JP2007241540A - Log information management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve the possibility of error factor research by efficiently recording log information in a limited memory for log in embedded equipment. <P>SOLUTION: Importance information relating to the importance of log information is stored in an importance information storing means 6. When it is detected that the memory 3 for log is full by a full-state detecting means 4, the log information whose importance is the lowest is extracted and erased based on the importance information, and new log information is added. The importance is defined as the order of debug(DEBUG), information(INFO), and error(ERROR). The log information of the oldest DEBUG event is erased for adding new log information to the memory 3 for log. The log information of the DEBUG events is sequentially erased in the ascending order of log information. When the no more log information of the DEBUG event to be erased exists, the log information of INFO events is erased in the ascending order of the log information. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a log information management method, and more particularly to a log information management method in a computer embedded device.

  In a computer or a device controlled by a computer, operation history information (log information) is recorded in order to investigate the cause of the failure when a failure occurs. Since log information is generated in large quantities, it is not possible to record everything in a limited memory. In order to save log information in the limited log memory, when the log memory is full, new log information can be overwritten on the old log information (ring buffer method), or an external log server There is a method to transfer to and save. Examples of related art related to this will be given below.

  The “log recording method” disclosed in Patent Document 1 does not increase the storage amount of the log file indefinitely, and does not delete important log information in the past without being erased by overwriting. This is a recordable log recording method. A plurality of partial log information storage units for storing log information are provided. The recording execution date and time of the last log information is stored in a plurality of partial log information storage units. When recording the log information, if there is no free space in the partial log information storage unit, the last log date is referred to and the elapsed period from the oldest last log date is obtained. When the storage period has passed a preset period, this log information is deleted and new log information is recorded. When there is no file whose period has elapsed, a new partial log information storage unit is generated and the log information generated in the new partial log information storage unit is recorded.

  The “failure information logging device” disclosed in Patent Document 2 is a failure information logging device that can prevent failure information that becomes the root cause of failure from being discarded by making buffer overflow less likely to occur. Detects a failure that occurred in a running device. Fault information including a fault ID and an occurrence time corresponding to the fault content is generated. The occurrence time of the new failure information is compared with the occurrence time of the failure information stored in the buffer with the same failure ID as the new failure information. If the time difference between the two is within the specified value, the new failure information is discarded.

  The “image forming system” disclosed in Japanese Patent Laid-Open No. 2004-228561 always stores operation log information reliably. When the log acquisition target process that is the target of log information acquisition operates, the log information of the operation is written and stored in a ring buffer file system (ring file system). The stored log information is read out by the log information reading process and displayed on the display unit. It forms an image on a transfer sheet and outputs it, or displays it on a PC client connected via a network.

The “information processing apparatus” disclosed in Patent Document 4 is required for analyzing the occurrence of a failure by avoiding the inconvenience that the execution history information output when the failure occurs is overwritten by the execution history information output after the failure has occurred. This is an information processing apparatus that can reliably save execution history information for a certain period as trace log information in an external storage device without incurring redundancy in storage capacity and without causing deterioration in system performance. The trace information storage function unit provided in the execution program main body stores the execution history and its processing state sequentially as trace information in the trace information storage area in the internal memory during program execution. When the trace information output function unit provided in the execution program main body receives the event notification of the failure occurrence from the system monitoring mechanism, the trace information stored in the trace information storage area in the internal memory is placed in the external storage device. Output to one of the trace information files.
Japanese Patent Laid-Open No. 10-11330 Japanese Patent Laid-Open No. 10-301815 Japanese Patent Laid-Open No. 2002-140210 JP 2002-215431 A

  However, the conventional log information management technique has the following problems. In a computer-embedded device that does not have a lot of memory, there is not enough memory to store log information, and it is necessary to store log information in a limited memory. When the log memory is full, important information cannot be recorded unless there is an external log server. Providing an external log server for all computer embedded devices is not possible in terms of cost. If log information is recorded by the ring buffer method, important log information will be erased. Of the log information related to the failure that occurred, only the latest log information can be saved. In the case of a failure whose root cause has occurred a long time ago, the cause cannot be determined from the log information.

  An object of the present invention is to solve the above-described conventional problems and efficiently record log information in a limited log memory in a computer embedded device or the like to increase the possibility of investigating the cause of an error. .

  In order to solve the above problems, in the present invention, the log information management method includes a log memory for storing log information, importance information holding means for holding importance information regarding importance of log information, Full detection means for detecting that the log memory is full, and extracting the oldest of the least important log information based on the importance information in response to detecting that the log memory is full And extracting means for deleting the extracted log information, and additional writing means for adding new log information to the log memory. In addition, there is provided an extracting means for extracting the oldest log information linked to the log information of the successful end event in response to detecting that the log memory is full. In addition, there is provided an extracting means for extracting log information linked to the log information of the event that has been successfully completed in response to the event having been successfully completed.

  By configuring as described above, log information with low importance is deleted from the oldest according to the importance set in advance, so what is not so necessary for failure analysis is deleted and the latest important log information is accumulated can do. In addition, since the log information of the successful end event is deleted from the oldest one, the log information almost irrelevant to the failure analysis can be deleted, and the log memory can be widely released at once. Further, by not storing log information linked to the successful end event, memory consumption can be reduced, and failure analysis can be performed at high speed only by using log information related to failure analysis.

  Hereinafter, the best mode for carrying out the present invention will be described in detail with reference to FIGS.

  The first embodiment of the present invention retains importance information related to the importance of log information, and when the log memory becomes full, the log information having the lowest importance is selected based on the importance information. This is a log information management method in which the oldest one is deleted and new log information is added.

  FIG. 1 is a conceptual diagram of a log information management method in Embodiment 1 of the present invention. The basic configuration of the log information management method according to the first embodiment of the present invention is the same as the conventional one. The appending and deletion processing methods are different from the conventional ones. In FIG. 1, event detection means 1 is means for detecting an event for which log information is to be recorded. The appending means 2 is means for appending new log information to the log memory. The log memory 3 is a memory for storing log information. The full detection means 4 is a means for inspecting whether the log memory is full. The extracting means 5 is a means for extracting the oldest log information with the lowest importance. The importance information holding means 6 is means for holding importance information of log information. The deletion means 7 is means for deleting the extracted log information from the log memory.

  FIG. 2 is a log information table of the log information management method according to the first embodiment of the present invention. Table 1 in FIG. 2A is a table showing a state where log information is recorded until the log memory becomes full. Table 2 in FIG. 2B is a table showing a state in which the oldest log information having the lowest importance is deleted when the log memory is full. FIG. 3 is a flowchart showing the processing procedure of the log information management method.

  The function and operation of the log information management method according to the first embodiment of the present invention configured as described above will be described. First, an overview of the function of the log information management method will be described with reference to FIG. Event detection means 1 detects an event for which log information is to be recorded. For example, an event to be recorded is detected by receiving notification of the occurrence of the event by an interrupt or the like and examining the type of the event. When an event to be recorded is detected, the full detection means 4 checks whether the log memory 3 is full. If not full, new log information is stored in the log memory 3. If it is full, the extraction means 5 refers to the importance information holding means 6 to obtain the importance information of the log information, and extracts the oldest log information having the lowest importance. The deleting means 7 deletes the least important log information from the log memory. After that, the additional log means 2 adds new log information to the log memory.

  Next, a method for adding log information will be described with reference to FIG. In advance, importance level information of log information is set in the importance level information holding means 6. With reference to this importance level information, when the log memory 3 is full, the log information is deleted from the less important log information. When log information is stored in the log memory 3, a log as shown in Table 1 of FIG. For simplicity, it is assumed that the log memory 3 has 10 lines. In this case, in order to add log information of a new event, it is necessary to delete old and less important log information. If the oldest DEBUG event is deleted, the log shown in Table 2 shown in FIG. Here, it is assumed that the importance increases in the order of debugging (DEBUG), information (INFO), and error (ERROR). Therefore, the log information of DEBUG events is erased one after another from the oldest. When there is no DEBUG event log information to be deleted, the INFO event log information is deleted in order of oldest. This information type is information explicitly added by each application when event log information is added.

  Next, the processing procedure of the log information management method will be described with reference to FIG. In step 1, the process waits until detection of an event to be logged. When an event is detected, it is checked in step 2 whether the log memory 3 is full. If not full, the log information is stored in the log memory 3. If it is full, in step 3, the importance level information is referred to and the oldest log information having the lowest importance level is extracted. In step 4, the extracted log information is deleted from the log memory 3. In step 5, the log information is stored in the log memory 3. In step 6, the process is repeated until log information management is completed.

  As described above, in the first embodiment of the present invention, the log information management method is based on the importance information when the importance information regarding the importance of the log information is held and the log memory is full. The oldest log information of the lowest importance is deleted, and new log information is added, so that the latest important log information can be accumulated while minimizing the adverse effect on failure analysis. .

  In the second embodiment of the present invention, when the log memory is full, the oldest log information linked to the log information of the successful end event is deleted, and new log information is added to the log memory. This is a log information management method.

  FIG. 4 is a conceptual diagram of a log information management method and a log information table according to the second embodiment of the present invention. The basic configuration of the log information management method in the second embodiment of the present invention is the same as that in the first embodiment. However, the appending and deletion processing methods are different. In FIG. 4A, event detection means 1 is means for detecting an event for which log information is to be recorded. The appending means 2 is means for appending new log information to the log memory. The log memory 3 is a memory for storing log information. The full detection means 4 is a means for inspecting whether the log memory is full. The extracting means 5 is means for extracting the oldest log information among the log information linked to the log information of the successful end event. The deletion means 7 is means for deleting the extracted log information from the log memory. Table 3 in FIG. 4B is a table showing a state in which the oldest log information in the log information linked to the log information of the successful end event is deleted when the log memory is full. FIG. 5 is a flowchart showing the processing procedure of the log information management method.

  The function and operation of the log information management method according to the second embodiment of the present invention configured as described above will be described. First, an overview of the log information management function will be described with reference to FIG. Event detection means 1 detects an event for which log information is to be recorded. When an event to be recorded is detected, the full detection means 4 checks whether the log memory is full. If not full, log information is stored in the log memory 3. If it is full, the extracting means 5 extracts the oldest log information among the log information linked to the log information of the successful end event. The deleting unit 7 deletes the extracted log information from the log memory. Thereafter, new log information is added to the log memory 3 by the additional recording means 2.

  Next, a method for adding log information will be described with reference to FIG. When the log memory 3 is full, the oldest log information linked to the log information of the successful end event is erased. In Table 1 of FIG. 2, the link information is placed in the second column, and information from where to where is recorded as the message ID. For simplicity, the message ID is a value between 10 and 999, and a reservation ID between 0 and 9 is used. Of the reservation IDs, the success end is 0 and the error end is 9. One log information sequence ends with 0 or 9. Since 168-> 169-> 0 in the log shown in Table 1 of FIG. 1 has been completed successfully, these two lines are erased when the log memory 3 becomes full. As a result, the log is as shown in Table 3 of FIG.

  Next, the processing procedure of the log information management method will be described with reference to FIG. In step 11, the process waits until detection of an event to be logged. When an event is detected, it is checked in step 12 whether the log memory 3 is full. If not full, the log information is stored in the log memory 3. If it is full, in step 13, the oldest log information in the link of the successful end event is extracted. In step 14, the extracted log information is deleted from the log memory 3. In step 15, new log information is stored in the log memory 3. In step 16, the process is repeated until log information management is completed.

  As described above, in the second embodiment of the present invention, when the log memory is full, the oldest log information linked to the log information of the successful end event is deleted when the log memory is full. Since the new log information is added to the log memory, the latest important log information can be accumulated by widely releasing the log memory at a time while eliminating the adverse effect on the failure analysis.

  The third embodiment of the present invention is a log information management system in which, when an event is successfully completed, the log information linked to the event is deleted, and when the event is not successful, new log information is added to the log memory.

  FIG. 6 is a conceptual diagram of a log information management method and a log information table according to the third embodiment of the present invention. The basic configuration of the log information management method in the third embodiment is the same as that in the first embodiment. However, the appending and deletion processing methods are different. In FIG. 6A, event detection means 1 is means for detecting an event for which log information is to be recorded. The appending means 2 is means for appending new log information to the log memory. The log memory 3 is a memory for storing log information. The extraction unit 5 is a unit that extracts log information linked to the success end event. The deletion means 7 is means for deleting the extracted log information from the log memory. Table 4 in FIG. 6B is a table showing a log in a state where log information linked to the success end event is deleted. FIG. 7 is a flowchart showing the processing procedure of the log information management method.

  The function and operation of the log information management method according to the third embodiment of the present invention configured as described above will be described. First, an overview of the function of the log information management method will be described with reference to FIG. Event detection means 1 detects an event for which log information is to be recorded. When an event to be recorded is detected, log information linked to a successful end event is extracted. The deleting unit 7 deletes the extracted log information from the log memory 3. The additional recording means 2 adds new log information to the log memory 3.

  Next, a method for adding log information will be described with reference to FIG. This is a method that does not save log information of events that have been successfully completed. When an event as shown in Table 1 in FIG. 1 actually occurs, the event is deleted when the message ID becomes 0. Therefore, finally, as shown in Table 4 of FIG. 6B, only the log information of the event that ended in error is stored.

  Next, the processing procedure of the log information management method will be described with reference to FIG. In step 21, the process waits until detection of an event to be logged. If an event is detected, it is checked in step 22 whether the event has been completed successfully. If not successful, the log information is stored in the log memory 3 in step 5. If successful completion, in step 23, log information linked to the successful completion event is extracted. In step 24, the extracted log information is deleted from the log memory 3. In step 26, the process is repeated until log information management is completed.

  As described above, in the third embodiment of the present invention, the log information management method is configured such that, when an event is completed successfully, the log information linked to the event is deleted, and if the event is not completed successfully, new log information is stored in the log memory. Since it is configured to append, log memory consumption can be reduced, and failure analysis can be performed at higher speed.

  The log information management method of the present invention is most suitable as a log information management method in a computer embedded device.

It is a conceptual diagram of the log information management system in Example 1 of this invention. It is a table | surface of the log information of the log information management system in Example 1 of this invention. It is a flowchart which shows the process sequence of the log information management system in Example 1 of this invention. It is the conceptual diagram of the log information management system in Example 2 of this invention, and the table | surface of log information. It is a flowchart which shows the process sequence of the log information management system in Example 2 of this invention. It is the conceptual diagram of the log information management system in Example 3 of this invention, and the table | surface of log information. It is a flowchart which shows the process sequence of the log information management system in Example 3 of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Event detection means, 2 ... Additional recording means, 3 ... Log memory, 4 ... Full detection means, 5 ... Extraction means, 6 ... Importance information holding means, 7. ..Delete means.

Claims (6)

  Log memory for storing log information, importance information holding means for holding importance information relating to the importance of log information, full detection means for detecting that the log memory is full, and An extraction means for extracting the oldest log information of the lowest importance based on the importance information in response to detecting that the log memory is full; a deletion means for deleting the extracted log information; A log information management system comprising: an appending means for appending new log information to the log memory.   A log memory for storing log information, a full detection means for detecting that the log memory is full, and log information of a successful end event in response to detecting that the log memory is full It comprises an extracting means for extracting the oldest log information to be linked, a deleting means for deleting the extracted log information, and an appending means for appending new log information to the log memory. Log information management method.   A log memory for storing log information, an extracting means for extracting log information linked to the log information of the successful end event in response to the successful completion of the event, a deleting means for deleting the extracted log information, A log information management system comprising: an appending means for appending new log information to the log memory.   When the importance level information on the importance level of the log information is retained and it is detected that the log memory for storing the log information is full, the log information with the lowest importance level is determined based on the importance level information. A log information management method comprising extracting and deleting the oldest one and adding new log information to the log memory.   When it is detected that the log memory for storing log information is full, the oldest log information linked to the log information of the successful end event is extracted and deleted, and the log memory is new. A log information management method comprising adding log information.   A log information management method, wherein log information linked to log information of a successful end event is extracted and deleted in response to successful completion of the event, and new log information is added to the log memory.

Images