# US 2014/0195856 A1 · Analysis method, analysis apparatus, and computer-readable recording medium storing analysis program

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0195856 A1
- Document ID: US20140195856A1
- Status: Published application
- Kind: A1
- Application number: 14/069,442
- Filed: 2013-11-01
- Published: 2014-07-10
- Earliest claimed: 2013-01-07
- Assignees: Fujitsu Limited
- Applicants: Fujitsu Limited
- Inventors: Yuuji HOTTA
- Web page: https://patentgrep.com/patent/US20140195856A1

## CPC

- G06F 11/0754: {by exceeding limits}
- G06F 11/0715: {in a system implementing multitasking (multitasking per se G06F9/46)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Normal and abnormal states are calculated from log data with respect to each of a plurality of processings in which shared modules exist. A timing of a change of the states is calculated. A time interval, in which the normal and abnormal states are not mixed, is separated with respect to each of the plurality of processings, based on the calculated timing. In the time interval, an abnormal module is detected, based on relationship information between the plurality of processings and the modules.

## Claims

### Claim 1

An analysis method comprising:
calculating normal and abnormal states from log data with respect to each of a plurality of processings in which shared modules exist;
calculating a timing of a change of the states;
separating a time interval, in which the normal and abnormal states are not mixed, with respect to each of the plurality of processings, based on the calculated timing; and
detecting an abnormal module in the time interval, based on relationship information between the plurality of processings and the modules.

### Claim 2 (depends on 1)

The analysis method according to claim 1, wherein a start timing of a different type of a state is an end timing of the time interval.

### Claim 3 (depends on 1)

The analysis method according to claim 1, wherein a last end timing of a same type of a state is an end timing of the time interval.

### Claim 4 (depends on 1)

The analysis method according to claim 1, wherein an end timing of a type of a state having appeared before a start timing of a different type of a state is an end timing of the time interval.

### Claim 5 (depends on 1)

The analysis method according to claim 1, wherein when necessary data enough to detect the abnormal module does not exist, data is supplemented by re-inputting necessary data from a stored user request.

### Claim 6 (depends on 1)

The analysis method according to claim 1, wherein when one of the processings passes through a plurality of paths being a set of the modules, the detection of the abnormal module is performed by identifying the paths using appearance probability.

### Claim 7

An analysis apparatus equipped with a computer, wherein the computer is configured to:
calculate normal and abnormal states from log data with respect to each of a plurality of processings in which shared modules exist;
calculate a timing of a change of the states;
separate a time interval, in which the normal and abnormal states are not mixed, with respect to each of the plurality of processings, based on the calculated timing; and
detect an abnormal module in the time interval, based on relationship information between the plurality of processings and the modules.

### Claim 8

A non-transitory computer-readable recording medium storing an analysis program to cause a computer to execute:
calculating normal and abnormal states from log data with respect to each of a plurality of processings in which shared modules exist;
calculating a timing of a change of the states;
separating a time interval, in which the normal and abnormal states are not mixed, with respect to each of the plurality of processings, based on the calculated timing; and
detecting an abnormal module in the time interval, based on relationship information between the plurality of processings and the modules.