Management computer and method for root cause analysis
In analyzing an elaborate computer system which requires large-scale or numerous event propagation models, a law-of-causality matrix gains size, so that significant amount of storage resources has been used in a management computer. To solve such a problem, the management computer to manage the computer system stores topologies, event propagation models, and causality information including one or more causal relations in the storage resources, determines, when the management computer analyzes or detects an event, whether a causal relation has already been created for the event to be analyzed, and creates the causal relation based on a topology and event propagation models, if not yet.
1. A management computer for managing a plurality of physical or logical components which configure a computer system, comprising:
storage resources holding a management program; and
a processor for executing the management program,
wherein the storage resources include:
a topology information indicating relationships among the plurality of components;
an event propagation model indicating a set of conditional expressions which are consisted of causal events and analysis results and are represented by a type of the components as a management target; and
a causality information including a plurality of causal relations which are the conditional expressions relevant to a specified component as a management target;
wherein the management program is configured for the processor to:
detect an event relating to a problem that has occurred to a managed component;
determine whether or not a first causal relation to be used in analysis of the detected event has been created in the causality information;
perform an on-demand expansion based on one of the topologies and one of the event propagation models to create the first causal relation in the causality information in case where the processor determines that the first causal relation has not been created and is not being created in the process of former determining; and
analyze the detected event using the first causal relation.
2. The management computer according to claim 1 , wherein the management program is furthermore configured for the processor to delete entire data of the causality information in case that the detected event is a configuration change.
3. The management computer according to claim 2 , wherein the on-demand expansion is performed in case that the detected event has an expiration date and time information and the detected event is valid.
4. A method for event analysis, the method comprising:
holding a management program; and
executing the management program,
indicating relationships among a plurality of components;
indicating a set of conditional expressions which consisting of causal events and analysis results and represented by a type of the components as a management target; and
including a plurality of causal relations which are the conditional expressions relevant to a specified component as a management target;
detecting an event relating to a problem that has occurred to a managed component;
determining whether or not a first causal relation to be used in analysis of the detected event has been created;
performing an on-demand expansion based a topology and an event propagation model to create the first causal relation in a causality information on a condition that a determination is made that the first causal relation has not been created and is not being created in the process of former determining; and
analyzing the detected event using the first causal relation.
5. The method according to claim 4 further comprising:
deleting entire data of the causality information on a condition that the detected event is a configuration change.
6. The method according to claim 5 , wherein the on-demand expansion is performed on a condition that the detected event has an expiration date and time information and the detected event is valid.
7. A computer system comprising:
a plurality of storage resources configured to hold a management program; and
a processor for executing the management program,
wherein the plurality of storage resources include:
a topology information indicating relationships among a plurality of components;
an event propagation model indicating a set of conditional expressions consisting of causal events and analysis results and are represented by a type of the components as a management target; and
a causality information including a plurality of causal relations which are the conditional expressions relevant to a specified component as a management target;
wherein the management program is configured for the processor to:
detect an event relating to a problem that has occurred to a managed component;
determine whether or not a first causal relation to be used in analysis of the detected event has been created in the causality information;
perform an on-demand expansion based on one of the topologies and one of the event propagation models to create the first causal relation in the causality information on a condition that the processor determines that the first causal relation has not been created and is not being created in the process of former determining; and
analyze the detected event using the first causal relation.
8. The computer system according to claim 7 , wherein the management program is furthermore configured for the processor to delete entire data of the causality information in case that the detected event is a configuration change.
9. The computer system according to claim 8 , wherein the on-demand expansion is performed in case that the detected event has an expiration date and time information and the detected event is valid.