JP6794909B2 - Message output program, message output method and message output device - Google Patents

Description

The present invention relates to a technique for aggregating messages.

A monitoring device receives a message about a wide variety of events from a host included in the network system to be monitored, and displays the message. The system administrator checks the displayed message to understand, for example, the occurrence of a failure.

The monitoring device may repeatedly accept the same message. Assuming such a situation, if a filter for discarding the second and subsequent messages for the same message is provided, duplicate messages can be eliminated.

Also, if there is regularity in a series of messages, the filter may combine the series of messages into one message based on a predetermined rule. This can also reduce the number of messages.

Multiple messages that have passed such filtering may result from the same event. However, the contents of messages caused by the same event are not always the same. Moreover, even if it is caused by the same event, it does not always have regularity as a series of messages. Therefore, these messages are displayed as they are even if a conventional filter is used. Therefore, the system administrator may have trouble grasping the situation.

Japanese Unexamined Patent Publication No. 2013-171471

An object of the present invention is, on the one hand, to make it easier to understand the purpose of a plurality of messages caused by the same event.

In the message output method according to one aspect, (A) a plurality of messages identified by each identifier are classified into a plurality of classes which are a set of messages based on the similarity between the messages, and (B) are included in the plurality of messages. This includes a process of identifying a common word in which the number of classes in which the word appears is larger than the standard, and (C) outputting a first message in which messages including the common word are aggregated.

On one side, it becomes easier to understand the purpose of multiple messages caused by the same event.

FIG. 1 is a diagram showing an example of a network configuration. FIG. 2 is a diagram showing a module configuration example of the monitoring device. FIG. 3A is a diagram showing an example of the first table. FIG. 3B is a diagram showing an example of the first table. FIG. 3C is a diagram showing an example of the first table. FIG. 3D is a diagram showing an example of the first table. FIG. 3E is a diagram showing an example of the first table. FIG. 4 is a diagram showing an example of a list. FIG. 5A is a diagram showing a module configuration example of the aggregation unit. FIG. 5B is a diagram showing a module configuration example of the aggregation unit. FIG. 6 is a diagram showing a main processing flow. FIG. 7 is a diagram showing an aggregation processing flow. FIG. 8 is a diagram showing a message classification processing flow. FIG. 9 is a diagram showing an example of a word table. FIG. 10 is a diagram showing a word extraction processing flow. FIG. 11 is a diagram showing an example of a summary table. FIG. 12 is a diagram showing an aggregation processing flow. FIG. 13 is a diagram showing an example of a multiple table. FIG. 14 is a diagram showing a multiple calculation processing flow. FIG. 15 is a diagram showing an example of a similarity table. FIG. 16 is a diagram showing a similarity calculation processing flow. FIG. 17 is a diagram showing an example of a classification table. FIG. 18 is a diagram showing an isomorphic group processing flow. FIG. 19 is a diagram showing an example of a class table. FIG. 20A is a diagram showing a candidate identification processing flow related to the same type group. FIG. 20B is a diagram showing a candidate identification processing flow related to the same type group. FIG. 21A is a diagram showing an example of an appearance rate table. FIG. 21B is a diagram showing an example of an appearance rate table. FIG. 22 is a diagram showing a variable discrimination processing flow. FIG. 23 is a diagram showing a record addition processing flow of the same type group. FIG. 24 is a diagram showing a common variable group processing flow. FIG. 25 is a diagram showing an example of a common word table. FIG. 26 is a diagram showing a common word identification processing flow. FIG. 27 is a diagram showing a group generation processing flow. FIG. 28A is a diagram showing an example of a primary group table. FIG. 28B is a diagram showing an example of a primary group table. FIG. 29 is a diagram showing an example of a secondary group table. FIG. 30 is a diagram showing a record addition processing flow of the common variable group. FIG. 31 is a functional block diagram of the computer.

FIG. 1 shows an example of a network configuration. In this example, the host 103, the DB (DataBase) server 105, and the DNS server 107 are connected to the network. The network is, for example, a LAN (Local Area Network). The host 103 may use the services of another host 103, the DB server 105, or the DNS server 107. The DB server 105 and the DNS server 107 are also a type of host device.

A monitoring device 101 is further connected to the network. The monitoring device 101 monitors the status of the host 103, the DB server 105, and the DNS server 107. That is, the host 103, the DB server 105, and the DNS server 107 correspond to the devices to be monitored. Specifically, when an event occurs in the device to be monitored, the device to be monitored sends an event notification including a message notifying the content of the event to the monitoring device 101. The monitoring device 101 displays the content of the received event notification on the display device. The administrator checks the contents of the event notification at any time to grasp the status of the monitored device.

FIG. 2 shows a module configuration example of the monitoring device 101. The monitoring device 101 includes a receiving unit 201, a filter 203, a rule storage unit 205, a first table storage unit 207, a first determination unit 209, a first addition unit 211, an aggregation unit 213, a second table storage unit 215, and a display processing unit. It has 217, a reference data storage unit 219, a reception unit 221 and a first extraction unit 223.

The receiving unit 201 receives the event notification. The filter 203 filters the received event notification. The rule storage unit 205 stores rules for filtering. The first table storage unit 207 stores the first table. The first table stores the contents related to the event notification that has passed the filter 203. The first table will be described later with reference to FIGS. 3A to 3E.

The first determination unit 209 determines whether or not the number of event notifications received within the unit period exceeds the threshold value. The first addition unit 211 adds the event notification received within the unit period to the second table. The aggregation unit 213 aggregates the event notifications received within the unit period. The second table storage unit 215 stores the second table. The second table has the same configuration as the first table. However, the second table may include records whose contents are aggregated event notifications.

The display processing unit 217 displays the list based on the second table. The reference data storage unit 219 stores the contents of the event notification to be aggregated. The reception unit 221 receives an inquiry instruction of the content of the event notification to be aggregated. When the inquiry instruction is received, the first extraction unit 223 extracts the event notification to be aggregated. The content of the event notification extracted by the first extraction unit 223 is displayed by the display processing unit 217. The display processing unit 217 is an example of an output unit. The form of output may be printing, transmission, writing to a storage medium, or the like.

The above-mentioned receiving unit 201, filter 203, first determination unit 209, first additional unit 211, aggregation unit 213, display processing unit 217, reception unit 221 and first extraction unit 223 are hardware resources (for example, FIG. 31). And a program that causes the processor to execute the processing described below.

The rule storage unit 205, the first table storage unit 207, the second table storage unit 215, and the reference data storage unit 219 described above are realized by using hardware resources (for example, FIG. 31).

3A to 3E show examples of the first table. The first table in this example has records corresponding to event notifications that have passed the filter 203. The record of the first table has a field for storing the event notification ID, a field for storing the reception date and time, a field for the host, and a field for storing the message.

The event notification ID identifies the event notification that has passed the filter 203. The reception date and time specifies the time when the event notification is received. The host field contains the name of the host that is the source of the event notification. The message represents the content of the event. The continuation of the first table shown in FIG. 3A is shown in FIG. 3B. The continuation of the first table shown in FIG. 3B is shown in FIG. 3C. The continuation of the first table shown in FIG. 3C is shown in FIG. 3D. The continuation of the first table shown in FIG. 3D is shown in FIG. 3E.

The first table shown in FIGS. 3A to 3E has a record relating to the event notification received in 3 seconds from 17:48:44 to 17:48:47 on October 13, 2015. .. Each record stores the contents related to the event notification in the order of reception.

The messages in the 18 records from event notification ID: 52132 to event notification ID: 52149 include the words "ORD05282" and "failure". All of these records relate to an event caused by a failure of the DB server 105 whose host name is "ORD05282". That is, the messages stored in these records are caused by the same event of failure of the DB server 105.

Further, the messages in the 16 records from the event notification ID: 52151 to the event notification ID: 52166 have common parts other than the variables corresponding to the host names such as "NT1CF100", "OMSKOBE", and "FABS5079". All of these records relate to events resulting from the failure of DNS server 107. That is, the messages stored in these records are due to the same event of a DNS server 107 failure.

The event notification ID: 52150 record relates to an event caused by a resource shortage of the host 103 itself having the host name "HOST_MVI". That is, the message stored in this record is due to a different event than the message stored in other records.

It takes time for the administrator to understand the relationship between many event notifications received within a short period of time and to consider what kind of event is expected. For example, if the contents of the records from the event notification ID: 52132 to the event notification ID: 52166 shown in FIGS. 3A to 3E are displayed all at once, the contents of the previously received event notification will flow out from the list. In addition, the message with event notification ID: 52150 is easily overlooked among the event notifications related to many similar messages.

FIG. 4 shows an example of a list displayed in the present embodiment. In the present embodiment, a group of event notifications related to messages having common parts other than variables, such as records from event notification ID: 52151 to event notification ID: 52166, is specified, and these messages are aggregated. The first row of the list shown in FIG. 4 shows the aggregated contents of the event notifications of this group. The event notification item "M1" identifies the group. The reception date and time indicates the date and time when the event notification of this group was first received. The number of hosts in the Hosts section is the net number of hosts that sent event notifications for this group. In the message item, the contents other than the variable and the code indicating the position of the variable are displayed. The message item also shows that there are 16 messages in this group.

Further, in the present embodiment, a group of event notifications related to a message including a common variable (in this example, "ORD05282") such as records from event notification ID: 52132 to event notification ID: 52149 is specified. And aggregate these messages. The third row of the list shown in FIG. 4 shows the aggregated contents of the event notifications of this group. The event notification item "W1" identifies the group. The reception date and time indicates the date and time when the event notification of this group was first received. The number of hosts in the Hosts section is the net number of hosts that sent event notifications for this group. The message item indicates that the messages in this group include "ORD05282" and "failure" and that there are 18 messages in this group.

The second line of the list shown in FIG. 4 shows the contents related to the event notification of ID: 52150 which does not belong to the above-mentioned two groups.

The fourth and subsequent lines show the contents based on the event notification received before the event notification shown in FIGS. 3A to 3E. This content will be omitted.

5A and 5B show a module configuration example of the aggregation unit 213. The aggregation unit 213 has a classification unit 501, a first group processing unit 503, a second group processing unit 505, and a second additional unit 507.

The classification unit 501 executes the message classification process. The message classification process will be described later with reference to FIG. The classification unit 501 includes a second extraction unit 511, an aggregation unit 513, a first calculation unit 515, a second calculation unit 517, and a clustering unit 519. The second extraction unit 511 executes the word extraction process. The word extraction process will be described later with reference to FIG. The aggregation unit 513 executes the aggregation process. The aggregation process will be described later with reference to FIG. The first calculation unit 515 executes the multiple calculation process. The multiple calculation process will be described later with reference to FIG. The second calculation unit 517 executes the similarity calculation process. The similarity calculation process will be described later with reference to FIG. The clustering unit 519 executes the clustering process.

The first group processing unit 503 executes the same type group processing. The isomorphic group processing will be described later with reference to FIG. The first group processing unit 503 has a first specific unit 521, a discrimination unit 523, and a third additional unit 525. The first specific unit 521 executes the candidate identification process related to the same type group. The candidate identification process for the same type group will be described later with reference to FIGS. 20A and 20B. The discrimination unit 523 executes the variable discrimination process. The variable discrimination process will be described later with reference to FIG. The third addition unit 525 executes the record addition process of the same type group. The record addition process of the same type group will be described later with reference to FIG.

The second group processing unit 505 executes common variable group processing. The common variable group processing will be described later with reference to FIG. 24. The second group processing unit 505 has a second specific unit 531 and a generation unit 533 and a fourth additional unit 535. The second specific unit 531 executes the common word identification process. The common word identification process will be described later with reference to FIG. The generation unit 533 executes the group generation process. The group generation process will be described later with reference to FIG. 27. The generation unit 533 has a second determination unit 537 and an integration unit 539. The second determination unit 537 determines whether or not to integrate a plurality of primary groups. The primary group will be described later. The integration unit 539 integrates a plurality of primary groups to generate a secondary group. The secondary group will be described later. The fourth addition unit 535 executes the record addition process of the common variable group. The record addition process of the common variable group will be described later with reference to FIG.

The second addition unit 507 adds event notifications that do not belong to the isomorphic group and the common variable group to the second table.

The classification unit 501, the first group processing unit 503, the second group processing unit 505, and the second additional unit 507 described above include hardware resources (for example, FIG. 31) and a program that causes the processor to execute the processing described below. Realized using. Similarly, the second extraction unit 511, the aggregation unit 513, the first calculation unit 515, the second calculation unit 517, the clustering unit 519, the first specific unit 521, the discrimination unit 523, the third additional unit 525, the second specific unit 531 and generation. The unit 533, the fourth additional unit 535, the second determination unit 537, and the integrated unit 539 are also realized by using hardware resources (for example, FIG. 31) and a program that causes the processor to execute the processing described below.

The explanation will move to FIG. 5B. The aggregation unit 213 further includes a word table storage unit 551, an aggregation table storage unit 553, a multiple table storage unit 555, a similarity table storage unit 557, a classification table storage unit 559, a class table storage unit 561, and an appearance rate table storage unit 563. , Has a common word table storage unit 565 and a group table storage unit 567.

The word table storage unit 551 stores the word table. The word table will be described later with reference to FIG. The aggregation table storage unit 553 stores the aggregation table. The summary table will be described later with reference to FIG. The multiple table storage unit 555 stores the multiple tables. The multiple tables will be described later with reference to FIG. The similarity table storage unit 557 stores the similarity table. The similarity table will be described later with reference to FIG. The classification table storage unit 559 stores the classification table. The classification table will be described later with reference to FIG.

The class table storage unit 561 stores the class table. The class table will be described later with reference to FIG. The appearance rate table storage unit 563 stores the appearance rate table. The appearance rate table will be described later with reference to FIGS. 21A and 21B. The common word table storage unit 565 stores the common word table. The common word table will be described later with reference to FIG. The group table storage unit 567 stores the primary group table and the secondary group table. The primary group table will be described later with reference to FIGS. 28A and 28B. The secondary group table will be described later with reference to FIG. 29.

The word table storage unit 551, the aggregation table storage unit 553, the multiple table storage unit 555, the similarity table storage unit 557, the classification table storage unit 559, the class table storage unit 561, the occurrence rate table storage unit 563, and the common word table. The storage unit 565 and the group table storage unit 567 are realized by using hardware resources (for example, FIG. 31).

FIG. 6 shows the main processing flow. The first determination unit 209 sequentially waits for the elapse of the unit period (S601). The length of the unit period is, for example, 3 seconds.

When the unit period elapses, the first determination unit 209 calculates the number of event notifications received within the unit period (S603). Then, the first determination unit 209 determines whether or not the number of event notifications received within the unit period exceeds the threshold value (S605). The threshold is, for example, the number of rows in the list.

When it is determined that the number of event notifications received within the unit period does not exceed the threshold value, the first addition unit 211 adds the event notifications received within the unit period to the second table (S607).

The display processing unit 217 displays the list based on the second table (S609). Specifically, the contents of the record of the latest reception date and time are displayed in the first line of the list. Further, the records are specified in the order of going back to the reception date and time, and the contents of the records are displayed one after another. The process ends when the last line is displayed. That is, the contents of the number of records corresponding to the number of rows in the list are displayed in the order of newest reception date and time. Then, the process returns to the process shown in S601, and the above-mentioned process is repeated.

On the other hand, when it is determined in S605 that the number of event notifications received within the unit period exceeds the threshold value, the aggregation unit 213 executes the aggregation process (S611). In the aggregation process, the aggregation unit 213 aggregates all or a part of the event notifications received within the unit period.

FIG. 7 shows an aggregation processing flow. The classification unit 501 executes the message classification process (S701). The classification unit 501 classifies the event notifications received within the unit period in the message classification process.

FIG. 8 shows a message classification processing flow. The second extraction unit 511 executes the word extraction process (S801). The second extraction unit 511 extracts the words included in each message in the word extraction process.

Before explaining the word extraction process, a word table for storing the extracted words will be described. FIG. 9 shows an example of a word table. The word table in this example has records corresponding to the words contained in the message. The record of the word table has a field in which the event notification ID is stored and a field in which the word is stored. The event notification ID identifies an event notification including a message in which the word appears.

FIG. 10 shows a word extraction processing flow. The second extraction unit 511 identifies one ID of the event notification received within the unit period waited in S601 of FIG. 6 (S1001). For example, the second extraction unit 511 specifies the ID of the event notification in the order of the reception time.

The second extraction unit 511 identifies the message included in the event notification (S1003). The second extraction unit 511 decomposes the specified message into words (S1005). Then, the second extraction unit 511 provides a new record in the word table for each decomposed word, and stores the event notification ID and the word in the record in association with each other (S1007).

The second extraction unit 511 determines whether or not there is an unspecified event notification ID (S1009). If it is determined that there is an unspecified event notification ID, the process returns to the process shown in S1001 and the above-mentioned process is repeated. On the other hand, if it is determined that there is no unspecified event notification ID, the word extraction process ends. When the word extraction process is completed, the process returns to the caller's message classification process.

Returning to the description of FIG. The aggregation unit 513 executes the aggregation process (S803). In the aggregation process, the aggregation unit 513 aggregates the number of words corresponding to the event notification ID and the number of appearances of each word.

Before explaining the aggregation process, the aggregation table used to aggregate the number of words corresponding to the event notification ID and the number of occurrences of each word will be described.

FIG. 11 shows an example of a summary table. The aggregation table in this example has a record corresponding to the event notification ID. The records in the summary table have fields corresponding to the words stored in the word table. In the field, a code indicating that the word is "included" or a code indicating that the word is "not included" is stored. The record in the summary table also has a field in which the number of words corresponding to the event notification ID is stored. The summary table also has a field in which the number of occurrences of each word is stored.

In the first record shown, the word "host", "ORD05282", "at", "disk", "output", "done", "parameter" and "C" are included in the event notification message identified by ID: 52132. It is included and indicates that the words "D" and "E" are not included. The first record shows that the event notification message identified by ID: 52132 contains 17 words.

Also, FIG. 11 shows that, for example, the word "host" is included in the six event notification messages.

FIG. 12 shows an aggregation processing flow. The totaling unit 513 specifies one ID of the event notification received within the unit period waited in S601 of FIG. 6 (S1201). For example, the aggregation unit 513 specifies the ID of the event notification according to the order of reception time.

The aggregation unit 513 stores a code to the effect that each word corresponding to the event notification ID in the word table is "included" in the field of the word in the record of the event notification ID in the aggregation table (S1203). In addition, the aggregation unit 513 stores a code indicating "not included" in the field of the word for which "included" is not set.

The aggregation unit 513 counts the fields in which the code to "include" is stored, and stores the number of the fields in the field of the number of words in the record of the event notification ID (S1205).

The aggregation unit 513 determines whether or not there is an unspecified event notification ID (S1207). If it is determined that there is an unspecified event notification ID, the process returns to the process shown in S1201 and the above-described process is repeated.

On the other hand, when it is determined that there is no unspecified event notification ID, the aggregation unit 513 counts the number of occurrences of each word and stores it in the field of the number of appearances corresponding to the word (S1209). The number of occurrences of a word is the number of fields in which a code indicating "contains" is stored for the word. When the aggregation process is completed, the process returns to the caller's message classification process.

Returning to the description of FIG. The first calculation unit 515 executes the multiple calculation process (S805). In the multiple calculation process, the first calculation unit 515 calculates the number of words included in the event notification message of the comparison source among the words included in the event notification message of the comparison destination. The number of such words is called multiple.

Before explaining the multiple calculation process, a multiple table that stores multiple multiple tables will be described. FIG. 13 shows an example of a multiple table. The multiple table in this example has a record corresponding to the event notification ID of the comparison source. The comparison source is each event notification received within the unit period waited in S601 of FIG. The record of the multiple table has a field (hereinafter, referred to as a multiple field) corresponding to each event notification ID of the comparison destination. The comparison destination is also each event notification received within the unit period waited in S601 of FIG. The above-mentioned multiple fields are stored in the multiple fields. The records in the summary table also have a field in which the number of words is stored. The number of words is the same as in the case of the aggregation table shown in FIG.

FIG. 13 shows, for example, that 16 words out of the 17 words included in the event notification message identified by ID: 52132 are included in the event notification message identified by ID: 52133. ..

Further, FIG. 13 shows that, for example, one word out of the 17 words included in the event notification message identified by ID: 52132 is included in the event notification message identified by ID: 62164. ing.

FIG. 14 shows a multiple calculation processing flow. The first calculation unit 515 specifies one event notification ID of the comparison source (S1401). For example, the first calculation unit 515 identifies one ID of the event notification received within the unit period waited in S601 of FIG. 6 in the order of the reception time.

The first calculation unit 515 specifies one event notification ID to be compared (S1403). For example, the first calculation unit 515 specifies one event notification ID received within the unit period waited in S601 of FIG. 6 in the order of reception time, excluding the event notification ID of the comparison source.

The first calculation unit 515 identifies one word included in the comparison source message based on the word table (S1405). The first calculation unit 515 determines whether or not the word is included in the comparison destination message based on the word table (S1407).

When it is determined that the word is included in the comparison destination message, the first calculation unit 515 sets 1 as the value of the multiple field of the comparison destination event notification ID in the record of the comparison source event notification ID. Add (S1409). The initial value in the multiple fields is 0. If it is determined that the word is not included in the comparison destination message, the first calculation unit 515 does not update the values of the multiple fields.

The first calculation unit 515 determines whether or not there is an unspecified word (S1411). If it is determined that there is an unspecified word, the process returns to the process shown in S1405 and the above-described process is repeated.

On the other hand, when it is determined that there is no unspecified word, the first calculation unit 515 determines whether or not there is an event notification ID of the comparison destination which is not specified (S1413). If it is determined that there is an event notification ID of the comparison destination that has not been specified, the process returns to the process shown in S1403, and the above-mentioned process is repeated.

On the other hand, when it is determined that there is no unspecified event notification ID of the comparison destination, the first calculation unit 515 compares the number of words in the field of the number of words in the record of the event notification ID of the comparison source based on the aggregation table. The number of words in the original event notification message is stored (S1415).

The first calculation unit 515 determines whether or not there is an event notification ID of the comparison source that has not been specified (S1417). If it is determined that there is an event notification ID of the comparison source that has not been specified, the process returns to the process shown in S1401 and the above-mentioned process is repeated.

On the other hand, if it is determined that there is no unspecified event notification ID of the comparison source, the multiple calculation process is completed. When the multiple calculation process is completed, the process returns to the caller's message classification process.

Returning to the description of FIG. The second calculation unit 517 executes the similarity calculation process (S807). The second calculation unit 517 calculates the similarity between the messages related to the two event notification IDs in the similarity calculation process. A large similarity value means that the two messages are similar. If the similarity value is small, it means that the two messages are not similar.

Before explaining the similarity calculation process, a similarity table for storing the similarity will be described. FIG. 15 shows an example of a similarity table. The similarity table in this example has a record corresponding to the event notification ID of the comparison source. The record of the similarity table has a field (hereinafter, referred to as a similarity field) corresponding to each event notification ID of the comparison destination. The above-mentioned similarity is stored in the field.

For example, the similarity between the event notification message identified by ID: 52132 and the event notification message identified by ID: 52133 is 0.94. The similarity between the event notification message identified by ID: 52132 and the event notification message identified by ID: 62164 is 0.06.

FIG. 16 shows a similarity calculation processing flow. The second calculation unit 517 identifies one set of event notification IDs received within the unit period waited in S601 of FIG. 6 (S1601).

The second calculation unit 517 calculates the degree of duplication with one event notification ID of the group as the comparison source and the other event notification ID of the group as the comparison destination (S1603). The multiplicity is determined by dividing the multiples specified by the comparison source and the comparison destination in the multiple table by the number of words specified by the comparison source.

The second calculation unit 517 further calculates the degree of duplication with the other event notification ID as the comparison source and the one event notification ID as the comparison destination (S1605).

Then, the second calculation unit 517 obtains the average of the calculated two multiplicities and stores it in the similarity field specified by the comparison source and the comparison destination (S1607). However, the multiplicity calculated in S1603 may be stored in the similarity field. Alternatively, the multiplicity calculated in S1605 may be stored in the similarity field.

The second calculation unit 517 determines whether or not there is a set of unspecified event notification IDs (S1609). When it is determined that there is a set of unspecified event notification IDs, the process returns to the process shown in S1601 and the above-described process is repeated. On the other hand, if it is determined that there is no unspecified event notification ID set, the similarity calculation process is completed. When the similarity calculation process is completed, the process returns to the caller's message classification process.

Returning to the description of FIG. The clustering unit 519 executes a clustering process (S809). The clustering unit 519 clusters event notifications based on the degree of similarity in the clustering process. The clustering process is a conventional technique. For example, the clustering unit 519 performs analysis by Ward's method. A class corresponds to a group of event notifications with similar messages.

FIG. 17 shows an example of a classification table that stores the results of the clustering process. The classification table in this example has a record corresponding to the event notification. The record of the classification table has a field in which the event notification ID is stored and a field in which the class ID is stored. The event notification ID identifies the classified event notification. The class ID identifies the class to which the event notification belongs, that is, the group.

FIG. 17 shows, for example, an event notification with ID: 52132, an event notification with ID: 52133, an event notification with ID: 52134, an event notification with ID: 52147, an event notification with ID: 52148, and an event notification with ID: 52149. It indicates that it belongs to the class identified by C01.

When the clustering process is completed, the message classification process is also completed and the process returns to the caller aggregation process.

Returning to the description of FIG. The first group processing unit 503 executes the same type group processing (S703). The first group processing unit 503 specifies a group of event notifications related to messages in which parts other than variables are common in the same type group processing. The group is called an isomorphic group.

FIG. 18 shows an isomorphic group processing flow. The first specific unit 521 executes the candidate identification process related to the same type group (S1801). The first identification unit 521 specifies a class corresponding to a candidate of the same type group in the candidate identification process relating to the same type group.

Before explaining the candidate identification process, the class table will be described. FIG. 19 shows an example of a class table. The class table in this example has records corresponding to the class. The records in the class table include a field that stores the class ID, a field that stores the number of event notifications, a field that stores multiple averages, a field that stores the average number of words, and words that do not overlap. It has a field for storing the number of, a field for storing the non-overlapping rate, and a field for candidates of the same type group.

The class ID identifies the class. The number of event notifications is the number of event notifications included in the class. The multiple average is the average of multiples in each set of event notifications belonging to the class. Multiples are identified based on a duplicate table. The average number of words is the average number of words in the event notification message belonging to the class. The number of non-overlapping words is the average number of words minus the average of multiple words. The non-duplicate rate is the number of non-overlapping words divided by the average number of words. In the field related to the candidate of the same type group, a code indicating that the class "corresponds" to the candidate of the same type group or a code indicating "not applicable" is stored. The method for determining whether or not the class is a candidate for the same type group will be described later.

The first record illustrated shows that the class with ID: C01 contains 6 event notifications, with a multiple average of 16 for these event notification pairs. Further, the first record shows that the average number of words in the message included in the event notification belonging to the class of ID: C01 is 17, and the non-duplicate words are regarded as one. In addition, the first record has a non-overlapping rate of 0.06 in the class with ID: C01, indicating that this class is a candidate for the isomorphic group.

FIG. 20A shows a candidate identification processing flow related to the same type group. The first specific unit 521 specifies one class ID (S2001). The first identification unit 521 identifies the event notification belonging to the class based on the classification table (S2003). The first specific unit 521 obtains the number of event notifications belonging to the class and stores it in the field of the number of event notifications of the record corresponding to the class (S2005).

The first specific unit 521 specifies the multiples related to the set based on the multiple table for each set of event notifications belonging to the class. The first specific unit 521 calculates the average of the specified multiples. Then, the first specific unit 521 stores the calculated average of the plurality of multiples in the record corresponding to the class (S2007).

The first specific unit 521 specifies the number of words in each event notification belonging to the class, and calculates the average of the specified number of words. The first specific unit 521 stores the average of the calculated number of words in the record corresponding to the class (S2009).

The first specific unit 521 subtracts the average of a plurality of multiple words from the average of the number of words to obtain the number of unique words. The first specific unit 521 stores the number of unique words in the record corresponding to the class (S2011).

The first specific unit 521 divides the number of non-overlapping words by the average number of words to obtain the non-overlapping rate. The first specific unit 521 stores the non-overlapping rate in the record corresponding to the class (S2013). The process of S2015 shown in FIG. 20B proceeds via the terminal A.

The first specific unit 521 determines whether or not the non-overlapping rate exceeds 0 and the non-overlapping rate is below the threshold value (for example, 0.2) (S2015). When the non-overlapping rate is 0, the variable is not included, so it is not considered to correspond to the isomorphic group in this example. If the non-overlapping rate exceeds the threshold, it is assumed that there are different words other than variables, so it does not correspond to the isomorphic group in this example.

When the non-duplicate rate exceeds 0 and the non-duplicate rate falls below the threshold value, the first specific unit 521 stores a code indicating "corresponding" in the candidate field of the same type group in the record corresponding to the class. (S2017).

On the other hand, when the non-overlapping rate is 0 or the non-overlapping rate is equal to or higher than the threshold value, the first specific unit 521 indicates that the field corresponding to the class corresponds to the candidate field of the same type group. Store the code (S2019).

The first specific unit 521 determines whether or not there is an unspecified class ID (S2021). When it is determined that there is an unspecified class ID, the process returns to the process shown in S2001 of FIG. 20A via the terminal B, and the above-described process is repeated. On the other hand, if it is determined that there is no unspecified class ID, the candidate identification process related to the same type group is completed. When the candidate identification processing related to the same type group is completed, the process returns to the same type group processing of the caller.

Returning to the description of FIG. The discrimination unit 523 executes the variable discrimination process (S1803). In the variable discrimination process, the discriminant unit 523 discriminates a word that is regarded as a variable among the words included in the message belonging to the class corresponding to the candidate of the same type group.

21A and 21B show an example of the appearance rate table. The appearance rate table is provided for each candidate of the same type group. The header of the occurrence rate table in this example has a field in which the ID of the class corresponding to the candidate of the same type group is stored. Further, the occurrence rate table in this example has a record corresponding to a word contained in a message of the class. The record of the occurrence rate table has a field for storing words, a field for storing the number of occurrence messages, a field for storing the occurrence rate, and a field for variables.

The word field stores the words contained in the message of the class. The number of appearing messages is the number of messages containing the word among the messages of the class. The appearance rate is a value obtained by dividing the number of appearance messages by the number of messages belonging to the class. In the field related to the variable, a code indicating that the word "corresponds" to the variable or a code indicating that the word "does not correspond" is stored.

FIG. 21A is an example of an appearance rate table for the class with ID: C01. The first record shows that the word "host" appears in six messages belonging to the class with ID: C01. In addition, the first record indicates that the word "host" appears in a message belonging to the class of C01 at a rate of 1.00, and this word does not correspond to a variable.

FIG. 21B is an example of an appearance rate table for the class with ID: C08. The last record shows that the word "GBSE5008" appears in one message belonging to the class ID: C08. In addition, the first record indicates that the word "GBSE5008" appears in a message belonging to the class of C08 at a rate of 0.06, and that this word corresponds to a variable.

FIG. 22 shows a variable discrimination processing flow. The determination unit 523 identifies one class ID corresponding to the candidate of the same type group based on the class table (S2201).

The determination unit 523 identifies one word included in any of the messages belonging to the class (S2203). The determination unit 523 counts the number of messages in which the word appears among the event notification messages belonging to the class based on the classification table and the word table. The determination unit 523 stores the number of the messages, that is, the number of occurrence messages, in the record of the word in the appearance rate table of the class (S2205).

The determination unit 523 divides the number of appearing messages by the number of messages belonging to the class to obtain the appearance rate. The determination unit 523 stores the occurrence rate in the record of the word in the appearance rate table of the class (S2207).

The determination unit 523 determines whether or not the appearance rate exceeds 0 and the appearance rate is below the threshold value (for example, 0.2) (S2209). In this example, the condition that the appearance rate exceeds 0 may be omitted. If the appearance rate exceeds the threshold value, it is expected that the word is not a variable such as the host name assumed in this example.

When it is determined that the appearance rate exceeds 0 and the appearance rate is lower than the threshold value, the determination unit 523 stores a code indicating "corresponding" in the field related to the variable in the record of the word (S2211).

On the other hand, when the appearance rate is 0 or the appearance rate is equal to or higher than the threshold value, the discrimination unit 523 stores a code indicating "not applicable" in the field related to the variable in the record of the word (S2213).

The determination unit 523 determines whether or not there is an unspecified word (S2215). When it is determined that there is an unspecified word, the process returns to the process shown in S2203, and the above-described process is repeated.

On the other hand, when it is determined that there is no unspecified word, the determining unit 523 determines whether or not there is an unspecified class ID (S2217). If it is determined that there is an unspecified class ID, the process returns to the process shown in S2201 and the above process is repeated.

On the other hand, if it is determined that there is no unspecified class ID, the variable determination process is terminated. When the variable discrimination process is completed, the process returns to the caller's isomorphic group process.

Returning to the description of FIG. The third addition unit 525 executes the record addition process of the same type group (S1805). The third addition unit 525 adds the aggregated records for the same type group to the second table in the record addition process of the same type group.

FIG. 23 shows a record addition processing flow of the same type group. The third additional unit 525 identifies one class including a variable among the classes that are candidates for the isomorphic group (S2301). That is, in the third additional unit 525, among the appearance rate tables for classes that are candidates for the same type group, a code indicating "corresponding" is set in any of the fields related to the variables included in the appearance rate table. To identify. The identified class corresponds to an isomorphic group.

The third additional unit 525 provides a new record in the second table (S2303). The third additional unit 525 assigns an ID that identifies the isomorphic group (S2305). The third addition unit 525 stores the assigned isomorphic group ID in the event notification field in the new record.

The third additional unit 525 specifies the first reception date / time among the reception date / time of the event notification belonging to the same type group (S2307). The third additional unit 525 stores the first reception date and time in the reception date and time field in the new record.

The third additional unit 525 obtains the net number of hosts that have transmitted event notifications belonging to the same type group (S2309). The third addendum 525 stores the net number of hosts in the host field in the new record.

The third additional unit 525 generates a common message including a word other than the variable and a code indicating the variable portion (S2311). For example, the third addition unit 525 replaces the word corresponding to the variable with the code indicating the variable part based on the message of any event notification belonging to the same type group. The code indicating the variable part is an example of an element indicating the position of the variable. Instead of the code indicating the variable part, the identifier of the figure or the mark indicating the variable part may be used. In this case, the display processing unit 217 replaces the identifier with an image of a figure or a mark and displays the identifier. The third addition unit 525 stores the generated common message in the message field in the new record.

The third additional unit 525 specifies the number of event notifications belonging to the same type group (S2313). The third additional unit 525 stores the specified number of event notifications in the message field in the new record.

The third additional unit 525 adds the content of the event notification belonging to the same type group to the reference data (S2315). At this time, the content of the event notification is associated with the same type group ID.

The third additional unit 525 determines whether or not there is an unspecified class (S2317). If it is determined that there is an unspecified class, the process returns to the process shown in S2301 and the above process is repeated.

On the other hand, if it is determined that there is no unspecified class, the record addition process of the same type group is completed. When the record addition processing of the same type group is completed, the process returns to the same type group processing of the caller.

Returning to the description of FIG. When the record addition processing of the same type group is completed, the same type group processing is completed. When the same type group processing is completed, the process returns to the caller's aggregation processing.

Returning to the description of FIG. The second group processing unit 505 executes common variable group processing (S705). The second group processing unit 505 specifies a group of event notifications related to a message including a common variable in the common variable group processing. The group is called a common variable group.

FIG. 24 shows a common variable group processing flow. The second specific unit 531 executes the common word identification process (S2401). The second identification unit 531 identifies a common word that appears in any event notification message belonging to the class in a predetermined number or more of the classes in the common word identification process. The word is called a common word.

Before explaining the common word identification process, the common word table used for specifying the common word will be described. FIG. 25 shows an example of a common word table. The common word table in this example has records corresponding to the words contained in the word table. The record of the common word table has a field for storing words, a field for storing the number of occurrence classes, and a field for common words.

The word field stores the words contained in the word table. The number of occurrence classes is the net number of classes to which the message containing the word belongs. In the common word field, a code indicating that the word "corresponds" to the common word or a code indicating that the word does not correspond is stored.

The first record shown shows that the word "host" appears in an event notification message belonging to one class and does not correspond to a common word. The second record shown shows that the word "ORD05282" appears in an event notification message belonging to six classes and corresponds to a common word. In the fourth record shown, the word "failure" also appears in the event notification message belonging to the six classes, indicating that it corresponds to a common word.

FIG. 26 shows a common word identification processing flow. The second specifying unit 531 identifies one word included in the word table (S2601). The second specific unit 531 provides a new record in the common word table and stores the word in the record.

The second specific unit 531 specifies one class ID (S2603). The second specific unit 531 determines whether or not the word is included in any event notification message belonging to the class based on the word table and the classification table (S2605). When it is determined that the word is included in the message of any event notification belonging to the class, the second specific unit 531 adds 1 to the value of the number of occurrence classes in the record (S2607). The initial value of the number of appearance classes is 0. If it is determined that the word is not included in any of the messages belonging to the class, the second specific unit 531 does not update the number of occurrence classes in the record.

The second specific unit 531 determines whether or not there is an unspecified class ID (S2609). If it is determined that there is an unspecified class ID, the process returns to the process shown in S2603 and the above-described process is repeated.

On the other hand, when it is determined that there is no unspecified class ID, the second specific unit 531 determines whether or not the number of appearing classes exceeds the threshold value (for example, 4) (S2611). When it is determined that the number of occurrence classes exceeds the threshold value, the second specific unit 531 stores a code indicating "corresponding" in the field relating to the common word in the record of the word (S2613). On the other hand, when it is determined that the number of occurrence classes is equal to or less than the threshold value, the second specific unit 531 stores a code indicating "not applicable" in the field relating to the common word in the record of the word (S2615).

The second specific unit 531 determines whether or not there is an unprocessed word (S2617). When it is determined that there is an unprocessed word, the process returns to the process shown in S2601 and the above-described process is repeated. On the other hand, when it is determined that there is no unprocessed word, the common word identification process is terminated. When the common word identification process is completed, the process returns to the common variable group process of the caller.

Returning to the description of FIG. 24. The generation unit 533 executes the group generation process (S2403). The generation unit 533 generates a common variable group based on a common word in the group generation process. Specifically, either one or both of the primary group and the secondary group are generated. That is, either or both of the primary group and the secondary group generated in the group generation process correspond to the common variable group.

In the present embodiment, the common words may include words corresponding to the common variables and words not corresponding to the common variables. In the above example, the common word "ORD05282" corresponds to a common variable. On the other hand, the common word "failure" does not correspond to a common variable.

FIG. 27 shows a group generation processing flow. The generation unit 533 generates a primary group for each common word (S2701). Specifically, a primary group table is provided.

28A and 28B show an example of a primary group table. The header of the primary group table in this example has a field in which the common variable group ID is stored and a field in which the common word is stored. The common variable group ID identifies the common variable group. However, the common variable group ID is not yet set when the primary group table is generated. Further, the primary group table in this example has a record in which the event notification ID is stored. The event notification ID identifies an event notification related to a message including the common word.

The example of the primary group table shown in FIG. 28A shows that the message identified by the 18 event notification IDs shown includes the common word "ORD05282". The example of the primary group table shown in FIG. 28B shows that the message identified by the 18 event notification IDs shown includes the common word "failure". In this example, the event notification ID in the primary group table shown in FIG. 28A and the event notification ID in the primary group table shown in FIG. 28B match.

Returning to the description of FIG. 27. The second determination unit 537 identifies the combination of the primary groups (S2703). The second determination unit 537 specifies, for example, combinations in descending order of the number of primary groups serving as combination elements.

The second determination unit 537 determines whether or not the event notification IDs in each primary group related to the combination are duplicated (S2705). In this example, the second determination unit 537 determines whether or not all the event notification IDs in each primary group match. The second determination unit 537 may determine whether or not a part of the event notification IDs in each primary group match. Specifically, the second determination unit 537 may determine whether or not a predetermined number or more of event notification IDs match. Alternatively, the second determination unit 537 may determine whether or not the event notification IDs of a predetermined ratio or more match.

When it is determined that the event notification IDs in each primary group are duplicated, the integration unit 539 integrates each primary group related to the combination to generate a secondary group (S2707). Specifically, the integration unit 539 creates a secondary group table and deletes each original primary group table. If it is determined that the event notification IDs in each primary group do not overlap, the process proceeds to S2709 as it is.

FIG. 29 shows an example of a secondary group table. The header of the secondary group table in this example has a field in which the common variable group ID is stored and a plurality of fields in which the common word is stored. A common word is a common word contained in an event notification message belonging to a secondary group. In the record in the secondary group table, the event notification ID related to the message including a plurality of common words stored in the header is stored. That is, the integration unit 539 sets the event notification ID common to each of the original primary group tables in the secondary group table.

Returning to the description of FIG. 27. The second determination unit 537 determines whether or not there is an unprocessed combination (S2709). When it is determined that there is an unprocessed combination, the process returns to the process shown in S2703, and the above-mentioned process is repeated.

On the other hand, when it is determined that there is no unprocessed combination, the generation unit 533 assigns the common variable group ID to the remaining primary group, that is, the primary group that has not been integrated (S2711). Then, the common variable group ID is stored in the header of the primary group table. When the group generation process is completed, the process returns to the common variable group process of the caller.

Returning to the description of FIG. 24. The fourth addition unit 535 executes the record addition process of the common variable group (S2405). The fourth addition unit 535 adds the aggregated records for the common variable group to the second table in the record addition process of the common variable group.

FIG. 30 shows a record addition processing flow of the common variable group. The fourth additional unit 535 identifies one generated common variable group (S3001).

The fourth additional unit 535 provides a new record in the second table (S3003). The fourth additional unit 535 stores the common variable group ID in the event notification field in the new record (S3005).

The fourth additional unit 535 specifies the first reception date / time among the reception date / time of the event notification belonging to the common variable group (S3007). The fourth addition unit 535 stores the first reception date and time in the reception date and time field in the new record.

The fourth additional unit 535 obtains the net number of hosts that have transmitted event notifications belonging to the common variable group (S3009). The fourth addition unit 535 stores the net number of hosts in the host field in the new record.

The fourth addition unit 535 stores the common word in the common variable group in the message field in the new record (S3011).

The fourth additional unit 535 specifies the number of event notifications belonging to the common variable group (S3013). The fourth addition unit 535 stores the specified number of event notifications in the message field in the new record.

The fourth additional unit 535 adds the content of the event notification belonging to the common variable group to the reference data (S3015). At this time, the content of the event notification is associated with the common variable group ID.

The fourth additional unit 535 determines whether or not there is an unspecified class (S3017). If it is determined that there is an unspecified class, the process returns to the process shown in S3001 and the above process is repeated.

On the other hand, if it is determined that there is no unspecified class, the record addition process of the common variable group is completed. When the record addition processing of the common variable group is completed, the process returns to the common variable group processing of the caller.

Returning to the description of FIG. 24. When the common variable group processing is completed, the process returns to the caller's aggregation processing.

Returning to the description of FIG. The second addition unit 507 extracts the records of the event notifications that do not belong to the same type group and the common variable group from the records (first table) corresponding to the event notifications received within the unit period waited in S601 of FIG. The extracted record is added to the second table (S707). When the aggregation process is completed, the caller returns to the main process.

Returning to the description of FIG. The display processing unit 217 displays the list (S613). As described above, the display processing unit 217 displays the contents of the records in the second table in the order of newest reception date and time. In this example, as shown in FIG. 4, the line related to the common variable group with ID: M1 is displayed first. Second, the line related to the event notification of ID: 52150 that does not belong to the common variable group and the isomorphic group is displayed. Third, the line related to the isomorphic group with ID: W1 is displayed. From the fourth onward, the contents based on the event notification acquired in the previous unit period are displayed. Then, when the display of the list is finished, the process returns to the process shown in S601 and the above-described process is repeated.

According to the present embodiment, since the messages of the common variable group are aggregated, it becomes easy to grasp the purpose of a plurality of messages caused by the same event. For example, messages containing the identifier of the device that caused the failure can be aggregated and a single message can indicate the device that caused the failure.

In addition, since a plurality of common words included in the same message are displayed together as an aggregated content, it becomes easier to more specifically understand the purpose of the plurality of messages caused by the same event. For example, in addition to the information for identifying the cause device, the state of the device can also be grasped.

In addition, since the messages of the same type group are aggregated, it becomes easy to catch the same event that has occurred multiple times.

In addition, since messages that do not belong to either the common variable group or the isomorphic group are displayed, it is possible to prevent overlooking messages other than the aggregation target.

Although one embodiment of the present invention has been described above, the present invention is not limited thereto. For example, the functional block configuration described above may not match the program module configuration.

Further, the configuration of each storage area described above is an example, and does not have to be the configuration as described above. Further, also in the processing flow, if the processing result does not change, the order of the processing may be changed or a plurality of processing may be executed in parallel.

The monitoring device 101 described above is a computer device, and as shown in FIG. 31, a memory 2501, a CPU (Central Processing Unit) 2503, a hard disk drive (HDD: Hard Disk Drive) 2505, and a display device 2509. The display control unit 2507, the drive device 2513 for the removable disk 2511, the input device 2515, and the communication control unit 2517 for connecting to the network are connected by a bus 2519. The operating system (OS: Operating System) and the application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. The CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 according to the processing contents of the application program to perform a predetermined operation. Further, although the data in the process of processing is mainly stored in the memory 2501, it may be stored in the HDD 2505. In the embodiment of the present invention, the application program for performing the above-described processing is stored and distributed on the computer-readable removable disk 2511 and installed from the drive device 2513 to the HDD 2505. It may be installed on the HDD 2505 via a network such as the Internet and a communication control unit 2517. Such a computer device realizes various functions as described above by organically collaborating with the hardware such as the CPU 2503 and the memory 2501 described above and the program such as the OS and the application program. ..

The embodiments of the present invention described above can be summarized as follows.

In the message output method according to the present embodiment, (A) a plurality of messages identified by each identifier are classified into a plurality of classes which are a set of messages based on the similarity between the messages, and (B) a plurality of messages. Among the words included in, a common word in which the number of classes in which the word appears is larger than the standard is specified, and (C) a process of outputting a first message in which messages including the common word are aggregated is included.

In this way, it becomes easy to understand the purpose of a plurality of messages caused by the same event. For example, a message containing the identifier of the device that caused the failure can be aggregated, and the device that caused the failure can be notified by a single message.

Further, regarding the combination of common words, it is determined whether or not the above identifiers of the messages including each common word are duplicated, and when the above identifiers are duplicated, the first message related to each common word is grouped in the same group. You may.

In this way, it becomes easier to more specifically grasp the purpose of a plurality of messages caused by the same event. For example, in addition to the information about the cause device, the phenomenon in the device can also be grasped.

Furthermore, among a plurality of classes, a candidate class in which the ratio of non-overlapping words among messages belonging to the same class is smaller than the standard is specified, and among a plurality of words included in the message belonging to the candidate class, a message unit belonging to the candidate class A word whose appearance rate of is smaller than the standard may be determined as a variable. Further, when a variable is determined for the candidate class, a word other than the variable included in the message belonging to the candidate class and an element indicating the position of the variable are output as the second message in which the messages belonging to the candidate class are aggregated. You may do so.

In this way, for example, it becomes easy to catch a plurality of similar events that have occurred.

Further, among a plurality of messages, a message that does not correspond to the aggregation target by the first message and the aggregation target by the second message may be output.

In this way, it is possible to prevent overlooking messages other than those to be aggregated.

A program for causing a computer to perform the processing by the above method can be created, and the program can be a computer-readable storage medium such as a flexible disk, a CD-ROM, a magneto-optical disk, a semiconductor memory, or a hard disk. It may be stored in a storage device. The intermediate processing result is generally temporarily stored in a storage device such as a main memory.

The following additional notes will be further disclosed with respect to the embodiments including the above embodiments.

(Appendix 1)
Multiple messages, each identified by an identifier, are classified into multiple classes, which are a collection of messages, based on the similarity between the messages.
Among the words included in the plurality of messages, the common word in which the number of classes in which the word appears is larger than the standard is identified.
A message output program that causes a computer to execute a process of outputting a first message in which messages including the common words are aggregated.

(Appendix 2)
In addition
For the combination of the common words, it is determined whether or not the identifier of the message including each common word is duplicated.
The message output program according to Appendix 1, which includes a process of grouping the first messages related to the common words into the same group when the identifiers are duplicated.

(Appendix 3)
In addition
Among the plurality of classes, a candidate class in which the ratio of unique words among messages belonging to the same class is smaller than the standard is specified.
Of the plurality of words included in the message belonging to the candidate class, the word whose appearance rate of the message unit belonging to the candidate class is smaller than the standard is determined to be a variable.
When the variable is determined for the candidate class, words other than the variable and the position of the variable included in the message belonging to the candidate class are set as the second message in which the messages belonging to the candidate class are aggregated. The message output program according to Appendix 1 or 2, which includes a process of outputting the indicated element.

(Appendix 4)
In addition
The message output program according to Appendix 3, which includes a process of outputting a message that does not correspond to the aggregation target by the first message and the aggregation target by the second message among the plurality of messages.

(Appendix 5)
Multiple messages, each identified by an identifier, are classified into multiple classes, which are a collection of messages, based on the similarity between the messages.
Among the words included in the plurality of messages, the common word in which the number of classes in which the word appears is larger than the standard is identified.
A message output method executed by a computer, which includes a process of outputting a first message in which messages including the common word are aggregated.

(Appendix 6)
A classification unit that classifies a plurality of messages identified by each identifier into a plurality of classes that are a set of messages based on the similarity between the messages.
Among the words included in the plurality of messages, a specific part that identifies a common word in which the number of classes in which the word appears is larger than the standard, and
A message output device including an output unit that outputs a first message in which messages including the common word are aggregated.

101 Monitoring equipment 103 Host 105 DB server 107 DNS server 201 Reception unit 203 Filter 205 Rule storage unit 207 1st table storage unit 209 1st judgment unit 211 1st additional unit 213 Aggregation unit 215 2nd table storage unit 217 Display processing unit 219 Reference data storage unit 221 Reception unit 223 1st extraction unit 501 Classification unit 503 1st group processing unit 505 2nd group processing unit 507 2nd additional unit 511 2nd extraction unit 513 Aggregation unit 515 1st calculation unit 517 2nd calculation unit 519 Clustering part 521 1st specific part 523 Discrimination part 525 3rd additional part 531 2nd specific part 533 Generation part 535 4th additional part 537 2nd judgment part 539 Integration part 551 Word table storage part 553 Aggregation table storage part 555 Multiple Table storage 557 Similarity table storage 559 Classification table storage 561 Class table storage 563 Occurrence rate table storage 565 Common word table storage 567 Group table storage

Claims (6)

Multiple messages, each identified by an identifier, are classified into multiple classes, which are a collection of messages, based on the similarity between the messages.
Among the words included in the plurality of messages, the common word in which the number of classes in which the word appears is larger than the standard is identified.
A message output program that causes a computer to execute a process of outputting a first message in which messages including the common words are aggregated. In addition
For the combination of the common words, it is determined whether or not the identifier of the message including each common word is duplicated.
The message output program according to claim 1, further comprising a process of grouping the first messages related to the common words into the same group when the identifiers are duplicated. In addition
Among the plurality of classes, a candidate class in which the ratio of unique words among messages belonging to the same class is smaller than the standard is specified.
Of the plurality of words included in the message belonging to the candidate class, the word whose appearance rate of the message unit belonging to the candidate class is smaller than the standard is determined to be a variable.
When the variable is determined for the candidate class, words other than the variable and the position of the variable included in the message belonging to the candidate class are set as the second message in which the messages belonging to the candidate class are aggregated. The message output program according to claim 1 or 2, which includes a process of outputting the indicated element. In addition
The message output program according to claim 3, further comprising a process of outputting a message that does not correspond to the aggregation target by the first message and the aggregation target by the second message among the plurality of messages. Multiple messages, each identified by an identifier, are classified into multiple classes, which are a collection of messages, based on the similarity between the messages.
Among the words included in the plurality of messages, the common word in which the number of classes in which the word appears is larger than the standard is identified.
A message output method executed by a computer, which includes a process of outputting a first message in which messages including the common word are aggregated. A classification unit that classifies a plurality of messages identified by each identifier into a plurality of classes that are a set of messages based on the similarity between the messages.
Among the words included in the plurality of messages, a specific part that identifies a common word in which the number of classes in which the word appears is larger than the standard, and
A message output device including an output unit that outputs a first message in which messages including the common word are aggregated.

Images