It system fault analysis technique based on configuration management database

A computer-implemented method for analyzing a root cause related to an abnormal situation in an IT system, which is performed by a computing device, the method comprising:

• detecting that an incident configuration item (CI) event for at least one of nodes to be monitored in the IT system occurs, wherein the nodes match CIs in a configuration management database (CMDB), respectively and the CMDB includes CIs and CI relation information;
• identifying an incident CI related to the incident CI event;
• deciding candidate CIs having a predetermined hierarchy depth from the identified incident CI based on the CI relation information in the CMDB, wherein the hierarchy depth is associated with a distance between the CIs in the CI relation information;
• identifying candidate events which occur in the candidate CIs;
• deciding the occurrence time of each of the candidate events;
• deciding one or more analysis target events among the candidate events based on the decided occurrence time;
• generating event correlation information connecting the one or more analysis target events to each other;
• deciding causality indicating a directional property for mutual connection of the one or more analysis target events included in the event correlation information based on the CI relation information in the CMDB;
• and
• analyzing a root cause for the incident CI event based on the causality in the event correlation information.

A management server for analyzing a root cause related to an abnormal situation in an IT system, the management server comprising:

• memory;
• and
• at least one processor connected to the memory,
• wherein the at least one processor is configured to:
• detect that an incident configuration item (CI) event for at least one of nodes to be monitored in the IT system occurs, wherein the nodes match CIs in a configuration management database (CMDB), respectively and the CMDB includes CIs and CI relation information;
• identify an incident CI related to the incident CI event;
• decide candidate CIs having a predetermined hierarchy depth from the identified incident CI based on the CI relation information in the CMDB, wherein the hierarchy depth is associated with a distance between the CIs in the CI relation information;
• identify candidate events which occur in the candidate CIs;
• decide the occurrence time of each of the candidate events;
• decide one or more analysis target events among the candidate events based on the decided occurrence time;
• generate event correlation information connecting the one or more analysis target events to each other;
• decide causality indicating a directional property for mutual connection of the one or more analysis target events included in the event correlation information based on the CI relation information in the CMDB;
• and
• analyze a root cause for the incident CI event based on the causality in the event correlation information.