Fault symptom detection method and information processing apparatus
An information processing apparatus determines first message types that are not used for learning, on the basis of the appearance frequencies of individual message types obtained using a set of collected messages, and learns a message pattern which appears when a fault occurs and from which the first message types have been removed, from the set of messages and fault information. The information processing apparatus determines second message types that are not used for detection, on the basis of the appearance frequencies of individual message types obtained using a set of collected messages, generates a message pattern, from which the second message types have been removed, from the set of messages, and compares the message patterns with each other to detect a fault symptom in a system.
1. A fault symptom detection method in collecting a plurality of types of messages from a monitored system, the method comprising:
determining, by a processor, a first message type that is not used for learning, based on appearance frequencies of individual message types obtained using a first set of messages collected;
learning, by the processor, a first message pattern, from which the first message type has been removed, from the first set of messages and fault information, the first message pattern being a message pattern that appears when a fault occurs, the fault information indicating occurrence of faults in the monitored system;
determining, by the processor, a second message type that is not used for detection, based on appearance frequencies of individual message types obtained using a second set of messages collected after the first set of messages;
generating, by the processor, a second message pattern, from which the second message type has been removed, from the second set of messages; and
comparing the first message pattern with the second message pattern to detect a fault symptom in the monitored system.
2. The fault symptom detection method according to claim 1 , wherein:
the first message type is a message type whose appearance frequency, calculated using the first set of messages, is greater than or equal to a threshold among a plurality of message types; and
the second message type is a message type whose appearance frequency, calculated using the second set of messages, is greater than or equal to a threshold among the plurality of message types.
3. The fault symptom detection method according to claim 1 , further comprising:
detecting a change in an operating state of the monitored system; and
re-calculating the appearance frequencies of the individual message types in response to the change in the operating state of the monitored system.
4. The fault symptom detection method according to claim 1 , further comprising determining that there is a fault symptom in the monitored system when the first message pattern without the first message type and the second message pattern without the second message type are identical to each other.
5. An information processing apparatus comprising:
a memory configured to store a plurality of types of messages collected from a monitored system and fault information indicating occurrence of faults in the monitored system; and
a processor configured to perform a process including
learning a first message pattern that appears when a fault occurs, from a first set of messages and the fault information,
generating a second message pattern from a second set of messages obtained after the first set of messages, and
comparing the first message pattern with the second message pattern to detect a fault symptom in the monitored system, wherein:
the process further includes
determining a first message type that is not used for learning, based on appearance frequencies of individual message types obtained using the first set of messages, and removing the first message type from the first message pattern, and
determining a second message type that is not used for detection, based on appearance frequencies of individual message types obtained using the second set of messages, and removing the second message type from the second message pattern.
6. A non-transitory computer-readable storage medium storing a computer program that causes a computer for collecting a plurality of types of messages from a monitored system to execute a process comprising:
determining a first message type that is not used for learning, based on appearance frequencies of individual message types obtained using a first set of messages collected;
learning a first message pattern, from which the first message type has been removed, from the first set of messages and fault information, the first message pattern being a message pattern that appears when a fault occurs, the fault information indicating occurrence of faults in the monitored system;
determining a second message type that is not used for detection, based on appearance frequencies of individual message types obtained using a second set of messages collected after the first set of messages;
generating a second message pattern, from which the second message type has been removed, from the second set of messages; and
comparing the first message pattern with the second message pattern to detect a fault symptom in the monitored system.