Abstract: A fault recovery support apparatus according to an embodiment includes: a fault insertion unit configured to insert a fault into a target system; a behavior execution unit configured to execute a behavior related to recovery from the fault for the target system; a first construction unit configured to construct an automaton representing a recovery process from the fault by using observation data acquired from the target system as a result of the behavior by the behavior execution unit; and a second construction unit configured to construct a workflow representing a behavior for separating each fault included in a plurality of faults and a recovery process of each fault by using a plurality of the automatons related to the plurality of faults.

Abstract: Techniques for extracting a set of highly correlated logs without user's prior knowledge of generation rules of logs generated by a machine. A log analysis apparatus includes: a template storage unit configured to store templates for log messages; a template determination unit configured to determine templates corresponding to log messages provided from a to-be-monitored host from the stored templates; an event candidate extraction unit configured to detect templates determined for log messages provided from the same host from the determined templates and extract a sequence of the detected templates as an event candidate; and an event extraction unit configured to extract a sequence of frequently occurring templates as an event from the extracted event candidate.

Abstract: A monitoring device information analyzing device calculates a log variation amount from a log variation amount of a monitoring target device h and a log variation amount of the monitoring target device on another day, by referring to a template information storage unit storing a time at which a log message arises, the log message arising in the past, a template that is associated with an ID of the monitoring target device, and a template ID of the template to calculate the log variation amount of the monitoring target device and to obtain the log variation amount of the monitoring target device on the other day at the same time zone; obtains the log variation amount that is to be a sample; executes verification according to a statistical method, and determines the sample as an advance log, if a test statistic is greater than a predetermined threshold value.

Abstract: Techniques for extracting a set of highly correlated logs without user's prior knowledge of generation rules of logs generated by a machine. A log analysis apparatus includes: a template storage unit configured to store templates for log messages; a template determination unit configured to determine templates corresponding to log messages provided from a to-be-monitored host from the stored templates; an event candidate extraction unit configured to detect templates determined for log messages provided from the same host from the determined templates and extract a sequence of the detected templates as an event candidate; and an event extraction unit configured to extract a sequence of frequently occurring templates as an event from the extracted event candidate.

Abstract: A monitoring device information analyzing device calculates a log variation amount from a log variation amount of a monitoring target device h and a log variation amount of the monitoring target device on another day, by referring to a template information storage unit storing a time at which a log message arises, the log message arising in the past, a template that is associated with an ID of the monitoring target device, and a template ID of the template to calculate the log variation amount of the monitoring target device and to obtain the log variation amount of the monitoring target device on the other day at the same time zone; obtains the log variation amount that is to be a sample; executes verification according to a statistical method, and determines the sample as an advance log, if a test statistic is greater than a predetermined threshold value.