Fujitsu Corporation

Yuuji Hotta

Motoyuki Kawaba

Lilian Harada

Hidekazu Takahashi

Riichiro Take

Takeshi Yasuie

Toshihiro Shimizu

Kenichi Kobayashi

Hiroshi Otsuka

Ken Yokoyama

Atsuji Sekiguchi

Kazumi Kubota

Nobuhiro Yugami

Naoki Akaboshi

Mikio Ito

Tadaomi Kato

Yasuhiko Kanemasa

Hirotaka Hara

Toshihiro Kodaka

Hidejiro Daikokuya

Tomohiro Ohtake

Osamu Kimura

Nobuyuki Kanaya

Sanya Uehara

Shigeki Suguta

Takao Okubo

An apparatus collects log data for each function; analyzes the log data to determine, for each function, whether a delay is present in a path of the function; classifies, for each function, one or more of a normal interval and an abnormal interval of the function based on the analyzed log data; defines, as an aggregation interval, a time interval at which two or more functions have an abnormal interval and one or more functions have a normal interval; identifies the one or more modules of paths of each function during the aggregation interval; and detects, as an abnormal module, a module that is present in two or more paths of functions with abnormal intervals during the aggregation interval and is not present in any path of the functions with normal intervals during the aggregation interval.

Abnormal module detection using aggregated time interval analysis

A processor calculates a correlation between a first data item and a second data item, based on values of the first data item in a first log and values of the second data item in a second log, and determines an influence direction by comparing values of a first chronological item with values of a second chronological item. The processor collects third and fourth logs respectively generated later than the first and second logs. The processor determines whether the correlation holds with respect to values of the first data item in the third log and values of the second data item in the fourth log, and outputs an anomaly report, when the correlation does not hold, to indicate which of the first and second data items is a cause data item (i.e., the source of an anomaly), based on the influence direction.

Apparatus, system, and method for analyzing logs

The analyzer includes a path information obtainer that extracts a component that a first function among a plurality of functions sometimes uses and sometimes does not use as an undetermined component beforehand; a detector that detects whether the undetermined component is used during operation; and a specifier that specifies, when a problem arises during the operation, a problem component, as a problem point, among one or more components based on path information including the one or more components that each of the plurality of functions uses and being obtained for the function beforehand, operation information obtained during the operation, and a result of detecting using of the undetermined component. This configuration makes it possible to specify an exact problem point.

Method for analysis, analyzer, and non-transitory computer-readable recording medium having stored therein analysis program

An analysis apparatus compares first code describing a plurality of first components with second code describing a plurality of second components, to extract difference components. The analysis apparatus sends a plurality of requests to an execution apparatus on which the plurality of second components are deployed, obtains first log information indicating the execution state of each difference component, and specifies relevant requests related to the execution of the difference components. The analysis apparatus sends the specified relevant requests to the execution apparatus and obtains second log information indicating the execution state of each of the plurality of second components. The analysis apparatus generates path information about second components executed in response to each relevant request among the plurality of second components, on the basis of the second log information.

Apparatus and method for collecting and analyzing logs to obtain information about program components used by applications

Relating to services each including a plurality of processes having a plurality of hierarchies, service information is stored in which processes for each service are grouped in a predetermined hierarchy taking presence or absence of a common hierarchy into consideration. Then, based on log data and the service information relating to a plurality of services, a first decision process for deciding presence or absence of an abnormality relating to a process included in one or more services is performed. Further, a second decision process is performed for developing, where a process decided as an abnormal process is a grouped grouping process, the grouping process decided as an abnormal process to one or more processes in a lower hierarchy than the predetermined hierarchy based on the service information and deciding presence or absence of an abnormality relating to the one or more developed processes.

Analysis method, analysis apparatus and computer-readable recording medium having stored therein analysis program

A first memory unit stores requester event information pieces each including time information indicating an occurrence time of an event associated with a process executed by a first server. A second memory unit stores request-destination event information pieces each including time information indicating an occurrence time of an event associated with a process executed by a second server in response to a request from the first server. A determining unit determines, for each request-destination event information piece, a correction allowable range of the time information by comparing the time information of the request-destination event information pieces with that of the requester event information pieces. A generating unit generates an information set by extracting, from the request-destination event information pieces arranged in chronological order according to the time information, chronologically consecutive request-destination event information pieces whose correction allowable ranges include a common value.

Apparatus and method for correcting time stamps of transactions performed by multiple servers

Common parameters in common between a plurality of request logs are extracted from parameters in the plurality of request logs. The plurality of request logs is obtained when a request is executed by a process that uses a plurality of components. A common parameter different from a common parameter extracted for another process among the extracted common parameters is determined as an identification parameter that identifies the process. This allows accurately categorizing the process based on a log to be obtained when the process is executed.

Method for analyzing request logs in advance to acquire path information for identifying problematic part during operation

A first memory stores requester event records describing events that occurred in relation to processes executed in a first server. A second memory stores requestee event records describing events that occurred in relation to processes executed in a second server in response to execution requests issued from the first server. An associating unit searches the first and second memories for requester event records and requestee event records whose transaction identifiers are identical and associates the found records together. A determining unit compares the associated event records with each other in terms of their time information. Based on this comparison, the determining unit determines a correction value for correcting time differences between requester event records in the first memory and requestee event records in the second memory.

Information processing apparatus and method for determining time correction values

Upon receiving a packet addressed to a virtual machine, a virtual switch connected to the virtual machine forwards the packet to the virtual machine, stores the received packet, the packet being related to an uncompleted transaction in the first storing unit in association with the uncompleted transaction, in response to an instruction for restoring the virtual machine, stops the forwarding of the packet to the virtual machine, and in response to the completion of the restoring of the virtual machine, upon receiving an instruction for resuming the forwarding, transmits one or a plurality of packets stored in the first storing unit in association with the uncompleted transaction to the virtual machine.

Recording medium storing transaction resuming program, information processing apparatus and transaction resuming method

A tied server includes a first storage unit that stores appearance patterns of messages having a transaction identifier to identify a transaction. The tied server also includes a second storage unit that stores messages executed on the transaction DB server having the transaction ID by the application server and communicated between an application server and a DB server. The tied server classifies the messages stored in the second storage unit with respect to each transaction based on the appearance patterns of the messages stored in the first storage unit.

Information processing apparatus, message classifying method and non-transitory medium for associating series of transactions

A character string which is unique in each transaction and a character string common to different transactions are extracted from a message log obtained when the same transaction is processed for a plurality of number of times. Then, messages stored by practically operating an information system are associated with each transaction by utilizing these character strings, and the character string common to the transactions of which execution times overlap with each other is deleted, so that the remained character strings are provided as linking keywords.

Computer readable recording medium storing linking keyword automatically extracting program, linking keyword automatically extracting method and apparatus

This message tying processing method include: extracting tying keys from a key definition database storing, for each protocol, tying keys included in messages relating to the protocol and used in a message tying processing, and generating data of a structure including nodes respectively corresponding to the extracted tying keys and links connecting between the nodes of the tying keys belonging to the same protocol: judging whether or not a loop is formed in the structure by the links; when it is judged that the loop is not formed in the structure, identifying, among allocation patterns that are combinations of allocation of the tying keys to each of plural tying processors, that respectively carry out the tying processing in cooperation with each other, an allocation pattern satisfying a first condition that a communication load between the tying processors is the minimum.

Message tying processing method and apparatus

An apparatus has a unit that receives plural messages, which belong to plural transactions and respectively have a pertinent transaction identifier, in an indefinite order; plural processors each having a queue storing the messages belonging to a transaction in charge, and outputting, after the messages belonging to one of the transactions in charge have become complete, the complete messages in the queue to a message processing unit; an allocation unit that outputs the received message to one of the plural processors, wherein one of the processors is identified based on the transaction identifier of the received message and an allocation rule predetermined for the transaction identifier; and a change unit that changes the allocation rule when activating or stopping the processor. When the change unit changes the allocation rule, each of the processors outputs at least messages for which re-allocation is necessary to the allocation unit.

Message binding processing technique

A computer-readable, non-transitory medium stores the system analysis program which can accurately analyze the operational status of a system without modifying functions of the system for providing services. A message analysis unit analyzes the contents of collected messages, and determines the times of occurrence of the messages, the process types requested by the messages, and whether or not each of the messages is a request message or a response message. In response to an instruction for model generation, a model generation unit generates a transaction model satisfying at least one limiting condition related to caller-called relationships between processes, based on a set of messages selected in accordance with a selection criterion based on the certainty of existence of caller-called relationships. Then, in response to an instruction for analysis, an analysis unit analyzes the processing status of a transaction based on a protocol log conforming to the transaction model.

System analysis program, system analysis method, and system analysis apparatus

A processing time can be defined in a system including a plurality of computers for which the processing time is calculated, by displaying candidates of paths corresponding to flow of a series of processings as to transmission and reception of each message based on transmission and reception of messages among a plurality of computers; receiving an input that selects one path among the displayed candidates; and creating a processing time in each of computers in the flow of a series of processings as to transmission and reception of messages based on the received input.

Growing community of inventors

Kawasaki, Japan

Yuuji Hotta