Early abnormality detection based on frequency-inverse document frequency vectors created using event logs

Abstract

A learning unit of an operation management system extracts, according to performance information and event logs of a device to be managed, a first abnormality occurrence period using the performance information, calculates a first TF-IDF vector created using event logs in the first abnormality occurrence period, and stores at least the first TF-IDF vector as a learning model. A recommendation section calculates, using the performance information and event logs newly acquired by the device, a second abnormality occurrence period and a second TF-IDF vector, calculates a first degree of similarity between the first TF-IDF vector in the learning model and the second TF-IDF vector, and outputs recommendation information regarding the calculated second abnormality occurrence period when the first degree of similarity is equal to or less than a predetermined value.