Patent ID: 8381038

Claim:
A management server for managing a computer system that includes a plurality of node devices, comprising: a storage resource; and a processor coupled to the storage resource, wherein the storage resource stores an event cause information including a cause identification code for each of a symptom event set, wherein the cause identification code is data denoting a relationship between the symptom event set and a cause event, wherein the symptom event set is a combination of one or more symptom events, wherein the cause event is an event of a cause, wherein the symptom event is an event that is generated having the cause event, and wherein the processor: (a) detects one or more first events; (b) selects from among the event cause information a first cause identification code corresponding to the symptom event set that matches a combination of the one or more first events; (c) identifies the cause event denoted by the first cause identification code as a cause of generation of the one or more first events; (d) changes the event cause information to a post-change event cause information corresponding to a post-change composition of the computer system in a case where a composition of the computer system has been changed to eliminate the cause of generation of the one or more first events; and (e) selects from the post-change event cause information a second cause identification code corresponding to the symptom event set that matches the symptom event set denoted by the first cause identification code, and notifies information related to the second cause identification code to an administrator, wherein the storage resource stores aggregation relation information denoting a relationship between a target device, which exists inside the computer system and is able to become a source of generation of an event, and a higher-level device and/or a lower-level device of the target device, and wherein the processor carries out the processing of the (e) based on a first device, which is the generation-source device of the symptom event denoted by the first cause identification code, a second device, which is the generation-source device of either the symptom event or the cause event denoted by the selected cause identification code, and the aggregation relation information.