Event monitoring apparatus and event monitoring method

An event monitoring apparatus that monitors an event including an event message indicated by a character string related to a phenomenon encountered in an information system, the event monitoring apparatus comprising:

• a ledger management section that stores a plurality of pieces of ledger data including a typical ledger guide message indicated by a character string and describing a method of handling the event;
• a threshold determination section that calculates degree of similarity between the ledger guide message and the event message, regards a maximum value of the calculated degree of similarity as a first threshold, sets a third threshold that is smaller than the first threshold by a predetermined value, and sets a fourth threshold that is equal to a second maximum value of the degree of similarity;
• a ledger allocation section that associates the ledger guide message having the degree of similarity intermediate between the first threshold and the third threshold with the event message;
• and
• a threshold evaluation section that reports the degree of similarity to a manager of the information system when the degree of similarity is intermediate between the third threshold and the fourth threshold.

An event monitoring method by an event monitoring apparatus that monitors an event including an event message indicated by a character string related to a phenomenon encountered in an information system, and includes a ledger management section for storing a plurality of pieces of ledger data including a typical ledger guide message indicated by a character string and describing a method of handling the event, the event monitoring method comprising:

• calculating degree of similarity between the ledger guide message and the event message, regarding a maximum value of the calculated degree of similarity as a first threshold, and setting a second threshold that is greater than the first threshold by a predetermined value;
• associating the ledger guide message having the degree of similarity intermediate between the first threshold and the second threshold with the event message;
• and
• reporting the degree of similarity to a manager of the information system when the degree of similarity is higher than the first threshold.