Patent ID: 8020045

Claim:
An event analysis method for a system management server which has a processor and a memory and which is coupled to a plurality of information processing apparatuses and a screen output apparatus, the event analysis method for analyzing events occurring in the plurality of information processing apparatuses, and the event analysis method comprising: a configuration information storing step of storing identification information of a server apparatus which is included in the plurality of information processing apparatuses and which is an access target of each of the plurality of information processing apparatuses for using a network service as a client, in configuration information held by the memory; a registration step of registering a plurality of monitored apparatuses which are included in the plurality of information processing apparatuses and from which the system management server obtains event information, in the configuration information held by the memory; a rule storing step of storing in the memory correlation analysis rule information indicating that, when an event that includes a first event type related to the network service and an event that includes a second event type being different from the first event type related to the network service, both occurring in the plurality of information processing apparatuses, are detected, an event corresponding to the first event type can occur due to an event corresponding to the second event type; an event storing step of storing in the memory, a plurality of the event information obtained from the plurality of monitored apparatuses; an event information identifying step of identifying first event information which includes the first event type from among the plurality of the event information stored in the memory, based on the correlation analysis rule information; a cause identifying step of identifying a first monitored apparatus which is one of monitored apparatuses and which sends the first event information and, a fault cause apparatus which is a server apparatus of the network service for the first monitored apparatus corresponding to the first event type, based on the configuration information; and an analysis result sending step of sending information identifying the first monitored apparatus, the first event type, the fault cause apparatus, and the second event type to the screen output apparatus in case that the fault cause apparatus is not included in the plurality of monitored apparatuses, based on the correlation analysis rule information and the configuration information, thereby causing the screen output apparatus to display information indicating that an event corresponding to the first event information that occurred in the first monitored apparatus is estimated to be caused by the fact that an event of the second event type occurred in the fault cause apparatus.