Analysis method, analysis apparatus, and computer-readable recording medium storing analysis program

Abstract

Normal and abnormal states are calculated from log data with respect to each of a plurality of processings in which shared modules exist. A timing of a change of the states is calculated. A time interval, in which the normal and abnormal states are not mixed, is separated with respect to each of the plurality of processings, based on the calculated timing. In the time interval, an abnormal module is detected, based on relationship information between the plurality of processings and the modules.

What is claimed is: 
     
         1 . An analysis method comprising:
 calculating normal and abnormal states from log data with respect to each of a plurality of processings in which shared modules exist;   calculating a timing of a change of the states;   separating a time interval, in which the normal and abnormal states are not mixed, with respect to each of the plurality of processings, based on the calculated timing; and   detecting an abnormal module in the time interval, based on relationship information between the plurality of processings and the modules.   
     
     
         2 . The analysis method according to  claim 1 , wherein a start timing of a different type of a state is an end timing of the time interval. 
     
     
         3 . The analysis method according to  claim 1 , wherein a last end timing of a same type of a state is an end timing of the time interval. 
     
     
         4 . The analysis method according to  claim 1 , wherein an end timing of a type of a state having appeared before a start timing of a different type of a state is an end timing of the time interval. 
     
     
         5 . The analysis method according to  claim 1 , wherein when necessary data enough to detect the abnormal module does not exist, data is supplemented by re-inputting necessary data from a stored user request. 
     
     
         6 . The analysis method according to  claim 1 , wherein when one of the processings passes through a plurality of paths being a set of the modules, the detection of the abnormal module is performed by identifying the paths using appearance probability. 
     
     
         7 . An analysis apparatus equipped with a computer, wherein the computer is configured to:
 calculate normal and abnormal states from log data with respect to each of a plurality of processings in which shared modules exist;   calculate a timing of a change of the states;   separate a time interval, in which the normal and abnormal states are not mixed, with respect to each of the plurality of processings, based on the calculated timing; and   detect an abnormal module in the time interval, based on relationship information between the plurality of processings and the modules.   
     
     
         8 . A non-transitory computer-readable recording medium storing an analysis program to cause a computer to execute:
 calculating normal and abnormal states from log data with respect to each of a plurality of processings in which shared modules exist;   calculating a timing of a change of the states;   separating a time interval, in which the normal and abnormal states are not mixed, with respect to each of the plurality of processings, based on the calculated timing; and   detecting an abnormal module in the time interval, based on relationship information between the plurality of processings and the modules.