System analysis device and system analysis method

A system analysis method comprising:

• storing, by a processor, a correlation model expressing correlations between metrics respectively indicating performances of computer resources included in a system;
• dividing, by the processor, a display region into n divided regions in such a way that an area of a divided region i (1≤i≤n) is equal to or larger than an area of a divided region i+1, allocating each cluster of a plurality of clusters obtained by tracking the correlations in the correlation model to the divided region i sequentially selected from i=1, in the decreasing order of the number of metrics contained in each of the clusters, in such a way that the allocated number of the clusters increases in accordance with increase in i, and drawing the cluster allocated to the divided region i in the divided region i;
• determining, by the processor, a candidate of an abnormality cause metric based on correlation destruction detected by using the correlation model and measured values of metrics;
• emphasizing, by the processor, a candidate of the abnormality cause metric on the cluster;
• and
• changing a configuration of the system to handle, by the processor, a failure relating to the abnormality cause metric of the system indicated in response to output of the display region on which the plurality of clusters are drawn.

A non-transitory computer readable storage medium recording thereon a program, causing a computer to perform a method comprising:

• storing a correlation model expressing correlations between metrics respectively indicating performances of computer resources included in a system;
• dividing a display region into n divided regions in such a way that an area of a divided region i (1≤i≤n) is equal to or larger than an area of a divided region i+1, allocating each cluster of a plurality of clusters obtained by tracking the correlations in the correlation model to the divided region i sequentially selected from i=1, in the decreasing order of the number of metrics contained in each of the clusters, in such a way that the allocated number of the clusters increases in accordance with increase in i, and drawing the cluster allocated to the divided region i in the divided region i;
• determining a candidate of an abnormality cause metric based on correlation destruction detected by using the correlation model and measured values of metrics;
• emphasizing a candidate of the abnormality cause metric on the cluster;
• and
• changing a configuration of the system to handle a failure relating to the abnormality cause metric of the system indicated in response to output of the display region on which the plurality of clusters are drawn.