Root cause analysis method, apparatus, and program for IT apparatuses from which event information is not obtained

A management computer comprising:

• a memory storing a management program;
• and
• a CPU (Central Processing Unit) that executes the management program,
• wherein when executed, the management program causes the CPU to:
• store correlation analysis rule information, indicating that an event of a second event type is a root cause of an event of a first event type for a network service;
• store configuration information including at least information about the network service of a plurality of monitored apparatuses;
• obtain event information from the plurality of monitored apparatuses;
• identify, from the event information, a first event of the first event type;
• identify a first monitored apparatus in which the first event occurs;
• and
• identify a root cause apparatus which is a server of the network service, based on the correlation analysis rule information and the configuration information, even if the root cause apparatus is not included in the plurality of monitored apparatuses.

A non-transitory machine-readable storage medium tangibly embodying a program for execution on a management computer, the program comprising code causing the management computer to:

• store correlation analysis rule information, indicating that an event of a second event type is a root cause of an event of a first event type for a network service;
• store configuration information including at least information about the network service of a plurality of monitored apparatuses;
• obtain event information from the plurality of monitored apparatuses;
• identify, from the event information, a first event of the first event type;
• identify a first monitored apparatus in which the first event occurs;
• and
• identify a root cause apparatus which is a server of the network service, based on the correlation analysis rule information and the configuration information, even if the root cause apparatus is not included in the plurality of monitored apparatuses.