JP5477057B2 - Log management method, log management program, and log management apparatus - Google Patents

Description

  The present invention relates to a log management method, a log management program, and a log management apparatus that store log information generated on a computer in a storage device of the computer in time series.

The log information is important information that is indispensable for confirming the details of the operation of the software when analyzing the cause of failure.
However, since the information is updated every time while the software is running, log information should be secured immediately after the failure occurs, that is, before the storage area storing the log information at the time of the failure is overwritten, or to some extent In order to save the log information, it is necessary to secure a sufficient storage area so that past log information is not overwritten even after the elapse of time.
Actually, it is not easy to secure log information immediately after the failure (within several hours), and the log information is overwritten and written over to a finite temporary storage area sequentially. If you try to secure it, you will need a very large storage capacity, and it will be a factor to press valuable system resources.
In particular, in the case where the same log information, such as an error message, is repeatedly rushed due to a single failure, a large amount of log information is output in a short time, thus ensuring log information at the time required for failure analysis. Was extremely difficult.

  As a technique for storing log information generated on a computer in a computer storage device in chronological order, a log management device, a log management method, a log management program disclosed in Patent Document 1, and Patent Document 2 are disclosed. The disclosed data processing system is already known.

  In the log management device, the log management method, and the log management program disclosed in Patent Document 1, when log information is continuously detected without intervening other events, a plurality of log information is detected at the second and subsequent detections. The storage area for saving log information is saved by merging and outputting all together.

  Also, in the data processing system disclosed in Patent Document 2, a time difference between the previous log information occurrence time and the current log information occurrence time is calculated, and the log output when log information is repeatedly generated in a short time By selecting information, a storage area for saving log information is saved.

  According to the technique disclosed in Patent Literature 1-2, it is possible to save a storage area for storing log information under a situation where log information is repeatedly generated in a short time for the same cause, Therefore, it is possible to maintain important log information. However, when other events are sandwiched between repeated log information detections, the log information is stored at intervals longer than the time difference considered to be a short time. In the case of repeated detection, the log information output volume cannot be suppressed, and the log information is cyclically written to a finite storage area, so that important log information related to the cause of the failure, for example, error There is a risk that the log information and the like storing the occurrence of the occurrence will be lost by overwriting.

  In addition, log information output from multiple computers connected so that information can be transmitted over a network is centrally managed by a single computer, and any computer connected so that information can be transmitted over a network has failed. In this case, it is already known in Patent Document 3-4 that the log information of another computer having an interdependence relationship with the computer in which an abnormality has occurred, and the character string analysis processing by the computer is disclosed in Patent Document 3, for example. It is a well-known technique as disclosed in No. 5 etc.

JP 2006-48332 A Japanese Patent Application No. 2-275545 JP 2005-202446 A JP 2005-258501 A JP 2009-237935 A

  Therefore, an object of the present invention is to detect log information repeatedly in a relatively long interval when log information is repeatedly generated in a short time or when another event is sandwiched between repeated log information detection. Even in such a case, a log that can hold important log information, more specifically, log information such as an error message specified by an extraction condition in a finite storage area for a long period of time A management method, a log management program, and a log management apparatus are provided.

The log management method of the present invention is a log management method for storing log information generated on a computer in a storage device of the computer along a time series, and in order to achieve the above object,
The generated log information is cyclically overwritten and stored in a finite temporary storage area constituting a part of the storage device in time series,
It is determined whether or not the content of the generated log information satisfies a preset extraction condition. If the predetermined extraction condition is satisfied, the content of the generated log information is further specified. Determining whether information is already stored in a finite storage area constituting another part of the storage device;
Only when the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, the information specifying the content of the log information is In addition to storing in the finite storage area constituting the other part of the storage device, the generated log information is added to the finite storage area constituting the other part of the storage device. It has a configuration characterized by being memorized.

The log management program of the present invention is a log management program for storing log information generated on a computer in a storage device of the computer in time series, and in order to achieve the same object as described above, ,
Log writing means for cyclically overwriting and storing the generated log information in a finite temporary storage area constituting a part of the storage device in time series, the microprocessor of the computer;
Extraction necessity determination means for determining whether or not the content of the generated log information satisfies a preset extraction condition;
When it is determined by the extraction necessity determination unit that the content of the generated log information satisfies a predetermined extraction condition, information for specifying the content of the generated log information is stored in another storage device. A storage necessity judging means for judging whether or not already stored in a finite storage area constituting a part;
Only when it is determined by the storage necessity determination means that the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, Content specifying information writing means for adding and storing information specifying the content of the log information in a finite storage area constituting the other part of the storage device; and
Only when it is determined by the storage necessity determination means that the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, The generated log information is made to function as an extraction log writing means for adding and storing the generated log information in a finite storage area constituting still another part of the storage device.

The log management apparatus of the present invention is a log management apparatus for storing log information generated on a computer in a storage device of the computer in time series, and in order to achieve the same object as described above,
Log writing means for cyclically overwriting and storing the generated log information in a finite temporary storage area constituting a part of the storage device in time series;
Extraction necessity determination means for determining whether or not the content of the generated log information satisfies a preset extraction condition;
When it is determined by the extraction necessity determination unit that the content of the generated log information satisfies a predetermined extraction condition, information for specifying the content of the generated log information is stored in another storage device. A storage necessity judging means for judging whether or not already stored in a finite storage area constituting a part;
Only when it is determined by the storage necessity determination means that the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, Content specifying information writing means for adding and storing information specifying the content of the log information in a finite storage area constituting the other part of the storage device;
Only when it is determined by the storage necessity determination means that the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, The system further comprises extraction log writing means for adding and storing the generated log information in a finite storage area constituting still another part of the storage device.

  The log management method, the log management program, and the log management apparatus according to the present invention determine whether or not the content of the generated log information satisfies a preset extraction condition, and when the preset extraction condition is satisfied Further, it is determined whether or not information specifying the content of the generated log information is already stored in the storage device. If the information specifying the content of the generated log information is stored in the storage device, the information specifying the content of the log information and the additional storage of the log information are not executed, and the content of the generated log information Since the information for identifying the contents of the log information and the log information are additionally stored in the storage device only when the information for specifying the information is not stored in the storage device, the important log information to be stored for a long term is stored in the storage device. The log information can be narrowed down by the extraction conditions, and even log information that has been narrowed down by the extraction conditions can be excluded from the storage target, so it is specified by important log information, that is, the extraction conditions Log information can be held in a finite storage area of the storage device for a long period of time.

FIG. 2 is a functional block diagram showing an outline of a configuration of a log management apparatus according to an embodiment and a plurality of computers connected to the log management apparatus via a network so as to be able to transmit information. It is the block diagram which showed the outline of the structure of the computer which comprises the log management apparatus of the embodiment. It is the block diagram shown about the outline | summary of the structure of the some computer connected so that information transmission was possible to the log management apparatus via the network. It is the flowchart which showed the outline of the client management program run by the microprocessor arrange | positioned at the computer connected so that information transmission was possible to the log management apparatus via the network. It is the continuation of the flowchart which showed the outline of the client management program. It is the flowchart which showed the outline of the client management program performed by the microprocessor arrange | positioned at the log management apparatus of the embodiment. It is the continuation of the flowchart which showed the outline of the client management program. It is the conceptual diagram which showed an example of the logical structure of the log information written in the log storage area of a log management apparatus. It is the conceptual diagram which showed an example of the logical structure of the extraction conditions memorize | stored in the identification condition storage table of a log management apparatus. It is the conceptual diagram which showed an example of the logical structure of the information memorize | stored in the existing log storage area which memorize | stores the information which specifies the content of log information. It is the conceptual diagram which showed an example of the log information which becomes identifiable because an offset value and the number of characters of a full length differ even if a keyword is the same. It is the conceptual diagram which showed an example of the logical structure of the dependence storage table which memorize | stores the mutual dependence relationship between computers by the correspondence of computer specific information. It is the conceptual diagram illustrated about the interdependence between computers.

  Next, a log management apparatus according to an embodiment to which the log management method of the present invention is applied and a log management program for controlling the log management apparatus will be described in detail with specific examples.

  FIG. 1 is a functional block diagram showing an outline of a connection relationship between a log management apparatus 1 according to an embodiment and a plurality of computers 3 connected to the log management apparatus 1 via a network 2 so as to be able to transmit information.

  As shown in FIG. 2, the log management apparatus 1 is configured by a computer such as a normal personal computer or workstation, and includes a microprocessor 101 for arithmetic processing, a ROM 102 that stores a startup program for the microprocessor 101, and the like. A nonvolatile memory 103 for storing various parameters, a RAM 104 used for temporary storage of operation data, and a hard disk drive 105 functioning as a mass storage device, and an input / output circuit 106 of the microprocessor 101 In addition, a printer 110 is connected in addition to a keyboard 107, a mouse 108 and a monitor 109 which function as a man-machine interface. The interface 111 is an interface for connecting to the network 2. The hardware configuration of each computer 3 is the same as that of the computer constituting the log management apparatus 1, and as shown in FIG. 3, the microprocessor 201, ROM 202, nonvolatile memory 203, RAM 204, hard disk drive 205, input / output circuit 206, keyboard 207, a mouse 208, a monitor 209, and a printer 210, and an interface 211 for connecting to the network 2 is provided.

  The log management device 1 stores log information generated on a plurality of computers 3 connected to the log management device 1 via the network 2 so as to be able to transmit information in a hard disk drive 105 as a storage device in time series. For computers.

As shown in FIG. 1, the log management apparatus 1 uses log information generated on a plurality of computers 3 in a finite temporary storage area A1 (hereinafter referred to as log storage) that constitutes a part of the hard disk drive 105 in time series. The log writing means B for cyclically overwriting and storing the area A1) and the latest log information generated on a plurality of computers 3 and transferred to the log management device 1, that is, the log writing means B Extraction necessity determination means C is provided for determining whether or not the content of the log information newly written in the log storage area A1 satisfies a preset extraction condition.
In this embodiment, every time new log information is written in the log storage area A1 by the log writing means B, the log reading means K reads the latest log information from the log storage area A1 and whether or not extraction is necessary. Since it is delivered to the determination means C, the latest log information is always read by the extraction necessity determination means C. Further, it is assumed that the extraction conditions used for the determination by the extraction necessity determination unit C are stored in advance in the identification condition storage table L (in the hard disk drive 105).
The log management apparatus 1 also stores information specifying the content of the log information in addition to the hard disk drive 105 when it is determined by the extraction necessity determination means C that the content of the log information satisfies a preset extraction condition. The storage necessity determination means D for determining whether or not the information is already stored in a finite storage area A2 (hereinafter referred to as an existing log storage area) constituting a part of the log information, and the contents of the log information by the storage necessity determination means D The contents specifying information writing for storing the information specifying the contents of the log information in addition to the existing log storage area A2 only when it is determined that the information specifying the ID is not stored in the existing log storage area A2. Only when the means E and the storage necessity determination means D determine that the information specifying the contents of the log information is not stored in the existing log storage area A2, the log information is stored in the hard disk drive. Finite storage area A3 (hereinafter, referred to as log storage area) constituting a further part of the other of the probe 105 in addition to comprising the extracted log writing unit F for storing.
The message transmission / reception means G is for identifying the log information generated by each computer 3 from the plurality of computers 3 connected to the log management device 1 via the network 2 so as to be able to transmit information and the computer 3 that generated the log information. The computer specific information is received and transferred to the log writing means B, and the command generated by the microprocessor 101 of the log management apparatus 1 is transmitted to each computer 3.
In this embodiment, since it is assumed that log information generated on a plurality of computers 3 is centrally managed by the log management apparatus 1, the telegram transmitting / receiving means G is required. When the function of the log management apparatus 1 is provided, in other words, when various application programs are installed in the log management apparatus 1 itself and used as a normal computer, in short, log information from other computers The message transmission / reception means G is not necessary in a configuration in which only its own log information is handled without being acquired.
The log management apparatus 1 according to this embodiment further includes a plurality of computers 3 only when the storage necessity determination unit D determines that information specifying the content of log information is not stored in the existing log storage area A2. Dependency that identifies a computer 3 that has a mutual dependency relationship with the computer 3 that generated the log information with reference to the dependency relationship storage table H (in the hard disk drive 105) that stores the mutual dependency relationship between the computer specific information. A command is output to each of the computers 3 specified by the relationship specifying means I and the dependency relationship specifying means I via the telegram transmitting / receiving means G, and the latest log information in each computer 3 is a storage device for each computer 3. Command output means J for storing in the hard disk drive 205 is provided.
Similarly to the above, in a configuration in which only log information is handled in a self-contained manner without acquiring log information from another computer, the dependency relationship storage table H, dependency relationship specifying means I, command output means J is not necessary.

Among these, the log storage area A1, the existing log storage area A2, the log storage area A3, the dependency relation storage table H, and the identification condition storage table L shown in FIG. 105, a log writing unit B, an extraction necessity determination unit C, a storage necessity determination unit D, a content specification information writing unit E, and an extraction log writing unit F. , Message transmission / reception means G, dependency relationship specifying means I, command output means J, and log reading means K are all log management programs installed in the microprocessor 101 of the log management apparatus 1 and its hard disk drive 105 constituted by a computer. (See FIGS. 6 to 7).
The log management program is read as an execution target program from the hard disk drive 105 to the RAM 104 when the log management apparatus 1 is started up, and resides in the RAM 104. As the multi-task processing by the microprocessor 101, each processing in FIG. 6 and FIG. It is executed repeatedly.

  On the other hand, each computer 3 connected to the log management device 1 via the network 2 so as to be able to communicate information is stored in the computer 3 when a usage status of the computer 3, a record of data communication, and various abnormalities are detected. A finite temporary storage area a1 (hereinafter referred to as a log storage area a1) for cyclically overwriting and writing the log information generated by the client, and a client log for reading the latest log information written in the log storage area a1 The log information read by the reading means k, the log reading means k for clients and the computer specifying information for specifying the computer 3 are transmitted to the log management apparatus 1 and the command transmitted from the log management apparatus 1 is accepted. The message transmission / reception means g for client handed over to the extracted log writing means f and the command transmitted from the log management device 1 Out with the latest log information finite log storage area of the log storage area a1 a3 (hereinafter, referred to as log storage area a3) comprises an additional to the client for extracting log writing unit f to be stored in. Since the generation of log information, the writing process to the log storage area a1, and the like are already known, they are not specifically described here.

Among these, the log storage area a1 and the log storage area a3 shown in FIG. 1 are both constructed using a part of the storage area of the hard disk drive 205 of the computer 3, and the extracted log writing means f for client f, Both the client message transmitting / receiving means g and the client log reading means k are realized by the microprocessor 201 of the computer 3 and the client management program (see FIGS. 4 to 5) installed in the hard disk drive 205 thereof.
The client management program is read as an execution target program from the hard disk drive 205 to the RAM 204 when the computer 3 is started up, and is resident in the RAM 204. As the background multitask processing by the microprocessor 201, each processing in FIGS. Repeatedly.

  Next, referring to the flowcharts of FIGS. 4 to 5 showing the outline of the client management program and the flowcharts of FIGS. 6 to 7 showing the outline of the log management program, the entire log management apparatus 1 of this embodiment will be described. The processing operation and the log management method of this embodiment realized by this will be specifically described.

  First, processing of log information generated in each computer 3 will be described with reference to FIGS.

  The microprocessor 201 of the computer 3 first determines whether or not new log information is written in the log storage area a1 of the hard disk drive 205 in the processing of the client management program that is repeatedly executed at predetermined intervals (see FIG. If the writing of new log information is not confirmed in step S1) of step 4, the processing in this cycle is terminated as it is.

If it is confirmed that new log information is written in the log storage area a1 of the hard disk drive 205 and the determination result in step S1 is true, the microprocessor functions as the client log reading means k. 201 reads the latest log information from the log storage area a1 of the hard disk drive 205, that is, the log information newly generated this time (step S2), and the microprocessor 201 functioning as the client message transmission / reception means g generates the log information. Computer identification information for identifying the computer 3 is attached to the log information (step S3), and the information is transmitted to the log management apparatus 1 via the network 2 (step S4).
In this embodiment, the agent ID of the client management program installed in the computer 3 is used as the computer identification information. However, other information may be used as long as the information can uniquely identify the computer 3. Absent.

The log information and the computer identification information sent from the computer 3 in this way are obtained by the microprocessor 101 functioning as the telegram transmitting / receiving means G in the log management apparatus 1 that repeatedly executes the processes of FIGS. Microprocessor 101 functioning as message transmission / reception means G receives this log information and computer specific information and delivers it to log writing means B (step T2). Microprocessor functioning as log writing means B 101 stores the log information and the computer specific information in the log storage area A1 of the hard disk drive 105 in a circular overwrite manner (step T3).
In other words, a large number of log information is written one after another in the finite storage area constituting the log storage area A1, and the storage area is filled with log information, in order from the beginning of the storage area. New log information is written in order from the storage area storing the oldest log information at that time.

An example of a logical configuration of log information written in the log storage area A1 of the hard disk drive 105 is shown in the conceptual diagram of FIG.
As shown in FIG. 8, one set of data written in the log storage area A1 includes the time (year, month, day, hour, minute) of the log information and the computer identification of the computer 3 that generated the log information. An agent ID that functions as information and a log information main body are configured. Further, the log information main body is configured by a message ID such as “AP — 10” and its body text such as “AP = ap89 start”. Among these, the log information transmitted from the computer 3 always includes the agent ID and the log information body. The log information generation time may be attached to the log information on the computer 3 side, You may make it memorize | store the time when log information was received in the management apparatus 1 side as generation | occurrence | production time of log information.

  When new log information is written in the log storage area A1 of the hard disk drive 105 in this way, the microprocessor 101 of the log management apparatus 1 that repeatedly executes the processes of FIGS. 6 to 7 writes new log information. (Step U1 in FIG. 7), the microprocessor 101 functioning as the log reading means K writes the latest log information from the log storage area A1, that is, the log storage area A1 of the hard disk drive 105 by the processing in step T3 described above. The read log information is read and delivered to the extraction necessity determination means C (step U2).

  Next, the microprocessor 101 functioning as the extraction necessity determination unit C of the log management apparatus 1 includes the log information delivered from the log reading unit K and the extraction conditions stored in the identification condition storage table L in the hard disk drive 105. (Step U3), it is determined whether or not the content of the log information satisfies a preset extraction condition (step U4).

  Here, the determination process in step U4 will be described in detail.

In this embodiment, log information related to statuses such as normal, abnormal, and warning (alert occurrence) of the computer 3 can be distinguished from each other, and the log information related to the abnormality is positioned as important log information to be extracted. In the identification condition storage table L in the hard disk drive 105, an identification condition for determining whether or not the log information to be determined is log information related to normality, abnormality, or warning is shown in FIG. Three types are set as shown.
Each of the identification conditions includes a filter ID unique to each identification condition, a message ID for specifying the overall characteristics of the log information, an offset value for specifying the keyword position on the log information, and the contents of the log information. It consists of a keyword for specifying and a status representing the state of the computer 3. The structure of the message ID has already been described with reference to FIG. The offset value is counted as 1, 2, 3,... From left to right with the first character of the log information body as shown in FIG.
Of course, the status to identify can be set by selecting one or more states other than normal, abnormal, and warning, and the correspondence between the message ID, offset, keyword, and status is one-to-one. Is not limited. For example, a plurality of keywords can be set corresponding to one status, or a plurality of offset values can be set corresponding to one keyword. Since the keyword is for specifying the content of the log information, naturally, it does not make sense unless it is a character string that may be included in the log information.
In this embodiment, setting of unconditional matching using a wild card (*) is allowed for each of the constituent factors excluding the keyword among the identification conditions. For example, in the abnormal status identification condition shown in the third row of the identification condition storage table L in FIG. 9, wildcards are set in the message ID and offset value columns of the components of the identification condition, and the keyword Since “error” is set in the column, log information including the character string “error” is written in any part of the log information body regardless of the message ID of the log information. It will be recognized as log information having an abnormal status.
Of the identification conditions shown in the identification condition storage table L of FIG. 9, in this embodiment, only the identification condition corresponding to the abnormal status is used as the extraction condition, and only the log information related to the abnormality is important log information. However, this is simply an operational problem, that is, a problem in using the device. If necessary, select one or more other identification conditions to obtain important log information to be extracted. It is also possible to use the extraction conditions.
The microprocessor 101 functioning as the extraction necessity determination means C of the log management apparatus 1 analyzes the log information delivered from the log reading means K in the process of step U4, and this log information is stored in the identification condition storage table of FIG. It is determined whether or not the extraction condition stored in L is satisfied.
For example, if log information as shown in the second line in FIG. 8 is transferred from the log reading means K to the extraction necessity determination means C as a determination target, a keyword is added to the log information body of this log information. Since the character string “error” is included, the determination result in step U4 is true. As described above, in the abnormality status identification condition shown in the third row in the identification condition storage table L of FIG. 9, “error” is set in the keyword column, and among the components of the identification condition, Since wildcards are set in the message ID and offset value fields, all log information including the character string “error” is recognized as log information related to abnormality, that is, important log information to be extracted. Because.
Therefore, the extraction necessity determination means C of this embodiment, when a wild card is set for the constituent factors excluding the keyword in the extraction condition, the constituent factor for which the wild card is set, that is, in this case, The extraction necessity determination means includes a function for determining that the message ID and the offset value satisfy the corresponding constituent factors in the preset extraction condition, that is, the condition of the message ID and the offset value unconditionally.
If the log information as shown in the first line in FIG. 8 is transferred from the log reading means K to the extraction necessity determining means C as a determination target, the message of the log information main body in this log information is assumed. Since the ID is “AP — 10” and the description of the keyword “start” is started by offsetting 14 characters from the head of the log information body, this log information is stored in the identification condition storage table L of FIG. Among them, the identification condition indicated by the filter ID “logA001” is satisfied, but since this is merely an identification condition and not an extraction condition, the determination result in step U4 is false.

  If the determination result in step U4 is false, it means that the log information delivered from the log reading means K does not need to be stored for a long period of time, so the microprocessor 101 of the log management apparatus 1 keeps the cycle as it is. Terminate the process.

  As described above, in the present embodiment, first, by limiting the important log information to be stored for a long term based on the extraction condition, a finite log of the hard disk drive 105 that is a storage device that stores the log information. The useless log information is prevented from being stored in the storage area A3.

On the other hand, if the determination result in step U4 is true and it is clear that the log information delivered from the log reading means K is important log information that requires long-term storage, the log management device 1 The microprocessor 101 calculates the offset value of the keyword of the log information delivered from the log reading means K (step U5), obtains the total number of characters of the log information main body (step U6), and further steps to these pieces of information. The filter ID of the extraction condition that obtained the matching determination result in the process of U4 and the information of the agent ID of the computer 3 that generated the log information delivered from the log reading means K are attached and delivered to the storage necessity judging means D. .
Therefore, for example, if log information as shown in the second line in FIG. 8 is transferred from the log reading means K to the extraction necessity determining means C as a determination target, the second line in FIG. As is apparent, the value of the agent ID is “Ag02”, the offset value that is the processing result of step U5 is “12”, the value of the total number of characters that is the processing result of step U6 is “49”, and As apparent from the identification condition storage table L in FIG. 9, the value of the filter ID obtained as a result of the match determination is “logE089”, and therefore the data delivered to the storage necessity determination unit D is “filter ID / offset”. “LogE089 / 12/49 / Ag02” in the sequence of value / total number of characters / agent ID ”.

  Next, the microprocessor 101 of the log management apparatus 1 functioning as the storage necessity determination means D accesses the existing log storage area A2 of the hard disk drive 105 and refers to information for specifying the contents of the log information (Step U7), and newly Whether the same as the “filter ID / offset value / total number of characters / agent ID” delivered from the extraction necessity determination means C is already stored in the existing log storage area A2, that is, the log reading means at the present time It is determined whether or not the log information that is the same as or equivalent to the log information read by K is already stored in the log storage area A3 of the hard disk drive 105 provided for long-term storage of the log information (step U8).

An example of the logical configuration of the information stored in the existing log storage area A2 for storing information for specifying the contents of the log information is shown in the conceptual diagram of FIG.
Each set of data stored in the existing log storage area A2 includes, as shown in FIG. 10, an ID, a filter ID, and an offset value that are unique to the data set for each data set of information that specifies the contents of log information. And the total number of characters of the log information body, the number of times the data set has been detected, and the agent ID.
Therefore, both the log information shown in FIG. 8 and the information specifying the contents of the log information shown in FIG. 10 include both the computer specifying information for specifying the computer that generated the log information, that is, the agent ID. It will be.
In short, the data set for specifying the contents of the log information is further divided into “filter ID / offset value / total number of characters / agent ID” pair delivered from the extraction necessity determination unit C to the storage necessity determination unit D. The item “number of detections” is added.

  The microprocessor 101 of the log management apparatus 1 functioning as the storage necessity determination unit D determines “filter ID / offset value / total number of characters from the data set already stored in the existing log storage area A2 in the determination process of step U8. / Agent ID "data set contents are read in order, and the existing log storage area has the same contents as" filter ID / offset value / total number of characters / agent ID "newly delivered from the extraction necessity determination means C It is determined whether it is stored in A2, and if the same content is already stored in the existing log storage area A2, the log information that is the same as or equivalent to the log information read by the log reading means K at the present time Is already stored in the log storage area A3 of the hard disk drive 105 provided for long-term storage of log information. If the same content is not stored in the existing log storage area A2, the log information that is the same as or equivalent to the log information read by the log reading means K at present is It is assumed that the data is not yet stored in the log storage area A3 of the hard disk drive 105.

  Here, when the determination result in step U8 becomes true, the storage area of the existing log storage area A2 is prevented from being wasted by re-registering the existing data set in the existing log storage area A2. The microprocessor 101 of the log management apparatus 1 skips the process of step U9 and does not execute it. Then, “detection” of the data set in the existing log storage area A2 corresponding to “filter ID / offset value / total number of characters / agent ID” delivered from the extraction necessity determination unit C to the storage necessity determination unit D at the present time. The value “number of times” is read, and it is determined whether or not the value is 0 (step U10).

  The value of the “detection count” in the data set of the existing log storage area A2 is initialized to 0 once when a new data set is newly registered, but it is set to 1 again by a task performed within the same processing cycle. Since it is incremented, a data set corresponding to “filter ID / offset value / total number of characters / agent ID” already passed from the extraction necessity determination means C to the storage necessity determination means D already exists. As long as it is registered in the log storage area A2, it is impossible that the “number of detections” takes a value of 0 (in FIG. 7, step U8 → step U9 → step U10 → step U11 → step U12 → step U13 → step Refer to the point that the final value of the number of detections is 1 when the process from U14 to step U115 is continued. .

  Therefore, if a data set having the same content as “filter ID / offset value / number of characters in total length / agent ID” delivered from the extraction necessity determination means C is already stored in the existing log storage area A2, the process proceeds to step U10. The determination result is inevitably false, and the microprocessor 101 of the log management apparatus 1 functioning as the storage necessity determination unit D re-registers existing log information in the log storage area A3, thereby storing the storage area of the log storage area A3. In order to prevent wasting, the processing of step U11 to step U14 is skipped and not executed.

  Next, the microprocessor 101 of the log management apparatus 1 functioning as the content specifying information writing unit E is currently handed over from the extraction necessity determination unit C to the storage necessity determination unit D “filter ID / offset value / full length. The value of the register storing the “detection count” of the data set in the existing log storage area A2 corresponding to the value of “number of characters / agent ID” is incremented by 1 (step U15), and the processing of this cycle is completed.

  Therefore, the content specifying information writing means E of this embodiment uses the information specifying the content of the log information when it is determined that the information specifying the content of the log information is stored in the existing log storage area A2. Correspondingly, this is content specifying information writing means having a function of incrementing the value of the extraction number storage register provided in the existing log storage area A2 by one.

  As described above, according to the present embodiment, log information to be stored for a long time is prevented from being written twice in the finite log storage area A3, and the log information to be stored is stored in the log storage area A3. By storing only once, the storage area of the log storage area A3 is prevented from being wasted.

  On the other hand, if the determination result in step U8 is false, that is, a data set having the same content as “filter ID / offset value / total number of characters / agent ID” delivered from the extraction necessity determination unit C is stored in the existing log. When it is determined that the log information is not stored in the area A2, log information that is the same or equivalent to the log information that is currently read by the log reading means K is provided for long-term storage of the log information. This means that it is not registered in the area A3, that is, it is necessary to newly register the log information currently read by the log reading means K in the log storage area A3.

  Therefore, in this case, first, the microprocessor 101 of the log management apparatus 1 functioning as the content specifying information writing means E specifies information for specifying the log information currently read by the log reading means K, that is, extracted at the current time. By newly adding and storing the data set of “filter ID / offset value / total number of characters / agent ID” passed from the necessity determination unit C to the storage necessity determination unit D and stored in the existing log storage area A2. In the existing log storage area A2 for storing that the log information currently read by the log reading means K is newly registered in the log storage area A3 in the processing cycle. The value of the register in the “number of detections” column is initialized to 0 (step U9).

  As an example, a data set in which the sequence of “filter ID / offset value / total number of characters / agent ID” is “logE089 / 12/49 / Ag02” is stored in the existing log storage area A2 as information for specifying the contents of log information. FIG. 10 is a conceptual diagram showing the situation when a new data set is additionally stored. As a result of the initialization of the “number of detections” performed in the process of step U9, the contents of the second data set in the existing log storage area A2 are “filter ID / offset value / total number of characters / number of detections / agent ID”. The value of “logE089 / 12/49/0 / 0Ag02” is taken according to the arrangement. In addition, ID in FIG. 8 is ID for specifying each data set, and is equivalent to what is called a data address.

The process of step U9 is performed by replacing the log information itself with information specifying the contents of the log information, that is, “filter ID / offset value / total number of characters / agent ID”, which is data having a smaller capacity than the log information. This is a process for reducing the storage capacity required as a whole by registering only the value.
Of course, it is technically possible to search the log storage area A3 for storing the log information itself to avoid duplication registration of the log information. In such a case, the existing information for storing the information specifying the log information is stored. Although it can be said that the log storage area A2 is unnecessary, in such a process, when a large amount of log information is accumulated, a search processing load increases or a time required for the processing increases. Darely storing data in a smaller capacity than the log information in the existing log storage area A2, thereby balancing the reduction of the required storage capacity with the reduction of the load and the time required for processing. ing.

  Next, the microprocessor 101 of the log management apparatus 1 has an existing one corresponding to “filter ID / offset value / total number of characters / agent ID” currently passed from the extraction necessity determination unit C to the storage necessity determination unit D. The value of “detection count” in the data set in the log storage area A2 is read and it is determined whether or not the value is 0 (step U10). In this way, information specifying the contents of the log information is the existing log. When the process of step U9 is executed by the content specifying information writing unit E by the storage necessity determination unit D determining that it is not stored in the storage area A2, the value of “number of detections” is the value of step U9. Since the state remains initialized by the processing, the determination result in step U10 is necessarily true.

  Therefore, the microprocessor 101 of the log management device 1 functioning as the extracted log writing means F is used to log information currently read by the log reading means K, that is, the log storage area of the hard disk drive 105 in the process of step T3 described above. The log information written in A1 is newly added and stored in the log storage area A3 of the hard disk drive 105 provided for long-term storage of the log information (step U11). The log storage area A3 stores log information in an archived state.

When a wild card is used when setting an identification condition as an extraction condition in the identification condition storage table L, a data set having a different offset value and a different total number of characters is stored in the existing log storage area A2 even with the same filter ID. There will be more than one. In this way, when an abnormality of multiple types of log information can be detected with one filter condition, the resolution of the multiple types of log information (specifically, the offset value or the total number of characters) is not handled as the same log information. One of the features of this embodiment is that log information duplication control can be realized.
For example, the two pieces of log information shown in FIG. 11 have the same character string “error” as a keyword, but can be distinguished from each other because the offset value and the total number of characters are different.

  When the important log information to be stored is stored in the log storage area A3 in this way, the microprocessor 101 of the log management apparatus 1 functioning as the dependency relationship specifying unit I is read by the log reading unit K at the present time. The agent ID attached to the log information, that is, information necessary for uniquely identifying the computer 3 that has transferred the log information is read (step U12). The agent ID of the computer 3 having a mutual dependency relationship with the computer 3 that generated the log information is specified by searching the dependency relationship storage table H (step U13).

An example of the logical configuration of the dependency relationship storage table H that stores the mutual dependency relationship between the computers 3 by the correspondence relationship of the agent ID is shown in the conceptual diagram of FIG.
The interdependency is set by a combination of agent IDs, and a unique configuration ID is assigned to each group. Each agent ID stores a corresponding IP address of each computer 3 so that a command can be easily transmitted to the computer 3.
The interdependency referred to here assumes, for example, a situation in which a plurality of computers 3 are linked to provide one service. For example, as shown in FIG. 13, two Web servers whose agent ID values are “AgWEB01” and “AgWEB02”, one AP server whose agent ID value is “AgAP11”, and the agent ID value 12 provides a single “Service-B” in combination with a single DB server “AgDB21”, the corresponding relationship is described in the dependency storage table H as shown in FIG. obtain.
Here, assuming that the value of the agent ID attached to the log information currently read by the log reading means K is “AgWEB01”, first, “Service-B” including the agent ID “AgWEB01”. The three agent IDs “AgWEB02”, “AgAP11”, and “AgDB21” excluding only “AgWEB01” from the plurality of agent IDs belonging to “Service-B” are mutually associated with “AgWEB01”. It is specified as the dependent agent ID. Of course, “AgWEB01”, which is the value of the agent ID attached to the log information currently read by the log reading means K, may be included in the category of mutually dependent agent IDs.

  In this way, when the agent ID of the computer 3 having a mutual dependency relationship with the agent ID of the computer 3 that generated the log information currently read by the log reading means K is specified, the command output means J The microprocessor 101 of the log management apparatus 1 functioning as the memory stores the latest log information for each computer 3 via the message transmission / reception means G to each of the computers 3 specified by the dependency relationship specifying means I. A command for saving in the log saving area a3 of the hard disk drive 205 as a device is output (step U14).

  Then, the microprocessor 101 of the log management apparatus 1 is currently reading the log information read by the log reading means K, that is, the log information newly written in the log storage area A1 of the hard disk drive 105 in the process of step T3 described above. Is incremented by 1 from 0 to 1 (step U15), and the processing of this cycle is terminated.

  The command sent from the log management device 1 to the computer 3 in this way is sent to the computer 3 repeatedly executing the processes of FIGS. 4 to 5 by the microprocessor 201 functioning as the client message transmitting / receiving means g in FIG. This command is detected in the process of step V1, and this command is delivered from the client message transmitting / receiving means g to the client extracted log writing means f.

  Next, the microprocessor 201 of the computer 3 functioning as the client extracted log writing means f reads the latest log information of the computer 3 from the temporary storage area a1 of the hard disk drive 205, and this log information is important in the hard disk drive 205. New log information is written in a log storage area a3 provided to store the log information (step V2).

  A command for storing the latest log information for each computer 3 in the hard disk drive 205 which is a storage device for each computer 3 is important to be stored from any of the computers 3 connected to the log management device 1. Immediately after the log information related to the abnormality, for example, the log information related to the abnormality is transferred to the log management device 1, it is immediately transferred to the other computer 3 having the interdependency with the computer 3 to which the abnormality log is transferred. Since the latest log information for each computer 3 can be secured at almost the same time for other computers 3 that are closely related to the computer 3 that has output the log information related to the Therefore, it is possible to improve the accuracy and efficiency of failure analysis.

As described above, the log management method, the log management program, and the log management apparatus 1 according to the present embodiment have the extraction condition in which the content of the generated log information is set in the identification condition storage table L of the hard disk drive 105 in advance (Step U4), and only when the preset extraction condition is satisfied, information that identifies the content of the generated log information, that is, the filter ID, offset value, and log information It is determined whether the number of characters of the main body and the agent ID of the computer 3 that has output the log are already stored in the existing log storage area A2 of the hard disk drive 105 (step U8).
If the information specifying the content of the generated log information is stored in the existing log storage area A2, the process of storing the information specifying the content of the log information in the existing log storage area A2 is not executed. At the same time (step U9 is skipped), additional storage of log information in the log storage area A3 is not executed (step U11 is skipped), while information specifying the content of the generated log information is stored in the existing log storage area A2. Only when it is not stored, information specifying the content of the log information is stored in the existing log storage area A2 (execution of step U9), and the log information is immediately added and stored in the log storage area A3. Therefore (execution of step U11), it is possible to narrow down the important log information to be stored for a long term by the extraction condition of the identification condition storage table L, and Even if the log information is narrowed down according to the conditions, the information already stored in the log storage area A3 is excluded from the storage target in the log storage area A3. Log information can be held in the log storage area A3 in the hard disk drive 105 functioning as a storage device for a long period of time.

  Therefore, even when a failure occurs in which the same log information is repeatedly output for the same cause, the first log information related to the beginning of the abnormality is securely held in the finite log storage area A3, and It is possible to prevent the storage area from being wasted by omitting the same log information from the second time onward.

In addition, when a wild card is used when setting an identification condition as an extraction condition in the identification condition storage table L, even if the filter ID is the same, a data set having a different offset value and the total number of characters is an existing log storage area. Although there are multiple in A2, even if it is possible to detect abnormalities in multiple types of log information with one filter condition, not all are treated as the same log information, according to the difference in offset value and the total number of characters Since log information is identified, various log information can be identified, and the number of detections for each log information can be managed to realize duplication control.
Furthermore, since the latest log information of the computer 3 related to the computer 3 that has output the abnormality log is secured for each computer 3, multi-face fault analysis including the computer 3 operating in association is possible. Thus, improvement in accuracy and efficiency of failure analysis can be realized.

  FIG. 1 illustrates the case where the log information generated on the two computers 3 is stored in the hard disk drive 105 of the log management device 1 in chronological order, but the computer 3 connected to the log management device 1 is illustrated. There is no particular limit to the number.

Further, even if the computer 3 has the function of the log management device 1 and handles only its own log information in a self-contained manner without acquiring log information from other computers, the above-described configuration Can be applied.
In this case, the computer 3 that handles the application software itself functions as the log management device 1. However, in the case of handling only its own log information in a self-contained manner, the message transmission / reception means G, the dependency relationship storage The table H, the dependency relationship specifying means I, and the command output means J are not necessary.

  A part or all of the embodiment disclosed above can be appropriately expressed by the description shown in the following supplementary notes, but the form for carrying out the invention and the technical idea of the invention are not limited to these. Absent.

[Appendix 1]
A log management method for storing log information generated on a computer in a computer storage device (105) in chronological order,
The generated log information is cyclically overwritten and stored in a finite temporary storage area (A1) constituting a part of the storage device (105) in time series,
It is determined whether or not the content of the generated log information satisfies a preset extraction condition. If the predetermined extraction condition is satisfied, the content of the generated log information is further specified. Determining whether information is already stored in a finite storage area (A2) constituting another part of the storage device (105);
The content of this log information only when the information specifying the content of the generated log information is not stored in the finite storage area (A2) constituting the other part of the storage device (105) Is added to and stored in the finite storage area (A2) constituting the other part of the storage device (105), and the generated log information is further stored in the storage device (105). Log management method, characterized by being added to and stored in a finite storage area (A3) constituting a section.

[Appendix 2]
A plurality of computers (3) for generating log information are connected to a computer (1) having the storage device (105) so that information can be transmitted, and the log information generated by the computer (3) for generating log information is Transfer to computer (1) with storage device (105),
The log information and the information specifying the content of the generated log information include at least computer specifying information (agent ID) for specifying the computer that generated the log information. The log management method described.

[Appendix 3]
A dependency relationship storage table (H) indicating the mutual dependency relationship between the computers (3) generating log information by the correspondence relationship of the computer identification information (agent ID) is previously stored in the computer (1) having the storage device (105). Remember,
The information generated by determining whether or not the information specifying the content of the generated log information is already stored in the finite storage area (A2) constituting the other part of the storage device (105). If it is determined that the information specifying the content of the log information is not stored in the finite storage area (A2) constituting the other part of the storage device (105), the storage device A computer (1) having (105) identifies a computer (3) that is interdependent with the computer (3) that generated the log information with reference to the dependency storage table (H);
The computer (1) having the storage device (105) outputs a command to each of the computers (3) having the interdependence relationship, and the latest log information in each computer (3) is obtained for each computer (3). The log management method according to appendix 2, wherein the log management method stores the data in a storage device (205).

[Appendix 4]
The extraction condition includes at least a keyword that may be included in the log information and an offset value for specifying the position of the keyword on the log information as constituent elements of the extraction condition.
The log according to any one of Supplementary Note 1, Supplementary Note 2 and Supplementary Note 3, wherein each of the constituent factors excluding the keyword among the extraction conditions is allowed to set an unconditional match using a wild card. Management method.

[Appendix 5]
The information generated by determining whether or not the information specifying the content of the generated log information is already stored in the finite storage area (A2) constituting the other part of the storage device (105). If it is determined that information specifying the content of the log information is stored in the finite storage area (A2) constituting the other part of the storage device, the content of the log information is specified Supplementary note 1, wherein the value of the extraction number storage register provided in the finite storage area (A2) constituting the other part of the storage device (105) is incremented by 1 corresponding to the information The log management method according to any one of 2, Supplementary Note 3 and Supplementary Note 4.

[Appendix 6]
A log management program for storing log information generated on a computer in a storage device (105) of the computer in time series,
Log writing means (B) for causing the microprocessor of the computer to cyclically overwrite and store the generated log information in a finite temporary storage area (A1) constituting a part of the storage device in time series ),
Extraction necessity determination means (C) for determining whether or not the content of the generated log information satisfies a preset extraction condition;
When the content of the generated log information is determined to satisfy a preset extraction condition by the extraction necessity determination means (C), information for specifying the content of the generated log information is the storage device. (105) A storage necessity determination means (D) for determining whether or not the information is already stored in a finite storage area (A2) constituting another part.
Information specifying the content of the log information generated by the storage necessity determination means (D) is not stored in the finite storage area (A2) constituting the other part of the storage device (105). Only when it is determined that the information specifying the content of the log information is added to the finite storage area (A2) constituting the other part of the storage device (105) and stored. Writing means (E), and
Information specifying the content of the log information generated by the storage necessity determination means (D) is not stored in the finite storage area (A2) constituting the other part of the storage device (105). Only when it is determined that the generated log information is added to and stored in a finite storage area (A3) that constitutes another part of the storage device (105). F) A log management program characterized by functioning as

[Appendix 7]
Log information generated by each computer (3) from a plurality of computers (3) connected to the computer (1) so that information can be transmitted to the microprocessor (101) of the computer (1) and the log information Appendix 6 characterized in that it receives computer specifying information (agent ID) for specifying the computer (3) that generated the message and functions as a message receiving means (G) to be delivered to the log writing means (B). Log management program.

[Appendix 8]
Log information generated by each computer (3) from a plurality of computers (3) connected to the computer (1) so that information can be transmitted to the microprocessor (101) of the computer (1) and the log information Computer identification information (agent ID) for identifying the computer (3) that generated the command is received and transferred to the log writing means (B), and the command generated by the microprocessor (101) is transmitted to the computer (1). A telegram transmitting / receiving means (G) for transmitting to each of the computers (3) connected to be able to transmit information to
Information specifying the content of the log information generated by the storage necessity determination means (D) is not stored in the finite storage area (A2) constituting the other part of the storage device (105). Only when it is determined that the log information is generated by referring to the dependency storage table (H) in which the mutual dependency between the computers (3) that generate the log information is stored by the correspondence of the computer identification information (agent ID). Dependency specifying means (I) for specifying the computer (3) having an interdependency with the generated computer (3), and
A command is output to each of the computers (3) specified by the dependency specifying means (I) via the telegram transmitting / receiving means (G), and the latest log information in each computer (3) is output to each computer (3). The log management program according to appendix 6, wherein the log management program is made to function as command output means (J) stored in each storage device (205).

[Appendix 9]
The microprocessor (101) of the computer (1) further reads a keyword that may be included in the log information from the extraction condition and an offset value for specifying the position of the keyword on the log information. When a wild card is set for a constituent factor to be excluded, the extraction necessity determination is provided with a function for determining that the constituent factor satisfies the condition of the corresponding constituent factor in the preset extraction condition unconditionally. The log management program according to any one of Supplementary Note 6, Supplementary Note 7, and Supplementary Note 8, wherein the log management program is caused to function as means (C).

[Appendix 10]
Information specifying the contents of the log information generated by the microprocessor (101) of the computer (1) and the storage necessity determination means (D) is the other part of the storage device (105). When it is determined that the log information is stored in the finite storage area (A2) that configures the log information, the other part of the storage device (105) is configured corresponding to the information that specifies the content of the log information. APPENDIX 6, APPENDIX 7, APPENDIX 8 characterized by functioning as content specifying information writing means (E) having a function of incrementing the value of the extraction count storage register provided in the finite storage area (A2) by 1 Or the log management program according to any one of Appendix 9.

[Appendix 11]
A log management device for storing log information generated on a computer in a storage device (105) of the computer in time series,
Log writing means (B) for cyclically overwriting and storing the generated log information in a finite temporary storage area (A1) constituting a part of the storage device (105) in time series;
Extraction necessity determination means (C) for determining whether or not the content of the generated log information satisfies a preset extraction condition;
When the content of the generated log information is determined to satisfy a preset extraction condition by the extraction necessity determination means (C), information for specifying the content of the generated log information is the storage device. (105) a storage necessity determination means (D) for determining whether or not the data is already stored in a finite storage area (A2) constituting another part;
Information specifying the content of the log information generated by the storage necessity determination means (D) is not stored in the finite storage area (A2) constituting the other part of the storage device (105). Only when it is determined that the information specifying the content of the log information is added to the finite storage area (A2) constituting the other part of the storage device (105) and stored. Writing means (E);
Information specifying the content of the log information generated by the storage necessity determination means (D) is not stored in the finite storage area (A2) constituting the other part of the storage device (105). Only when it is determined that the generated log information is added to and stored in a finite storage area (A3) that constitutes another part of the storage device (105). F). A log management apparatus comprising:

[Appendix 12]
Computer identification information for identifying log information generated by each computer (3) from a plurality of computers (3) connected to the computer (1) so as to be able to transmit information, and the computer (3) that generated the log information The log management apparatus according to appendix 11, further comprising: a message receiving unit (G) that receives (agent ID) and delivers it to the log writing unit (B).

[Appendix 13]
Computer identification information for identifying log information generated by each computer (3) from a plurality of computers (3) connected to the computer (1) so as to be able to transmit information, and the computer (3) that generated the log information (Agent ID) is received and delivered to the log writing means (B), and a command generated by the computer (1) is transmitted to each of the computers (3) connected to the computer (1) so as to be able to transmit information. Message transmission / reception means (G),
Information specifying the content of the log information generated by the storage necessity determination means (D) is not stored in the finite storage area (A2) constituting the other part of the storage device (105). Only when it is determined that the log information is generated by referring to the dependency storage table (H) in which the mutual dependency between the computers (3) that generate the log information is stored by the correspondence of the computer identification information (agent ID). Dependency specifying means (I) for specifying the computer (3) having an interdependency with the generated computer (3);
A command is output to each of the computers (3) specified by the dependency specifying means (I) via the telegram transmitting / receiving means (G), and the latest log information in each computer (3) is output to each computer (3). The log management device according to appendix 11, further comprising command output means (J) for storing in each storage device (205).

[Appendix 14]
The extraction necessity determination means (C) reads the keywords that may be included in the log information from the extraction conditions and the offset value for specifying the keyword position on the log information, and uses them as constituent factors excluding the keywords. Appendix 11, characterized in that when a wild card is set, the constituent factor has a function of determining that the condition of the corresponding constituent factor in the preset extraction condition is unconditionally satisfied 14. The log management device according to any one of appendix 12 or appendix 13.

[Appendix 15]
Information specifying the content of the log information generated by the storage necessity determination unit (D) in the content specifying information writing unit (E) constitutes the other part of the storage device (105). When it is determined that the log information is stored in the finite storage area (A2), the finite memory constituting the other part of the storage device (105) corresponding to the information specifying the content of the log information 15. The log management device according to any one of appendix 11, appendix 13, appendix 13, or appendix 14, which has a function of incrementing the value of the extraction count storage register provided in the area (A2) by 1. .

  The present invention can be applied to a log message monitoring application of an IT system composed of various products such as a server, a database, and a network device. In particular, when multiple independent devices are related to each other to realize a single service, such as a client / server system or a Web service system composed of multiple servers, This is effective for collecting log information.

A1 Finite temporary storage area (log storage area) for overwriting and writing log information
A2 Storage area for storing information specifying the contents of log information (existing log storage area)
A3 Limited storage area for storing log information (log storage area)
B Log writing means C Extraction necessity determination means D Storage necessity determination means E Content specifying information writing means F Extraction log writing means G Message transmission / reception means H Dependency storage table I storing interdependencies between computers Relation specifying means J Command output means K Log reading means L Identification condition storage table a1 storing log information extraction conditions a1 Finite temporary storage area (log storage area) for overwriting and writing log information
a3 A finite storage area (log storage area) for storing log information
f Extracted log writing means for client g Message transmission / reception means for client k Log reading means for client 1 Log management device 2 Network 3 Computer 101 Microprocessor 102 ROM
103 Nonvolatile memory 104 RAM
105 Hard disk drive (computer storage device)
106 I / O circuit 107 Keyboard 108 Mouse 109 Monitor 110 Printer 111 Interface 201 Microprocessor 202 ROM
203 Non-volatile memory 204 RAM
205 Hard disk drive (storage device for each computer)
206 Input / output circuit 207 Keyboard 208 Mouse 209 Monitor 210 Printer 211 Interface

Claims (7)

A log management method for storing log information generated on a computer in a storage device of the computer along a time series,
The generated log information is cyclically overwritten and stored in a finite temporary storage area constituting a part of the storage device in time series,
It is determined whether or not the content of the generated log information satisfies a preset extraction condition. If the predetermined extraction condition is satisfied, the content of the generated log information is further specified. Determining whether information is already stored in a finite storage area constituting another part of the storage device;
Only when the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, the information specifying the content of the log information is In addition to storing in the finite storage area constituting the other part of the storage device, the generated log information is added to the finite storage area constituting the other part of the storage device. A log management method characterized by storing. A plurality of computers for generating log information are connected to a computer having the storage device so that information can be transmitted, and log information generated by the computer for generating log information is transferred to the computer having the storage device, and
2. The log according to claim 1, wherein the log information and the information specifying the contents of the generated log information include at least computer specifying information for specifying a computer that generated the log information. Management method. A dependency relationship storage table that indicates the interdependency relationship between computers that generate log information by the correspondence relationship of computer specific information is stored in advance in a computer including the storage device,
The content of the generated log information is determined by determining whether or not the information specifying the content of the generated log information is already stored in a finite storage area constituting the other part of the storage device. If it is determined that the specified information is not stored in a finite storage area constituting the other part of the storage device, the computer including the storage device further stores the dependency relationship storage table. Identify the computer that is interdependent with the computer that generated the log information by referring to it,
The computer having the storage device outputs a command to each of the computers having an interdependence so that the latest log information in each computer is stored in the storage device of each computer. Log management method. The extraction condition includes at least a keyword that may be included in the log information and an offset value for specifying the position of the keyword on the log information as constituent elements of the extraction condition.
4. The method according to claim 1, wherein an unconditional match setting by a wild card is allowed for each of the constituent factors excluding the keyword among the extraction conditions. 5. The log management method described.   The content of the generated log information is determined by determining whether or not the information specifying the content of the generated log information is already stored in a finite storage area constituting the other part of the storage device. If it is determined that the information to be identified is stored in a finite storage area that constitutes the other part of the storage device, the storage device corresponds to the information that specifies the content of the log information. 5. The value of an extraction number storage register provided in a finite storage area constituting the other part is incremented by one, and any one of claim 1, claim 2, claim 3 or claim 4 The log management method according to one item. A log management program for storing log information generated on a computer in a storage device of the computer along a time series,
Log writing means for cyclically overwriting and storing the generated log information in a finite temporary storage area constituting a part of the storage device in time series, the microprocessor of the computer;
Extraction necessity determination means for determining whether or not the content of the generated log information satisfies a preset extraction condition;
When it is determined by the extraction necessity determination unit that the content of the generated log information satisfies a predetermined extraction condition, information for specifying the content of the generated log information is stored in another storage device. A storage necessity judging means for judging whether or not already stored in a finite storage area constituting a part;
Only when it is determined by the storage necessity determination means that the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, Content specifying information writing means for adding and storing information specifying the content of the log information in a finite storage area constituting the other part of the storage device; and
Only when it is determined by the storage necessity determination means that the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, A log management program that functions as extraction log writing means for adding and storing the generated log information in a finite storage area that constitutes another part of the storage device. A log management device for storing log information generated on a computer in a storage device of the computer in time series,
Log writing means for cyclically overwriting and storing the generated log information in a finite temporary storage area constituting a part of the storage device in time series;
Extraction necessity determination means for determining whether or not the content of the generated log information satisfies a preset extraction condition;
When it is determined by the extraction necessity determination unit that the content of the generated log information satisfies a predetermined extraction condition, information for specifying the content of the generated log information is stored in another storage device. A storage necessity judging means for judging whether or not already stored in a finite storage area constituting a part;
Only when it is determined by the storage necessity determination means that the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, Content specifying information writing means for adding and storing information specifying the content of the log information in a finite storage area constituting the other part of the storage device;
Only when it is determined by the storage necessity determination means that the information specifying the content of the generated log information is not stored in a finite storage area constituting the other part of the storage device, A log management apparatus comprising: an extracted log writing unit that stores the generated log information in addition to a finite storage area that constitutes another part of the storage device.

Images