VAX/VMS event monitoring and analysis

Event logs can be used effectively to improve computer system availability. Uses include retrospective and predictive diagnosis; fault management; failure rate estimation; and trend analysis. Unfortunately, much of the research to date has been hampered by the lack of suitable event data, and occasionally by the incorrect interpretation of the available data. This research uses one of the largest sets of data, and the most intensive investigation of the monitoring process conducted to date, to examine event monitoring and analysis. 2.35 million events from 193 VAX/VMS systems covering 335 machine years were used. Examples are presented which show that monitoring deficiencies complicate the analyses, consume additional time, and make incorrect conclusions more likely. For example, incorrect handling of bogus timestamps changes the mean time between groups of events by an order of magnitude. An analysis procedure to identify defects is provided, along with design rules to create better quality logs.<>