A root cause analysis engine uses event survival times and gradual deletion of events to improve analysis accuracy and reduce the number of required calculations. Certainty factors of relevant rules are recalculated every time notification of an event is received. The calculation results are held in a rule memory in the analysis engine. Each event has a survival time, and when the time has expired, that event is deleted from the rule memory. Events held in the rule memory can be deleted without affecting other events held in the rule memory. The analysis engine can then re-calculate the certainty factor of each rule by only performing the re-calculation with respect to affected rules that are related with the deleted event. The calculation cost can be reduced because analysis engine processes events incrementally or decrementally. Analysis engine can determine the most possible conclusion even if one or more condition elements were not true, because analysis engine can calculate the certainty factor of rule even if one or more events were not notified to analysis engine.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method for monitoring a system which includes a plurality of nodes coupled by a network, the method comprising: managing a first rule which has at least one first relationship between a first condition element and a first conclusion element and a second rule which has at least one second relationship between the first condition element and a second conclusion element, the first relationship and second relationship being configured by considering a topology of the system; creating a data structure including a first cause object corresponding to the first conclusion element in the first rule, and a second cause object corresponding to the second conclusion element in the second rule, and a first condition object corresponding to the first condition element in both the first rule and the second rule, the first condition object being linked to both the first cause object and the second cause object without duplication of the first condition object; and analyzing a root cause of an event, which has occurred on a node of the system and is related to the first condition object, based on the data structure. 2. A method according to claim 1 further comprising: searching a condition object corresponding to a condition element if the condition object has been stored in the data structure; and creating the condition object for storing in the data structure if the condition object has not been included in the data structure. 3. A method according to claim 1 further comprising: creating the first rule and the second rule based on a plurality of general rules, which are independent from the topology of the system, and the topology of the system. 4. A method according to claim 1; wherein the first rule has a first IF part including the first condition element and a first THEN part including the first conclusion element, and the second rule has a second IF part including the first condition element and a second THEN part including the second conclusion element. 5. A method according to claim 1 further comprising: linking the first condition object with the first cause object through a first operator object; and linking the first condition object with the second cause object through a second operator object. 6. A method according to claim 1 further comprising: receiving the event related to the first condition object; and updating the data structure by writing data corresponding to the event into the first condition object. 7. A method according to claim 6 further comprising, calculating possibility of the root cause of the event based on the updated data structure.