure.

Abstract: A technique for improving determination of handling of guides to events generated in an information system is provided. An event monitoring apparatus for monitoring an event including an event message indicated by a character string related to a phenomenon occurring in an information system includes a guide storage unit that stores a plurality of guides including guide messages indicated by a character string and indicating a method of handling the event and a threshold relating to similarity between the guide messages of the guides and event messages in association with each other; an event storage unit that records the event from the information system; and a guide provision unit that calculates the similarity between the event messages included in the event and the guide messages of the guide and associates a guide whose similarity exceeds a threshold with the event.

Abstract: It is necessary to allocate sufficient surplus resources to each service in order to maintain a service level of each service, but, as a result, many resources which are not used may be necessary. A resource allocation optimizing system performs, with respect to each of a plurality of services, a predictive judgement which is a determination of whether or not accurate prediction of a workload of the service is able to be anticipated, and controls allocation of a resource to the service on the basis of a result of the predictive judgement. With respect to each service, the predictive judgement is performed on the basis of at least one of (x) time-series measured workloads and time-series predicted workloads in a predefined period for the service and (y) at least one of a measured service level and a predicted service level in the predefined period for the service.

Abstract: An apparatus for monitoring a computer system includes a data collecting unit that collects performance data on a plurality of performance items related to the performance of the computer system; a performance degradation cause model 30 in which a cause event and degradation performance items which are one or more performance items degraded by the cause event are associated with one another; and an outlier score calculator 50 that specifies a degree of deviation, when target performance data which is performance data of degradation performance items collected by the data collecting unit deviates from a normal range under a condition that the normal range of the performance data of the one or more degradation performance items for the cause event is predetermined, and outputs information on the cause event based on a temporal change in the degree of deviation.

Abstract: Pursuant to the increase in the number of objects to be managed and the complication of relations of the objects to be managed, the current condition is that the visibility of the GUI of management software is deteriorating. As one such current condition, there is a problem in that the display name of equipment to be managed on the GUI cannot be entirely displayed depending on the screen. Thus, the present invention improves the readability on the GUI by changing the display name according to the objective of the administrator by using a label in which the display name is divided into morphemes and the priority assigned thereto, as well as using topology information, and fitting the display name within the display area prepared on the screen.

Abstract: In a system where resources are used in a varying manner, when performances are monitored based on detected past behavior when the system was operating normally, if performance behavior is detected that is different, it is difficult to determine whether the detected performance behavior results from resources being used differently than when the system was operating normally. According to the present invention, monitoring accuracy is improved by determining whether performance behavior results from change in characteristics relating to the usage of the system by using means for measuring performances when the system is in operation and detecting a performance different from when the system was operating normally, means for measuring characteristics relating to the usage of the system and detecting whether the characteristics are different from when the system was operating normally, and means for comparing performance information with characteristic information relating to the usage of the system.

Abstract: A management device managing a storage device having a plurality of logical storage areas accessed by a computer has a monitor module for determining whether a setting is made by which the computer uniformly accesses the plurality of logical storage areas, obtaining respective access counts of the plurality of logical storage areas when it is determined that the setting is made, and comparing the obtained plurality of access counts, thereby determining whether a logical storage area having a problem exists; an analysis module for obtaining, when the problem exists, configuration information of the storage device assigned to the logical storage area having the problem, and identifying a configuration in the storage device as a bottleneck on the basis of the obtained configuration information; a creation module for creating a countermeasure of changing an access route passing through the configuration as the identified bottleneck.