JP7673435B2 - Information processing device, information processing method, and information processing program - Google Patents

Description

The present invention relates to an information processing device connected to a network to which multiple devices are connected, an information processing method for the information processing device, and an information processing program.

ICT (Information and Communication Technology) is also being used in manufacturing sites, and various devices are increasingly being networked. As a result, the main cause of an abnormality can be identified and the problem can be solved based on events recorded as logs in the system.

When an abnormality occurs, many secondary events occur as a result of the abnormality, making it difficult to identify the main cause simply by checking the logs as chronological data. As a result, troubleshooting takes a huge amount of time, leading to losses due to equipment shutdowns and increased maintenance costs.

JP 2018-124697 A

Patent Document 1 discloses a method for identifying the cause from system configuration information when multiple events occur. However, because the above-mentioned method makes judgments based only on system configuration information, cases in which the cause of multiple events that occur simultaneously can be identified are extremely limited. For example, it is not possible to identify the main cause from events that occur simultaneously within the same device. Furthermore, it is not possible to identify the cause of events that occur in applications that cannot be determined from system configuration information alone.

Furthermore, in each device that makes up the system, various events that are different from the cause of the abnormality occur, and these are generally stored in the same memory area. The capacity of this memory area is limited and it is overwritten as needed, so it is possible that the logs of necessary events will be erased, making troubleshooting impossible.

One aspect of the present invention aims to identify the causative event from among multiple events that occur on a network to which multiple devices are connected.

In order to solve the above problem, an information processing device according to one aspect of the present invention is an information processing device connected to a network to which multiple devices are connected, and includes a log acquisition unit that acquires a log recording information processing events performed in the device itself and/or other devices connected to the device itself via the network, a grouping processing unit that groups the multiple events recorded in the log into related event groups based on predetermined criteria, an identification unit that identifies, from the related event groups, a causal event that is a cause of the occurrence of the related event groups, and an output unit that outputs the causal event identified by the identification unit, and the identification unit identifies the causal event using event correlation information indicating information for identifying the causal event for each type of event.

With the above configuration, related events are grouped from multiple events in the log, and the event that caused the problem can be appropriately identified from among them by using event correlation information. Therefore, even if multiple events occur simultaneously, the event that caused the event can be easily identified and troubleshooting can be performed.

The event correlation information may include, for each type of event, information regarding the cause priority of the device in which the event occurred, as information for identifying the cause event.

According to the above configuration, when multiple identical causal events occur during processing by the identification unit, the true causal event can be identified by checking the causal priority according to the items set in the causal priority.

The information regarding the factor priority may be set by a configuration information priority setting, which is information indicating the order of the factor priority by the position in the configuration information indicating the network connection relationship of the device.

According to the above configuration, factor priorities can be set based on the configuration information priority settings, using general rules for network configuration information, without identifying individual devices.

The information regarding the factor priority may be set by an identification information priority setting, which is information indicating the order of the factor priority by information that identifies the device.

According to the above configuration, by identifying individual devices based on the identification information priority setting, it is possible to set factor priorities in a more detailed and appropriate manner.

The grouping processing unit may perform grouping based on the occurrence time of the event.

With the above configuration, events that occur close together are expected to have a causal relationship, so by treating these as a related event group, the cause can be appropriately identified.

The information processing device may further include a setting unit that reads configuration information indicating the connection relationship of the network and sets the event correlation information.

The above configuration allows event correlation information to be set without the need for user input, thus reducing the user's workload.

The information processing device may be a programmable logic controller (PLC), and the logs may be collected from a slave device connected to the PLC.

With the above configuration, a system can be easily constructed that uses a program in the PLC to collect logs from the PLC and slaves connected to the PLC.

The information processing device may be a slave device controlled by a programmable logic controller (PLC), and may collect the logs from a lower-level device connected to the slave device.

The above configuration makes it easy to build a system in which a slave connected to a PLC collects logs from that slave and from lower-level devices on a subordinate network connected to that slave.

The information processing device may be a PC (Personal Computer) connected to a PLC (Programmable Logic Controller), and may acquire the log from the PLC.

The above configuration makes it easy to build a system in which a PC connected to a PLC collects logs from the PLC and the slaves connected to the PLC.

In order to solve the above problem, an information processing method of an information processing device according to another aspect of the present invention is an information processing method of an information processing device connected to a network to which multiple devices are connected, and includes a log acquisition step of acquiring a log that records information processing events performed in at least one of the device itself and other devices connected to the device itself via the network, a grouping processing step of grouping the multiple events recorded in the log into a related event group based on a predetermined criterion, an identification step of identifying a causal event that is a cause of the occurrence of the related event group from the related event group, and an output step of outputting the causal event identified by the identification unit, and the identification unit identifies the causal event using event correlation information that indicates information for identifying the causal event for each type of event.

The information processing device according to each aspect of the present invention may be realized by a computer. In this case, the control program of the information processing device that causes the computer to operate as each unit (software element) of the information processing device to realize the information processing device, and the computer-readable recording medium on which it is recorded, also fall within the scope of the present invention.

According to one aspect of the present invention, it is possible to identify the causative event from among multiple events that occur simultaneously.

1 is a block diagram showing a configuration of a main part of an information processing system according to a first embodiment. FIG. 1 is a schematic diagram of a method for determining related events from logs. FIG. 13 is a schematic diagram of another method for obtaining a group of related events from a group of logs. FIG. 4 is a diagram illustrating an example of event correlation information according to the first embodiment. FIG. 4 is a diagram showing a process of identifying a causal event according to the first embodiment. 4 is a flowchart showing an operation of the information processing system according to the first embodiment. FIG. 11 is a block diagram showing a configuration of a main part of an information processing system according to a second embodiment. FIG. 11 is a block diagram showing a configuration of a main part of an information processing system according to a third embodiment. FIG. 13 is a diagram illustrating an example of event correlation information according to the third embodiment.

[Embodiment 1]
Hereinafter, an embodiment according to one aspect of the present invention (hereinafter, also referred to as "the present embodiment") will be described with reference to the drawings. In the drawings, the same or corresponding parts are designated by the same reference characters and their description will not be repeated.

§1. Application Example Fig. 1 is a block diagram showing the configuration of the main parts of an information processing system 100 according to embodiment 1. The information processing system 100 includes a PC (Personal Computer) (information processing device) 1, a PLC (Programmable Logic Controller) (information processing device) 2, a slave (information processing device) A (slave device) 3, a slave B (slave device) 4, a communication means 5, and a network 6.

The PC 1 collects logs 2a, 3a, and 4a that store events from each device on the network 6, such as the PLC 2, slave A 3, and slave B 4. The collected logs are divided into several groups based on the time the event occurred, and predetermined processing is performed on them based on the event correlation information 22 to identify the event that caused the event.

§2. Configuration example (configuration of information processing system 100)
The information processing system 100 will be described in more detail below. The PC 1 communicates with the PLC 2 and operates based on information obtained from the PLC 2, the slave A 3, and the slave B 4. The PC 1 can take various forms, and may be a notebook computer or a server personal computer.

PLC2 is a control device in the information processing system 100. PLC2 is not limited to a PLC and may be any control device.

Slaves A3 and B4 are slaves on network 6 controlled by PLC 2. The number of slaves subordinate to PLC 2 is not limited to two, and may be any number. Slaves on network 6 include various devices such as actuator drivers, communication couplers, and image processing units, in addition to general-purpose I/O units.

The communication means 5 is a means for communication between the PC 1 and the PLC 2, and is any communication means such as USB (Universal Serial Bus) (registered trademark), EtherNet (registered trademark), and serial communication.

Network 6 is a network that can transmit and receive information between devices, and may be a so-called field network. Network 6 may employ various protocols, such as EtherNet (registered trademark), EtherCAT (registered trademark), EtherNet/IP (registered trademark), DeviceNet (registered trademark), and CompoNet (registered trademark).

(Configuration of devices on network 6)
Slave A3 and slave B4 store logs 3a and 4a, respectively, and transmit the logs 3a and 4a to PLC 2 via network 6. PLC 2 stores log 2a, and transmits the logs 2a, 3a, and 4a, along with the received logs 3a and 4a, to PC 1 via communication means 5. PC 1 can therefore obtain the logs of devices on network 6. The contents of logs 2a, 3a, and 4a will be described later.

(Configuration of PC1)
The PC 1 includes a control unit 10 and a storage unit 20. The control unit 10 includes a log acquisition unit 11, a grouping processing unit 12, an identification unit 13, an output unit 14, and a setting unit 15. The storage unit 20 includes event correlation information 22 configured from an identification information priority list (identification information priority setting) 221 and a configuration information priority setting 222, and a network configuration 23.

The log acquisition unit 11 acquires the log 2a of the PLC 2, as well as the log 3a of the slave A 3 and the log 4a of the slave B 4. That is, the events in the information processing system 100 are acquired as a log group. The log acquisition unit 11 outputs the log group to the grouping processing unit 12.

(Grouped into related events)
The grouping processing unit 12 performs a predetermined process on the log group acquired by the log acquisition unit 11, thereby grouping events included in the log group into a related event group. The grouping is performed using the occurrence time of the event as a key. The grouping processing unit 12 outputs the related event group to the identification unit 13. A related event group is a grouping of multiple events included in the log group into at least one or more related events.

Figure 2 is an overview of a method for determining a related event group L2 from a log group L1. Specifically, if the time difference between the occurrence times of an event in the log group L1 and a previously occurring event is within a predetermined time, it is determined that the related events are the same related event group L2. For example, if the time difference in the log group 311 (L1) is "1 second," and if the "time difference is less than 1 second," it is determined that the related events are the same related event group L2 and grouped as indicated by reference numeral 312. Also, if the time difference in the log group 311 (L1) is "3 seconds," and if the "time difference is less than 3 seconds," it is determined that the related events are the same related event group L2 and grouped as indicated by reference numeral 313.

Figure 3 is an overview diagram of another method for determining the related event group L2 from the log group L1. Specifically, the log group L1 is divided into groups at regular intervals. For example, in the log group 321 (L1), if the period is "1 second", the related event group L2 is grouped as indicated by the reference numeral 322 with one related event group L2 at the occurrence time of "00:00:01", one related event group L2 at "00:00:02", one related event group L2 at "00:00:04", and one related event group L2 at "00:00:07". In addition, in the log group 321 (L1), if the period is "5 seconds", the related event group L2 is grouped as indicated by the reference numeral 323 with one related event group L2 at "00:00:01-00:00:05" and one related event group L2 at "00:00:06-00:00:10".

(Event correlation information)
The event correlation information 22 is information that organizes and summarizes factors that cause various events to occur in the information processing system 100. The event correlation information 22 may be in the form of a table.

FIG. 4 is a diagram illustrating an example of event correlation information 22 according to embodiment 1. As shown in FIG. 4, the event correlation information 22 includes an event name, a causal event, a configuration information priority setting 222, and an identification information priority list 221.

A causal event is an event that causes the occurrence of a particular event. In other words, if a causal event and a secondary event that occurs secondary to the causal event occur simultaneously, it is considered that the secondary event occurred because of the occurrence of the causal event. There is no limit to one causal event for an event, and there may be multiple causal events. For example, event A in Figure 4 can be caused by event B or event C.

The identification information priority list 221 is the order in which multiple causal events are prioritized. For example, the identification information priority list for "Event A" in FIG. 4 is "PLC, Slave A, Slave B," which indicates that if Event A occurs in Slave A3 and Event A occurs in Slave B4 at the same time, Event A occurring in Slave A3 becomes the causal event.

In addition, in the identification information priority list 221, the devices on the network 6 can be arbitrarily selected by the user, such as "Slave A, Slave B" in "Event B" in FIG. 4. In this case, the user can set the priority of the device that is the cause regardless of the configuration information of the network 6, so that the setting can be made according to the actual system application.

As shown in Figure 4, in a system connected via a network, if an information processing event such as a communication anomaly occurs in some of the devices on the network, a chain reaction of events may occur. Specifically, event C (e.g., "slave communication anomaly") occurs in the slave, which causes event B (e.g., "communication synchronization anomaly") to occur in the communication coupler, and event A (e.g., "link off anomaly") to occur in the PLC. In this case, event C is the causal event, and event A/event B are secondary events.

Similarly, not only communication anomalies in a network, but also equipment anomalies can trigger a chain reaction of secondary events (such as anomalies) caused by the occurrence of a causal event. In this way, event correlation information is also information that indicates the chain relationship between multiple events.

(Event correlation information settings)
The network configuration 23 is the configuration of the network 6. That is, it is a configuration that indicates what is the master and in what order the slaves are connected in the network 6. For example, in the network 6 in Fig. 1, the master is "PLC", and the slaves are connected in the order of "slave A" and "slave B".

The configuration information priority setting 222 is a parameter for determining the identification information priority list 221. For example, if the configuration information priority setting is "first slave", it is the first device on the network 6, and if it is "last slave", it is the last device on the network 6. It can also be set arbitrarily by the user, such as "slave A, slave B", etc.

The setting unit 15 creates and sets the identification information priority list 221 by referring to the network configuration 23 and the configuration information priority setting 222. Based on the configuration information priority setting 222, it is determined which event correlation information 22 is to be prioritized in the network configuration 23. Therefore, if the configuration information priority setting 222 is "first slave", the identification information priority list 221 is allocated in the order of priority from the top of the network 6, and if the configuration information priority setting 222 is "last slave", the identification information priority list 221 is allocated in the order of priority from the bottom of the network 6.

(Identifying the causal event)
The identification unit 13 identifies a causal event in the associated event group L2.

First, each event is considered to be a causal event candidate, and the causal event of each event is confirmed. If the causal event has some other event and is in the causal event candidates, the event is considered to be a secondary event and is removed from the causal event list. If the causal event is "none" or is not in the causal event candidates, the event is considered to be a possible causal event and is left in the causal event candidates. This process is performed for all causal event candidates. Next, if the same event has occurred in different devices among the causal event candidates, they are prioritized according to the order based on the identification information priority list 221 in the event correlation information. As a result, the true causal event is determined.

Figure 5 is a diagram showing the process of identifying a causal event according to the first embodiment. Hereinafter, the process of identifying a causal event from the related event group L2 in the event correlation information 22 in Figure 4 will be specifically described with reference to Figures 4 and 5.

There is a related event group 331 (L2), which includes six events, events 331a to 331f. The related event group 331 (L2) includes "Event A", "Event B", and "Event C". With reference to the event correlation information 22, the causal event of "Event A" is "Event B", and the causal event of "Event B" is "Event C". Therefore, in the related event group 331 (L2), "Event C" is the causal event candidate 332, and events 331c, 331e, and 331f are applicable.

In this case, if there is only one possible causal event 332, that event is the true causal event 333.

Because there are multiple causal event candidates 332, the identification information priority list in the event correlation information 22 is used to further narrow down the candidates and identify the true causal event 333. Referring to the event correlation information 22, it can be seen that the identification information priority list 221 for "Event C" has the first candidate as "Slave B4", the second candidate as "Slave A", and the third candidate as "PLC". Therefore, from among the causal event candidates 332, event 331c that occurred in "Slave B" is identified as the true causal event 333. The identification unit 13 outputs the identified causal event 333 to the output unit 14.

(Output of cause event)
The output unit 14 outputs the identified true cause event 333 to another program or another device. As a form of output, a cause log L3 summarizing the true cause events 333 may be constructed, a flag indicating that the cause event 333 is a true cause event may be set in an existing log, or the cause event 333 may be displayed on a screen. The true cause event 333 may also be output to another device, or may be displayed on an HMI (Human Machine Interface) such as a touch panel. The operation of the output unit 14 is not limited to these, and may be an operation of outputting any cause event 333.

§3. Operation Example Fig. 6 is a flowchart showing the operation of the information processing system 100 according to the first embodiment.

In S11, the log acquisition unit 11 acquires logs from PLC2, slave A3, and slave B4, respectively, and sets the logs as log group L1. The targets from which logs are acquired are not limited to these, and may be any device that shares the network 6. The log acquisition unit 11 outputs the log group L1 to the grouping processing unit 12.

In S12, the grouping processing unit 12 groups the log group L1 into a related event group L2. The grouping processing unit 12 outputs the related event group L2 to the identification unit 13.

In S13, the identification unit 13 identifies a causal event from the related event group L2 based on the event correlation information 22. The identified causal event is output to the output unit 14.

In S14, the output unit 14 outputs the cause events identified for each related event together in a cause log L3.

§4. Function and Effect The PC 1 acquires logs from devices on the network 6, organizes them into a log group L1, and then groups them into a related event group L2, and can identify the causal event for each related event I based on the event correlation information 22. This makes it easy to identify the true causal event from among many events, and to take measures.

By checking the identification information priority list 221, the event correlation information 22 can identify the true causal event from among multiple identical causal event candidates in different devices. In addition, the identification information priority list 221 can be easily set using the configuration information priority setting 222 and the network configuration 23. With the configuration information priority setting 222, if the causal event is an event that occurs uniquely in a certain device, without taking the network configuration 23 into consideration, the device of the event can also be specified in the identification information priority list 221.

The log group L1 can be grouped into related events I by the occurrence time of each event. When grouping by occurrence time, the grouping process can be performed by the time difference between the occurrence times or the period of occurrence times, making it possible to handle cases where multiple events do not occur simultaneously. That is, depending on the priority of the program, a related event (secondary event) may occur with a time difference from the event that is the true cause. An event may also propagate via the network 6 from one device that has caused a different event on the network 6 to another device, in which case a time difference is likely to occur. Even in these cases, grouping can be performed by allowing a range for the occurrence time.

[Embodiment 2]
Other embodiments of the present invention will be described below. For ease of explanation, the same reference numerals are given to components having the same functions as those described in the above embodiment, and the description thereof will not be repeated.

Figure 7 is a block diagram showing the configuration of the main parts of an information processing system 100a according to the second embodiment. The information processing system 100a includes a PLC 2, a slave A 3, a slave B 4, and a network 6. The second embodiment differs from the first embodiment in that the device that identifies the causal event is the PLC 2, not the PC 1.

PLC2 includes a control unit 10 and a memory unit 20a. Unlike memory unit 20, memory unit 20a further includes a log 2a that stores events that occur in PLC2.

In the second embodiment, unlike the first embodiment, the process of identifying a cause event can be performed by the PLC alone, without using the PC1. Therefore, using the network 6, each time an abnormality occurs on the network 6, a log group L1 can be constructed, and a cause log L3 can be constructed and saved.

The advantage of this is that when logs from devices on network 6, such as PLC 2, slave A 3, and slave B 4, are saved in temporary memory, processing can be performed before the temporary memory is overwritten with other data. In other words, processing can be performed to identify the causative event in real time when an event occurs, or at a slightly delayed time interval, making it less likely that an event will be overlooked. Therefore, even in situations where there are no tools available on a PC, the causes of multiple events that have occurred can be easily identified, making it easier to take measures.

[Embodiment 3]
Other embodiments of the present invention will be described below. For ease of explanation, the same reference numerals are given to components having the same functions as those described in the above embodiment, and the description thereof will not be repeated.

Figure 8 is a block diagram showing the configuration of the main parts of an information processing system 100b according to embodiment 3. Information processing system 100b includes a PLC 2, slave A3, slave B4, network 6, module A7, module B8, and lower network 9. Embodiment 3 differs from embodiment 1 in that the device that identifies the cause event is slave A3, not PC1. Slave A3 also operates as the master of lower network 9. In other words, embodiment 3 differs from embodiment 1 in that the network configuration is nested.

The lower network 9 may be a field network or a bus communication. Examples of the slave that serves as the master in the third embodiment include a communication coupler that complies with the communication standard of the field network.

Slave A3 includes a control unit 10 and a memory unit 20b. Memory unit 20b differs from memory unit 20 in that it further includes a log 3a, that event correlation information 22 becomes event correlation information 22b, and that network configuration 23 becomes network configuration 23b. Event correlation information 22b includes an identification information priority list 221b and configuration information priority settings 222b, which differ from identification information priority list 221 and configuration information priority settings 222 in embodiment 1.

Module A7 and module B8 each have a log 7a and a log 8a that store events that have occurred in the device itself. These logs 7a and 8a are communicated to slave A3 via lower network 9. Module A7 and module B8 are, for example, slave units of a field network or modules that comply with the standards for communication couplers.

Figure 9 is a diagram showing an example of event correlation information 22b according to embodiment 3. Unlike embodiment 1, in embodiment 3, the event correlation information 22b includes an attached priority list 223b (identification information priority setting) and attached priority setting (configuration information priority setting) 224b in addition to an identification information priority list 221b and a configuration information priority setting 222b.

The attached priority list 223b defines the order for identifying causal events on the lower network 9. In other words, by identifying causal events from events that occur in modules that make up the lower network on the lower network 9, it becomes possible to identify the cause and location of the event in more detail.

The attached priority setting 224b is a user setting that defines the order in which an event occurring in a module is identified as a causal event among multiple events occurring in the lower network 9. Specifically, for example, there is a "leading module," which refers to the slave itself (e.g., slave A3) equipped with a communication function that serves as the master of the lower network.

Network configuration 23b includes the configuration of network 6 as well as the configuration of lower network 9. The attached priority list 223b is set by network configuration 23b and attached priority setting 224b.

In the third embodiment, unlike the first embodiment, the information processing system 100b (which does not necessarily include the PLC 2) composed of only slaves can also be executed, so that the processing can be performed by the device alone. Therefore, the lower network 9 can be used to periodically construct a log group L1, and to construct and store a cause log L3.

The advantage of this is that when logs from devices on the lower network 9, such as slave A3, module A7, and module B8, are saved in the temporary memory, processing can be performed before the temporary memory is overwritten with other data. In other words, processing can be performed to identify the causative event in real time when an event occurs, or at a slightly delayed time interval, making it less likely that an event will be overlooked. Therefore, even in situations where there are no tools available on the PC, the causes of multiple events that have occurred can be easily identified, making it easier to take measures.

In addition, by identifying the cause log on a slave-by-slave basis on the network 6, processing on higher-level devices (e.g., PLC 2 or PC 1) is reduced, improving the processing efficiency of identifying cause events across the entire information processing system.

[Software implementation example]
The functions of the information processing devices (hereinafter referred to as "devices"), which are PC1, PLC2, and slave A3, can be realized by a program for causing a computer to function as the device, and a program for causing a computer to function as each control block of the device (particularly each part included in the control unit 10).

In this case, the device includes a computer having at least one control device (e.g., a processor) and at least one storage device (e.g., a memory) as hardware for executing the program. The control device and storage device execute the program, thereby realizing each of the functions described in each of the above embodiments.

The program may be recorded on one or more computer-readable recording media, not on a temporary basis. The recording media may or may not be included in the device. In the latter case, the program may be provided to the device via any wired or wireless transmission medium.

In addition, some or all of the functions of each of the above control blocks can be realized by a logic circuit. For example, an integrated circuit in which a logic circuit that functions as each of the above control blocks is formed is also included in the scope of the present invention. In addition, it is also possible to realize the functions of each of the above control blocks by, for example, a quantum computer.

The processes described in each of the above embodiments may be executed by AI (Artificial Intelligence). In this case, the AI may run on the control device, or on another device (such as an edge computer or a cloud server).

[Additional Notes]
The present invention is not limited to the above-described embodiments, and various modifications are possible within the scope of the claims. Embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included in the technical scope of the present invention.

1 PC (information processing device)
2. PLC (information processing device)
3 Slave A (slave device)
4 Slave B (slave device)
5 Communication means 6 Network 7 Module A
8 Module B
9 Lower network 10 Control unit 11 Log acquisition unit 12 Grouping processing unit 13 Identification unit 14 Output unit 15 Setting unit 20, 20a, 20b Storage unit 22, 22b Event correlation information 23, 23b Network configuration 100, 100a, 100b Information processing system 221, 221b Identification information priority list (identification information priority setting)
222, 222b Configuration information priority setting 223b Attachment priority list (identification information priority setting)
224b Attachment priority setting (configuration information priority setting)
2a, 3a, 4a, 7a, 8a Log L1 Log group L2 Related event group L3 Cause log

Claims (10)

An information processing device connected to a network to which a plurality of devices are connected,
a log acquisition unit that acquires a log that records events of information processing performed in at least one of the device itself and another device connected to the device via the network;
a grouping processing unit that groups the plurality of events recorded in the log into related event groups based on a predetermined criterion;
an identification unit that identifies a causal event that is a cause of occurrence of the related event group from the related event group;
an output unit that outputs the cause event identified by the identification unit,
the identification unit identifies the causal event by using event correlation information indicating information for identifying the causal event for each type of event;
The event correlation information includes, as information for identifying the causal event, information regarding a causal priority of a device in which the event occurs for each type of event . The information processing apparatus according to claim 1 , wherein the information regarding the factor priority is set by a configuration information priority setting that indicates the order of the factor priority by a position in configuration information that indicates a network connection relationship of the apparatus. The information processing apparatus according to claim 1 , wherein the information regarding the factor priority levels is set by an identification information priority level setting that indicates an order of the factor priority levels by information for identifying the apparatus. The information processing apparatus according to claim 1 , wherein the grouping processing unit performs grouping based on an occurrence time of the event. The information processing apparatus according to claim 1 , further comprising a setting unit that reads configuration information indicating a connection relationship of the network and sets the event correlation information. The information processing device according to claim 1 , wherein the information processing device is a programmable logic controller (PLC), and collects the logs from slave devices connected to the PLC. The information processing apparatus according to claim 1 , wherein the information processing apparatus is a slave device controlled by a PLC (Programmable Logic Controller), and collects the logs from lower level devices connected to the slave device. The information processing apparatus according to claim 1 , wherein the information processing apparatus is a personal computer (PC) connected to a programmable logic controller (PLC), and acquires the log from the PLC. An information processing method of an information processing device connected to a network to which a plurality of devices are connected, comprising:
a log acquisition step of acquiring a log that records an event of information processing performed in at least one of the device itself and another device connected to the device itself via the network;
a grouping process step of grouping the plurality of events recorded in the log into related event groups based on a predetermined criterion;
a step of identifying a causal event that is a cause of occurrence of the related event group from the related event group;
an output step of outputting the cause event identified by the identification step,
the identifying step includes identifying the causal event by using event correlation information indicating information for identifying the causal event for each type of event ;
The information processing method of an information processing device , wherein the event correlation information includes, as information for identifying the causal event, information regarding a causal priority of a device in which the event occurred for each type of event . An information processing program for causing a computer to function as the information processing device according to claim 1, the information processing program causing a computer to function as the log acquisition unit, the grouping processing unit, the identification unit, and the output unit.

Images