Operations management system, operations management method and program thereof

1. An operations management system, comprising:

a correlation model storing unit which stores a correlation model which indicates a correlation among plural types of performance values, for each of plural systems;

an analysis order storing unit which stores a sequence in said plural systems for carrying out detection of a correlation destruction;

an analysis unit which carries out, in each of plural time periods, detection of whether said correlation destruction of said correlation included in said correlation model of each of said plural systems is caused by use of performance values inputted for said each of plural time periods, according to said sequence; and

an order control unit which updates said sequence in said each of plural time periods, in such a way that said detection for a system on which said correlation destruction has been caused carried out earlier than said detection for a system on which said correlation destruction has not been caused,

wherein said order control unit determines said sequence based on a result of said detection of whether said correlation destruction is caused in each of said plural systems,

wherein said order control unit determines said sequence by use of a degree of abnormality which is derived from at least one of a degree of correlation destruction calculated on a basis of a number of destructed correlations included in said result of said detection, and a degree of similarity between said result of said detection obtained when a fault is caused in said system and said result of said detection on said inputted performance values, and

wherein, in a case that said detection has not been carried out for one of said plural systems in one of said plural time periods, said order control unit sets a value greater than said degree of abnormality which was calculated in a time period in which said detection was carried out for said one of said plural systems, before said one of said plural time periods, to said degree of abnormality of said one of said plural systems.

2. The operations management system according to claim 1 , wherein

said order control unit sets a value obtained through multiplying said degree of abnormality which was calculated in a time period in which said detection was carried out for said one of said plural systems, before said one of said plural time periods, by a coefficient becoming greater according to a number of time periods in which said detection was not carried out, to said degree of abnormality of said one of said plural systems.

3. The operations management system according to claim 1 , wherein

said order control unit generates a group of plural systems whose number of time periods in which said detection was not carried out is greater than other systems, and sets a total of said degrees of abnormality, each of which was calculated in a time period when said detection was carried out for a corresponding one of said plural systems included in said group, before said one of said plural time periods, to said degree of abnormality of each of said plural systems included in said group.

4. The operations management system according to claim 1 , wherein,

in a case that said analysis unit carries out said detection in each of said plural time periods, said analysis unit carries out said detection by use of not only said performance values inputted for said each of said plural time periods but also said performance values inputted for a time period in which said detection was not carried out, before said each of said plural time periods.

5. The operations management system according to claim 1 , wherein said sequence includes a plurality of system identifier, respectively, in an order of a degree of correlation destruction in the plural systems.

6. The operations management system according to claim 1 , wherein an invariant analysis based on the correlation destruction is performed on each of the plural system, sequentially.

7. An operations management method, comprising:

storing a correlation model which indicates a correlation among plural types of performance values, for each of plural systems;

storing a sequence in said plural systems for carrying out detection of a correlation destruction;

carrying out, in each of plural time periods, detection of whether said correlation destruction of said correlation included in said correlation model of each of said plural systems is caused by use of performance values inputted for said each of plural time periods, according to said sequence; and

updating said sequence in said each of plural time periods, in such a way that said detection for a system on which said correlation destruction has been caused carried out earlier than said detection for a system on which said correlation destruction has not been caused,

wherein said updating said sequence determines said sequence based on a result of said detection of whether said correlation destruction is caused in each of said plural systems,

wherein said updating said sequence determines said sequence by use of a degree of abnormality which is derived from at least one of a degree of correlation destruction calculated on a basis of a number of destructed correlations included in said result of said detection, and a degree of similarity between said result of said detection obtained when a fault is caused in said system and said result of said detection on said inputted performance values, and

wherein, in a case that said detection has not been carried out for one of said plural systems in one of said plural time periods, a value greater than said degree of abnormality which was calculated in a time period in which said detection was carried out for said one of said plural systems, before said one of said plural time periods, is set to said degree of abnormality of said one of said plural systems.

8. The operations management method according to claim 7 , wherein

a value obtained through multiplying said degree of abnormality which was calculated in a time period in which said detection was carried out for said one of said plural systems, before said one of said plural time periods, by a coefficient becoming greater according to a number of time periods in which said detection was not carried out, is set to said degree of abnormality of said one of said plural systems.

9. The operations management method according to claim 7 , wherein

a group of plural systems whose number of time periods in which said detection was not carried out is greater than other systems is generated, and a total of said degrees of abnormality, each of which was calculated in a time period when said detection was carried out for a corresponding one of said plural systems included in said group, before said one of said plural time periods, is set to said degree of abnormality of each of said plural systems included in said group.

10. The operations management method according to claim 7 , wherein,

in a case that said detection in each of said plural time periods is carried out, said detection by use of not only said performance values inputted for said each of said plural time periods but also said performance values inputted for a time period in which said detection was not carried out, before said each of said plural time periods, is carried out.

11. A non-transitory computer readable storage medium recording thereon a program, causing a computer to perform a method comprising:

storing a correlation model which indicates a correlation among plural types of performance values, for each of plural systems;

storing a sequence in said plural systems for carrying out detection of a correlation destruction;

carrying out, in each of plural time periods, detection of whether said correlation destruction of said correlation included in said correlation model of each of said plural systems is caused by use of performance values inputted for said each of plural time periods, according to said sequence; and

updating said sequence in said each of plural time periods, in such a way that said detection for a system on which said correlation destruction has been caused carried out earlier than said detection for a system on which said correlation destruction has not been caused,

wherein said updating said sequence determines said sequence based on a result of said detection of whether said correlation destruction is caused in each of said plural systems,

wherein said updating said sequence determines said sequence by use of a degree of abnormality which is derived from at least one of a degree of correlation destruction calculated on a basis of a number of destructed correlations included in said result of said detection, and a degree of similarity between said result of said detection obtained when a fault is caused in said system and said result of said detection on said inputted performance values, and

wherein, in a case that said detection has not been carried out for one of said plural systems in one of said plural time periods, a value greater than said degree of abnormality which was calculated in a time period in which said detection was carried out for said one of said plural systems, before said one of said plural time periods, is set to said degree of abnormality of said one of said plural system.

12. The non-transitory computer readable storage medium according to claim 11 , recording thereon said program causing said computer to perform said method, wherein

a value obtained through multiplying said degree of abnormality which was calculated in a time period in which said detection was carried out for said one of said plural systems, before said one of said plural time periods, by a coefficient becoming greater according to a number of time periods in which said detection was not carried out, is set to said degree of abnormality of said one of said plural systems.

13. The non-transitory computer readable storage medium according to claim 11 , recording thereon said program causing said computer to perform said method, wherein

a group of plural systems whose number of time periods in which said detection was not carried out is greater than other systems is generated, and a total of said degrees of abnormality, each of which was calculated in a time period when said detection was carried out for a corresponding one of said plural systems included in said group, before said one of said plural time periods, is set to said degree of abnormality of each of said plural systems included in said group.

14. The non-transitory computer readable storage medium according to claim 11 , recording thereon said program causing said computer to perform said method, wherein,

in a case that said detection in each of said plural time periods is carried out, said detection by use of not only said performance values inputted for said each of said plural time periods but also said performance values inputted for a time period in which said detection was not carried out, before said each of said plural time periods, is carried out.

15. An operations management system, comprising:

correlation model storing means for storing a correlation model which indicates a correlation among plural types of performance values, for each of plural systems;

analysis order storing means for storing a sequence in said plural systems for carrying out detection of a correlation destruction;

analysis means for carrying out, in each of plural time periods, detection of whether said correlation destruction of said correlation included in said correlation model of each of said plural systems is caused by use of performance values inputted for said each of plural time periods, according to said sequence; and

order control means for updating said sequence in said each of plural time periods, in such a way that said detection for a system on which said correlation destruction has been caused carried out earlier than said detection for a system on which said correlation destruction has not been caused,

wherein said order control means determines said sequence based on a result of said detection of whether said correlation destruction is caused in each of said plural systems,

wherein said order control means determines said sequence by use of a degree of abnormality which is derived from at least one of a degree of correlation destruction calculated on a basis of a number of destructed correlations included in said result of said detection, and a degree of similarity between said result of said detection obtained when a fault is caused in said system and said result of said detection on said inputted performance values, and

wherein, in a case that said detection has not been carried out for one of said plural systems in one of said plural time periods, said order control means sets a value greater than said degree of abnormality which was calculated in a time period in which said detection was carried out for said one of said plural systems, before said one of said plural time periods, to said degree of abnormality of said one of said plural systems.