JP3365372B2 - Event log storage system, event log storage method, and recording medium - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an event log storage system , an event log storage method, and a recording medium for storing event log information in a network management system.

[0002]

2. Description of the Related Art Generally, in a network management system,
When a state change or failure of a managed node connected to the network occurs, the occurred event, that is, an event is collected by the manager, and the event generated at all managed nodes is centrally managed by the manager as a log. Each event includes at least information of “occurrence time”, “occurrence source”, and “message indicating failure content”. Upon receiving the event, the manager stores the information as an event log in the storage area of the event log allocated on the memory or the hard disk.

The network administrator refers to the event log to confirm the occurrence status of the network failure, and deletes the event log that has been dealt with and is no longer needed.
Since the capacity of the event log storage area has an upper limit, unnecessary event logs are deleted on a daily basis in order to secure an area for storing new events.
However, when a large number of events occur in a short period of time, it takes time for the network administrator to check the event log, etc., so the unnecessary event log cannot be deleted in time, and the capacity of the event log storage area is reduced. There are many cases where the limit is reached. Even in such a case, various event log storage methods have been devised in order to automatically delete unnecessary event logs and store newly generated events as event logs.

As the most basic method, there is a method of cyclically utilizing the storage area of the event log. This is because each time an event occurs, the event log is written in sequence from the beginning of the event log storage area, and when the end of the event log storage area is reached, it returns to the beginning of the event log storage area again. This method overwrites the stored event log with a new event log. However, in this method, the oldest event log is simply overwritten, so in a system that centrally manages the events of a plurality of managed nodes 6a to 6c, the event log of a managed node that occurred first However, there is a problem in that the event logs of the other managed nodes 6a to 6c that are generated later are overwritten and completely lost.

In order to solve the above problem, a method has been devised in which an event log storage area is separately secured for each managed node, but in this method, the number of event logs that can be stored for each managed node is preset. In addition to the limitation, if there is a variation in the number of event logs that occur for each managed node,
As a whole, a situation occurs in which a certain managed event log is overwritten again even though there is an unused area.

As a method for solving the above problems, there is Japanese Patent Laid-Open No. 3-149943. This publication describes a method of storing trace data similar to an event log. In this method, the trace data of all communication lines are stored in the same trace data storage memory, and the trace data storage memory is used cyclically. At that time, by judging the overwrite permission condition according to the old or new trace time for each communication line, it is possible to save the minimum number of trace data for each communication line without overwriting.

[0007]

In any of the above methods, the storage area of the event log is scanned from the top to the end of the area in the storage order, and the previously detected overwriteable event log is overwritten. Therefore, there is a problem that the number of event logs saved without being overwritten is largely biased among the managed nodes.

The problems will be specifically described below. Figure 2
It is assumed that the event log storage area shown in (a) can store at least two latest event logs for each managed node 6a to 6c without overwriting. Here, when an event occurs in each node shown in FIG. 9 at each time from time t-1 to t-10 in the chronological order shown in FIG. 9, the node 6 as shown in FIG.
A state in which five event logs of a are stored at times t-1 to t-5 and five event logs of the node 6b are stored at times t-6 to t-10 (that is, the event storage area is the upper limit) It has reached). As a result of three events of the node 6c occurring from this state at times t-11 to t-13, only three event logs of the node 6a are overwritten, and the event log of the node 6b is not overwritten, as shown in FIG. As a result, the event log of the node 6a is 2, the event log of the node 6b is 5, the event log of the node 6c is 3, and the number of stored event logs varies depending on the managed nodes 6a to 6c. You can see that In this example, since the scale is reduced for simplification of the description, the difference between the upper limit and the lower limit of the number of events stored for each of the managed nodes 6a to 6c is only 3, but in the actual operation, the above example is used. If the scale is 100 times larger than the above, there will be a difference of 300 in the number of event logs stored in each of the managed nodes 6a to 6c.

The present invention solves each of the problems described above, and stores the event log without limiting the number of event logs for each managed node until the stored event log reaches the upper limit of the storage area of the event log. After the log reaches the upper limit of the event log storage area, the event log is stored in each managed node so that the number of event logs stored in each managed node becomes even within the limited event log storage area. Event log storage system that allocates storage space , event
An object of the present invention is to provide a log storage method and a recording medium .

[0010]

According to a first event log storage system of the present invention, when a failure occurs in a managed node of a network, the failure is collected as an event in a network management manager device via the network, and an event log is recorded. a event log storage system having a function of storing in the external storage device of the network manager unit as an event receiving unit for receiving the event from the managed node via (a) the network, (b) the The area where the event log is stored and the event
It is divided into an unused area where no log is stored.
The external storage device is provided with a vent log storage area.
The event received by the event receiving means is
The event log rating stored as the event log
The external storage device provided with a storage area; and (c) the network management manager device.
Internal storage device, which is stored in the event log storage area
Storage location of the event log storage location in advance
A storage location entry list having a list of entries
Therefore, the event log generated in the managed node
For when it was stored for each of the managed nodes
As a list structure that follows the sequence order,
Areas are also stored as a list structure.
Entry list and the storage location entry list
The number of storage location entries is
Event log storage for each unused area
And the internal storage device having a region management table, when receiving the event (f) the event receiving means, searches the event log storage area management table,
If there is the storage location entry of the unused area, the storage location entry at the head of the storage location entry list of the unused area is selected, and if there is no storage location entry of the unused area, the storage location Event log storage position selecting means for selecting the first storage position entry of the storage position entry list of the managed node having the largest number of entries; and (g) the storage position selected by the event log storage position selecting means. Event log writing means for writing the received event as the event log at a position stored by an entry; (h) the event log storage location selecting means removes the storage location entry selected from the storage location entry list, The removed storage location entry list of the storage area management table 1 is subtracted from the storage location entry list, the removed storage location entry is listed at the end of the storage location entry list of the managed node that has transmitted the event, and the listed storage location entry is listed in the storage area management table. Event log storage area management table updating means for adding 1 to the number of storage location entries in the storage location entry list.

A second event log storage system <br/> of the present invention, in the first aspect, when storing the event the newly received as the event log, the unused area in the event log storage area If there is not, the number of event logs stored for each managed node is equalized and stored.

A third event log storage system <br/> of the present invention, in the second invention, when storing the event the newly received as the event log, the unused area in the event log storage area without, comprising storing the event received newly to the location of the event log stored in the oldest among the managed node where the event log are most often stored.

[0013] The fourth event log storage system <br/> of the present invention, in the first aspect, when storing the event the newly received as the event log, the unused area in the event log storage area If there is, it comprises storing in the unused area.

The fifth event log storage system of the present invention is
In the first invention, the event included in the internal storage device
The event log is also recorded in the log storage area management table.
The maximum number that can be stored is preset for each managed node
The event log storage location selection means is
If there is no storage location entry for the unused area, the
If the number of delivery location entries exceeds the maximum number
The top of the storage location entry list of the managed node
Selecting the storage location entry .

The first event log storage method of the present invention is
If a managed node in the network fails,
Network it as an event via the network
It was collected into management manager device, network as an event log
A event log storage method network manager device event log storage system having a function of storing on an external storage device is executed, the event log storage Shi
The system has a network management manager device
Data processing device and the event as the event log
And the area where the event log is stored.
Separated into unused area where event log is not stored
The external storage device provided with an event log storage area
The event received by the event receiving means.
Is stored as the event log
The external storage device provided with a storage area, and the event
The event log storage location in the log storage area is recorded in advance.
A storage location error containing a list of stored storage location entries.
Is a security list and occurred on the managed node
For the event log, refer to each managed node.
As a list structure that stores them in chronological order,
Also, the unused area is stored as a list structure.
The storage location entry list and the storage location entry
The number of storage location entries in the list is
Stored for each of the target node and the unused area
An event log storage area management table;
And a data storage device.
But before from the managed node via the (a) Network
The first step of receiving the event, and (b) in the storage of the event received in the first step in the event log storage area, the event log storage area management table is searched to find the unused area. If there is the storage location entry of the unused area, the storage location entry at the head of the storage location entry list of the unused area is selected, and if there is no storage location entry of the unused area, the number of the storage location entries A second step of selecting the first storage location entry of the storage location entry list of the most managed nodes, and (c) a location stored in the storage location entry selected in the second step, A third step of writing the received event as the event log, and (d) the second step Remove the storage position entry Oite said selected from the storage position entry list, the number of the storage location entry of the removal has been stored position entry list of the storage area management table 1
The removed storage location entry is listed at the end of the storage location entry list of the managed node that has subtracted and transmitted the event, and the storage location entry of the listed storage location entry list of the storage area management table fourth step and the actual to 1 adds the number of
Provided that the row.

According to the first recording medium of the present invention, when a failure occurs in a managed node of the network, the failure is generated as an event and the network management management is performed via the network.
It was collected into catcher equipment, network management as an event log
Provided with the function to store in the external storage device of the manager device
In addition, the data processing device and the event are
Stored as an event log, the event log is stored as
Area and unused area where the event log is not stored
Before the event log storage area divided into
The external storage device is received by the event receiving means.
The event is stored as the event log
The external storage device provided with an event log storage area
And the event log rating in the event log storage area
The storage location has a list of storage location entries stored in advance.
Of the storage location entry list,
For the event log that occurred in the
A list in chronological order in which it is stored for each elephant node
As a structure, the unused area is also listed.
The storage location entry list stored as a structure, and
The storage location entry in the storage location entry list
To the managed node and the unused area.
An event log storage area management table that is stored for
Management including the internal storage device having
In the event log storage system including the manager device
A computer as the data processing device
It is a computer-readable recording medium for
To the computer, (a) from the managed node via the network
The first step of receiving the event, and (b) in the storage of the event received in the first step in the event log storage area, the event log storage area management table is searched to find the unused area. If there is the storage location entry of the unused area, the storage location entry at the head of the storage location entry list of the unused area is selected, and if there is no storage location entry of the unused area, the number of the storage location entries A second step of selecting the first storage location entry of the storage location entry list of the most managed nodes, and (c) a location stored in the storage location entry selected in the second step, A third step of writing the received event as the event log, and (d) the second step Remove the storage position entry Oite said selected from the storage position entry list, the number of the storage location entry of the removal has been stored position entry list of the storage area management table 1
The removed storage location entry is listed at the end of the storage location entry list of the managed node that has subtracted and transmitted the event, and the storage location entry of the listed storage location entry list of the storage area management table And a program for executing the fourth step of adding 1 to the number of.

[0017]

BEST MODE FOR CARRYING OUT THE INVENTION Next, a first embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of an event log storage system according to the first embodiment of the present invention. This embodiment is composed of a manager 1 and managed nodes 6a to 6c which are connected by a network 5 and are capable of direct communication. Manager 1
Is composed of a data processing device 2, an external storage device 3, and an internal storage device 4. The internal storage device 4 is RA
The external storage device 3 may be a hard disk or the like.

The data processing device 2 includes an event receiving unit 21, a control unit 22, an event log storage area management table updating unit 23, and an event log storage position selecting unit 2.
4 and an event log writing means 25.

The event receiving means 21 receives events from the managed nodes 6a to 6c via the network 5.

The event log storage area 31 is assigned to the external storage device 3.

Event log storage area management table 41
Are assigned to the internal storage device 4. In the event log storage area 31, as shown in the example of FIG.
For example, a total of 10 event logs can be stored, and each event log stores a time field 31a that stores the time when the event occurred, and the managed node 6a where the event occurred.
A source field 31b for storing 6c to 6c, and a message body 31c for storing the content of the event that has occurred.

Further, by designating the storage positions A01 to A10 to the event log writing means 25, the data can be stored at any position in the event log storage area.

Event log storage area management table 41
As shown in FIG. 3A, the management target identifier field 41a can identify which of the management target nodes 6a to 6c is an unused area in which the event log is not stored. .

Further, the unused area and the managed node 6a
.. to 6c, a storage location entry 41f for storing in which location in the event storage area one event log is stored, and each of the managed nodes 6a to
It is held as a storage location entry list 41e that is listed in the order of event occurrence times for each 6c. It also stores a pointer 41c to the beginning of the storage position entry list and a pointer 41d to the end of the storage position entry list. Further, the number of storage location entries 41f of each of the managed nodes 6a to 6c is stored as the number of entries 41b.

Note that FIG. 9 shows 13 events that occur in the managed nodes 6a to 6c used in the description of this embodiment. 2A and 3A show the event log storage area 31 and the event log storage area management table 41 in the initial state where no event has been received yet.
According to FIG. 2A, one event block is
Event occurrence time 31a, which is the time when the event occurred
And an event generation source 31b which is the management nodes 6a to 6c in which the event has occurred, and an event message body 31c which is the content of the event. 2B and FIG. 3B show the event log storage area 31 and the event log storage area management table 41 in a state where 10 events have been received. 2C and FIG. 3C show the event log storage area 31 and the event log storage area management table 41 after receiving four more events.

Referring to FIG. 4, the overall flow of this system controlled by the control unit 22 is largely the same in this embodiment as the event receiving process S101 performed by the event receiving means 21 and the event log storage position determination. Event log storage position selection processing S102 performed by the means 24 and event log storage processing S performed by the event log writing means 25
103, and an event log storage area management table update processing S104 performed by the event log storage area management table updating means 23.

Referring to FIG. 5, the event log storage location selection processing S102 includes an initialization step S201 of a current-managed object identifier, which is a variable on the internal storage device 4, and a determination step S202 of the presence / absence of an unused area. Internal storage device 4
Initialization step S203 of the number of entries 41bMAX which is the upper variable, step S204 of moving the current-managed object identifier, step S205 of determining the number of entries 41bMAX, and selection of the variable on the internal storage device-4.
It includes a step S206 of updating the managed object identifier and a step S207 of judging the end of the current-managed object identifier.

Referring to FIG. 6, the event log writing S103 is performed by moving the writing pointer S301.
And event information writing step S302.

Referring to FIG. 7, the event log storage area management table updating process S104 is performed in a step S4 of initializing a new-managed object identifier which is a variable on the internal storage device 4.
01, step S402 of removing the selection-management target identifier storage location entry, and step S403 of subtracting 1 from the number of selection-management target identifier entries 41b.
And a step S404 of inserting a storage position entry into the new-management target identifier, and a step S405 of adding 1 to the entry number 41b of the new-management target identifier.

Next, the operation of the present embodiment configured as above will be described in detail.

First, FIG. 2A and FIG.
Event log storage area 31 and event log storage area management table 4 in an initial state in which no one event has been received
It is the figure which showed 1. Looking at this, the event log storage area 31 has a space that can store 10 event logs, and the event log storage area management table 41 corresponds to the space that can store the above event logs.
There are 0 storage location entries, all of which are management target identifiers 41
It is held in the unused area of a. It should be noted that the event log storage area 31 is previously stored in each storage location entry 41f.
A pointer area for listing the storage position entries 41f is also prepared at the same time as the destination address for storing the above one event log is held, although not shown. The operation when the 13 events shown in FIG. 9 are sequentially received will be described below.

According to the flow charts of FIGS. 4 to 7,
First, the control is transferred to the event receiving means 21, and the event receiving process (S101) is executed. When the event receiving unit 21 receives the event from the "node 6a" that occurs at t-1, the event receiving process ends, the control shifts to the event log storage position selecting unit 23, and the event log storage position selecting process (S102). Is executed.

The event log storage position selection means 23 initializes the current-management object identifier pointer so that the first management object identifier 41a on the event log storage area management table 41 points to an "unused area" (S201). To do. Next, the "unused area" pointed to by the current-managed identifier pointer
It is checked whether the number of entries 41b of 1 is 1 or more, and it is determined whether there is an unused area in the event log storage area 31 (S202). Since the number of entries 41b of the "unused area" is 10, it is determined that there is an unused area, the "unused area" pointed to by the current-managed object identifier pointer is selected-stored in the managed object identifier pointer (S211), and the event The log storage position selection process (S102) ends. At this time, "unused area" is set in the selection-management target identifier pointer.

Next, the control is transferred to the event log writing means 25, and the event log writing process (S103) is executed. The event log writing means 25 determines the position “A on the event log storage area 31 indicated by the storage position entry 41f at the head of the storage position entry list 41e of the“ unused area ”pointed to by the selection-management target identifier pointer.
The write pointer is moved to "-01" (S301).
If it is a UNIX file, this is executed by the lseek function or the like. Next, the event receiving means 21 writes the information of the event that occurred earlier at t-1 and occurred at "A-01" (S302), and the event log writing process (S302).
103) ends.

Next, the control is transferred to the event log storage area management table updating means 24, and the event log storage area management table updating processing (S104) is executed. The event log storage area management table updating means 24 sets the source node “node 6a” of the event occurring at t−1 previously received by the event receiving means 21 in the new-management target identifier pointer (S401). Next, the storage position entry 41f pointing to "A-01" at the beginning is removed from the storage position entry list 41e of the "unused region" pointed to by the selection-management target identifier pointer (S402). ] Storage location entry list 4
The beginning of 1e is a storage location entry 41 pointing to "A-02"
f. Next, the number of entries 41b of the "unused area" pointed to by the selection-management target identifier pointer is decremented by 1 to obtain 9
(S403). Next, the previously removed storage location entry 41f is inserted at the end of the storage location entry list 41e of the "node 6a" pointed to by the new-managed object identifier (S404). Since the storage location entry of "node 6a" was still empty, this insertion resulted in "node 6a".
The beginning and the end of the storage location entry list 41e for "a" are storage location entries 41f that point to "A-01". Next, “node 6a” indicated by the new-managed object identifier
The number of entries 41b of 1 is incremented by 1 to be 1 (S40
5). This completes the event log storage area management table update processing (S104).

The above is the general processing when one event is received. Thereafter, similar processing is executed until the used area of the event log storage area reaches the upper limit, and the event log generated at t-2 to t-10 in FIG. 9 is stored. The state of the event log storage area 31 at this time is shown in FIG. 2B, and the state of the event log storage area management table 41 is shown in FIG. 3B.

The operation when an event is received after the used area of the event log storage area reaches the upper limit will be described. The event receiving means 21 is t-
When the event of the "node 6c" that has occurred in 11 is received, the event reception process ends, control is transferred to the event log storage position selection means 23, and the event log storage position selection process (S102) is executed. The event log storage position selection means 23 initializes the current-management target identifier pointer (S201), and checks whether the number 41b of entries in the "unused area" pointed to by the current-management target identifier pointer is 1 or more (S202). ). At this time, as shown in (b) of FIG. 3, since the number of entries 41b of the "unused area" is 0, it is determined that there is no unused area, and the node that uses the most storage area is the managed node 6a. The process of finding from the managed nodes 6b and 6c is started.

First, the entry MAX variable is initialized to 0 (S203), and the current-managed object identifier pointer is moved to the next "node 6a" (S204). Next, the number of entries 41 of the current-managed target identifier pointer “node 6a” 41
It is compared whether or not b is larger than the entry MAX variable (>) (S205). Here, since the entry MAX variable is 0 and the number of entries 41b is 5, the entry MAX variable is present-
Number of entries of managed object identifier pointer "node 6a" 4
1b is updated to 5, and this "node 6a" is set as a selection candidate in the selection-management target identifier pointer (S2).
06). Next, it is determined whether the current-management target identifier pointer is the end of the event log storage area management table 41 (S207). Since "node 6a" is not the end, the current-managed object identifier pointer is moved to the next "node 6b" (S204). Next, it is compared whether the number of entries 41b of the current-managed object identifier pointer "node 6b" is larger than the entry MAX variable (>) (S205). Here, since the entry MAX variable is 5 and the number of entries 41b is 5, which does not satisfy the condition, step S206 is skipped. Next, it is determined whether the current-management target identifier pointer is the end of the event log storage area management table 41 (S
207). Since "node 6b" is not the end, the current-managed object identifier pointer is moved to the next "node 6c" (S204). Next, it is compared whether or not the number of entries 41b of the current-managed object identifier pointer "node 6c" is larger than the entry MAX variable (>) (S205). Here, since the entry MAX variable is 5 and the entry number 41b is 0, which does not satisfy the condition, step S206 is skipped. Next, it is determined whether the current-management target identifier pointer is the end of the event log storage area management table 41 (S20).
7). Since the "node 6c" is the terminal end, the event log storage position selection step (S102) ends. At this time,
"Node 6a" is set in the selection-management target identifier pointer, and the storage position entry 41f corresponding to the oldest event log at the head of the storage position entry list 41e of "node 6a" is removed and "node 6c" is removed. The event log writing process (S103) and the event log storage area management table updating process (S104) are executed in the same manner as described above by performing a list or the like at the end of the storage position entry list 41e. Hereinafter, the same processing is performed for storing the event logs t-12 to t-13 illustrated in FIG. 9, and the same processing is performed when an event occurs. As described above, t-1 to t-13 shown in FIG.
The state of the event log storage area 31 at the time of receiving all the events is shown in (c) of FIG. 2, and the state of the event log storage area management table 41 is shown in (c) of FIG. According to this, the number of event logs stored for each management target is 3 for node 6a, 4 for node 6b, and 6c for node 6c.
Will be three. It can be seen that the stored events are even among the managed nodes 6a to 6c.

In the above description, the number of event logs stored in each of the managed nodes 6a to 6c is evenly distributed. However, the managed nodes 6a to 6c are distributed.
It is also possible to intentionally incline the distribution by providing a distribution coefficient for each c. For example, assuming that the event log storage area has a size that can store event logs of 300, it is assumed that the nodes are composed of three nodes, and the distribution coefficients of the nodes 6a, 6b, and 6c are expressed as percentages of 50%, 30%, and 20%, respectively. Suppose you have specified%. At this time, the upper limit values that can be stored in the event log held by each node are 150, 90, and 60, respectively. This value is set in the event log storage area management table 41 when the system is started. When an event newly occurs at a certain node, if there is an unused area, the same process as described above is performed. When a new event occurs in a state where there is no unused area, the upper limit value assigned to the node is compared with the stored entry number 41b of the node. At this time, it is assumed that a new event occurs in the node 6b and the number of stored entries 41b is 180, 40, 80. For each node, the difference between the upper limit value and
0 exceeded, node 6b exceeded -50, node 6c reached 2
0 is exceeded. The storage area of the oldest event log of the node 6a having the largest difference is taken out and used as the storage area of the newly generated event of the node 6b. As a result, the number of entries 41b held by each node
Changes to 179, 41, and 80, respectively, and approaches the distribution value.

Next, a second embodiment of the present invention will be described with reference to the drawings.

Similar to the description of the first embodiment, according to the flowcharts of FIGS. 4 to 7, first, control is passed to the first step of receiving an event, and the event receiving process (S101) is executed. To do. When the first step of receiving an event receives the event of the "node 6a" that occurred at t-1, the event receiving process ends, the control moves to the second step, and the received event is stored in the event log storage area 31. The process of selecting the storage location entry list 41e to be stored in is executed.

In the second step, the current-managed object identifier pointer is initialized so as to point to the first "unused area" on the event log storage area management table 41, as described above (S201). To do. Next, the number of entries 41 in the "unused area" pointed to by the current-managed object identifier pointer 41
It is checked whether or not b is 1 or more, and it is determined whether or not there is an unused area in the event log storage area 31 (S2
02). Since the number of entries 41b of the "unused area" is 10, it is determined that there is an unused area, and the "unused area" pointed to by the current-managed object identifier pointer is selected-stored in the managed object identifier pointer (S211). Step 2 (S10
2) ends. At this time, "unused area" is set in the selection-management target identifier pointer.

Next, the control moves to the third step, and the event log writing process (S103) is executed. In the third step, the write pointer is moved to the position "A-01" indicated by the storage position entry at the beginning of the storage position entry list 41e of the "unused area" indicated by the selection-management target identifier pointer (S301). "A-01" is written in the information of the event that occurred earlier at t-1 (S302), and the event log writing process (S1) is performed.
03) ends.

Then, the control shifts to the fourth step, and the originator node "node 6a" of the event occurred at t-1 received previously is set to the new-managed object identifier pointer (S401). Next, the storage location entry list 4 of the "unused area" indicated by the selection-management target identifier pointer
The storage location entry that points to "A-01" at the top of 1e is removed (S402), so that the beginning of the storage location entry list 41e of "unused area" is "A-0."
It becomes the storage location entry 41f pointing to "2". Next, the entry number 41b of the "unused area" pointed to by the selection-management target identifier pointer is decremented by 1 to be 9 (S403).
Next, the previously removed storage location entry 41f is inserted at the end of the storage location entry list 41e of the "node 6a" pointed to by the new-managed object identifier (S404). Since the storage location entry list 41e of "node 6a" is still empty, this insertion causes the beginning and the end of the storage location entry list 41e of "node 6a" to be "A-
01 ”. Next, add 1 to the number of entries 41b of "node 6a" pointed to by the new-managed identifier,
It is set to 1 (S405). With this, the update processing of the event log storage area management table 41 in step 4 (S104)
Ends.

The above is the general processing when one event is received. Thereafter, similar processing is performed until the used area of the event log storage area reaches the upper limit, as shown in t of FIG.
Stores the event log that occurred at -2-t-10. The state of the event log storage area 31 at this time is shown in FIG. 2B, and the state of the event log storage area management table 41 is shown in FIG. 3B.

Further, the operation when an event is received after the event log storage area 31 reaches the upper limit will be described. When the first step receives the event of the "node 6c" that occurs at t-11 shown in FIG. 9, the event receiving process ends, and when the control moves to the second step, the current-managed object identifier pointer is initialized. (S201), and it is checked whether or not the number of entries 41b of the "unused area" pointed to by the current-managed object identifier pointer is 1 or more (S20).
2). At this time, as shown in (b) of FIG. 3, since the number of entries 41b of the "unused area" is 0, it is determined that there is no unused area, and the managed nodes 6a to 6c that use the most storage areas are determined. Start the process of finding.

First, the entry MAX variable is initialized to 0 (S203), and the current-managed object identifier pointer is moved to the next "node 6a" (S204). Next, the number of entries 41 of the current-managed target identifier pointer “node 6a” 41
It is compared whether or not b is larger than the entry MAX variable (>) (S205). Here, since the entry MAX variable is 0 and the number of entries 41b is 5, the entry MAX variable is present-
Number of entries of managed object identifier pointer "node 6a" 4
1b is updated to 5, and this "node 6a" is set as a selection candidate in the selection-management target identifier pointer (S2).
06). Next, it is determined whether the current-management target identifier pointer is the end of the event log storage area management table 41 (S207). Since "node 6a" is not the end, the current-managed object identifier pointer is moved to the next "node 6b" (S204). Next, it is compared whether the number of entries 41b of the current-managed object identifier pointer "node 6b" is larger than the entry MAX variable (>) (S205). Here, since the entry MAX variable is 5 and the number of entries 41b is 5, which does not satisfy the condition, step S206 is skipped. Next, it is determined whether the current-management target identifier pointer is the end of the event log storage area management table 41 (S
207). Since "node 6b" is not the end, the current-managed object identifier pointer is moved to the next "node 6c" (S204). Next, it is compared whether or not the number of entries 41b of the current-managed object identifier pointer "node 6c" is larger than the entry MAX variable (>) (S205). Here, since the entry MAX variable is 5 and the entry number 41b is 0, which does not satisfy the condition, step S206 is skipped. Next, it is determined whether the current-management target identifier pointer is the end of the event log storage area management table 41 (S20).
7). Since the "node 6c" is the terminal end, the second step (S102) ends. At this time, "node 6a" is set in the selection-management target identifier pointer, and the third step (S103) and the fourth step (S104) are executed in the same manner as described above. Hereinafter, the same processing is performed for storing the event logs t-12 to t-13 illustrated in FIG. 9, and the same processing is performed when an event occurs. As described above, from t-1 to t shown in FIG.
The state of the event log storage area 31 at the time of receiving all the events of −13 is shown in (c) of FIG. 2, and the state of the event log storage area management table 41 is shown in (c) of FIG. According to this, it is understood that the number of saved event logs for each of the managed nodes 6a to 6c is equal in the managed nodes 6a to 6c.

Next, a third embodiment of the present invention will be described with reference to the drawings. Referring to FIG. 10, the third exemplary embodiment of the invention is a recording medium 120 for recording a program that causes a computer 100 to execute each step of the second exemplary embodiment of the present invention.

[0049]

As described above, according to the event log storage method of the present invention, the number of event logs for each managed node 6a to 6c until the stored event log reaches the upper limit of the event log storage area 31. Event logs can be stored in the event log storage area 31
After the whole has reached the end of use, the managed nodes 6a to 6c are distributed to the managed nodes 6a to 6c so that the number of event logs stored in each managed node 6a to 6c becomes equal within the limited event log storage area 31. The event log storage area 31 can be distributed. Further, it is possible to intentionally incline the distribution by providing a distribution coefficient for each of the managed nodes 6a to 6c.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a system to which an event log storage system according to a first embodiment of the present invention is applied.

FIG. 2 shows a structure of an event log storage area in FIG. 1, a state where there is no event log in the event log storage area, a state immediately after being completely used, and four more events are registered after being completely used. It is a figure explaining the state which was done.

FIG. 3 is an event log storage area management table 4 in FIG.
It is a figure explaining the structure of 1 according to each state of FIG.

FIG. 4 is a flowchart showing control performed by a control unit in FIG.

5 is a flowchart showing a process of an event log storage position selection means in FIG.

FIG. 6 is a flowchart showing a process of an event log writing unit in FIG.

FIG. 7 is a flowchart showing a process of an event log storage area management table updating means in FIG.

FIG. 8 is a diagram illustrating an example of storing an event log according to a conventional technique.

FIG. 9 is a diagram in which received events used in the description of the embodiment are arranged in time series.

FIG. 10 is a block diagram showing a third embodiment of the present invention.

[Explanation of symbols]

1 manager 2 Data processing device 3 external storage 4 Internal storage 5 network 6a, 6b, 6c Managed node 21 Event reception means 22 Control unit 23 Event Log Storage Area Management Table Update Means 24 Event log storage location selection means 25 Event log writing means 31 Event log storage area 31a Event occurrence time 31b Event source Message body of 31c event 41 Event log storage area management table 41a Managed object identifier 41b Number of entries 41c Pointer to the beginning of the storage position entry list 41d Pointer to the end of the storage location entry list 41e Storage location entry list 41f Storage location entry

Claims (7)

(57) [Claims] 1. When a failure occurs in a managed node of the network, the function is collected as an event in the network management manager device via the network and is stored as an event log in the external storage device of the network management manager device . An event log storage system, comprising: (a) an event receiving unit that receives the event from the managed node via a network; (b) an area in which the event log is stored;
It is divided into an unused area where no log is stored.
The external storage device is provided with a vent log storage area.
The event received by the event receiving means is
The event log rating stored as the event log
The external storage device provided with a storage area; and (c) the network management manager device.
Internal storage device, which is stored in the event log storage area
Storage location of the event log storage location in advance
A storage location entry list having a list of entries
Therefore, the event log generated in the managed node
For when it was stored for each of the managed nodes
As a list structure that follows the sequence order,
Areas are also stored as a list structure.
Entry list and the storage location entry list
The number of storage location entries is
Event log storage for each unused area
And the internal storage device having a region management table, when receiving the event (f) the event receiving means, searches the event log storage area management table,
If there is the storage location entry of the unused area, the storage location entry at the head of the storage location entry list of the unused area is selected, and if there is no storage location entry of the unused area, the storage location Event log storage position selecting means for selecting the first storage position entry of the storage position entry list of the managed node having the largest number of entries; and (g) the storage position selected by the event log storage position selecting means. Event log writing means for writing the received event as the event log at a position stored by an entry; (h) the event log storage location selecting means removes the storage location entry selected from the storage location entry list, The removed storage location entry list of the storage area management table 1 is subtracted from the storage location entry list, the removed storage location entry is listed at the end of the storage location entry list of the managed node that has transmitted the event, and the listed storage location entry is listed in the storage area management table. An event log storage area management table updating means for adding 1 to the number of the storage position entries in the storage position entry list. Wherein when storing the event received newly as the event <br/> Ntorogu, when the unused area in the event log storage area is not present, the number of event logs stored in each of the managed node The event log storage system according to claim 1, wherein the event logs are stored evenly. Wherein when storing the event received newly as the event <br/> Ntorogu, when the unused area in the event log storage area is not, the management which the event log is most frequently stored It received new to the location of the event log stored in the oldest among the nodes
The event log storage system according to claim 2, wherein the event is stored. Wherein when storing the event received newly as the event <br/> Ntorogu, if there is the unused area in the event log storage area, and characterized in that stored in the unused area The event log storage system according to claim 1. 5. An event log included in the internal storage device
The storage area management table can also store event logs.
Is set in advance for each managed node.
The event log storage location selection means is
If there is no storage location entry for the area, then the storage location
The management pair whose number of entries exceeds the maximum number most.
The case at the head of the storage location entry list of the elephant node
The event log storage system according to claim 1 , wherein a delivery position entry is selected . 6. A function of collecting, when an error occurs in a managed node of a network, an event in a network management manager device via the network and storing it as an event log in an external storage device of the network management manager device. A method for storing an event log executed by an event log storage system, comprising:
The physical manager device includes a data processing device, the event is stored as the event log, and
The area where the event log is stored and the event log
Event log divided into unused areas that are not stored
The external storage device having a storage area,
The event received by the event receiving means is the event log.
The event log storage area that is stored as
The external storage device and the event log storage location in the event log storage area
Location has a pre-stored list of storage location entries
The storage location entry list, wherein the managed node
For the event log that occurred in
A list structure that follows the chronological order in which it is stored for each code
As a list structure for the unused area,
Stored in the storage location entry list and the storage location entry list in the storage location entry list.
The number of birds for each of the managed node and the unused area
Event log storage area management table
When, which has a said internal storage device with the data processing apparatus, before the said managed node via the (a) Network
The first step of receiving the event, and (b) in the storage of the event received in the first step in the event log storage area, the event log storage area management table is searched to find the unused area. If there is the storage location entry of the unused area, the storage location entry at the head of the storage location entry list of the unused area is selected, and if there is no storage location entry of the unused area, the number of the storage location entries A second step of selecting the first storage location entry of the storage location entry list of the most managed nodes, and (c) a location stored in the storage location entry selected in the second step, A third step of writing the received event as the event log, and (d) the second step Remove the storage position entry Oite said selected from the storage position entry list, the number of the storage location entry of the removal has been stored position entry list of the storage area management table 1
The removed storage location entry is listed at the end of the storage location entry list of the managed node that has subtracted and transmitted the event, and the storage location entry of the listed storage location entry list of the storage area management table The event log storing method is characterized by executing the fourth step of adding 1 to the number of 7. When a failure occurs in a managed node of a network, the failure is collected as an event in a network management manager device via the network, and an event is collected.
External storage of network management manager device as log
And a data processing device, wherein the event is stored as the event log.
The area where the event log is stored and the event log
Event log divided into unused areas that are not stored
The external storage device having a storage area,
The event received by the event receiving means is the event log.
The event log storage area that is stored as
The external storage device and the event log storage location in the event log storage area
Location has a pre-stored list of storage location entries
The storage location entry list, wherein the managed node
For the event log that occurred in
A list structure that follows the chronological order in which it is stored for each code
As a list structure for the unused area,
Stored in the storage location entry list and the storage location entry list in the storage location entry list.
The number of birds for each of the managed node and the unused area
Event log storage area management table
And a network management including the internal storage device having
In the event log storage system including the manager device
A computer as the data processing device
It is a computer-readable recording medium for
To the computer, (a) from the managed node via the network
The first step of receiving the event, and (b) in the storage of the event received in the first step in the event log storage area, the event log storage area management table is searched to find the unused area. If there is the storage location entry of the unused area, the storage location entry at the head of the storage location entry list of the unused area is selected, and if there is no storage location entry of the unused area, the number of the storage location entries A second step of selecting the first storage location entry of the storage location entry list of the most managed nodes, and (c) a location stored in the storage location entry selected in the second step, A third step of writing the received event as the event log, and (d) the second step Remove the storage position entry Oite said selected from the storage position entry list, the number of the storage location entry of the removal has been stored position entry list of the storage area management table 1
The removed storage location entry is listed at the end of the storage location entry list of the managed node that has subtracted and transmitted the event, and the storage location entry of the listed storage location entry list of the storage area management table A recording medium for recording a program for executing the fourth step of adding 1 to the number of 1.