Early abnormality detection based on frequency-inverse document frequency vectors created using event logs

An operation management method comprising:

• successively receiving, from a device to be managed, performance information and event logs of the device to be managed;
• extracting, according to the performance information and the event logs of the device to be managed, a first abnormality occurrence period using the performance information, calculating a first term frequency-inverse document frequency vector created using event logs in the first abnormality occurrence period, and storing at least the first term frequency-inverse document frequency vector as a learning model;
• calculating, using the performance information and event logs newly acquired by the device, a second abnormality occurrence period and a second term frequency-inverse document frequency vector, calculating a first degree of similarity between the first term frequency-inverse document frequency vector in the learning model and the second term frequency-inverse document frequency vector, and transmitting, to a terminal of an operation manager of the device, recommendation information regarding the calculated second abnormality occurrence period when the first degree of similarity is equal to or less than a predetermined value;
• acquiring, for the performance information and the event logs of the device, predicted data of performance information using the performance information as learning data, extracting an abnormality occurrence period of the predicted data to set the abnormality occurrence period of the predicted data as a third abnormality occurrence period, and storing the third abnormality occurrence period and event logs corresponding to the third abnormality occurrence period;
• and
• calculating, when there is a predetermined difference in comparison of the second abnormality occurrence period and the third abnormality occurrence period, a third term frequency-inverse document frequency vector according to the event logs corresponding to the third abnormality occurrence period, calculating a second degree of similarity between the second term frequency-inverse document frequency vector and the third term frequency-inverse document frequency vector, and transmitting, to the terminal of the operation manager of the device, recommendation information regarding the second abnormality occurrence period when the second degree of similarity is equal to or greater than a predetermined value.

A non-transitory computer-readable storage medium that has recorded an operation management computer program for causing a computer to execute:

• successively receiving, from a device to be managed, performance information and event logs of the device to be managed;
• extracting, according to the performance information and the event logs of the device to be managed, a first abnormality occurrence period using the performance information, calculating a first term frequency-inverse document frequency vector created using event logs in the first abnormality occurrence period, and storing at least the first term frequency-inverse document frequency vector as a learning model;
• calculating, using the performance information and event logs newly acquired by the device, a second abnormality occurrence period and a second term frequency-inverse document frequency vector, calculating a first degree of similarity between the first term frequency-inverse document frequency vector in the learning model and the second term frequency-inverse document frequency vector, and transmitting, to a terminal of an operation manager of the device, recommendation information regarding the calculated second abnormality occurrence period when the first degree of similarity is equal to or less than a predetermined value;
• acquiring, for the performance information and the event logs of the device, predicted data of performance information using the performance information as learning data, extracting an abnormality occurrence period of the predicted data to set the abnormality occurrence period of the predicted data as a third abnormality occurrence period, and storing the third abnormality occurrence period and event logs corresponding to the third abnormality occurrence period;
• and
• calculating, when there is a predetermined difference in comparison of the second abnormality occurrence period and the third abnormality occurrence period, a third term frequency-inverse document frequency vector according to the event logs corresponding to the third abnormality occurrence period, calculating a second degree of similarity between the second term frequency-inverse document frequency vector and the third term frequency-inverse document frequency vector, and transmitting, to the terminal of the operation manager of the device, recommendation information regarding the second abnormality occurrence period when the second degree of similarity is equal to or greater than a predetermined value.