Method for monitoring abnormal behavior in a computer system
AssigneeHitachi, Ltd.
InventorsAkihiro Urano, Toshiaki Hirata, Shuji Fujino, Toshio Sato
Life of this patent
Estimating the term…
Abstract
The present invention relates to a method for monitoring a computer system in which one manager computer is connected to a plurality of agent computers over a network. The manager computer sends information on the types of log to be collected to the plurality of agent computers. In response, the plurality of agent computers collect the specified types of log. Then, the plurality of agent computers send the collected logs to the manager computer. Thus, the plurality of agent computers are able to collect the types of log specified by the manager computer.
Claims11
A method for monitoring a computer system in which a manager computer and a plurality of agent computers are connected over a network, comprising:
- in response to an abnormal state occurring on one of said plurality of agent computers, presuming on said manager computer a first cause of said abnormal state;
- sending a request from said manager computer to said plurality of agent computers, said request requesting to collect logs to prove said presumed first cause;
- collecting a log to prove said presumed first cause on each of said plurality of agent computers;
- sending said collected log from each of said plurality of agent computers to said manager computer;
- comparing on said manager computer said collected logs with each other to presume, as a result of comparison thereof, a second cause which caused the first cause;
- and
- sending a request from said manager computer to said plurality of agent computers, said request requesting to collect logs to prove said presumed second cause.
A method for monitoring a computer system in which a manager computer and (n+1) agent computers are connected over a network, comprising:
- dividing a log collected on said manager computer into n pieces of log information;
- on said manager computer, generating appendage information which recovers said log based on pieces of log information less than n;
- distributing said n pieces of information and said appendage information to said (n+1) agent computers, respectively;
- and
- on each of said (n+1) agent computers, encrypting and memorizing respective one of said distributed log information and said appendage information.
A method for monitoring a computer system in which a plurality of computers to be managed and a manager computer are connected to a network, comprising:
- monitoring, by said manager computer, logs collected from said plurality of computers to be managed;
- and
- detecting, by said manager computer, suspicious behavior by comparing said logs or checking inconsistency of said logs.
Dependencies are inferred from the claim text.