Patent ID: 9021304
Filing Date: 2015-04-28
Classification: G06F

Abstract:
1. A fault analysis rule extraction device comprising: an event preprocessing section which is implemented by a hardware processor and which is configured to create a set of event logs for an inputted event log file every certain time period with reference to event occurrence time in event logs, and perform a cluster analysis on the sets of event logs to classify a plurality of clusters; and a fault analysis rule extraction section which is implemented by a hardware processor and which is configured to relate the event logs to each other in each of the plurality of clusters which is classified by the event preprocessing section, and output a fault analysis rule file indicating a fault analysis rule which relates event logs that can be presumed to occur from the same fault, wherein the event preprocessing section is further configured to create the set of event logs by: storing a cluster list file in which data of a target of a cluster analysis is recorded in a storage medium, referring to occurrence time of the event logs for the inputted event log file, grouping event logs every certain time period based on the occurrence time of the event logs, acquiring the number of event occurrences for each event in each of the grouped sets of event logs, and recording the number of event occurrences for each event in each of the grouped sets of event logs in the cluster list file, and wherein the event preprocessing section is further configured to perform the cluster analysis on the sets of event logs to classify the plurality of clusters by: storing an inter-cluster dissimilarity list file in which distances between clusters are recorded, a tree diagram file in which a new cluster, which is created by merging clusters, and the merged two clusters are recorded, and a cluster configuration list file in which a classification result of the cluster analysis is recorded, in a storage medium, reading the cluster list file, calculating distances between the grouped sets of event logs using a distance function for the grouped sets of event logs, recording the distances between the grouped sets of event logs in the inter-cluster dissimilarity list file, referring to the inter-cluster dissimilarity list file, performing the cluster analysis on the sets of event logs, recording a relationship between a merging cluster and two merged clusters in the tree diagram file every time when clusters are merged in the process of the cluster analysis, and recording the merging clusters in the cluster list file, selecting an optimal cluster by using a cluster evaluation method for the merging clusters in the tree diagram file, acquiring respective clusters and the sets of event logs included in the respective clusters by tracing the tree diagram file for the cluster, and recording a configuration of the entire clusters in the cluster configuration list file.