# US 2013/0159778 A1 · Operations management apparatus, operations management method and program thereof > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0159778 A1 - Document ID: US20130159778A1 - Status: Published application - Kind: A1 - Application number: 13/579,538 - Filed: 2011-12-16 - Published: 2013-06-20 - Earliest claimed: 2011-12-16 - Assignees: NEC Corporation - Inventors: Kentarou Yabuki - Web page: https://patentgrep.com/patent/US20130159778A1 ## CPC - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/3495: {for systems} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A candidate to cause a fault is identified, in case that correlation destruction is detected in some processing apparatuses or the like due to spread of the fault within a system. A correlation destruction detecting unit 104 detects correlation destruction related to a correlation which is included in a correlation model 122 by applying inputted performance value of a monitored object to the correlation model 122 of the monitored object which a correlation model storing unit 112 stores. The fault analyzing unit 105 determines and outputs the monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting the correlation destruction related to a common correlation in a plurality of the monitored objects which are connected directly or indirectly with a common apparatus or common the monitored object and which have the correlation models 122 including the common correlation. ## Claims ### Claim 1 An operations management apparatus, comprising: a correlation model storing unit which stores a correlation model including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects; a correlation destruction detecting unit which detects correlation destruction related to a correlation which is included in said correlation model by applying inputted said performance value of said monitored object to said correlation model of said monitored object which said correlation model storing means stores; and a fault analyzing unit which determines and outputs said monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in a plurality of said monitored objects which are connected directly or indirectly with a common apparatus or common said monitored object and which have said correlation models including said common correlation. ### Claim 2 (depends on 1) The operations management apparatus according to claim 1, wherein said fault analyzing unit determines said monitored object having low degree of similarity on said result of judging whether detecting or not detecting said correlation destruction related to said common correlation in comparison with another monitored object as said candidate to cause a fault. ### Claim 3 (depends on 1) The operations management apparatus according to claim 1, wherein said plural monitored objects are grouped into a plurality of layers, and each of said monitored objects belonging to one layer out of two adjacent said layers is connected with each of said monitored objects belonging to the other layer, and said correlation models of said plural monitored objects belonging to each of said plural layers include said common correlation, and said fault analyzing unit compares said results of judging whether detecting or not detecting said correlation destruction related to said common correlation in said plural monitored objects belonging to each of said plural layers. ### Claim 4 (depends on 1) The operations management apparatus according to claim 1, wherein said fault analyzing unit outputs a correlation on which said correlation destruction is detected, which is included in said correlation model of said monitored object determined as said candidate to cause a fault, in association with a type of a performance value related to said correlation on which said correlation destruction is detected. ### Claim 5 (depends on 1) The operations management apparatus according to claim 1, further comprising: a group information generating unit which extracts a group including said plural monitored objects each having said correlation model including said common correlation, through comparing said correlation models in said plural monitored objects which are connected directly or indirectly with said common apparatus or said common said monitored object. ### Claim 6 An operations management method, comprising: storing a correlation model including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects; detecting correlation destruction related to a correlation which is included in said correlation model by applying inputted said performance value of said monitored object to said correlation model of said monitored object; and determining and outputting said monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in a plurality of said monitored objects which are connected directly or indirectly with a common apparatus or common said monitored object and which have said correlation models including said common correlation. ### Claim 7 (depends on 6) The operations management method according to claim 6, wherein said determining determines said monitored object having low degree of similarity on said result of judging whether detecting or not detecting said correlation destruction related to said common correlation in comparison with another monitored object as said candidate to cause a fault. ### Claim 8 (depends on 6) The operations management method according to claim 6, wherein said plural monitored objects are grouped into a plurality of layers, and each of said monitored objects belonging to one layer out of two adjacent said layers is connected with each of said monitored objects belonging to the other layer, and said correlation models of said plural monitored objects belonging to each of said plural layers include said common correlation, and said determining compares said results of judging whether detecting or not detecting said correlation destruction related to said common correlation in said plural monitored objects belonging to each of said plural layers. ### Claim 9 (depends on 6) The operations management method according to claim 6, wherein said outputting outputs a correlation on which said correlation destruction is detected, which is included in said correlation model of said monitored object determined as said candidate to cause a fault, in association with a type of a performance value related to said correlation on which said correlation destruction is detected. ### Claim 10 (depends on 6) The operations management method according to claim 6, further comprising: extracting a group including said plural monitored objects each having said correlation model including said common correlation, through comparing said correlation models in said plural monitored objects which are connected directly or indirectly with said common apparatus or said common said monitored object. ### Claim 11 A non-transitory computer readable storage medium recording thereon a program, causing a computer to perform a method comprising: storing a correlation model including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects; detecting correlation destruction related to a correlation which is included in said correlation model by applying inputted said performance value of said monitored object to said correlation model of said monitored object; and determining and outputting said monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in a plurality of said monitored objects which are connected directly or indirectly with a common apparatus or common said monitored object and which have said correlation models including said common correlation. ### Claim 12 (depends on 11) The non-transitory computer readable storage medium according to claim 11, recording thereon said program causing said computer to perform said method, wherein said determining determines said monitored object having low degree of similarity on said result of judging whether detecting or not detecting said correlation destruction related to said common correlation in comparison with another monitored object as said candidate to cause a fault. ### Claim 13 (depends on 11) The non-transitory computer readable storage medium according to claim 11, recording thereon said program causing said computer to perform said method, wherein said plural monitored objects are grouped into a plurality of layers, and each of said monitored objects belonging to one layer out of two adjacent said layers is connected with each of said monitored objects belonging to the other layer, and said correlation models of said plural monitored objects belonging to each of said plural layers include said common correlation, and said determining compares said results of judging whether detecting or not detecting said correlation destruction related to said common correlation in said plural monitored objects belonging to each of said plural layers. ### Claim 14 (depends on 11) The non-transitory computer readable storage medium according to claim 11, recording thereon said program causing said computer to perform said method, wherein said outputting outputs a correlation on which said correlation destruction is detected, which is included in said correlation model of said monitored object determined as said candidate to cause a fault, in association with a type of a performance value related to said correlation on which said correlation destruction is detected. ### Claim 15 (depends on 11) The non-transitory computer readable storage medium according to claim 11, recording thereon said program causing said computer to perform said method, further comprising: extracting a group including said plural monitored objects each having said correlation model including said common correlation, through comparing said correlation models in said plural monitored objects which are connected directly or indirectly with said common apparatus or said common said monitored object. ### Claim 16 An operations management apparatus, comprising: a correlation model storing unit which stores a correlation mode including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects; a correlation destruction detecting unit which detects correlation destruction related to a correlation which is included in said correlation model by applying inputted said performance value of said monitored object to said correlation model of said monitored object which said correlation model storing means stores; and a fault analyzing unit which determines and outputs said monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in said plural monitored objects which provide the same function each other, said plural monitored objects receiving a request for processing issued by a common apparatus or common said monitored object or using a result of a process carried out by a common apparatus or common said monitored object. ### Claim 17 (depends on 16) The operations management apparatus according to claim 16, wherein said fault analyzing unit determines said monitored object having low degree of similarity on said result of judging whether detecting or not detecting said correlation destruction related to said common correlation in comparison with another monitored object as said candidate to cause a fault. ### Claim 18 (depends on 16) The operations management apparatus according to claim 16, wherein said fault analyzing unit outputs a correlation on which said correlation destruction is detected, which is included in said correlation model of said monitored object determined as said candidate to cause a fault, in association with a type of a performance value related to said correlation on which said correlation destruction is detected. ### Claim 19 (depends on 16) The operations management apparatus according to claim 16, further comprising: a group information generating unit which extracts a group including said plural monitored objects each having said correlation model including said common correlation, through comparing said correlation models in said plural monitored objects which provide the same function each other, said plural monitored objects receiving a request for processing issued by said common apparatus or said common said monitored object or using a result of a process carried out by said common apparatus or said common said monitored object. ### Claim 20 An operations management method, comprising: storing a correlation mode including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects; detecting correlation destruction related to a correlation which is included in said correlation model by applying inputted said performance value of said monitored object to said correlation model of said monitored object; and determining and outputting said monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in said plural monitored objects which provide the same function each other, said plural monitored objects receiving a request for processing issued by a common apparatus or common said monitored object or using a result of a process carried out by a common apparatus or common said monitored object. ### Claim 21 (depends on 20) The operations management method according to claim 20, wherein said determining determines said monitored object having low degree of similarity on said result of judging whether detecting or not detecting said correlation destruction related to said common correlation in comparison with another monitored object as said candidate to cause a fault. ### Claim 22 (depends on 20) The operations management method according to claim 20, wherein said outputting outputs a correlation on which said correlation destruction is detected, which is included in said correlation model of said monitored object determined as said candidate to cause a fault, in association with a type of a performance value related to said correlation on which said correlation destruction is detected. ### Claim 23 (depends on 20) The operations management method according to claim 20 further comprising: extracting a group including said plural monitored objects each having said correlation model including said common correlation, through comparing said correlation models in said plural monitored objects which provide the same function each other, said plural monitored objects receiving a request for processing issued by said common apparatus or said common said monitored object or using a result of a process carried out by said common apparatus or said common said monitored object. ### Claim 24 An operations management apparatus, comprising: correlation model storing means for storing a correlation model including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects; correlation destruction detecting means for detecting correlation destruction related to a correlation which is included in said correlation model by applying inputted said performance value of said monitored object to said correlation model of said monitored object which said correlation model storing means stores; and fault analyzing means for determining and outputting said monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in a plurality of said monitored objects which are connected directly or indirectly with a common apparatus or common said monitored object and which have said correlation models including said common correlation. ### Claim 25 An operations management apparatus, comprising: correlation model storing means for storing a correlation mode including one or more correlation functions each of which indicates a correlation for a pair of types of performance values out of a plural types of performance values, for each of plural monitored objects; correlation destruction detecting means for detecting correlation destruction related to a correlation which is included in said correlation model by applying inputted said performance value of said monitored object to said correlation model of said monitored object which said correlation model storing means stores; and fault analyzing means for determining and outputting said monitored object which should be a candidate to cause a fault through comparing results of judging whether detecting or not detecting said correlation destruction related to a common correlation in said plural monitored objects which provide the same function each other, said plural monitored objects receiving a request for processing issued by a common apparatus or common said monitored object or using a result of a process carried out by a common apparatus or common said monitored object.