JP2012203522A - Log analysis support system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a log analysis support system capable of easily detecting an abnormal part.SOLUTION: An input part 110 divides log information for each process and stores it as a long information list 113 arranged in an occurrence order in a log information storage part 112. An extraction part 120 generates an extraction log list 126 sectioned for each process section related to a specified process on the basis of an extraction condition. A display part 130 turns a first coordinate axis to a time base, sets a second coordinate axis using an item included in resource information of an object system for generating a log, and displays the log as a two-dimensional graph.

Description

  The present invention relates to a log analysis support system mainly for performing software failure analysis.

  Conventionally, in software, information related to operations is recorded as log information, and when a failure occurs, the cause is identified based on the log information. In the log information, various information such as the contents of the event that has occurred, the contents of the processing that has been performed, the system status, and the like are recorded along with the time. When a failure occurs, the cause of the failure is clarified based on the log.

  When a failure occurs, a log notifying that a failure has occurred may be output. In this case, since only the log for notifying the occurrence of the failure is searched, the location where the failure has occurred can be identified by a simple search operation regardless of the amount of log information.

  However, if a result different from the intended one occurs due to an unexpected situation, the software may not be recognized as abnormal and the process may be continued. In such a case, there is no log that reports the occurrence of a failure, so it is necessary for the operator to extract a log that seems to be related to the failure, and to identify the abnormal operation that caused the failure compared with the normal operation . However, generally, a large amount of log information is output, and it is not easy to find an abnormal part from the log information.

If it is an abnormal operation that can be assumed in advance, it is possible to record the pattern and compare it with a log to automate the detection. Although this method is effective for abnormal operations that are assumed in advance, such as detection of unauthorized access to the system, in general, a failure is caused by an unexpected operation. The registration method is not suitable.
In view of this, a method has been proposed in which the characteristics of the log are analyzed and candidates for a portion that seems to be abnormal are presented. For example, in the conventional apparatus disclosed in Patent Document 1, the appearance frequency of a log is calculated, and a log with a low appearance frequency is determined to have a high possibility of abnormal operation.

JP 2006-1555064 A

However, in the method of determining a log with a low appearance frequency as a candidate for an abnormal operation as in the apparatus disclosed in Patent Document 1, the effect is limited when an abnormal process that does not normally occur occurs and is necessary. It is difficult to detect a failure caused by a processing procedure such as lack of proper processing or reversal of order.
In order to identify such a cause, verification of the log of the entire process related to the operation is necessary, but conventionally, there is no technique for specifying the log range of the process related to a certain operation, and the worker himself It was necessary to judge.
Even if the range of the log is specified, the processing procedure of one operation is not always completely the same. In mechanical collation, it is conceivable to specify a coincidence rate or a feature action. However, it is troublesome to finely readjust these conditions while looking at the collation result. In such a case, it is more appropriate for the operator to see the general tendency and make a rough comparison, but conventionally, there has been no method suitable for seeing the general tendency.

  The present invention has been made to solve the above-described problems, and an object of the present invention is to obtain a log analysis support system that can easily detect an abnormal part.

  The log analysis support system according to the present invention defines an input unit that inputs a generated log, a log that is a start point of processing related to one operation, and a log that is an end point in advance, and inputs according to these definitions An extraction unit that extracts the extracted logs by dividing each processing section related to a specific process, and a display unit that displays the logs extracted in units of sections.

  The log analysis support system of the present invention defines a log as a start point and a log as an end point of a process related to one operation, and divides the input log into processing intervals related to a specific process according to these definitions. Since they are extracted, the tendency of logs can be compared, so that an abnormal part can be easily detected.

It is a block diagram which shows the log analysis assistance system by Embodiment 1 of this invention. It is a block diagram which shows the log analysis assistance system by Embodiment 1 of this invention with an operation example. It is explanatory drawing which shows the log extracted for every process area of the log analysis assistance system by Embodiment 1 of this invention, and the log after a process. It is explanatory drawing which shows the example of a display of the log of the several process area of the log analysis assistance system by Embodiment 1 of this invention. It is a block diagram of the display part at the time of adding the comparison display part of the log analysis assistance system by Embodiment 1 of this invention. It is explanatory drawing which shows the log after reprocessing for the comparison display of the log analysis assistance system by Embodiment 1 of this invention, and its processing procedure. It is explanatory drawing of the example of a display which displays the several process area of the log analysis assistance system by Embodiment 1 of this invention in alignment with a time axis. It is explanatory drawing of the example of a display which arranges the several processing area of the log analysis assistance system by Embodiment 1 of this invention, aligning a time axis, and displaying it. It is explanatory drawing which shows the example of a display of the log analysis assistance system by Embodiment 2 of this invention.

In the present invention, first, the operation to be analyzed is limited to a type of operation that can clearly define the log section by the triggering process and the resulting process.
For example, if a plurality of functions operate in cooperation with each other according to an event, the process is started with an event A as a trigger, and a plurality of events are generated from there and a plurality of functions cooperate to perform processing. All the events that have finally occurred due to event A are processed, and one operation is completed. It can be said that the range of processing related to one event processing operation is from the triggering event A to the end of processing of all the resulting events.
Also, in the case of a control system, control processing occurs inside triggered by a disturbance, and as a result, the internal state is settled. In this case, it can be said that the range of processing related to one control operation is from the occurrence of disturbance to the stabilization of the internal state.
In the present invention, logs output by simultaneous parallel processing, such as multi-process and multi-thread, are not targeted.

In the present invention, by separating and extracting logs for each processing range related to operations, there is no need to search for a target location from a large amount of logs, and it is possible to easily compare the logs of each operation. .
Further, when comparing the logs specifying the sections, only the feature of interest is extracted and displayed as a multidimensional graph. A normal log is one-dimensional information only on the time axis. On the other hand, the trend of processing can be displayed as a graphic by graphing the log with elements other than time as the second and third axes. As a result, the worker can easily grasp the tendency of the processing by ignoring detailed information. Embodiment 1 of the present invention will be described below.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a log analysis support system according to Embodiment 1 of the present invention.
The log analysis support system shown in FIG. 1 defines an input unit 110 that inputs a generated log file 100, a log that is a start point of processing related to one operation, and a log that is an end point. The extraction unit 120 extracts and extracts the input log for each processing section related to a specific process, and the display unit 130 displays the log extracted for each section.

The input unit 110 includes an input processing unit 111 for reading log information and a log information storage unit 112 for storing the read log.
As the log information read by the input unit 110, various information such as the contents of the event that has occurred, the contents of the processing performed, the system status, and the like are recorded along with the time. Since all the logs are recorded together in the log information, the input processing unit 111 divides this information for each process and stores it in the log information storage unit 112 as a list of logs arranged in the order of occurrence. To do.
Note that the input processing unit 111 has an interface for inputting external information such as a file and serial output, and a general interface such as a file selection unit for the user to specify information to be read.

  The extraction unit 120 includes an extraction condition setting unit 121 for setting a processing range definition condition for each operation, an extraction condition storage unit 122 for storing the set definition condition, and a section unit according to the set condition. An extraction processing unit 123 for extracting a log and an extraction log storage unit 124 for storing the extracted log are provided.

  The process range definition condition is to define a log as a start point and a log as an end point of processing related to one operation. For example, when attention is paid to a graphic user interface (hereinafter referred to as GUI), processing in the system is executed in response to a user operation, and finally drawing is updated. The log that records user operations is the log of the start point, and the log that records drawing processing is the log of the end point. The user operation refers to a hardware button press or a touch panel operation. The definition of the end point is not limited to a specific process log, but may be specified by a condition such that a specific process has not occurred for a certain time or longer.

  The extraction condition setting unit 121 registers the operation and processing range definition conditions in the extraction condition storage unit 122. The definition condition may be input by a setting file or the like, or a means for the user to input interactively may be provided. In the first embodiment, it is assumed that the user selects an operation to be extracted from the registered operations.

  The extraction processing unit 123 divides and extracts logs for each processing range related to the designated operation, and registers it in the extraction log storage unit 124.

  The display unit 130 includes a search processing unit 131 for further limiting conditions from logs extracted in units of sections, a display condition setting unit 132 for setting conditions for displaying the log as a multidimensional graph, A display processing unit 133 that performs conversion processing for displaying as a multidimensional graph in accordance with the set display conditions, a graph display unit 134 that includes an interface for displaying a graph, and a display condition storage that stores the set display conditions Part 135.

  The operation for cutting out the processing section is a large unit such as a GUI operation or a control operation, and there are a plurality of processes serving as start point logs. For example, in the case of a GUI operation, the type of processing called “user operation” is the start point log, but “user operation” includes various operations such as pressing the ENTER key, volume operation, and menu selection. Therefore, the search processing unit 131 performs secondary narrowing down from the logs cut out for each processing section.

  The log information is usually a one-dimensional list arranged on a time axis such as a log generation time or a generation order. In order to display this as a multidimensional graph, it is necessary to create second and third axes. The display condition setting unit 132 defines items to be used as the second and third axes. The display processing unit 133 extracts information on the designated item from the log, creates data that can be displayed as a graph, and displays the graph on the graph display unit 134.

  It is not important whether the graph is two-dimensional or three-dimensional. What is important is that a log which is a list having only one dimensional coordinate axis called a time axis can be displayed as a figure by adding the coordinate axes of other elements.

  In the display processing unit 133, in order to create a graph using the specified item as a coordinate axis, information on the specified item is extracted, data that can be displayed as a graph is generated, and sent to the graph display unit 134 to display the graph. The unit 134 displays a graph based on the data from the display processing unit 133.

  Further, the log analysis support system of the present invention is realized by using a computer, and the input processing unit 111, the extraction condition setting unit 121, the extraction processing unit 123, the search processing unit 131, the display condition setting unit 132, and the display processing unit 133 described above. Is composed of software corresponding to each function and hardware such as a CPU and a memory for executing the software. Alternatively, at least a part of these functional units may be configured with dedicated hardware.

Next, a specific operation of the log analysis support system according to the first embodiment will be described with reference to FIG.
First, the input unit 110 reads log information recorded in the log file 100. At this point, since a large amount of log is one large data, it is decomposed into one log according to predetermined delimiter information. Here, the log file 100 is generated as a text file, and a line feed character indicates a delimiter between individual logs.
The input processing unit 111 reads the log file 100 and extracts it as one log for each line feed. The log is added to the log information list 113 of the log information storage unit 112 as a combination of the time of occurrence and the content of the log.

Next, the extraction unit 120 performs extraction for each processing section related to the designated operation.
The extraction condition setting unit 121 presents a list of operations (extraction condition list 125) stored in the extraction condition storage unit 122 on a display or the like (not shown), and allows the user to specify which operation log to extract. Here, it is assumed that the user selects the GUI operation in order to extract the GUI operation log. It should be noted that it is desirable that the operations that can be extracted and the definitions of the start point log and the end point log of the operations are registered in a setting file or the like, or an interface for additional registration is provided so that the user can add them.

When the operation to be extracted is designated, the extraction processing unit 123 searches the log information list 113 stored in the log information storage unit 112 in order from the top. When it finds the log that is the start point, it records that part and searches for the log that becomes the end point. When a log as an end point is found, a range from the first start point log to the end point log is extracted as one range. Logs within the extracted range are registered in the extracted log list 126 of the extracted log storage unit 124 as one element. The log range defined in this way is called a processing section. When the next start point log appears without finding the end point log, the processing section is considered to be before the next start point log. Thereby, even in the case of a failure in which the end point log is missing, the processing section can be cut out.
In the first embodiment, the GUI operation is selected as an extraction target. The GUI operation uses a user operation or an external event as a start point, and a range having a drawing process as an end point as a processing section. However, since the drawing update may not occur, in this case, the portion immediately before the start position of the next drawing processing section is extracted as the processing section.

Finally, the display unit 130 displays the log as a graph.
First, the search processing unit 131 performs secondary narrowing. It is assumed that the search processing unit 131 includes an interface for presenting and selecting a condition that can be specified as a narrowing condition to the user. For example, in the extracted log list 126 of FIG. 2, two types of user operations A and B are included as the start point log. Here, when narrowing down only to the user operation A, the GUI operation log triggered by the user operation B in the section 3 is excluded from the display target. Note that this narrowing is not necessarily performed at the beginning of the display process. If there is no prospect of identifying the location where the failure has occurred, the method may be such that, first, all the GUI operation processing sections are displayed, and then the operation that seems to be suspicious is gradually narrowed down.

  Next, the user sets an item to be the second coordinate axis in the display condition setting unit 132. Here, the priority of the event is set. The candidate items to be set in the additional coordinate axes differ depending on the analysis target software. Therefore, the items may be registered by a setting file or the like, or may be added by the user by providing an additional registration interface. In the illustrated example, a display condition list 136 is provided.

  The item set in the additional coordinate axis specifies the contents included in the log information. The log information refers to information included in the log, such as processing contents, system status, event type, event priority, use amount of resources such as memory and CPU, processing time, and the like. Even if the processing time is not directly described in the log, the processing time can be calculated from the difference between the occurrence times of the event processing start log and the event processing end log. Information that can be acquired by processing the log even if it is not directly described in the log is also referred to as log information.

Among log information, information relating to the usage status of computer resources, such as memory usage, CPU occupancy, and processing time, is called resource information and distinguished. Further, in the present invention, information that is a judgment material for using resources, such as event priority, is also regarded as resource information in a broad sense. Since the resource information has high relevance between adjacent elements, when setting the processing characteristics as an axis, the unit granularity can be changed by grouping mechanically.
Furthermore, a memory usage amount or the like may be designated as the third coordinate axis. However, in the first embodiment, in order to simplify the description, an example of displaying as a two-dimensional graph with only the second coordinate axis added is shown.

Next, the display processing unit 133 performs processing for displaying the contents of the extraction log list 126 for each processing section created by the extraction unit 120 as a graph. First, the log of the first processing section is taken out. FIG. 3A shows details of the log of the extracted processing section. At this point, all log information recorded in the log is included. Each log in the processing section is taken out one by one, and as shown in FIG. 3B, a table is created in which only the event priority that is the item of the second coordinate axis is taken out from the log information. Based on this table, the graph display unit 134 in FIG. 2 uses the first coordinate axis 137a as the occurrence time and the second coordinate axis 137b as the event priority, and stores the stored logs one by one in the graph. A line graph 137 plotted at the corresponding position and connected by lines is displayed. This is repeated for the logs in all processing sections, and a log graph is displayed. As a result, the contents of the log can be displayed as a simple waveform-like figure as shown in FIG. 4, so that it can be performed much more easily than the text information when the operator visually compares the contents. .
In an operation in which multiple functions are linked, there may be differences that can be ignored, such as the number of repeated communications that occur in the middle, but even in this case, if only the rough shapes of the figures are compared Good.

If attention is paid to the priority of the event, a certain regularity appears in the tendency of processing of the operation. In an event-driven system, events are processed according to priority, and during each event processing, no other event processing is interrupted, and each time an event is processed, the remaining events are checked and The event with the highest priority at the moment is processed. When a new event occurs due to event processing, it is first added to the event list waiting to be processed, and is processed according to the priority when the processing of the first event is completed.
For this reason, when the priority of an event is taken as a coordinate axis, the event tends to converge gradually to a low priority event. When a new event with a higher priority occurs due to event processing, the wave that has converged to the lower priority returns to the higher priority again. This small mountain can be said to be a smaller processing section within one processing section.

  In the first embodiment, when there are three types of event priorities, low, medium, and high, the user operation that is the start point and the drawing process that is the end point are positioned at the lower priority level. When displayed in this way, it can be determined at a glance that a closed figure surrounded by a polygonal line and a time axis is a case where the drawing process is finished, and a non-closed figure is a case where the figure is finished without the drawing process.

  The log may be displayed continuously as shown in the screen 401 in FIG. 4A, but is displayed in another screen in units of operation as shown in the screens 402 to 404 in FIG. 4B. There is also a method. When displayed continuously as shown in FIG. 4A, the occurrence position of the operation in the entire time axis becomes clear. On the other hand, when the operation unit is displayed on another screen as shown in FIG. 4B, the logs of arbitrary processing sections can be displayed side by side. There is an advantage that it is easy to compare, such as displaying only the processing section of interest.

Next, as an example of comparison, an example in which an arbitrary section selected by the user is displayed with the time axis aligned will be described.
FIG. 5 shows a configuration of the display unit 130a in this example. In this example, a comparison display unit 138 is added to the basic system configuration as shown in FIG. Since the configuration other than the display unit 130a is the same as that in FIG. 2, the other configurations are not shown. The comparison display unit 138 calculates the time for comparison display in order to display the processing sections to be compared so that the positions on the time axis of the first log are aligned.

FIG. 6A shows a log list reprocessed for comparison display, and FIG. 6B is a flowchart showing a processing procedure for obtaining a time for comparison display.
When aligning the time axis based on the top log, first, the top log generation time t0 (the generation time 601 in FIG. 6A) is acquired, and 0 is set as the comparison display time 602 of this log (step ST1). ). Next, since the next log exists in the processing section (step ST2), the second log occurrence time tn (occurrence time 603) is acquired (step ST3), and the first log occurrence time (occurrence time 601) is obtained. The subtracted value (tn-t0) is set as the second log display time (comparison display time 604) (step ST4). By repeating this, the time when the first log generation time is set to 0 is obtained for all the logs in the processing section, and registered as the comparison display time. That is, it repeats until there is no next log in the processing section in step ST2. This is executed for all processing sections to be compared and displayed.

The comparison display unit 138 sends the display data of the comparison graph with the same time axis to the graph display unit 134 using the comparison display time obtained in the above processing.
As shown in FIG. 7, the comparative display method may display a plurality of processing sections in an overlapping manner as shown in FIG. 8 in addition to aligning and displaying the reference positions 701 on the time axis. When the number of processing sections to be compared is large, it is easier to see the images displayed side by side. When the number of processing sections to be compared is small, the superimposed displays are easier to compare.

  FIG. 8A shows a case where a plurality of processing sections are overlapped with the head log as a reference, and the position of the head log is a reference position 801. FIG. 8B shows a case where a plurality of processing sections are overlapped with a designated log as a reference. That is, FIG. 8B is an example of display based on the position of the second log in each processing section. The log generation time is corrected and displayed so that the second log is positioned at the reference position 802. For operations that are known to have variations in the initial processing, it is possible to superimpose the parts that you really want to compare by specifying an arbitrary log as the reference point for comparison.

  As described above, according to the log analysis support system of the first embodiment, the input unit that inputs the generated log, the log that is the start point of the process related to one operation, and the log that is the end point In accordance with these definitions, it has an extraction unit that extracts and extracts the input log for each processing section related to a specific process, and a display unit that displays the log extracted in section units. Since the comparison can be made, the abnormal part can be easily detected.

  Further, according to the log analysis support system of the first embodiment, the extraction unit extracts the processing sections related to the graphic user interface operation as one processing section, so that the processing sections that do not overlap each other can be reliably extracted. Can do.

  Further, according to the log analysis support system of the first embodiment, the display unit performs multi-dimensional display using items included in the resource information of the target system that generates the log with respect to the time axis that is the first coordinate axis. Since it has a display processing unit that sets additional coordinate axes and generates display data for displaying log information as a multidimensional graph, it can be recognized as a figure by displaying it as a multidimensional graph Therefore, the comparison of logs becomes easy, and the detection of the abnormal part can be performed more easily. Focusing on resource information, it is easy to find anomalous patterns, especially because certain patterns are likely to appear. Furthermore, since adjacent elements are highly related, they can be mechanically grouped to change the unit granularity. Can do. That is, the figure can be seen at a rougher level.

  Further, according to the log analysis support system of the first embodiment, the display unit includes the comparison display unit that generates display data for displaying the data of the plurality of processing sections to be compared with the time axis aligned. , The difference of the comparison can be clarified.

Embodiment 2. FIG.
In the first embodiment, the event occurrence time is displayed as the time axis. However, there are cases where it is more appropriate to normalize the time axis and display it in the order of occurrence rather than the occurrence time. This will be described as a second embodiment. The configuration of the second embodiment in the drawing is the same as the configuration shown in FIG. 1, FIG. 2, or FIG. 5 in the first embodiment, and will be described with reference to these drawings.
The display processing unit 133 according to the second embodiment is a processing unit that generates display data in the order of event occurrence instead of the event occurrence time according to the first embodiment as a time axis. Other configurations in the log analysis support system are the same as those in the first embodiment.

FIG. 9 is an explanatory diagram illustrating a display example of the second embodiment, in which the processing time is used for the second coordinate axis 901.
Since events are always processed one by one, the processing time of each event is calculated by calculating the time from the log indicating the start of event processing (event start log) to the log indicating the end (event end log) I can do things. Therefore, the display processing unit 133 first calculates the processing time of each event. An event end log corresponding to the event start log of each event is found, and the difference in occurrence time is stored as the processing time of the event. In this case, since there is no merit of taking the occurrence time on the time axis, the order of event occurrence is used for the time axis 902. In addition, since it is not necessary to display both the start log and the end log, only the start log is displayed. When the processing time of events is plotted in order from the first event, the graph shown in FIG.

When a physical quantity such as processing time is used as the second coordinate axis, a bar graph or the like may be easier to understand intuitively as shown in FIG. In the case of a bar graph, one rectangle 903 indicates one event process. In this case, when displaying all on one screen, it is necessary to display the processing section. When connecting the position of each log such as a line graph, it can be seen that one lump connected by a line is one processing section, but in the case of a bar graph etc., it is unknown how far it is the processing section. It is.
Therefore, as shown in FIG. 9B, the separation lines 904 and 905 are displayed at the positions of the start point log and the end log of the processing section, and the corresponding start point log position separation line 904 and the end point log position separation line. A double arrow 906 that associates 905 is displayed. Further, when the end point log does not exist, a one-way arrow 907 is displayed to distinguish and display the presence or absence of the end point log.

  As described above, according to the log analysis support system of the second embodiment, the display unit uses the processing order as the second coordinate axis because the order of generation of data in a plurality of processing sections is used as the time axis. In the case where the occurrence time does not have a meaning, such as in the case of performing, it is possible to easily compare a plurality of processing sections by simplifying the pattern. Even when the extracted processing section exists only in a part on the time axis, logs can be collected and viewed.

  In the present invention, within the scope of the invention, any combination of the embodiments, or any modification of any component in each embodiment, or omission of any component in each embodiment is possible. .

  100 log file, 110 input unit, 111 input processing unit, 112 log information storage unit, 113 log information list, 120 extraction unit, 121 extraction condition setting unit, 122 extraction condition storage unit, 123 extraction processing unit, 124 extraction log storage unit , 125 extraction condition list, 126 extraction log list, 130 display section, 131 search processing section, 132 display condition setting section, 133 display processing section, 134 graph display section, 135 display condition storage section, 136 display condition list, 137 line graph 138 Comparison display part.

Claims (5)

An input unit for inputting the generated log;
In advance, a log that is a start point and a log that is an end point of a process related to one operation is defined, and an extraction unit that extracts and divides an input log into processing sections related to a specific process according to these definitions;
A log analysis support system comprising: a display unit that displays a log extracted in units of sections.   2. The log analysis support system according to claim 1, wherein the extraction unit extracts a processing section related to the graphic user interface operation as one processing section.   The display unit sets an additional coordinate axis for multidimensional display using the items included in the resource information of the target system that generates the log with respect to the time axis that is the first coordinate axis, and displays the log information in a multidimensional graph. The log analysis support system according to claim 1, further comprising: a display processing unit that generates display data for display as a display data.   The display unit includes a comparison display unit that generates display data for displaying data of a plurality of processing sections to be compared with a time axis aligned. The log analysis support system according to claim 1.   The log analysis support system according to claim 3 or 4, wherein the display unit is arranged in the order of generation of data of a plurality of processing sections as a time axis.

Images