Abstract: An apparatus collects log data for each function; analyzes the log data to determine, for each function, whether a delay is present in a path of the function; classifies, for each function, one or more of a normal interval and an abnormal interval of the function based on the analyzed log data; defines, as an aggregation interval, a time interval at which two or more functions have an abnormal interval and one or more functions have a normal interval; identifies the one or more modules of paths of each function during the aggregation interval; and detects, as an abnormal module, a module that is present in two or more paths of functions with abnormal intervals during the aggregation interval and is not present in any path of the functions with normal intervals during the aggregation interval.

Abstract: A processor calculates a correlation between a first data item and a second data item, based on values of the first data item in a first log and values of the second data item in a second log, and determines an influence direction by comparing values of a first chronological item with values of a second chronological item. The processor collects third and fourth logs respectively generated later than the first and second logs. The processor determines whether the correlation holds with respect to values of the first data item in the third log and values of the second data item in the fourth log, and outputs an anomaly report, when the correlation does not hold, to indicate which of the first and second data items is a cause data item (i.e., the source of an anomaly), based on the influence direction.

Abstract: The analyzer includes a path information obtainer that extracts a component that a first function among a plurality of functions sometimes uses and sometimes does not use as an undetermined component beforehand; a detector that detects whether the undetermined component is used during operation; and a specifier that specifies, when a problem arises during the operation, a problem component, as a problem point, among one or more components based on path information including the one or more components that each of the plurality of functions uses and being obtained for the function beforehand, operation information obtained during the operation, and a result of detecting using of the undetermined component. This configuration makes it possible to specify an exact problem point.

Abstract: An analysis apparatus compares first code describing a plurality of first components with second code describing a plurality of second components, to extract difference components. The analysis apparatus sends a plurality of requests to an execution apparatus on which the plurality of second components are deployed, obtains first log information indicating the execution state of each difference component, and specifies relevant requests related to the execution of the difference components. The analysis apparatus sends the specified relevant requests to the execution apparatus and obtains second log information indicating the execution state of each of the plurality of second components. The analysis apparatus generates path information about second components executed in response to each relevant request among the plurality of second components, on the basis of the second log information.

Abstract: A processor calculates a correlation between a first data item and a second data item, based on values of the first data item in a first log and values of the second data item in a second log, and determines an influence direction by comparing values of a first chronological item with values of a second chronological item. The processor collects third and fourth logs respectively generated later than the first and second logs. The processor determines whether the correlation holds with respect to values of the first data item in the third log and values of the second data item in the fourth log, and outputs an anomaly report, when the correlation does not hold, to indicate which of the first and second data items is a cause data item (i.e., the source of an anomaly), based on the influence direction.

Abstract: Normal and abnormal states are calculated from log data with respect to each of a plurality of processings in which shared modules exist. A timing of a change of the states is calculated. A time interval, in which the normal and abnormal states are not mixed, is separated with respect to each of the plurality of processings, based on the calculated timing. In the time interval, an abnormal module is detected, based on relationship information between the plurality of processings and the modules.

Abstract: Relating to services each including a plurality of processes having a plurality of hierarchies, service information is stored in which processes for each service are grouped in a predetermined hierarchy taking presence or absence of a common hierarchy into consideration. Then, based on log data and the service information relating to a plurality of services, a first decision process for deciding presence or absence of an abnormality relating to a process included in one or more services is performed. Further, a second decision process is performed for developing, where a process decided as an abnormal process is a grouped grouping process, the grouping process decided as an abnormal process to one or more processes in a lower hierarchy than the predetermined hierarchy based on the service information and deciding presence or absence of an abnormality relating to the one or more developed processes.

Abstract: The analyzer includes a path information obtainer that extracts a component that a first function among a plurality of functions sometimes uses and sometimes does not use as an undetermined component beforehand; a detector that detects whether the undetermined component is used during operation; and a specifier that specifies, when a problem arises during the operation, a problem component, as a problem point, among one or more components based on path information including the one or more components that each of the plurality of functions uses and being obtained for the function beforehand, operation information obtained during the operation, and a result of detecting using of the undetermined component. This configuration makes it possible to specify an exact problem point.

Abstract: Common parameters in common between a plurality of request logs are extracted from parameters in the plurality of request logs. The plurality of request logs is obtained when a request is executed by a process that uses a plurality of components. A common parameter different from a common parameter extracted for another process among the extracted common parameters is determined as an identification parameter that identifies the process. This allows accurately categorizing the process based on a log to be obtained when the process is executed.

Abstract: A first memory unit stores requester event information pieces each including time information indicating an occurrence time of an event associated with a process executed by a first server. A second memory unit stores request-destination event information pieces each including time information indicating an occurrence time of an event associated with a process executed by a second server in response to a request from the first server. A determining unit determines, for each request-destination event information piece, a correction allowable range of the time information by comparing the time information of the request-destination event information pieces with that of the requester event information pieces.

Abstract: An analysis apparatus compares first code describing a plurality of first components with second code describing a plurality of second components, to extract difference components. The analysis apparatus sends a plurality of requests to an execution apparatus on which the plurality of second components are deployed, obtains first log information indicating the execution state of each difference component, and specifies relevant requests related to the execution of the difference components. The analysis apparatus sends the specified relevant requests to the execution apparatus and obtains second log information indicating the execution state of each of the plurality of second components. The analysis apparatus generates path information about second components executed in response to each relevant request among the plurality of second components, on the basis of the second log information.

Abstract: A first memory stores requester event records describing events that occurred in relation to processes executed in a first server. A second memory stores requestee event records describing events that occurred in relation to processes executed in a second server in response to execution requests issued from the first server. An associating unit searches the first and second memories for requester event records and requestee event records whose transaction identifiers are identical and associates the found records together. A determining unit compares the associated event records with each other in terms of their time information. Based on this comparison, the determining unit determines a correction value for correcting time differences between requester event records in the first memory and requestee event records in the second memory.

Abstract: A non-transitory computer-readable storage medium storing an information control program that causes a computer to execute a process including receiving an update request for updating first information stored in a first storage area, the update request corresponding to a selected application, and when the selected application is a first application having been available later than a second application that is configured to update the first information stored in a first storage area, updating second information based on the update request for updating the first information, the second information being information corresponding to a part of the first information and being stored in a second storage area different from the first storage area.

Abstract: A verifying method includes: creating, for each of tests, combination in which information identifying the test, information identifying input data, and information identifying output data are associated with one another; specifying, when a first test is changed, second combination in which information identifying output data in first combination relating to the first test is set as the information identifying input data, the second combination relating to a second test; updating, in the first combination, the information identifying the corresponding test to first information identifying the changed first test; updating, in the first combination, the information identifying the output data to second information identifying output data output by verifying the changed first test; and updating the second combination, based on verifying the second test in which the information identifying input data in the second combination is set as the second information identifying the output data in the updated first combin

Abstract: Upon receiving a packet addressed to a virtual machine, a virtual switch connected to the virtual machine forwards the packet to the virtual machine, stores the received packet, the packet being related to an uncompleted transaction in the first storing unit in association with the uncompleted transaction, in response to an instruction for restoring the virtual machine, stops the forwarding of the packet to the virtual machine, and in response to the completion of the restoring of the virtual machine, upon receiving an instruction for resuming the forwarding, transmits one or a plurality of packets stored in the first storing unit in association with the uncompleted transaction to the virtual machine.

Abstract: An analysis method including: storing information on modules through which each processing passes with respect to each of a plurality of processings in which shared modules exist; determining a normal or abnormal state of each of the processings which are performed during a predetermined time interval based on log information related to the plurality of processings which are performed during the predetermined time interval; correcting the information on the modules according to each of the processings which are performed during the predetermined time interval, based on a predetermined condition, when an abnormal module is not identified in a process of identifying the abnormal module by using a determination result of the normal or abnormal state and the information on the modules according to each of the processings; and identifying the abnormal module by using the determination result and the corrected information on the modules.

Abstract: Relating to services each including a plurality of processes having a plurality of hierarchies, service information is stored in which processes for each service are grouped in a predetermined hierarchy taking presence or absence of a common hierarchy into consideration. Then, based on log data and the service information relating to a plurality of services, a first decision process for deciding presence or absence of an abnormality relating to a process included in one or more services is performed. Further, a second decision process is performed for developing, where a process decided as an abnormal process is a grouped grouping process, the grouping process decided as an abnormal process to one or more processes in a lower hierarchy than the predetermined hierarchy based on the service information and deciding presence or absence of an abnormality relating to the one or more developed processes.

Abstract: Common parameters in common between a plurality of request logs are extracted from parameters in the plurality of request logs. The plurality of request logs is obtained when a request is executed by a process that uses a plurality of components. A common parameter different from a common parameter extracted for another process among the extracted common parameters is determined as an identification parameter that identifies the process. This allows accurately categorizing the process based on a log to be obtained when the process is executed.

Abstract: A tied server includes a first storage unit that stores appearance patterns of messages having a transaction identifier to identify a transaction. The tied server also includes a second storage unit that stores messages executed on the transaction DB server having the transaction ID by the application server and communicated between an application server and a DB server. The tied server classifies the messages stored in the second storage unit with respect to each transaction based on the appearance patterns of the messages stored in the first storage unit.

Abstract: Upon receiving a packet addressed to a virtual machine, a virtual switch connected to the virtual machine forwards the packet to the virtual machine, stores the received packet, the packet being related to an uncompleted transaction in the first storing unit in association with the uncompleted transaction, in response to an instruction for restoring the virtual machine, stops the forwarding of the packet to the virtual machine, and in response to the completion of the restoring of the virtual machine, upon receiving an instruction for resuming the forwarding, transmits one or a plurality of packets stored in the first storing unit in association with the uncompleted transaction to the virtual machine.