JP6547341B2 - INFORMATION PROCESSING APPARATUS, METHOD, AND PROGRAM - Google Patents

Description

  The present invention relates to a computer device that processes data in an IT system.

  A data processing method and a data analysis method for data management or data monitoring are disclosed in an information technology (IT) system.

  For example, in Patent Document 1, a log indicating that a client accessed a confidential file is collected with time, it is determined whether the log has been copied, and log information, time information, matrix structure whether or not it has been copied. The log display system to be displayed by is described.

  In addition, Patent Document 2 describes a method of monitoring an access log of an IT system, calculating a ratio of a plurality of tasks performed by the IT system (task pattern), and optimizing a network configuration according to the task pattern. It is done.

  Further, in Patent Document 3, the data of the identification item and the value of the key item included in the coupling source data and the coupling destination data are respectively compared, and the coupling destination data is coupled to the coupling source data according to the conditions. A data combining method has been described that improves the success rate of combining.

  Further, according to the patent document 4, the aggregation target data is read out from the data using the aggregation management table that defines the aggregation target according to the aggregation level of the data, and the aggregation target data is hierarchically structured according to the aggregation level. Describes the data aggregation method to be output.

  Among data analysis methods, for example, there is known a method of performing analysis using correlation analysis and similarity matching when performing system monitoring for failure detection.

  For example, in Patent Document 5, an IT system capable of analyzing and displaying a fault in a device which can not acquire fault information by analyzing the fault based on correlation analysis rule information and a network configuration of the IT system. Management method is described.

  Further, in Patent Document 6, the dissimilarity between the component of the transaction to be monitored and the component of the transaction model is determined, the matching rate is determined based on the dissimilarity, and the matching rate is determined based on the matching rate. A system monitoring method for analyzing the processing status of the system is described.

  Further, in Patent Document 7, a pattern is extracted from integrated log information in which information of elements constituting the system and log information of the system are integrated, and the pattern is compared with a pattern to be compared; A failure analysis method is described that detects differences and presents them as the source of failure of the system.

JP 2007-200047 A JP, 2005-99973, A WO 2010/134440 JP 06-309343 A WO 2010/038327 JP, 2010-231825, A International Publication No. 2014/196129

  In the log display method described in Patent Document 1 described above or in the access log monitoring technology described in Patent Document 2, it is described that logs are counted or work patterns are calculated by monitoring logs. . However, none of the techniques for analyzing the content of the log information without using correlation analysis or similarity matching technology and analyzing the abnormal log of the log have been described.

  Patent Document 3 and Patent Document 4 describe a method of combining data and a technique for layering aggregated data. However, a technique for analyzing the contents of log information without using correlation analysis and similarity matching techniques to analyze anomalous patterns of logs has not been described.

  When the correlation analysis described in Patent Document 5 or the determination of similarity matching described in Patent Document 6 is used, although the same error is indicated, it is possible to analyze an abnormality log that includes different information. difficult.

  Moreover, although the pattern of the log which causes a system failure is detected in patent document 7, the technique which analyzes an abnormal log is not described.

  Therefore, an object of the present invention is to provide an information processing apparatus that analyzes an abnormality log without using correlation analysis or similarity matching.

  When the information processing apparatus according to the present invention reads a log including a record and determines that the log is a normal log, the information processing apparatus transmits the log as a normal log and determines that the log is not a normal log. The log reading means for transmitting the log as an abnormal log, the pattern which is the appearance order of the records included in the normal log, and the abnormal log are compared, and the abnormal log partially matches the pattern In this case, records that partially match the pattern are classified into incomplete patterns, and if the abnormal log does not match the pattern, the abnormal log is classified into unmatched records, and the incomplete pattern and the unmatched And log classification means for analyzing records.

  The information processing method according to the present invention reads a log including a record, and determines that the log is a normal log, transmits the log as a normal log, and determines that the log is not a normal log. The log is transmitted as an abnormal log, and a pattern which is an appearance order of the records included in the normal log is compared with the abnormal log, and when the abnormal log partially matches the pattern, the pattern The partially matched records are classified into uncompleted patterns, and when the abnormal log does not match the pattern, the abnormal log is classified into unmatched records, and analysis of the uncompleted patterns and the unmatched records is performed. It is characterized by making a computer perform what it does.

  The information processing program according to the present invention reads a log including a record, and when determining that the log is a normal log, transmits the log as a normal log, and determines that the log is not a normal log. The log is transmitted as an abnormal log, and a pattern which is an appearance order of the records included in the normal log is compared with the abnormal log, and when the abnormal log partially matches the pattern, the pattern The partially matched records are classified into uncompleted patterns, and when the abnormal log does not match the pattern, the abnormal log is classified into unmatched records, and analysis of the uncompleted patterns and the unmatched records is performed. It is characterized by making a computer perform what it does.

  With the above configuration, log analysis can be performed without using correlation analysis or similarity matching.

It is a block diagram showing composition of an information processor 1 concerning a 1st embodiment of the present invention. It is a block diagram which shows the hardware constitutions of the information processing apparatus 1 which concerns on 1st Embodiment of this invention. It is a flowchart which shows the operation | movement which the information processing apparatus 1 which concerns on 1st Embodiment of this invention performs. It is an exemplary conceptual diagram of the normal log list 311 according to the first embodiment of the present invention. It is an example conceptual diagram of the abnormal log list 321 which concerns on 1st Embodiment of this discovery. It is an exemplary conceptual diagram of the module information list 331 which concerns on 1st Embodiment of this invention. FIG. 6 is an exemplary conceptual view of a pattern list 341 according to the first embodiment of the present invention. It is a flowchart of the process A which the information processing apparatus 1 which concerns on 1st Embodiment of this invention performs. It is an illustration figure of the message which the display apparatus 5 which concerns on 1st Embodiment of this invention displays. It is a flowchart of the pattern comparison process which the pattern comparison part 23 which concerns on 1st Embodiment of this invention performs. It is a flowchart which shows the module link process which the module link part which concerns on 1st Embodiment of this invention performs. It is a flowchart of the process B which the module correlation part 24 which concerns on 1st Embodiment of this invention performs. It is a block diagram showing composition of an information processor 10 concerning a 2nd embodiment of the present invention. It is a flowchart of the uncompleted pattern intensive process of the uncompleted pattern intensive unit 25 according to the second embodiment of the present invention. It is an illustration figure which shows the intensive processing which the uncompleted intensive part 25 performs. It is a block diagram which shows the structure of the information processing apparatus 20 which concerns on 3rd Embodiment of this invention. It is a flowchart which shows the operation | movement which the information processing apparatus 20 which concerns on 3rd Embodiment of this invention performs. It is a flowchart of the process C which the information processing apparatus 20 which concerns on 3rd Embodiment of this invention performs. It is a flowchart which shows the module link process which the module link part which concerns on 3rd Embodiment of this invention performs. It is a flowchart of the process D which the module correlation part 24 which concerns on 3rd Embodiment of this invention performs. It is a block diagram showing composition of an information processor 30 concerning a 4th embodiment of the present invention. It is a block diagram showing composition of an information processor 40 concerning a 5th embodiment of the present invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

First Embodiment
FIG. 1 is a block diagram showing the configuration of the information processing apparatus 1 according to the first embodiment of the present invention. In FIG. 1, the information processing apparatus 1 includes a control unit 2, a storage unit 3, a pattern generation unit 4, a display device 5, and a log storage unit 6. The control unit 2 controls the operation of the information processing device 1. Furthermore, the control unit 2 includes an ID assignment unit 21, a log determination unit 22, a pattern comparison unit 23, and a module association unit 24.

  The ID assigning unit 21 reads the log, and assigns a record ID and a module ID corresponding to each record of the read log. The module ID assigned here may be, for example, a file name of a log, or an identifier of a type of log existing in each record, such as a facility of Syslog. Those skilled in the art can appropriately select based on what criteria the module is set and the module ID is given. The log determination unit 22 determines whether the input log is a normal log. If the log is a normal log, the log determination unit 22 transmits the log as a normal log to the normal log storage unit 31 of the storage unit 3 and stores the log. If the log is not a normal log, the log determination unit 22 transmits it as an abnormality log to the abnormality log storage unit 32 of the storage unit 3 and stores it in the same. The pattern comparison unit 23 compares the pattern which is the appearance order of each record ID included in the normal log generated by the pattern generation unit 4 with the abnormality log, and determines whether the pattern matches the pattern. Then, the pattern comparison unit 23 transmits, to the module association unit 24, an abnormality log that does not match the pattern. The module association unit 24 associates the abnormal log with the module.

  The storage unit 3 includes a normal log storage unit 31, an abnormality log storage unit 32, a module information storage unit 33, and a pattern storage unit 34. The normal log storage unit 31 includes a normal log list 311 that is a list of normal logs determined by the log determination unit 22 to be normal logs. The abnormality log storage unit 32 includes an abnormality log list 321 which is a list of abnormality logs. The module information storage unit 33 includes a module information list 331 which indicates which record is included in which module. The pattern storage unit 34 stores a pattern list 341 which is a list of patterns generated by the pattern generation unit 4.

  The pattern generation unit 4 generates the appearance order of each record ID as a pattern based on the normal log. Further, the display device 5 displays the result of the association by the module association unit 24. Furthermore, the log storage unit 6 stores a log.

<Hardware configuration>
FIG. 2 is a block diagram showing the hardware configuration of the information processing apparatus 1 of the present invention. The information processing apparatus 1 includes a central processing unit (CPU) 61, a road only memory (ROM) 62, a random access memory (RAM) 63, a network interface 64, a storage unit 65, an input device 66, and an output device. And 67. FIG.

  The ID assigning unit 21 includes a network interface 64, an input device 66, and a CPU 61 that writes the computer program stored in the ROM 62 and the storage device 65 into the RAM 63 and executes the written computer program. The pattern generation unit 4, the log determination unit 22, the pattern comparison unit 23, and the module association unit 24 write the computer program stored in the ROM 62 and the storage unit 65 in the RAM 63 and execute the written computer program CPU 61 Composed of Further, the normal log storage unit 31, the abnormality log storage unit 32, the pattern storage unit 33, and the module information storage unit 33 are configured by the storage device 65. The display device 5 is configured of an output device 67.

  Similarly, the information processing apparatus 10, the information processing apparatus 20, and the information processing apparatus 30 in the second, third, and fourth embodiments described later can also have the above-described hardware configuration, and the information processing apparatus 10 and the information processing The respective functions of the device 20 and the information processing device 30 are realized as hardware or software. The above hardware configuration is an example, and is not limited to the above configuration.

  FIG. 3 is a flowchart showing an operation performed by the information processing apparatus 1 according to the first embodiment of the present invention. The operation of the information processing apparatus 1 according to the first embodiment will be specifically described below with reference to FIG.

  First, the ID assigning unit 21 reads a log from the log storage unit 6 (step S101), and assigns a record ID corresponding to each record of the read log (step S102). For example, the ID assigning unit 21 generates a record ID to be assigned by using a known method such as the K-means method, which is a method of clustering. Record ID is given for each record. Furthermore, the ID assigning unit 21 assigns a module ID to each record (step S103). The module ID to be assigned may be, for example, a file name of a log, or an identifier of a type of log existing in each record, such as a facility of Syslog. Those skilled in the art can appropriately select based on what criteria the module is set and the module ID is given. Then, the ID assignment unit 21 transmits the correspondence relationship between the record ID and the module ID as the module information list 331 to the module information storage unit 33, and stores it in the module information storage unit 33 (step S104).

  Next, when a log is input to the log determination unit 22, the log determination unit 22 determines whether the input log is normal (step S105). For example, the determination may be performed according to the invention described in WO 2014/196129 (Patent Document 7). If the input log is not normal, the log determination unit 22 determines that the input log is an abnormality log, transmits the abnormality log as an abnormality log list 321 to the abnormality log storage unit 32, and stores it there (step S106). ). Then, the process proceeds to step S110.

  On the other hand, when the input log is normal, the log determination unit 22 determines the input log as a normal log, transmits the normal log as the normal log list 311 to the normal log storage unit 31, and stores the log in the normal log storage unit 31. (Step S107).

  The pattern generation unit 4 extracts the normal log from the normal log storage unit 31, and generates a pattern based on the extracted normal log, with the order of appearance of each record of the normal log as a pattern (step S108). Furthermore, the pattern generation unit 14 transmits the generated pattern as the pattern list 341 to the pattern storage unit 34, and stores it in the pattern storage unit 34 (step S109). Note that, as a method of generating a pattern, for example, a known algorithm such as Apriori or backtrack method may be used to generate a pattern. Then, the ID assigning unit 21 determines whether all the logs in the log storage unit 6 have been read (step S110). If all the logs have not been read, the process proceeds to step S101. If all the logs have been read, the process proceeds to processing A described later.

  By the operation described above, when the control unit 2 identifies the abnormal log and the normal log, the pattern generation unit 4 can generate a pattern based on the normal log.

  FIG. 4 is an exemplary conceptual view of the normal log list 311 according to the first embodiment of the present invention. The normal logs are determined by the log determination unit 22 and are input as normal log 1 (311_1), normal log 2 (311_2), normal log 3 (311_3), ..., normal log n (311_n (n is a natural number))) It is memorized. The time of a record, the content of the record, and the module ID are associated with one record ID, and a plurality of records of normal logs are stored. The contents of the record describe, for example, the processing performed by the system.

  FIG. 5 is an exemplary conceptual view of the abnormal log list 321 according to the first embodiment of the present invention. The abnormality logs are determined by the log determination unit 22, and are stored as an abnormality log 1, an abnormality log 2, ..., an abnormality log n (n: natural number) in the order of input. The time of a record, the content of the record, and the module ID are associated with one record ID, and a plurality of records of the abnormal log are stored.

  FIG. 6 is an exemplary conceptual view of the module information list 331 according to the first embodiment of the present invention. A module ID is stored corresponding to each record ID. For example, if the record ID is 1, the module ID is Module 1; if the record ID is 2, the module ID is Module 2; if the record ID is m (m: natural number), the module ID is Module n (n : Natural number).

  FIG. 7 is an exemplary conceptual view of the pattern list 341. The patterns generated by the pattern generation unit 4 become pattern 1 (341_1), pattern 2 (341_2), pattern 3 (341_3),..., Pattern n (341: n (n is a natural number)) in the order of generation. These patterns are sequentially stored in the pattern storage unit 34. The appearance order of the record IDs is the arrangement order of one pattern, and the record IDs are arranged and stored in the appearance order. In FIG. 7, a, b, c, d and e in the pattern 341 _n represent natural numbers indicating arbitrary record IDs. The pattern 341 _ 1 and the pattern 341 _ 2 have a configuration with five record IDs, and the pattern 341 _ 3 has a configuration with four record IDs, but one skilled in the art can appropriately select the number of record IDs that configure one pattern.

  FIG. 8 shows a flowchart of the process A described above. First, the pattern comparison unit 23 performs pattern comparison processing for comparing the abnormality log with the patterns included in the pattern list 341 (step S201), and according to the comparison result, the abnormality log does not match the match log and the uncompleted pattern. Classify as records. Details of this pattern comparison process will be described later.

  Next, the module associating unit 24 performs a module associating process on the uncompleted pattern and the unmatched record (step S202). This module association process will be described later. Then, the display device 5, which is a log display unit, displays a message as shown in FIG. 9 (step S203). FIG. 9 is an exemplary conceptual view of a message displayed by the display device 5 according to the first embodiment. In the completion pattern, the patterns for which the processing by the module association unit 24 is completed are stored, and are pattern 1, pattern 2, pattern 3, pattern 4,..., Pattern m (m: natural number). For example, when a pattern to be displayed (pattern m in the case of FIG. 9) is selected, the record ID and the contents of the record included in the selected pattern are displayed. In the abnormal message and the related message, unmatched records compared with the pattern by the module associating unit 24 are stored. In addition, it is not limited to this display screen.

  The module associating unit 24 associates the uncompleted pattern with the unmatched record using the module ID, thereby defining no information to be compared with the data to be analyzed or a unique rule based on the information. And, it is possible to analyze and display the relationship between the data to be analyzed.

  FIG. 10 is a flowchart of the pattern comparison process performed by the pattern comparison unit 23 described above.

  First, the pattern comparison unit 23 extracts a pattern from the pattern storage unit 34, and determines whether there is a pattern that matches the transmitted abnormality log (step S301). If there is a pattern that matches the abnormality log, the pattern comparison unit 23 transmits the abnormality log as a match log to the normal log storage unit 31 and stores it (step S302). Then, the process proceeds to step S306.

  On the other hand, if there is no pattern that matches the abnormality log, the pattern comparison unit 23 determines whether there is a pattern that partially matches the abnormality log (step S303). If there is a pattern that partially matches the abnormality log, the pattern comparison unit 23 transmits the record matching the pattern as the uncompleted pattern to the module association unit 24, and the abnormality log and the unmatched pattern do not match. The record in which the completion pattern does not match is transmitted to the module associating unit 24 as a mismatch record (step S304). When the abnormality log does not partially match the pattern (when all the patterns do not match), the pattern comparison unit 23 transmits the mismatch record to the module association unit 24 (step S305). Then, the pattern comparison unit 23 determines whether all the abnormality logs in the abnormality log storage unit 31 have been processed (step S306). If all the abnormality logs are not processed, the process proceeds to step S301. If all the abnormality logs are processed, the process proceeds to step S202.

  According to the above-described operation, the pattern comparison unit 23 can compare the abnormal log with the pattern, and classify the abnormal log into the match log, the uncompleted pattern, and the unmatched record according to the degree of match with the pattern. .

  FIG. 11 is a flowchart of the module associating process performed by the module associating unit 24 described above.

First, the module associating unit 24 records the time of the first record of the transmitted uncompleted pattern as the leading time of the uncompleted pattern (step S401). Next, a time when a predetermined time has elapsed since the time of the last record included in the uncompleted pattern is recorded as the end time (step S402).
For example, the start time of the uncompleted pattern is α, and the end time of the uncompleted pattern is β. Here, the fixed time may be, for example, the average time of completion of each pattern or the longest time at the time of pattern generation. Also, the module associating unit 24 acquires the module ID of each record of the uncompleted pattern (step S403), and determines whether the acquired module ID is registered in the module information list 331 (step S404). If the acquired module ID is registered in the module information list 331, the process proceeds to step S406.

  On the other hand, when the acquired module ID is not registered in the module information list 331, the module associating unit 24 registers the acquired module ID in the module information list 331 (step S405). Then, the module associating unit 24 determines whether the uncompleted pattern matching record has been processed (step S406). If the unmatched pattern matching record is processed, the process proceeds to step S407. If the unmatched pattern matching record is not processed, the process proceeds to step S404. Furthermore, the module associating unit 24 determines whether all uncompleted patterns have been processed (step S407). If all the uncompleted patterns have not been processed, the process proceeds to step S401. If all the uncompleted patterns are processed, the process proceeds to processing B.

  By the operation described above, the start time and end time of the uncompleted pattern can be recorded, and it can be confirmed whether the module ID of each record of the uncompleted pattern is registered in the module information list.

  FIG. 12 is a flowchart of the process B performed by the module association unit 24 described above.

  First, the module associating unit 24 records the time of the transmitted unmatched record (step S501). Here, as an example, the time of the unmatched record is γ. Then, the module associating unit 24 compares the time (γ) of the unmatched record, the start time (α) of the uncompleted pattern, and the end time (β) of the uncompleted pattern. Specifically, the module association unit 24 has an uncompleted pattern in which the start time of the uncompleted pattern is earlier than the time of the unmatched record, and the end time of the uncompleted pattern is later than the time of the unmatched record. In other words, it is determined whether there is an uncompleted pattern in which α <γ <β (step S502). If there is no uncompleted pattern in which α <γ <β, the process proceeds to step S507.

  On the other hand, when there is an uncompleted pattern in which α <γ <β, the module associating unit 24 acquires the module ID of the unmatched record (step S503). Then, the module associating unit 24 determines whether the acquired module ID is registered in the module information list 331 (step S504). When the acquired module ID is not registered in the module information list 331, the module associating unit 24 registers the acquired module ID in the item of the abnormality message of the message displayed by the display device 5 (step S505). When the acquired module ID is registered in the module information list 331, the module associating unit 24 registers the acquired module ID in the item of the related message of the message displayed by the display device 5 (step S506).

  Then, the module associating unit 24 determines whether all the unmatched records have been processed (step S507). If all the unmatched records have not been processed, step S501 follows. If all the unmatched records are processed, step S203 follows.

  As described above, by the operation described above, the module ID of the unmatched record included in the uncompleted pattern is classified into the related message and the abnormal message according to whether or not the module ID is registered in the module list. You can understand which module a record is associated with or not.

  Then, the analysis of the abnormal log can be performed without performing the analysis using the correlation analysis or the similarity matching by analyzing the uncompleted pattern and the unmatched record in which the abnormal log is classified based on the module ID.

Second Embodiment
Next, an information processing apparatus 10 according to a second embodiment of the present invention will be described with reference to FIG. In the information processing apparatus 10 according to this embodiment, an uncompleted pattern aggregation unit 21 is newly added to the configuration of the first embodiment. In the drawings referred to in the description of the present embodiment, the same reference numerals are given to the same configuration and steps as those in the other embodiments, and the duplicated description in the present embodiment will be omitted (others The same applies to the embodiment).

  The uncompleted pattern aggregating unit 25 newly added in the present embodiment performs processing of aggregating a plurality of uncompleted patterns into one uncompleted pattern. Note that the information processing apparatus 10 according to the embodiment performs the same process as the information processing apparatus 1 according to the first embodiment, and the log aggregation unit 25 further performs the above-described aggregation process. The uncompleted pattern aggregation unit 25 executes the above-described aggregation processing before the pattern comparison processing of step S201 in FIG.

  FIG. 14 is a flowchart showing the uncompleted pattern aggregation process performed by the uncompleted pattern aggregation unit 25 described above.

  First, the uncompleted pattern aggregating unit 25 records the time of the first record included in the transmitted uncompleted pattern as the leading time of the uncompleted pattern (step S601). Next, the uncompleted pattern aggregation unit 25 records, as the end time, a time when a predetermined time has elapsed from the time of the last record included in the uncompleted pattern (step S602). For example, let x be the start time of the uncompleted pattern and y be the end time of the uncompleted pattern. Here, the fixed time may be, for example, the average time of completion of each pattern or the longest time at the time of pattern generation. Further, the uncompleted pattern aggregation unit 25 records the leading time of the next uncompleted pattern (step S603). Here, for example, the leading time of the next incomplete pattern is assumed to be z. Then, the uncompleted pattern aggregation unit 25 compares the start time (z) of the next uncompleted pattern, the start time (x) of the uncompleted pattern, and the end time (y) of the uncompleted pattern. Specifically, whether the start time of the next uncompleted pattern is behind the time of the uncompleted pattern and the start time of the next uncompleted pattern is before the end time of the uncompleted pattern, that is, It is determined whether x <z <y (step S604). If x <z <y does not hold, the process proceeds to step S606. On the other hand, if x <z <y, the uncompleted pattern aggregating unit 25 aggregates the first uncompleted pattern and the next uncompleted pattern (step S605). The process of aggregation is detailed using FIG. explain.

  FIG. 15 is a conceptual diagram exemplarily showing an incomplete pattern to be aggregated and an aggregated incomplete pattern.

  Here, the uncompleted pattern 201 and the uncompleted pattern 202 are aggregated. Also, the fixed time used to calculate the end time is set to 15 seconds. Of course, the fixed time is not limited to this number.

  First, since the start time of the uncompleted pattern 201 is 14:00:00 and the last record time is 14:00:03, the end time calculated from this is 14:00:18. . Here, since the start time of the uncompleted pattern 202 is 14:00:08, it is included between the start time and the end time of the uncompleted pattern 201, so the uncompleted pattern 201 and the uncompleted pattern 202 are aggregated. . Then, the uncompleted patterns 204 are aggregated. Also, for example, when trying to combine the uncompleted pattern 201 and the uncompleted pattern 203, since the start time of the uncompleted pattern 203 is 14:00:34, the start time and the end time of the uncompleted pattern 201 Not included and can not be aggregated.

  Then, the uncompleted pattern aggregation unit 25 determines whether or not all uncompleted patterns have been processed (step S606). If all the uncompleted patterns have not been processed, the process advances to step S601. If all uncompleted patterns have been processed, the process ends. The processes performed by the information processing apparatus 10 in addition to the above-described incomplete pattern aggregation process are the same as the information processing apparatus 1 according to the first embodiment of the present invention described with reference to FIGS. The description in the present embodiment is omitted.

  By collecting the uncompleted patterns in advance before the module association processing according to the above-described operation, it is possible to reduce the number of steps for the module association processing.

Third Embodiment
FIG. 16 is a block diagram showing the configuration of the information processing apparatus 20 according to the third embodiment of the present invention.

  The information processing apparatus 20 includes a pattern generation unit 4, an ID assignment unit 21, a log determination unit 22, a pattern comparison unit 23, a module association unit 24 and a module information storage unit 33. The module information storage unit 33 includes a module information list 331. The present embodiment differs from the first embodiment in that the configuration does not include the log storage unit 6, the normal log storage unit 31, the abnormality log storage unit 32, the module information storage unit 33, and the pattern storage unit 34. It has become.

  FIG. 17 is a flowchart showing an operation performed by the information processing apparatus 20 according to the third embodiment of the present invention. The operation of the information processing apparatus 20 according to the third embodiment will be specifically described below with reference to FIG.

  First, the ID assigning unit 21 reads a log (step S701), and assigns a record ID corresponding to each record of the read log (step S702). For example, the ID assigning unit 21 generates a record ID to be assigned by using a known method such as the K-means method, which is a method of clustering. Record ID is given for each record. Furthermore, the ID assigning unit 21 assigns a module ID to each record (step S703). The module ID to be assigned may be, for example, a file name of a log, or an identifier of a type of log existing in each record, such as a facility of Syslog. Those skilled in the art can appropriately select based on what criteria the module is set and the module ID is given. Then, the ID assigning unit 21 transmits the log to which the record ID and the module ID are assigned to the log determination unit 22, and transmits the correspondence between the record ID and the module ID to the module information storage unit 33 as the module information list 331. And store it there (step S704).

  Next, when a log is input to the log determination unit 22, the log determination unit 22 determines whether the input log is normal (step S705). For example, the determination may be performed according to the invention described in WO 2014/196129 (Patent Document 7). If the input log is not normal, the log determination unit 22 determines that the input log is an abnormality log, and transmits an abnormality log to the pattern comparison unit 23 (step S706). Then, the process proceeds to step S709.

  On the other hand, if the input log is normal, the log determination unit 22 determines that the input log is a normal log, and transmits a normal log to the pattern generation unit 4 (step S707). The pattern generation unit 4 generates an appearance order of each record ID included in the transmitted normal log as a pattern (step S 708). Note that, as a method of generating a pattern, for example, a known algorithm such as Apriori or backtrack method may be used to generate a pattern. Then, the ID assigning unit 21 determines whether all the logs have been read (step S709). If all the logs have not been read, the process proceeds to step S701. If all the logs have been read, the process proceeds to process C described later. For example, the ID assigning unit 21 may detect that a log is not input for a certain period of time, and may proceed to processing C.

  By the operation described above, the ID assigning unit 21 assigns the record ID and the module ID, and the module information list is generated, so that the correspondence between the record ID and the module ID becomes clear, and the log judging unit 22 obtains the abnormality log. By identifying the normal log, the pattern generation unit 4 can generate a pattern based on the normal log.

  FIG. 18 shows a flowchart of the process C described above.

  First, the pattern comparison unit 23 determines whether there is a pattern that completely matches the transmitted abnormality log (step S801). If there is a pattern that completely matches the sent abnormal log, the process proceeds to step S805.

  On the other hand, if there is no pattern that completely matches the transmitted abnormality log, the pattern comparison unit 23 determines whether there is a pattern that partially matches the abnormality log (step S802). If there is a pattern that partially matches the transmitted abnormality log, the pattern comparison unit 23 transmits the record matching the pattern in the transmitted abnormality log to the module association unit 24 as an uncompleted pattern. The record not matching the pattern is transmitted to the module associating unit 24 as a non-matching record (step S 803). If the transmitted abnormality log does not partially match the pattern, the pattern comparison unit 23 transmits the nonconformity record to the module association unit 24 (step S804). Then, the pattern comparison unit 23 determines whether all the abnormal logs have been processed (step S805). If all the anomaly logs are not processed, the process proceeds to step S801. If all the anomaly logs are processed, the process proceeds to step S806. In addition, for example, when the abnormality log is not transmitted for a fixed time, the pattern comparison unit 23 may proceed to step S806. Then, the module association unit 24 performs module association processing (step S806). This process will be described later.

  By the operation described above, the pattern comparison unit 23 can classify the abnormality log into the matching pattern, the incomplete pattern, and the non-matching record.

  FIG. 19 is a flowchart showing module association processing performed by the module association unit 24 described above.

  First, the module associating unit 24 records the time of the first record of the transmitted uncompleted pattern as the leading time of the uncompleted pattern (step S901). Next, the time when a predetermined time has elapsed since the time of the last record included in the uncompleted pattern is recorded as the end time (step S902). For example, the start time of the uncompleted pattern is α, and the end time of the uncompleted pattern is β. Here, the fixed time may be, for example, the average time of completion of each pattern or the longest time at the time of pattern generation. Also, the module associating unit 24 acquires the module ID of each record of the uncompleted pattern (step 903), and determines whether the acquired module ID is registered in the module information list 331 (step S904). If the acquired module ID is registered in the module information list 331, the process proceeds to step S906.

  On the other hand, when the acquired module ID is not registered in the module information list 331, the module associating unit 24 registers the acquired module ID in the module information list 331 (step S905). Then, the module associating unit 24 determines whether all the uncompleted pattern matching records have been processed (step S906). If all uncompleted pattern matching records have been processed, the process proceeds to processing D. If all uncompleted pattern matching records have not been processed, the process proceeds to step S 903.

  By the operation described above, it is possible to store the start time and end time of all uncompleted patterns, and to confirm whether the module ID of each record of uncompleted patterns is registered in the module information list.

  FIG. 20 is a flowchart of the process D performed by the module association unit 24 described above.

  First, the module associating unit 24 records the time of the unmatched record (step S1001). Here, as an example, the time of the unmatched record is γ. Then, the module associating unit 24 compares the time (γ) of the unmatched record, the start time (α) of the uncompleted pattern, and the end time (β) of the uncompleted pattern. Specifically, whether there is an uncompleted pattern in which the start time of the uncompleted pattern is earlier than the time of the unmatched record and the end time of the uncompleted pattern is later than the time of the unmatched record; It is determined whether there is an uncompleted pattern such that γ <β (step S1002). If there is no uncompleted pattern in which α <γ <β, the process advances to step S1007.

  On the other hand, when there is an uncompleted pattern in which α <γ <β, the module associating unit 24 acquires the module ID of the unmatched record (step S1003). Then, the module associating unit 24 determines whether the acquired module ID is registered in the module information list 331 (step S1004). If the acquired module ID is not registered in the module information list 331, the module associating unit 24 transmits the acquired module ID as an abnormality message (step S1005). When the acquired module ID is registered in the module ID list 171, the module associating unit 24 transmits the acquired module ID as a related message (step S1006).

  Furthermore, the module associating unit 24 determines whether all the unmatched records have been processed (step S1007). If all unmatched records have not been processed, the process advances to step S1001. If all unmatched records have been processed, the process advances to step S1008. Then, the module associating unit 24 determines whether all uncompleted patterns have been processed (step S1008). If all uncompleted patterns have not been processed, the process proceeds to process E. On the other hand, if all uncompleted patterns have been processed, the processing is ended. The module associating unit 24 may end the process, for example, when the incomplete pattern is not transmitted for a predetermined time.

  As described above, according to the operation described above, the nonconforming record is included in the incomplete pattern by dividing it into the related message and the abnormal message depending on whether the module ID of the nonconforming record included in the incomplete pattern is registered in the module list. But which module it is associated with or not. That is, analysis on the abnormal log can be performed.

Fourth Embodiment
FIG. 21 is a block diagram showing the configuration of an information processing apparatus 30 according to the fourth embodiment of the present invention.

  The configuration of the information processing apparatus 30 according to the present embodiment corresponds to the basic configuration of the other embodiments.

  The information processing apparatus 30 includes a log reading unit 301 and a log classification unit 302. A log reading unit 301 is used instead of the ID assigning unit 21 and the log determining unit 22 in the first to third embodiments. Also, instead of the pattern generation unit 4 of the first to third embodiments, the pattern comparison unit 23 and the module association unit 24, a log classification unit 302 is used.

  The log reading unit 301 reads a log including data and an instruction generated in the process of information processing in the information processing apparatus 30. When the read log is normal, the log reading unit 301 transmits the log as a normal log to the log classification unit 302, and when the read log is not normal, the log reading unit 301 transmits the log as an abnormal log to the log classification unit 302.

  The log classification unit 302 compares the pattern of the appearance order of the records included in the log with the abnormal log based on the normal log. As a result of comparison, if the pattern partially matches, the log classification unit 302 classifies the record partially matching the pattern as an incomplete pattern, and if the pattern does not match the pattern, the abnormal log is a nonmatching record Classified into Then, the log classification unit 302 analyzes the uncompleted pattern and the unmatched record.

  By classifying the log as a normal log or an abnormal log by the above-mentioned operation, and classifying the abnormal log as an incomplete pattern or unmatched record by a pattern based on the normal log and performing analysis of the abnormal log, correlation analysis or Anomaly logs can be analyzed without analysis using similarity matching.

Fifth Embodiment
FIG. 22 is a block diagram showing the configuration of an information processing apparatus 40 according to the fifth embodiment of the present invention.

  The information processing apparatus 40 includes a log reading unit 301, a log classification unit 302, and a pattern storage unit 34. The pattern storage unit 34 includes a pattern list 341.

  The log reading unit 301 reads a log including data and an instruction generated in the process of information processing in the information processing apparatus 30. When the read log is normal, the log reading unit 301 transmits the log as a normal log to the log classification unit 302, and when the read log is not normal, the log reading unit 301 transmits the log as an abnormal log to the log classification unit 302.

  The log classification unit 302 generates the appearance order of the records included in the log as a pattern based on the normal log, and stores the generated pattern as a pattern list 341 in the pattern storage unit 34. Then, the log classification unit 302 compares the generated pattern with the abnormality log. As a result of comparison, if the pattern partially matches, the log classification unit 302 classifies the record partially matching the pattern as an incomplete pattern, and if the pattern does not match the pattern, the abnormal log is a nonmatching record Classified into Then, the log classification unit 302 analyzes the uncompleted pattern and the unmatched record.

  Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above embodiments. The configurations and details of the present invention can be modified in various ways that can be understood by those skilled in the art within the scope of the present invention.

Reference Signs List 1 information processing device 2 control unit 3 storage unit 4 pattern generation unit 5 display device 6 log storage unit 10 information processing device 20 information processing device 30 information processing device 21 ID assignment unit 22 log determination unit 23 pattern comparison unit 24 module association unit 25 Uncompleted pattern aggregation unit 31 Normal log storage unit 32 Abnormality log storage unit 33 Module information storage unit 34 Pattern storage unit 61 CPU
62 ROM
63 RAM
64 Network interface 65 Storage device 66 Input device 67 Output device 201 Incomplete pattern 202 Incomplete pattern 203 Incomplete pattern 204 Incomplete pattern collected 301 Log reading part 302 Log classification part 311 Normal log list 321 Abnormal log list 331 Module information List 341 List of patterns

Claims (10)

If a log including a record is read and it is determined that the log is a normal log, the log is transmitted as a normal log, and if it is determined that the log is not a normal log, the log is transmitted as an abnormal log Log reading means,
A pattern is the appearance order of the records contained in the normal log, said comparing the error log, if the abnormality log is coincident with said pattern portion, said pattern partially coincident with that record Are classified into uncompleted patterns, and records which do not match the pattern are classified into unmatched records, and the abnormal log is classified into unmatched records if the abnormal log does not partially match the pattern, An information processing apparatus, comprising: a log classification unit that analyzes a completion pattern and the unmatched record. The log includes a time corresponding to a record included in the log,
The log reading means includes an ID assigning means for assigning a record ID and a module ID corresponding to the type of the log to the record included in the log when the log is read. Information processor as described. A storage unit that stores a module information list indicating a correspondence between the record ID and the module ID;
The storage means is
The information processing apparatus according to claim 2, wherein a normal log list that is a list of the normal logs, an abnormal log list that is a list of the abnormal logs, and the pattern are stored. The log classification unit
The time of the first record included in the uncompleted pattern is recorded as the beginning time of the uncompleted pattern, and the time when a certain time has elapsed from the time of the last record of the uncompleted pattern is recorded as the end time of the uncompleted pattern When the module ID of the record included in the uncompleted pattern is not registered in the module information list, the module ID of the record included in the uncompleted pattern is registered in the module information list. The information processing apparatus according to Item 3. The log classification unit
When the time of the unmatched record is acquired, and the time of the unmatched record exists between the start time of the uncompleted pattern and the end time of the uncompleted pattern, the module ID of the unmatched record is acquired, When the module ID of the unmatched record is registered in the module information list, the unmatched record is output as a related message, and when the module ID of the unmatched record is not registered in the module information list, the unmatched record is abnormal The information processing apparatus according to claim 4, which outputs as a message. Incomplete pattern aggregating means for aggregating one incomplement pattern and the other incompletion pattern when the start time of the other incompletion pattern exists between the start time and the end time of one incompletion pattern The information processing apparatus according to claim 5, comprising: The information processing apparatus according to claim 6, further comprising display means for displaying the related message and the abnormal message. The log classification unit
The information processing apparatus according to any one of claims 1 to 7 , wherein the pattern which is the appearance order of the records included in the normal log is generated. If a log including a record is read and it is determined that the log is a normal log, the log is transmitted as a normal log, and if it is determined that the log is not a normal log, the log is transmitted as an abnormal log ,
A pattern is the appearance order of the records contained in the normal log, said comparing the error log, if the abnormality log is coincident with said pattern portion, said pattern partially coincident with that record Are classified into uncompleted patterns, and records which do not match the pattern are classified into unmatched records, and the abnormal log is classified into unmatched records if the abnormal log does not partially match the pattern, An information processing method that causes a computer to execute an analysis of a completion pattern and the unmatched record. If a log including a record is read and it is determined that the log is a normal log, the log is transmitted as a normal log, and if it is determined that the log is not a normal log, the log is transmitted as an abnormal log ,
A pattern is the appearance order of the records contained in the normal log, said comparing the error log, if the abnormality log is coincident with said pattern portion, said pattern partially coincident with that record Are classified into uncompleted patterns, and records which do not match the pattern are classified into unmatched records, and the abnormal log is classified into unmatched records if the abnormal log does not partially match the pattern, An information processing program that causes a computer to execute an analysis of a completion pattern and the unmatched record.

Images