Monitoring device information analyzing device and method, and non-transitory storage medium storing program

A monitoring device information analyzing method that extracts, from log information that is output from a plurality of monitoring target devices, a log such that there is a change in an amount of generation before and after a specific event, the monitoring device information analyzing method comprising:

• a log variation amount calculation step of calculating a log variation amount that is to be a sample from a log variation amount of a monitoring target device h and a log variation amount of the monitoring target device h on another day at a same time zone, by referring to, upon a given target event, the monitoring target device h, time of occurrence and end time of the target event, and a time width (Tpre, Tpos) before and after the target event being provided, a template information storage unit storing a time at which a log message arises, the log message arising in a past, a template that is associated with an ID of the monitoring target device h, and a template ID of the template to calculate the log variation amount of the monitoring target device h and to obtain the log variation amount of the monitoring target device h on the other day at the same time zone;
• and
• a verification step of obtaining the log variation amount that is to be the sample, executing verification according to a statistical method by using the sample, and determining the sample as an advance log, if a test statistic is greater than a predetermined threshold value.

A non-transitory storage medium storing a monitoring device information analyzing program for causing a computer to function as a monitoring device information analyzing device that extracts, from log information that is output from a plurality of monitoring target devices, a log such that there is a change in an amount of generation before and after a specific event,

• wherein the monitoring device information analyzing device comprises:
• a log variation amount calculation unit that calculates a log variation amount that is to be a sample from a log variation amount of a monitoring target device h and a log variation amount of the monitoring target device h on another day at a same time zone, by referring to, upon a given target event, the monitoring target device h, time of occurrence and end time of the target event, and a time width (Tpre, Tpos) before and after the target event being provided, a template information storage unit storing a time at which a log message arises, the log message arising in a past, a template that is associated with an ID of the monitoring target device h, and a template ID of the template to calculate the log variation amount of the monitoring target device h and to obtain the log variation amount of the monitoring target device h on the other day at the same time zone;
• and
• a verification unit that obtains the log variation amount that is to be the sample, that executes verification according to a statistical method by using the sample, and that determines the sample as an advance log, if a test statistic is greater than a predetermined threshold value.