Patent ID: 8429453

Claim:
A computer system, comprising: a plurality of node apparatuses; and a management system comprising one or more computers, and configured to detect an event that occurs in the plurality of node apparatuses, wherein the management system is configured to store event information, meta rule information, and failure record information including a failure record entry, wherein the event information includes an event entry representing information for identifying a generation-source node apparatus of the event that occurred, and an event type that occurred, wherein the meta rule information includes a meta rule representing a potential event type that could potentially occur in the node apparatus and an event type that can be identified as a root cause in a case where an event corresponding to the potential event type occurs, without including an identifier of the node apparatus, wherein the management system is configured: (A) to identify a first cause event, which is the root cause of a first event identified by an event entry stored in the event information based on the meta rule information, and to identify a first meta rule used in identifying the first cause event; (B) to receive via an input device a first recovery method, which is a method for recovering from the first cause event, and into the failure record information, to add a first failure record entry including the first recovery method, an identifier of a first cause apparatus occurring the first cause event, and an identifier of the first meta rule; (C) to identify a second cause event, which is the root cause of a second event identified by the event entry stored in the event information based on the meta rule information, and identifies a second meta rule used in identifying the second cause event; (D) to identify a particular failure record entry including the identifier of the second meta rule; (X) to display information related to the second cause event as the root cause of the second event; (Y) to display a recovery method from the second cause event by showing: (Y1) the first recovery method in the certain failure record entry, and (Y2) the identifier of the first cause apparatus in the particular failure record entry.