JP7424052B2 - Control program, control method and control device - Google Patents

Description

The present invention relates to a control program, a control method, and a control device.

Collecting logs is an important measure from the viewpoint of information security, and the number of users collecting logs is increasing. For example, a user can improve the soundness of the processing content of a business computer by using a monitoring computer to collect and analyze logs output by the business computer. Since logs are often output in large quantities from multiple business computers, improving the efficiency of log collection has become one of the important issues in recent years.

Log collection can be performed in real time, but this increases the processing load on both the collecting side (monitoring computer) and the collecting side (business computer), and also causes processing delays. Therefore, methods have been proposed to collect logs periodically at fixed intervals (collection interval), and methods to collect logs outside business hours (for example, at night) using a scheduler. These methods are often used.

Japanese Patent Application Publication No. 2005-157933

A business computer sequentially stores output logs in multiple files (log files), and if logs are already stored in all files, the log stored in the oldest file is deleted and the log file becomes empty. The new log may be stored in the file that was previously saved. In such a case, if the logs stored in the old files are deleted before being collected by the monitoring computer, the collected logs will be missing.

On the other hand, with the method of collecting logs at regular intervals or the method of collecting logs outside of business hours as described above, if a business computer suddenly outputs more logs than the user expected, the logs are There is a risk that defects may occur.

According to one aspect, an object is to control the timing at which logs are collected without loss.

In one aspect, when the computer acquires a plurality of pieces of operating state information indicating the operating state of the information processing apparatus that outputs logs to the log storage part at any time according to the processing of the information processing apparatus, the information processing apparatus stores the logs in the storage part. Further, the correlation between the plurality of pieces of acquired operating state information and the output speed indicating the amount of data of the log output by the information processing device per unit time, and the free capacity of the log storage unit to store the log. A process is executed to control the timing of collecting the log from the log storage unit based on a certain storage capacity.

According to one aspect, the timing at which logs are collected without loss can be controlled.

FIG. 1 shows an example of collecting logs. FIG. 2 shows an example of a log stored in the log storage unit 15. FIG. 3 shows a functional block diagram of the control device 1. As shown in FIG. FIG. 4A shows a functional block diagram of the log collection unit 11. FIG. 4B shows a functional block diagram of the output amount collection unit 12. FIG. 5 shows an example of a flowchart of the control device 1. FIG. 6A shows an example of the process in step S1. FIG. 6B shows an example of the process in step S21. FIG. 7 shows specific examples of log types. FIG. 8 shows another example of collecting logs. FIG. 9 shows a functional block diagram of the control device 5. As shown in FIG. FIG. 10A shows a functional block diagram of the performance information collection unit 53. FIG. 10B shows a functional block diagram of the performance information analysis unit 54. FIG. 11A shows another example of the process of step S1. FIG. 11B shows an example of the process in step S41. FIG. 11C shows an example of the process in step S42. FIG. 12A shows an example of the related table 7. FIG. 12B shows an example of the related table 7. FIG. 12C shows an example of the association table 7. FIG. 12D shows an example of the related table 7. FIG. 13 shows an example of the related table 8. FIG. 14 shows an example of a hardware configuration according to the first embodiment and the second embodiment.

Embodiments of the present invention will be described with reference to the drawings. Note that the embodiment described in the specification is one mode of realizing the invention, and the contents, execution order, etc. of each process in the embodiment can be changed as appropriate within the scope of realizing the invention.

[Example 1]
First, a specific example of the problem to be solved in Example 1 will be explained.

An information processing device such as a computer outputs machine data (log) at any time in accordance with the processing of the information processing device. Users of information processing devices may collect and analyze logs in order to prevent cyber attacks and unauthorized use of business system servers, networks, storage, etc. Here, the business system is, for example, a system that executes business processes such as document management and customer management. By analyzing logs, users can monitor whether the business system is operating normally. There are also operation management systems that manage the operation of business systems by collecting and analyzing logs. The operation management system collects logs by monitoring access to the logs in real time in order to safely manage business systems. The operation management system also checks for falsification of logs to improve the soundness of the contents. However, if the operation management system constantly collects logs from the business system (in real time), it may affect the processing capacity (resources) of the business system, causing delays in the operation of each application executed by the business system. There is. Furthermore, when collecting logs, additional data called a header is added to the data including the logs. Therefore, if you try to collect logs frequently, the amount of extra data will increase. In other words, when ultimately trying to collect the same amount of logs, the processing load on the business system increases if a small amount of logs are collected more frequently than if the logs are collected all at once. To solve this problem, for example, there is a method in which the operation management system collects logs at regular intervals rather than in real time.

For example, a business system stores logs in a certain number of log files in chronological order, and when logs are stored in all log files and a new log is output, the oldest log is overwritten (deleted). )do. Here, the log file is a data file in which the output log is divided and stored into parts of a certain size. Further, the cycle from when the oldest log is stored in a log file until it is overwritten by the latest log is sometimes called rotation. If the business system stores logs in a fixed number of files, the operation management system collects the logs at intervals shorter than the rotation cycle so that the oldest logs are collected before they are overwritten by the latest logs. It becomes possible to do so. However, if a business system suddenly outputs a large number of logs, the log output speed increases, and uncollected logs may be overwritten before the logs are collected, resulting in missing logs. . Note that the output speed is, for example, the speed at which the business system outputs logs per unit time.

In addition, since the rotation time interval changes according to changes in the log output speed, it is difficult for the operation management system to appropriately set the log collection interval at regular intervals to avoid losing logs output by the business system. difficult. Furthermore, if the program that outputs logs and the program that collects logs are different, it is difficult for the program that collects logs to know what kind of processing is being executed by the program that outputs logs. Furthermore, the program that collects logs cannot predict what types of logs will be output in large numbers, depending on the processing that is being executed by the program that outputs logs. For example, in the first embodiment, a program that outputs logs runs on a business system, and a program that collects logs runs on an operations management system. Therefore, the program that collects logs and the program that outputs logs are different, and the operation management system may not be able to determine the amount of data that the business system outputs as logs.

FIG. 1 shows an example of collecting logs. The control device 1 includes a log collection section 11 , an output amount collection section 12 , and a storage section 13 . Furthermore, the control device 1 collects logs from the monitored server 14 . The control device 1 is, for example, a server of an operation management system. The monitored server 14 includes a log storage section 15 . The monitored server 14 is, for example, a server for a business system.

The log collection unit 11 repeatedly collects logs or log files from the log storage unit 15 at a timing based on a collection interval, which will be described later, for example. Further, when collecting logs from the log storage unit 15, the log collection unit 11 may collect all logs stored in the log storage unit 15. Further, the log collection unit 11 may collect only log differences from the log storage unit 15. In other words, the log collection unit 11 may collect only the logs that are not collected by the control device 1 from the log storage unit 15.

The output amount collection unit 12 collects, for example, information including the output amount (size information) of the log or log file stored in the log storage unit 15 from the log storage unit 15. Here, the output amount is information indicating the capacity of the log file, and is, for example, the amount of log data expressed in bytes.

The storage unit 13 stores, for example, logs collected by the log collection unit 11 from the log storage unit 15. Further, the storage unit 13 stores, for example, the output amount collected by the output amount collection unit 12 from the log storage unit 15. Further, the storage unit 13 stores, for example, information on the timing at which the log collection unit 11 collects logs from the log storage unit 15.

The monitored server 14 is an information processing device whose logs are collected (monitored) by the control device 1 . The monitored server 14 is, for example, a business system, computer, server, information system, or the like. Further, the monitored server 14 outputs a type of log depending on the content of the process executed by the monitored server 14, for example. Here, specific examples of log types will be explained with reference to FIG. 7, which will be described later.

The log storage unit 15 stores logs output from the monitored server 14 in accordance with processes executed by the monitored server 14. Further, the log storage unit 15 stores the log in a file format as a log file 2 shown in FIG. 2, which will be described later.

FIG. 2 shows an example of a log stored in the log storage unit 15. The log file 21 indicates a log file that has been deleted because a new log has been output and that the control device 1 can no longer collect. The log files 22 to 26 are log files 2 stored in the log storage unit 15 shown in FIG. 1, and are log files 2 that can be collected by the control device 1. The log is divided into a plurality of files and stored, such as log files 22 to 26, for example. In FIG. 2, as an example, it is assumed that "rotation is performed in 5 files" and "files are switched when the size of one file reaches 100 Mega Byte (MB)". That is, as an example, assume that there are five log files, and the storage limit for each log file is 100 MB. Note that the number of log files and the storage limit of log files are information corresponding to "log characteristics" described later. First, it is assumed that the capacity of logs stored in all files (log files 21 to 25) is 0 MB. Next, assume that logs are output and stored in order from log file 21 to log file 25. After that, consider a case where logs of 100 MB each are stored in all log files 21 to 25. At this time, if more logs are output, the monitored server 14 shown in FIG. 1 deletes the logs stored in the log file 21, which is the oldest log file 2. Thereafter, the newly output log starts to be stored in the log file 21 (log file 26), which has become 0 MB due to the log being deleted. If 100 MB of logs are stored in the log file 26, the next log stored in the log file 22 will be deleted. For example, when the log file 2 is deleted (switched) in this way, the measured output speed for the logs stored in the log file 2 will no longer be accurate. Note that, for the sake of simplicity, a case has been described in which each log file 2 stores an upper limit of 100 MB, but in reality, it is not always the case that exactly up to the upper limit capacity, such as 99 MB, is stored.

According to the example explained using FIG. 2, if the control device 1 collects logs before the total amount of uncollected logs exceeds 500 MB, no logs will be lost; If the size exceeds 500MB, the deleted logs will be lost. For example, if logs are output at a constant rate of 1 MB/min, the rotation interval is approximately 500 minutes (approximately 8.33 hours), so the control device 1 sets the log collection interval to 8 hours. By doing so, it is expected that all logs will be collected without being lost. Note that the rotation interval is the interval until the oldest log file 2 in which logs are stored is deleted after the latest log is output. However, in reality, the speed at which logs are stored in the log file 2 is rarely constant, and the amount of log output also changes depending on the operating status of the system and server. For example, if you set logs to be collected at extremely short intervals that are sufficient to collect logs without missing them, you can expect to collect all logs, but in this case, there is no way to collect logs in real time. Similarly, the resources of the monitored server 14 shown in FIG. 1 will be affected. Therefore, when the control device 1 collects logs at regular intervals, the interval at which the log file 2 is rotated is not constant depending on the output amount of logs, so it is difficult for the control device 1 to set a collection interval at which logs are not lost.

[Functional block]
FIG. 3 shows a functional block diagram of the control device 1. As shown in FIG. Note that the control device 1 is, for example, an information processing device such as a server, a computer, or a personal computer (PC). Further, the control device 1 includes, for example, a collection section 31, a storage section 32, an acquisition section 33, a calculation section 34, and a setting section 35. Further, each processing unit may be realized by the same hardware, or may operate in a distributed manner on a plurality of pieces of hardware.

The collection unit 31 collects logs and output amounts from external devices, and outputs the collected information to the storage unit. The collection unit 31 collects log files 2 from the log storage unit 15 shown in FIG. 1, for example. Further, the collection unit 31 collects, for example, from the log storage unit 15 shown in FIG. 1, information indicating the output amount of logs that are not collected by the log collection unit 11 shown in FIG. The external device is, for example, an information processing device such as a server, computer, or PC, and is, for example, the monitored server 14 shown in FIG. Further, the collection unit 31 collects the log files 2 based on the collection interval and collection time set by the setting unit 35. Note that the collection interval is a time interval at which the control device 1 collects logs from an external device. Moreover, the collection time is the time or time at which the control device 1 collects logs from an external device. Also, the collection time may simply be referred to as timing.

The storage unit 32 stores various information. The various types of information include, for example, information regarding logs, collection intervals, collection times, and the like. Furthermore, the storage unit 32 is, for example, a storage medium such as a Hard Disk Drive (HDD) or a Solid State Drive (SSD) as hardware. Further, the storage unit 32 stores information such as the log file 2 and output amount received from the collection unit 31, for example. Furthermore, the storage unit 32 outputs various types of stored information to the acquisition unit 33.

The acquisition unit 33 acquires various types of information stored in the storage unit 32 and outputs the acquired various types of information to the collection unit 31 , the calculation unit 34 , and the setting unit 35 . Further, the acquisition unit 33 acquires or outputs various types of information via a wired circuit or a wireless circuit. The various types of information include, for example, logs, log files, number of files, size, criteria for switching files, output speed, and the like. Further, the acquisition unit 33 always acquires the current time (current time). Note that the acquisition unit 33 may acquire time information from a device different from the control device 1, or may be configured to collect time information measured by the control device 1 using a measurement unit (not shown). .

The calculation unit 34 receives information on the log file 2 from the acquisition unit 33. The calculation unit 34 specifies, based on the log file 2 received from the acquisition unit 33, the number of files that the log file 2 rotates, the capacity (size) that can be stored per file, and the criteria for switching files. do. The number of files is, for example, "5 files" in FIG. 2 as an example. Further, the size is, for example, "100 MB" using FIG. 2 as an example. The calculation unit 34 calculates the output speed, which is the amount of data output as a log per unit time, the rotation interval, and the time at which the oldest log file 2 is deleted from among the log files 2 that have not been collected. Further, the calculation unit 34 outputs the calculated rotation interval and the time at which the oldest log file 2 is deleted to the setting unit 35. Note that the rotation interval is, for example, "8.33 hours" using FIG. 2 as an example. Furthermore, the criteria for switching files include, for example, "switching based on date" and "switching based on file size." In addition, in FIG. 2, the case where the criterion for switching files is "switching based on file size" has been explained. Here, when the criteria for switching files is "switching by date", it means that the log file 2 shown in FIG. 2 is switching by date. For example, the log file 21 shown in FIG. 2 is "December 10th". In this case, for example, a log output by the monitored server 14 shown in FIG. 1 on "December 10" is stored in the log file 21 shown in FIG. 2. In other words, if the criteria for switching files is "switching by date", the user can collect all logs without loss by collecting logs at a fixed collection interval (every fixed number of days) depending on the number of files. can. The calculation unit 34 calculates the output speed using, for example, equation (1). The calculation unit 34 outputs the calculated output speed to the setting unit 35.

(Output speed) = (File size difference) / ΔT ... (1)
In equation (1), the output speed indicates the speed at which logs are output (the amount of data per unit time). Further, the file size difference indicates the difference between the output amount of the log file 2 collected last time and the output amount of the log file 2 collected this time. For example, the file size difference is newly stored in the log storage unit 15 after the output amount collection unit 12 shown in FIG. Indicates the amount of logged data. Further, ΔT is a time interval for collecting the output amount of the log file 2 according to the file size difference. ΔT is, for example, a time interval at which the output amount collection unit 12 shown in FIG. 1 collects the log output amount from the log storage unit 15.

The setting unit 35 receives the number of files, the size of the log file, the criteria for switching files, and the output speed from the calculation unit 34. The setting unit 35 sets the collection time based on the received information. Further, the setting unit 35 acquires the current time from the acquisition unit 33. The setting unit 35 compares the acquired current time and the set collection time, and determines whether the current time matches the collection time. If the result of the determination is that they match, the setting unit 35 determines to collect logs.

An example in which the setting unit 35 sets the collection time will be described. Assume that the number of files is "5 files", the size of the log file is "100 MB", the criteria for switching files is "switch by file size", and the output speed is "1 MB/min". Furthermore, assume that the log collection unit 11 shown in FIG. 1 collects log files from the log storage unit 15 at “00:00 on December 10th”. In this case, as described above, after "8.33 hours" have elapsed, the oldest log that has not been collected by the log collection unit 11 will be deleted. Therefore, the setting unit 35 sets the collection interval to 8 hours, and sets the next collection time to "8:00 on December 10th", for example. In this case, the log collection unit 11 shown in FIG. 1 collects logs when the current time becomes "8:00, December 10th."

Note that the setting unit 35 may allow the user to reset the collection interval and collection time, for example. That is, in the case of the above example, the setting unit 35 can expect to collect all logs without loss if the log collection interval is within "8.33 hours". However, as described above, for example, the log file 2 shown in FIG. 2 is rarely switched accurately depending on the file size, and the output speed is not always constant. Therefore, the user may reset the time "8.33 hours" set by the setting unit 35 to "8 hours", "300 minutes", etc. Further, the control device 1 may include a reset section (not shown) for resetting the collection interval and collection time. Further, the control device 1 may include an initial setting section (not shown) for setting the collection interval and collection time in the initial state.

FIG. 4A shows a functional block diagram of the log collection unit 11. The log collection unit 11 includes a collection unit 111 and an acquisition unit 112. The collection unit 111 functions as the collection unit 31 shown in FIG. Further, the acquisition unit 112 functions as the acquisition unit 33 shown in FIG. 3.

FIG. 4B shows a functional block diagram of the output amount collection unit 12. The output amount collection section 12 includes a collection section 121 , an acquisition section 122 , a calculation section 123 , and a setting section 124 . The collection unit 121 functions as the collection unit 31 shown in FIG. Further, the acquisition unit 122 functions as the acquisition unit 33 shown in FIG. 3. Further, the calculation unit 123 functions as the calculation unit 34 shown in FIG. 3. Further, the setting section 124 functions as the setting section 35 shown in FIG. 3.

〔flowchart〕
FIG. 5 shows an example of a flowchart of the control device 1. For example, the control device 1 sets a collection time (step S1), determines whether or not to collect logs (step S2), and collects logs (step S3). The process of step S1 will be described later. In step S2, based on the collection time set by the setting unit 35 shown in FIG. 3 and the current time, it is determined whether the current time matches the collection time. As a result of the determination, if they match (step S2: Y), the setting unit 35 determines to collect logs from the log storage unit 15, and the process of step S3 is executed. On the other hand, if the result of the determination is that they do not match (step S2: N), the setting unit 35 determines not to collect logs from the log storage unit 15, and returns to the process of step S1. In step S3, the collection unit 31 shown in FIG. 3 collects logs and outputs the collected logs to the storage unit 32. After the process in step S3, the process returns to step S1.

FIG. 6A shows an example of the process in step S1. For example, the control device 1 collects the output amount of logs (step S21), specifies the characteristics of the logs (step S22), calculates the collection interval (step S23), and sets the collection time (step S24). The process of step S21 will be described later. In step S22, the calculation unit 34 specifies information on the number of files, size, and criteria for switching files based on the information on the output amount of logs collected by the collection unit 31 shown in FIG. In step S23, based on the output speed calculated by the calculation unit 34 and information on the number of files, size, and file switching criteria specified by the calculation unit 34, the collection unit 31 calculates the output speed when the output speed is assumed to be constant. Calculate the time (collection interval) at which the oldest log that has not been collected will be deleted. In step S24, the setting unit 35 sets the time (collection time) for the collection unit 31 to collect logs, based on the collection interval calculated by the calculation unit 34 and the current time acquired by the acquisition unit 33. When the control device 1 executes the process of step S24, the control device 1 returns to execute the process of step S21. Note that the processes of steps S21 to S24 are repeatedly executed, for example, at predetermined intervals (for example, every minute).

FIG. 6B shows an example of the process in step S21. For example, the control device 1 collects the output amount of logs (step S31), determines whether the output amount is decreasing (step S32), and calculates the output speed (step S33). In step S31, the collection unit 31 shown in FIG. 3 (or the collection unit 121 shown in FIG. 4B) collects the amount of log output. Next, in step S32, the output amount collected by the collection unit 31 (current output amount) is compared with the output amount collected last time by the collection unit 31 (previous output amount), and the calculation unit 34 calculates the current output amount. If the output amount is smaller than the previous output amount, it is determined that the output amount is decreasing. Furthermore, if the calculation unit 34 determines that the output amount has decreased (step S32: Y), it detects that the log file has been deleted, and returns to the process of step S31. As a result, if it is determined that the output speed cannot be calculated correctly, the collection of the log output amount is re-executed. In step S32, when the calculation unit 34 determines that the output amount has not decreased (step S32: N), the process of step S33 is executed. In step S33, the calculation unit 34 calculates the output speed using equation (1). Moreover, when the control device 1 executes step S33, the control device 1 executes the process of step S22 shown in FIG. 6A.

For example, the control device 1 may be configured to independently execute the processing in steps S1 to S3 shown in FIG. 5 and the processing in steps S21 to S24 shown in FIG. 6A. That is, for example, a log collection device (not shown) may execute steps S1 to S3 shown in FIG. 5, and a setting device (not shown) may execute steps S21 to S24 shown in FIG. 6A. In this case, for example, the collection time set by the setting device (not shown) is notified to the log collection device (not shown) using a communication unit (not shown), and the log collection device (not shown) , the processes of steps S1 to S3 shown in FIG. 5 may be executed.

Further, the control device 1 does not necessarily need to perform steps S23 to S24 shown in FIG. 6A. In other words, the control device 1 determines that the amount of log data that has not been collected by the control device 1 is the maximum capacity calculated based on the number of files and the file size, based on the log output amount and log characteristics. It may also be configured to collect logs when Using FIGS. 1 and 2, consider the case where the log file 2 shown in FIG. 2 is stored in the log storage unit 15 shown in FIG. 1. For example, the control device 1 causes the output amount collection unit 12 to notify that the amount of log data stored in the log storage unit 15 that has not been collected by the log collection unit 11 has reached 500 MB (maximum storage capacity). When calculated, the log collection unit 11 may immediately collect all the log files 2 stored in the log storage unit 15. By doing so, the control device 1 can collect all logs without any loss. Furthermore, at this time, if the amount of log data stored in the log storage unit 15 that has not been collected by the log collection unit 11 reaches, for example, 400 MB (80% of the maximum storage capacity), the log collection unit 11 may collect the log file 2. By doing this, the control device can be saved due to time lags caused by the processing of the control device 1, the communication status between the control device 1 and the monitored server 14, or the case where the log storage unit 15 does not accurately store logs up to its maximum storage capacity. 1 can reduce the risk of losing logs. It can be said that these methods determine the timing of log collection depending on the available capacity for storing logs.

Further, the control device 1 may include a log analysis section (not shown). A log analysis unit (not shown) analyzes logs collected by the log collection unit 11 shown in FIG. 1, for example. By analyzing the collected logs, the control device 1 monitors whether unauthorized processing is being performed on the monitored server 14 shown in FIG. 1.

In addition, the control device 1 can, for example, set a collection time based on the output amount of logs and the characteristics of the logs, and collect logs at the set collection time, thereby deleting logs that the control device 1 has not collected. Because the logs can be collected before the logs are sent, all logs can be collected without any loss.

Further, the control device 1 compares the collection time set by the user and the collection time set by the setting unit 35 shown in FIG. (collection time may be adopted preferentially). Alternatively, the control device 1 compares the collection time set by the user with the collection time set by the setting unit 35 shown in FIG. It is also possible to collect logs. By doing so, the control device 1 can avoid the risk of missing logs while collecting logs at the collection time set by the user.

FIG. 7 shows specific examples of log types. Logs record, for example, operation details, system movements associated with operations, data changes, etc. in chronological order, and are classified into categories 41 and log types 42. As shown in the log types 42, the monitored server 14 shown in FIG. 1 outputs and stores a plurality of types of logs depending on the processing. Furthermore, the control device 1 collects a plurality of types of logs stored in the monitored server 14, respectively. Further, the log categories and log types are not limited to the categories 41 and log types 42. The category 41 and the log type 42 each describe a portion of the log.

The category 41 is the name of a category for classifying log types. The category 41 includes, for example, Windows (registered trademark) event logs, UNIX (registered trademark) Operating System (OS) logs, Global Server (GS) system logs, Windows Internet Information Service (IIS) logs, Apache (registered trademark), These include middleware and storage.

The Windows event log is a category for event logs that record phenomena and operations that occur within the Windows system, which is one of the computer OSs.

The UNIX OS log is a category for logs output in response to processing by the UNIX OS, which is one of the computer OSs.

The GS system log is, for example, a category for logs output in response to global server processing.

The IIS log is a category of logs output in response to processing by IIS, which is one of the Windows World Wide Web (WWW) web server software.

Apache log is a category for logs output in response to processing by Apache, which is one of the web server software.

The middleware log is a category for logs output in response to middleware processing of a computer.

Storage log is a category for logs output according to computer storage processing.

Log type 42 indicates the type of log classified by category 41. Log types 42 include, for example, application logs, security logs, system logs, Domain Name System (DNS) server logs, directory services, file replication services, Distributed File System (DFS) replication, hardware event logs, and forwarded events. There are logs etc. Further, the log type 42 includes, for example, Hyper-V server event log, system log, login log, su log, access log, business log, NCSA common log file format, Microsoft (registered trademark) IIS log file format, and W3C extended format. , access log NCSA format (initial format), error log, etc. Further, the types of logs 42 include, for example, logs output by commands, console audit logs, server access audit logs, and event logs.

The application log is, for example, a log in which the application itself records the operating status of the application in a file.

The security log is a log that outputs, for example, success or failure of auditing, such as success in reading a specific file or failure in logon.

The system log is, for example, a log that records important events that occur while the OS is running.

The DNS server log is, for example, a log recorded by a DNS server that manages the correspondence between domain names, host names, and IP addresses on a Transmission Control Protocol (TCP)/Internet Protocol (IP) network such as the Internet.

A directory service is, for example, a log recorded by a directory service, which is a system that collects, records, and searches information such as resources on a network, their locations, attributes, and settings.

The file replication service is, for example, an event log output by a file replication service that manages file replication for troubleshooting problems related to file replication.

DFS Replication is, for example, a log that records the processing of DFS Replication, which is a function that associates folders on multiple computers and automatically copies internal files and folders to improve availability and distribute load.

The hardware event log is, for example, a log related to power supply, HDD, temperature, CPU, memory, etc.

The transferred event log is, for example, an event log transferred from another computer when an event viewer is set to receive an event from another information processing device and record the received log.

The Hyper-V server event log is, for example, a log related to virtual machine events recorded by a monitoring function that monitors the operation of the virtual machine.

The system log is, for example, a log that records important events that occur during operation of the OS.

The login log is, for example, a log that records computer login operations.

The su log is a log that is recorded when, for example, a user operating UNIX is switched using a substitute user (su) command in UNIX.

The access log is, for example, a log that records operations and requests from users and external systems.

The business log is, for example, a log that records the history of business, which is output by a comprehensive online transaction system equipped with online database processing and data guarantee functions.

The National Center for Supercomputing Applications (NCSA) common log file format is one of the file formats for logs recorded by web servers such as IIS, and is a fixed American Standard Code for Information Interchange (ASCII) format that cannot be customized. be.

The Microsoft IIS log file format is one of the file formats of logs recorded by a web server such as IIS, and is a fixed ASCII format that cannot be customized. For example, the Microsoft IIS log file format is characterized by recording more information items than the NCSA common log file format.

The W3C extended format is one of the file formats of logs recorded by a web server such as IIS, and is an ASCII format that can be customized.

The access log NCSA format (initial format) is an access log output by Apache, for example, and is a log output in the NCSA format.

The error log is, for example, a log that is recorded when an error occurs on a computer, and includes information such as the content of the error, the date and time when the error occurred, and the status of the error.

A log output by a command is, for example, a log uniquely output by a command provided by middleware.

The console audit log is, for example, a log that records the details of system operations performed from a screen.

The server access audit log is, for example, a log that records operation details related to server access.

The event log is, for example, a log that records phenomena and operations that occur within the system.

For example, a log whose category 41 is "Windows event log" includes logs whose log type 42 is "application log," "security log," "system log," and the like. The control device 1 collects different types of logs as shown in the log types 42.

[Example 2]
In the first embodiment, for example, a method has been described in which the control device 1 shown in FIG. 1 collects all logs from the monitored server 14 without missing them. As described above, each time the control device 1 collects the log output amount, it calculates the log output speed based on the collected log output amount and the previous output amount, and stores the calculated output speed and the log. The collection interval is calculated based on the capacity (free capacity). However, there are cases where the correct output speed cannot be calculated based on the log output amount, and in this case, it is necessary to collect the log output amount again. As described above, the control device 1 has a problem in that the processing load is large due to repeated execution of the necessary processing until calculating the collection interval. In the second embodiment, for example, as a means to improve such a problem, a control device will be described in which an operation management system focuses on performance information collected from a business system in addition to the amount of log output. In the following description, if the configuration is the same as that of the first embodiment, the description will be omitted, and only the configuration that is different from the first embodiment will be described.

FIG. 8 shows another example of collecting logs. The control device 5 includes a log collection section 51 , an output amount collection section 52 , a performance information collection section 53 , a performance information analysis section 54 , and a storage section 55 . Further, the control device 5 collects logs from the monitored server 56, for example. The monitored server 56 includes a log storage section 57 and a performance information acquisition section 58. Note that the control device 5 has the same functions as the control device 1 shown in FIG. That is, the log collection section 51 has the same functions as the log collection section 11 shown in FIG. Further, the output amount collection unit 52 has the same function as the output amount collection unit 12 shown in FIG. Furthermore, the storage unit 55 has the same functions as the storage unit 13 shown in FIG. Furthermore, the monitored server 56 has the same functions as the monitored server 14 shown in FIG. Further, the log storage unit 57 has the same functions as the log storage unit 15 shown in FIG.

The performance information collection unit 53 collects performance information of the monitored server 56 from the performance information acquisition unit 58, for example. Here, the performance information is, for example, information indicating the operating state of each resource of the monitored server 56 (that is, the operating state and load of the resource), and is rephrased as operating state information, operating state information, load information, etc. be able to. The performance information includes the types of information shown in FIGS. 12A to 12D, which will be described later. In the following description, items of performance information will be described as performance items, and values of performance information will be described as performance values.

The performance information analysis unit 54 analyzes the performance information collected by the performance information collection unit 53, for example.

The control device 5 collects the log output amount and performance information from the monitored server 56, analyzes and stores the relationship between the change in the value of the performance information and the log output amount, and stores the collected performance information. Set the log collection time according to value changes.

FIG. 9 shows a functional block diagram of the control device 5. As shown in FIG. The control device 5 includes, for example, a collection section 61, a storage section 62, an acquisition section 63, a calculation section 64, a generation section 65, and a setting section 66. Further, the collection unit 61, storage unit 62, acquisition unit 63, calculation unit 64, and setting unit 66 have the same configuration as the collection unit 31, storage unit 32, acquisition unit 33, calculation unit 34, and setting unit 35 shown in FIG. 3, respectively. including. Further, each processing unit may be realized by the same hardware, or may operate in a distributed manner on a plurality of pieces of hardware.

The collection unit 61 collects performance information from the performance information acquisition unit 58 shown in FIG. 8, for example, and outputs it to the storage unit 62.

The storage unit 62 stores, for example, information representing the relationship between the performance information collected by the collection unit 61, the performance information generated by the generation unit 65, and the amount of log output.

The acquisition unit 63 acquires, for example, performance information from the storage unit 62, a related table 7 described later, and a related table 8 described later, and transmits the acquired information to the collection unit 61, the calculation unit 64, the generation unit 65, and the setting unit 66. Output to.

The calculation unit 64 calculates, for example, the output speed, the rate of increase in the performance value, and the relationship coefficient, and outputs the calculated results to the storage unit 62. The rate of increase in performance value indicates the rate of increase in the value when the performance value collected by the collection unit 61 is compared with the performance value collected by the collection unit 61 at an arbitrary timing. Note that the arbitrary timing is, for example, normal time. However, normal times refer to, for example, a case where the monitored server 56 shown in FIG. Let it represent the state where is outputting. Note that the predetermined period is, for example, one day or one month. Further, the relationship coefficient is, for example, a coefficient for adjusting the collection interval with respect to the arbitrary collection interval calculated by the calculation unit 64. Note that the arbitrary collection interval is, for example, a normal collection interval. Furthermore, the collection interval means the time interval from when the previous log collection is performed until when the next log collection is performed. The calculation unit 64 calculates the output speed, for example, using equation (1) similarly to the first embodiment. Further, the calculation unit 64 calculates the increase rate of the performance value using, for example, equation (2). Further, the calculation unit 64 calculates the collection interval using, for example, equation (3).

(Increase rate of performance value) = (current performance value) / (normal performance value) ... (2)
However, the "increase rate of performance value" indicates the amount of change in the performance value collected by the collection unit 61 shown in FIG. 9 when the output speed changes. Moreover, the "current performance value" indicates the value of performance information collected by the control device 5 by executing the process of step S42 shown in FIG. 11A. Further, the "normal performance value" indicates the value of the performance information at the normal output speed calculated by the control device 5 executing the process of step S41 shown in FIG. 11A.

(Collection interval) = (Normal collection interval) × (Relationship coefficient) ... (3)
However, the "collection interval" indicates the interval at which the control device 5 collects logs. Alternatively, the "collection interval" is a collection interval calculated by the control device 5 by executing the process of step S42 shown in FIG. 11A. Moreover, the "normal collection interval" indicates the collection interval set by the control device 5 by executing the process of step S41 shown in FIG. 11A. Moreover, the "relationship coefficient" indicates the relation coefficient calculated by the control device 5 executing the process of step S66 shown in FIG. 11C.

For example, the generation unit 65 associates the performance information received from the acquisition unit 63 with the output amount of logs, and generates a related table 7 shown in FIGS. 12A to 12D and a related table 8 shown in FIG. 13 described later, respectively, and The generated information is stored in the storage unit 62. For example, based on the performance information and the log output amount, the generation unit 65 identifies the type of log whose output amount is increasing at a timing when the performance value of at least one item is increasing, and generates this performance information. A related table 7 is generated as a table that associates the logs with the logs. Further, the generation unit 65 generates the related table 8 as a table that associates the performance value increase rate, output speed, relationship coefficient, and collection interval, based on the performance information and the output amount of logs, for example.

Further, when the collection unit 61 collects the performance information and the output amount, the generation unit 65 determines whether the related table 7 has already been generated. Further, when the collection unit 61 collects the performance information and the output amount, the generation unit 65 determines whether the combination of performance value increase rates calculated by the calculation unit 64 is already stored in the related table 8. Note that the generation unit 65 determines, for example, whether the combination of performance value increase rates calculated by the calculation unit 64 matches the combination of performance value increase rates already stored in the storage unit 62 as the related table 8. Judgment is made based on the However, the generation unit 65 does not necessarily require that the combination of performance value increase rates calculated by the calculation unit 64 match the combination of performance value increase rates already stored in the storage unit 62 as the related table 8. There isn't. In other words, the generation unit 65 determines that the combination of performance value increase rates calculated by the calculation unit 64 is a combination of performance value increase rates already stored in the storage unit 62 as the related table 8 and a predetermined value (for example, 1 %) may be determined to be within the error range.

The setting unit 66 obtains, for example, performance information and a related table 7 and a related table 8, which will be described later, from the obtaining unit 63, and calculates the collection time based on the obtained information.

FIG. 10A shows a functional block diagram of the performance information collection unit 53. The performance information collection unit 53 includes a collection unit 531 and an acquisition unit 532. The collection unit 531 functions as the collection unit 61 shown in FIG. Further, the acquisition unit 532 functions as the acquisition unit 63 shown in FIG. 9 .

FIG. 10B shows a functional block diagram of the performance information analysis unit 54. The performance information analysis section 54 includes an acquisition section 541, a calculation section 542, a generation section 543, and a setting section 544. The acquisition unit 541 functions as the acquisition unit 63 shown in FIG. Further, the calculation unit 542 functions as the calculation unit 64 shown in FIG. 9. Further, the generation unit 543 functions as the generation unit 65 shown in FIG. 9 . Further, the setting section 544 functions as the setting section 66 shown in FIG.

〔flowchart〕
The processing of the control device 5 will be explained. Note that the control device 5 executes the processes of steps S1 to S3 shown in FIG. Further, details of step S1 will be described as a process different from the first embodiment.

FIG. 11A shows another example of the process of step S1. The control device 5 collects the log output amount (step S21), sets the normal collection interval (step S41), collects performance information (step S42), calculates the collection time (step S43), The collection time is notified (step S24). Note that the processing in steps S41 to S42 will be described later. Furthermore, the process in step S21 is the same as step S21 shown in FIG. 6A, so the explanation will be omitted. In step S43, the calculation unit 64 shown in FIG. 9 determines the collection interval based on the association table 8 generated by the generation unit 65. Further, the calculation unit 64 calculates the collection time based on the current time collected by the acquisition unit 63. When the control device 5 executes the process of step S24, it returns to the process of step S21 and executes it. Note that the processes of steps S21 to S24 are repeatedly executed, for example, at predetermined intervals (for example, every minute).

FIG. 11B shows an example of the process in step S41. The control device 5 determines whether a normal collection interval has been set (step S51), specifies the characteristics of the log (step S22), and sets the normal collection interval (step S52). In step S51, the control device 5 determines whether or not the setting unit 66 shown in FIG. 9 has set the normal collection interval, and as a result of the determination, if the normal collection interval has not been set (step :N), execute step S22. On the other hand, in step S51, as a result of the determination, if the normal collection interval is set (step S51: Y), the process of step S41 ends. Note that step S22 is the same as the process of step S22 shown in FIG. 6A, so a description thereof will be omitted.

In step S52, the control device 5 determines the collection interval based on the output speed calculated by the calculation unit 64 shown in FIG. 9 and the characteristics of the log specified by the calculation unit 64, assuming that the output speed is constant. Calculated as a collection interval of hours. Furthermore, in step S52, the setting unit 66 shown in FIG. 9 sets the normal output speed and the normal performance value. Note that in step S52, the control device 5 does not necessarily need to determine the normal collection interval in one process. That is, the control device 5 repeatedly executes step S21 and step S41, temporarily calculates a plurality of (for example, 5) normal collection intervals, and determines the average collection interval as the final normal collection interval. You may. Further, in step S1 shown in FIG. 5, the control device 5 may set the collection time based on the normal collection interval calculated by the calculation unit 64 shown in FIG. Furthermore, the process in step S41 is not essential, and the configuration may be such that the user sets the normal collection interval.

FIG. 11C shows an example of the process in step S42. The control device 5 collects performance information (step S61), determines whether to generate the association table 7 (step S62), and generates the association table 7 (step S63). Furthermore, the control device 5 calculates the increase rate of the performance value (step S64), determines whether it is stored in the related table 8 (step S65), and generates the related table 8 (step S66). In step S62, the control device 5 executes step S63 if the related table 7 is to be generated as a result of the determination (step S62: Y), and if the related table 7 is not to be generated (step S62: N), the control device 5 executes step S64. Execute. Further, in step S65, the control device 5 executes step S66 if the result of the determination is that the data is not stored in the related table 8 (step S65: N), and if it is stored in the related table 8 (step S65: :Y) End the process of step S42.

In step S61, the collection unit 61 shown in FIG. 9 collects performance information.

In step S62, it is determined whether the generation unit 65 generates the association table 7 shown in FIGS. 12A to 12D, which will be described later. Note that the process in step S62 may be determined based on whether or not the related table 7 has already been generated. Alternatively, the control device 5 may decide in advance an arbitrary number of times to execute the process of step S63, and in step S62, it may be determined whether or not to generate the related table 7 based on the number of times step S63 has been executed. .

In step S63, the generation unit 65 shown in FIG. 9 generates a related table 7 shown in FIGS. 12A to 12D, which will be described later, based on the change in the value of the performance information and the change in the output amount of the log. Furthermore, in step S63, the generation unit 65 does not necessarily need to generate the related table 7 in one process. That is, the control device 5 executes the process of step S63 multiple times to generate the related table 7. Thereby, when the collection unit 61 collects abnormal values of performance information and output amount, it is possible to suppress generation of an incorrect association table 7.

In step S64, the calculation unit 64 shown in FIG. 9 calculates the rate of increase in performance value. The rate of increase in performance value is calculated, for example, based on the above-mentioned formula (2).

In step S65, the generation unit 65 determines whether the combination of performance value increase rates calculated by the calculation unit 64 is stored in the related table 8.

In step S66, the generation unit 65 shown in FIG. 9 generates the related table 8 based on the output speed and the rate of increase in performance value.

When the control device 5 attempts to collect multiple types of logs, it is desirable that the generation unit 65 shown in FIG. 9 generate the related table 7 based on multiple performance items. Since the network and system status of the monitored server 56 shown in FIG. 8 is collected by the control device 5 as performance information, for example, the transition of the performance information and the transition of the output amount of logs may be collected (monitored) together. This makes it possible to detect an opportunity for an increase in the amount of log output. However, since the performance information of the monitored server 56 is diverse and each performance item is related to each other, it is not possible to monitor only a specific performance item and increase or decrease the amount of log output by focusing on a specific type. Difficult to detect. Therefore, the control device 5 can be expected to identify types of logs related to performance items by monitoring a plurality of performance items.

12A to 12D show an example of the association table 7. The association table 7 is a table showing the association between performance information items and specific types of logs. The related table 7 includes, for example, performance information 71 and log type 72. In the related table 7, performance items whose performance values are increasing at the same time as the log output amount are increased are indicated by circles. Details of the performance information 71 will be described later. The log types 72 include, for example, "access log" (same as the access log NCSA format (initial format) shown in FIG. 7) and "log output by command" (log output by command and shown in FIG. 7). similar). In the example of the related table 7 shown in FIGS. 12A to 12D, for example, the value of the performance information 71 indicated by a circle is It can be seen that there is a rising trend.

The performance information 71 includes, for example, the number of page faults, CPU usage rate, disk busy rate, real memory usage rate, page file usage rate, number of processes, number of processor waiting threads, disk usage rate, number of disk waiting requests, etc. shown in FIG. 12A. It is. Further, the performance information 71 includes, for example, the number of received bytes, the number of transmitted bytes, the line usage rate, the received packet rate, the discarded packet rate, the error packet rate, the segment usage rate, the collision occurrence rate, the number of requests, etc. shown in FIG. 12B. . Further, the performance information 71 includes, for example, the Input/Output (I/O) completion waiting time rate within the unit time shown in FIG. 12C, the number of reads from the disk, the number of writes to the disk, and the Read/Write (R/W) ) waiting time, number of Structured Query Language (SQL) statement executions, number of deadlocks, number of exclusive waits, etc. Further, the performance information 71 includes, for example, the number of physical reads shown in FIG. 12D, the maximum processing waiting time A, the maximum processing waiting time B, the number of connections, the number of responses, and the like. 12A to 12D show that, for example, logs output by the Web server are output in association with performance information 71 such as the number of received bytes, the number of transmitted bytes, and the line usage rate. Further, FIGS. 12A to 12D show that, for example, logs output by the application server are output in association with performance information 71 such as CPU usage rate, real memory usage rate, and disk usage rate.

The number of page faults is, for example, the number of processes that occur when it is found that the virtual memory area that a program attempts to access does not exist in the physical memory and is saved to a hard disk or the like.

The CPU usage rate is, for example, the rate or total amount of processing time of the CPU occupied by programs being executed by the computer.

The disk busy rate is a rate that indicates, for example, the unevenness of the load on each disk on the computer.

The real memory usage rate is, for example, the usage rate of the computer's physical memory, or the ratio of the capacity used by the computer to the storage capacity of the main storage device.

For example, the page file usage rate is based on the available storage capacity of the virtual memory (page file) that the OS creates in a storage such as an HDD to temporarily store the contents of unused memory areas. , is the percentage of storage capacity in use.

The number of processes is, for example, the number of processes operating on the system.

The number of threads waiting for the processor is, for example, the number of threads waiting for processing among threads operating in a multi-threaded manner.

The disk usage rate is, for example, the percentage of disks in use.

The number of requests waiting for the disk is, for example, the number of system requests waiting to access the disk.

The number of received bytes is, for example, the amount of bytes received by the system.

The number of transmitted bytes is, for example, the amount of bytes transmitted by the system.

The line usage rate is the ratio of data that can be transmitted to the capacity of the line.

The received packet rate, for example, is the rate of packets that the computer successfully receives from the network.

The discarded packet rate is, for example, the rate of packets discarded on the network.

The error packet rate is, for example, the rate of packets that were not transmitted or received, or the rate of packets in which an error was detected in the received packets.

The segment usage rate is, for example, a ratio representing the usage rate of divided networks and data.

The collision occurrence rate is, for example, the rate at which signal collisions occur due to almost simultaneous data transmission from multiple hosts.

The number of requests is, for example, the number of accesses to files on the server.

The I/O completion waiting time rate within a unit of time is, for example, the time spent waiting for I/O completion within a unit of time (for example, the interval at which a product collects performance, such as one minute). This is the percentage of

The number of times data is read from a disk is, for example, the number of times data is read from a disk on a computer.

The number of times data has been written to a disk is, for example, the number of times data has been written to a disk on a computer.

The R/W waiting time is, for example, the waiting time of a process of reading data from a disk on a computer or a process of writing data to a disk on a computer.

The number of SQL statement executions is, for example, the number of times an SQL statement used for issuing commands from a user or external software to a database management system is executed.

The number of deadlocks is the number of times deadlocks occur.

The number of times of waiting for occupancy is, for example, the operating status of the application, information on the use of system resources, and the number of times the application has waited for occupancy of the resource acquired.

The number of physical reads is, for example, the number of times an SQL statement reads data from a storage device (physical reads).

The maximum processing waiting time A is the maximum processing waiting time within the collection interval, which is the time from receiving a request from the client application to starting processing of the server application.

The maximum processing waiting time B is the maximum processing waiting time of operations processed within the performance information collection interval.

The number of connections is, for example, information regarding the number of virtual dedicated communication paths established between communicating devices and software.

The response number relationship is, for example, information related to the number of responses to data sent by a computer or system.

FIG. 13 shows an example of the related table 8. The related table 8 is a table generated by the generation unit 65 shown in FIG. 9 based on the output speed and performance information. Further, the case where the log type 72 of the related table 8 shown in FIG. 13 is an "access log" will be explained based on the related table 7 shown in FIGS. 12A to 12D. In addition, in FIG. 13, as an example, it is assumed that the log file is rotated at 500 MB and the normal output speed is 1 MB/min. In addition, an explanation will be given using an example of a log in which the performance information values (performance values) of Central Processing Unit (CPU) usage rate 81, disk busy rate 82, number of threads waiting for the processor 83, and number of requests 84 increase when the output speed increases. . The performance values when the output speed is 1 MB/min are as follows: CPU usage rate 81 is 10%, disk busy rate 82 is 20%, number of threads waiting for the processor 83 is 5 (pieces), and number of requests 84 is 10 (pieces). ). In addition, the performance values when the output speed is 2MB/min are as follows: CPU usage rate 81 is 20%, disk busy rate 82 is 30%, number of threads waiting for the processor 83 is 15 (pieces), and number of requests 84 is 20%. (pieces). At this time, since the unit of performance value is different for each performance item, it may be converted into an increase rate and compared. In this case, the respective increase rates are 200% for the CPU usage rate 81, 150% for the disk busy rate 82, 300% for the number of threads waiting for the processor 83, and 200% for the number of requests 84. When the normal relationship coefficient 85 is "1" and the collection interval 86 is "8 hours", the relationship coefficient 85 and the collection interval 86 when the output speed is 2 MB/min are determined. In FIG. 13, as an example, when the output speed is 2 MB/min, the relationship coefficient 85 is set to "0.5", and the collection interval 86 is determined to be "4 hours". In this way, the relationship between output speed and performance information is stored as a related table, and when the combination of performance value increase rates for the performance information collected by the control device 1 matches the related table 8, the control device 1 stores the same The collection interval 86 stored in the related table 8 is set. In other words, for example, if the CPU usage rate 81 is 200%, the disk busy rate 82 is 150%, the number of threads waiting for the processor 83 is 300%, and the number of requests 84 is 200%, the collection interval is Set 86 to 4 hours. When the types of logs are different, the values of the performance items shown in FIG. 13 do not necessarily increase. Therefore, when collecting multiple types of logs, it is preferable to generate the related table 8 according to each type of log.

Here, a comparison between Example 1 and Example 2 will be explained. In the first embodiment, the log collection timing (collection interval) is determined by collecting the log output amount. However, as described above, in the aspect of the first embodiment, it may not be possible to calculate the correct output speed based on the output amount of logs. In this case, it is necessary to collect the log output amount again. Furthermore, as explained in the problem related to real-time collection, the process of acquiring logs and the amount of log output generates a load on the monitored server.

In response to the above problem, the inventor newly discovered that there is a correlation between the amount of log output and the performance information (obtained performance value) of the monitored server. We also focused on the fact that the performance information items that correlate with the output amount differ depending on the type of log.

In operation management systems, in addition to the process of collecting logs, there are many ways to collect performance information for the purpose of monitoring whether or not hardware is operating normally. By using performance information, it is possible to appropriately determine the log collection timing without depending on information about the logs to be collected or the amount of log output. Therefore, the problems described in connection with the first embodiment can be avoided.

Based on the above, the control device 5 described in the second embodiment uses performance information, for example, unlike the control device 1 according to the first embodiment. The control device 5 generates the association table 7 shown in FIGS. 12A to 12D, and specifies the type of log related to the performance information. Furthermore, the control device 5 generates a related table 8 shown in FIG. 13, and stores changes in performance values and changes in log output amount in association with each other. By doing so, the control device 5 can determine the collection interval based on the performance information. That is, the control device 5 can determine a specific log collection interval from specific performance information. Furthermore, the control device 5 repeatedly executes processing to collect performance information and log output amount, and executes processing to generate a related table 8 according to the collected performance information and log output amount. A related table 8 corresponding to the performance value is stored. At this time, for example, if the collected performance values and log output amount are already stored as the related table 8, the control device 5 determines the collection interval based on the collected performance values and the already stored related table 8. Determine. Therefore, it is possible to specify the log output speed and relationship coefficient with less processing load.

The processing of the control device 5 of the second embodiment is, for example, when executing step S1 for the first time, requires processing of generating the related table 7 and the related table 8. , there is a possibility that the processing load will increase. However, as described above, each time the control device 5 of the second embodiment repeatedly executes the process of step S1, the frequency of executing the process of generating the related table 7 and the related table 8 decreases. The processing load placed on 5 is reduced. In contrast, in the control device 1 of the first embodiment, even if the process of step S1 is repeatedly executed, the processing load on the control device 1 is not reduced. Therefore, when the control device 5 repeatedly executes a series of processes, the processing load on the control device 5 can be reduced compared to when the control device 1 similarly executes the processes.

According to the control device 5, by setting a collection time according to the performance value and collecting logs at the set collection time before uncollected logs are deleted, the frequency of log collection is reduced and the log Logs can be collected without loss while reducing the processing load on the information processing device that outputs the logs.

Further, according to the control device 5, since the collection time is set based on the relationship between the log output speed and the performance information, it is possible to collect logs without loss according to the log output amount.

Furthermore, since the control device 5 sets the collection time based on a combination of a plurality of pieces of performance information, it is possible to set the collection time according to the type of log to be collected.

Further, according to the control device 5, since the collection interval is determined based on the output amount of logs and the performance value, it is possible to avoid collecting logs as much as possible within the time range in which no logs are lost. Therefore, the processing load placed on the monitored server 56 and the control device 5 shown in FIG. 8, which is caused by frequently collecting logs, can be reduced.

Further, according to the control device 5, changes in the log output speed can be detected by acquiring performance information, storing the acquired performance information in association with the output speed, and monitoring changes in the performance value. .

In addition, for example, by collecting logs before the calculated time elapses, the control device 5 eliminates the need to collect logs frequently, reducing the impact on the operations of the information processing device when collecting logs. can do.

For example, if the log output speed changes and the collection interval is re-determined before the log collection interval is determined and the logs are collected at the determined collection interval, the control device 5 may change the collection interval to a shorter collection interval. Logs may be collected based on By doing so, the risk that the control device 5 loses the log can be avoided.

Note that, like the control device 1 described in the first embodiment, the control device 5 can also control the collection time in consideration of the collection time set by the user. That is, the control device 5 compares the collection time set by the user and the collection time set by the setting unit 66 shown in FIG. (collection time may be adopted preferentially). Alternatively, the control device 5 compares the collection time set by the user with the collection time set by the setting unit 66 shown in FIG. It is also possible to collect logs. By doing so, the control device 5 can avoid the risk of missing logs while collecting logs at the collection time set by the user.

[Hardware configuration diagram]
FIG. 14 shows an example of a hardware configuration according to the first embodiment and the second embodiment. The control device 1 includes, for example, a CPU 92, a memory 93, a storage device 94, a network interface card (NIC) 95, a medium reading device 96, an input device 97, and a display device 98, each of which is interconnected via a bus 91. It is a processing device.

The CPU 92 controls various operations executed by the control device 1 or the control device 5. The CPU 92 is a processor that reads a program stored in the memory 93 or the storage device 94 and executes processing and control. Each functional section of the control device 1 or the control device 5 may be realized through processing and control by the CPU 92.

The memory 93 and the storage device 94 can store programs that execute the various processes described in the first and second embodiments and data used in the various processes. The storage device 94 is, for example, a storage medium such as an HDD or an SSD. Furthermore, each of the memory 93 and the storage device 94 can function as the storage section 32 or the storage section 62, for example. Further, the storage unit 32 or the storage unit 62 does not necessarily need to be stored in the storage device 94. In other words, the configuration may be such that the information is stored in a storage device outside the control device 1 or the control device 5.

The NIC 95 is hardware used for transmitting and receiving data via a wired or wireless network.

The medium reading device 96 is a device that reads data from a storage medium. The medium reading device 96 is, for example, a disk drive that reads data stored on a disk medium such as a Compact Disc Read Only Memory (CD-ROM) or a Digital Versatile Disc (DVD), or a card that reads data stored on a memory card. slots, etc. A part or all of the data stored in the storage unit 32 shown in FIG. 3 or the storage unit 62 shown in FIG. 9 may be stored in a readable recording medium using the medium reading device 96.

The input device 97 is a device that receives inputs and specifications from the user of the control device 1 or the control device 5. Further, the input device 97 is, for example, a keyboard, a mouse, a touch pad, or the like.

The display device 98 displays various information under the control of the CPU 92. Further, the display device 98 is, for example, a liquid crystal display.

Each component of each device shown in FIG. 14 does not necessarily need to be physically configured as shown in FIG. In other words, the specific form of distributing and integrating each device is not limited to that shown in Figure 14, but all or part of it can be functionally or physically distributed in arbitrary units depending on various loads and usage conditions. It can be configured in a distributed/integrated manner. Further, the various processes described in the above embodiments can be realized by executing a program prepared in advance on a computer such as a PC or a workstation.

1, 5 Control device 14, 56 Monitored server 91 Bus 92 CPU
93 Memory 94 Storage device 95 NIC
96 Media reading device 97 Input device 98 Display device

Claims (8)

to the computer,
When a plurality of pieces of operation status information indicating the operation status of the information processing apparatus that outputs logs to the log storage unit at any time according to the processing of the information processing apparatus is acquired, the plurality of acquired operations are stored in the storage unit. Based on the correlation between the state information and the output speed indicating the amount of data of the log output by the information processing device per unit time, and the storage capacity that is the free capacity in which the log storage unit can store the log. , controlling the timing of collecting the log from the log storage unit;
A control program that executes processing. to the computer;
In the controlling process, a collection interval, which is an interval at which the logs are collected, is determined based on the output speed and the storage capacity, and the timing at which the logs are collected is controlled based on the determined collection interval.
The control program according to claim 1, which causes the control program to execute a process. to the computer;
In the acquisition process, the plurality of pieces of operating state information are acquired, and size information, which is information representing an amount of uncollected log data, is acquired from the log storage unit;
calculating the output speed based on the size information;
storing the plurality of operating state information and an output speed indicating an amount of data of the log output by the information processing device per unit time in the storage unit in association with each other;
identifying the storage capacity based on the size information;
3. The control program according to claim 1, which causes the control program to execute a process. 4. The control program according to claim 1, wherein the log includes a plurality of logs of different types. to the computer;
In the collecting process, the log is collected at a time when the collection interval time has elapsed since the last time the collecting process was executed.
3. The control program according to claim 2, which causes the control program to execute a process. to the computer;
a first collection time, which is a time at which the predetermined log is collected from the log storage unit; and a second collection time, which is a time at which the log is collected from the log storage unit, which is determined based on the collection interval. , compare
The controlling process controls the timing of collecting the logs from the log storage unit so that as a result of the comparison, an earlier time is prioritized.
6. The control program according to claim 5, which causes the control program to execute a process. The computer is
acquiring a plurality of pieces of operating state information indicating the operating state of the information processing device that outputs logs to a log storage unit at any time in accordance with processing of the information processing device;
storing the plurality of operating state information in association with an output speed indicating an amount of data of the log output by the information processing device per unit time;
When operating state information is obtained, the log is stored based on the output speed stored in association with the obtained operating state information and a storage capacity that is a free space in which the log storage unit can store the log. controlling the timing of collection from the log storage unit;
A control method characterized by executing processing. an acquisition unit that acquires a plurality of pieces of operational status information indicating the operational status of the information processing device, which outputs logs to a log storage unit at any time according to processing of the information processing device;
a storage unit that associates and stores the plurality of operating state information and an output speed indicating an amount of data of the log output by the information processing device per unit time;
When operating state information is obtained, the log is stored based on the output speed stored in association with the obtained operating state information and a storage capacity that is a free space in which the log storage unit can store the log. a control unit that controls the timing of collection from the log storage unit;
A control device comprising:

Images