Method for monitoring abnormal behavior in a computer system

A method for monitoring a computer system in which a manager computer and a plurality of agent computers are connected over a network, comprising the steps of:

• in response to an error occurring on one of said plurality of agent computers, supposing a first cause of said error on said manager computer;
• sending a request from said manager computer to said plurality of agent computers, said request requesting to collect a log to prove said supposed first cause;
• collecting the log to prove said supposed first cause on each of said plurality of agent computers;
• sending said collected log from each of said plurality of agent computers to said manager computer;
• supposing a second cause of the first cause on said manager computer;
• and
• sending the request from said manager computer to said plurality of agent computers, said request requesting to collect the log to prove said supposed second cause.

A method for monitoring a computer system in which a manager computer and (n+1) agent computers are connected over a network, comprising the steps of:

• dividing a log collected on said manager computer into n pieces of log information;
• on said manager computer, generating appendage information to be added to the n pieces of log information;
• distributing said n pieces of information and said appendage information among said (n+1) agent computers;
• and
• on said (n+1) agent computers, encrypting and memorizing said distributed log information and said appendage information.