JP2012108783A - Failure record relaying apparatus, program and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To shorten a process for failure information acquisition in a computer system.SOLUTION: A failure information relaying apparatus comprises: a log information saving part for storing log information that is transmitted from a user terminal facing an event interrupting execution of information processing whenever the event occurs and that includes a log (failure log) relating to the event; and log information transmitting and receiving means for receiving the log information from the user terminal to store it in the log information saving part and for transmitting the failure log from the log information saving part to a maintenance device that searches for a cause of occurrence of the event based on the event.

Description

  The present invention relates to a failure record relay device, a program, and a method.

  System failure monitoring is one of the indispensable elements in computer operation management. As means for preventing a system failure in advance, a CPU (Central Processing Unit) temperature rise monitor, virus check, and the like are known. However, it is difficult to avoid failures such as infection with a new type of computer virus or sudden power failure even with these countermeasures (computer viruses are hereinafter referred to as viruses). As one of countermeasures against failures that cannot be avoided, LOG (hereinafter referred to as a log) that is a log automatically recorded by a computer is analyzed to identify the cause of the failure. In this case, the flow in which the log is automatically sent from the computer where the failure has occurred to the maintenance center via the Internet, and the maintenance center analyzes the cause of the failure is the most efficient.

  However, it is dangerous to connect directly to the Internet when the computer that has failed has data that cannot be transmitted directly to the Internet for security reasons or considering the possibility of being infected by a computer virus. In the case of such a computer, it takes much time to transmit log information for failure analysis to the maintenance center. With conventional technology, when a failure occurs on a computer with highly secure information, log information is not automatically encrypted and saved, and the administrator or maintenance personnel manually collects the log locally. , It took time to start the investigation. In addition, maintenance personnel existed only in remote areas, and it took time to go to the site where the failure occurred. Furthermore, when a computer failure occurs, the maintenance personnel carry the storage in which the log information is saved to the maintenance center and investigate the failure. However, there is a risk of information leakage due to an accident such as loss during transportation. Moreover, even if it is not lost, the maintenance staff manually sends the log information to the maintenance center, so it was not possible to prevent accidents in which information was leaked and the information was leaked.

Patent Document 1 discloses a maintenance USB (Universal Serial) in the event of a system failure.
(Bus) stores the log.

  Patent Literature 2 discloses that a memory card device is connected to a device that provides personal information, etc., and the personal information is stored and removed as usage information. After the usage information is used by the usage device, the personal information is deleted. is doing.

Patent Document 3 discloses that what is recorded in a RAM as a log at the time of failure is registered in a storage unit and used for searching for a failure.

  Patent Document 4 discloses a destruction process that makes data stored in a storage unit meaningless data when unauthorized removal of a memory board or the like occurs.

JP2008-158862 JP 2008-217390 A JP 63-99652 A JP-A-11-175406

  The problem to be solved by the present invention is to shorten the fault information acquisition process of the computer system. The method described in Patent Document 1 is a technique on the premise that connection and removal of the maintenance USB are performed manually, and it takes time to handle the maintenance USB. The method described in Patent Document 2 does not reach a countermeasure for acquiring fault information. Therefore, this method cannot shorten the fault information acquisition process. The method described in Patent Document 3 makes it possible to automate the process from recording the log to the RAM to storing it in the storage unit. However, Patent Document 3 does not mention anything about the timing of taking out log data for analysis. That is, the method described in Patent Document 3 does not allow failure information to be collected promptly when a failure occurs. Therefore, this method cannot shorten the fault information acquisition process. Patent Document 4 discloses data erasure and evacuation for the trouble of unauthorized removal, but makes no mention of log data retrieval. Therefore, the method described in Patent Document 4 cannot shorten the trouble information acquisition process.

  An object of the present invention is to provide a failure record relay device, a program, and a method capable of solving the above-described problems and shortening the failure information acquisition process of a computer system.

  The failure information relay device according to the present invention stores a log information including a log (failure log) related to the event, which is transmitted every time the event occurs from a user terminal in which an event that prevents the execution of information processing has occurred An information saving unit; and receiving the log information from the user terminal and storing the log information in the log information saving unit; searching the failure information from the log information saving unit and the cause of the occurrence of the event from the event; Log information transmission / reception means for transmitting to the maintenance device.

The failure information relay program according to the present invention is:
Log information saving processing for storing, in a log information saving unit, log information including a log (failure log) related to the event, which is transmitted every time the event occurs from a user terminal in which an event that prevents the execution of information processing has occurred , Acquiring the log information from the user terminal and storing it in the log information saving unit,
From the log information saving unit, causes the computer to execute log information transmission / reception processing for transmitting the failure log to a maintenance device that searches the history of past events for an event that has caused the same situation as the event. .

  In the failure information relay method according to the present invention, log information including a log (failure log) related to the event, which is transmitted every time the event occurs, is transmitted from the user terminal in which an event that prevents execution of information processing has occurred. A maintenance device that retrieves from the terminal, stores the log information in the log information saving unit, and searches the failure log from the log information saving unit for events that occurred in the past that bring about the same situation as the event from the history of past events. Send.

  According to the present invention, the failure recovery process of the computer system can be shortened.

FIG. 1 is a block diagram showing a configuration example of the first embodiment of the present invention. FIG. 2 is a flowchart showing the processing of the first embodiment of the present invention. FIG. 3 is a flowchart showing the processing of the second embodiment of the present invention. FIG. 4 is a diagram illustrating an example of a failure log according to the first embodiment of this invention. FIG. 5 is a diagram illustrating an example of a related log according to the first embodiment of this invention. FIG. 6 is a diagram illustrating an example of a related log according to the first embodiment of this invention. FIG. 7 is a sequence chart of the first embodiment of the present invention. FIG. 8 is a flowchart of the second embodiment of the present invention. FIG. 9 is a block diagram showing an example of the configuration of the third exemplary embodiment of the present invention.

(First embodiment)
The first embodiment of the present invention will be described in detail with reference to the drawings as follows. FIG. 1 is a block diagram illustrating a configuration example of the present embodiment.

  The user terminal 100 includes a failure occurrence notification unit 11, a log information creation unit 16, a log information storage unit 12, a log information automatic collection unit 13, a log information encryption unit 14, and a power supply unit 15. The user terminal 100 is disconnected from the network when a failure is detected, and is connected only to the control unit 200 and the failure record relay device 300.

  The failure occurrence notification unit 11, the log information creation unit 16, the log information automatic collection unit 13, and the log information encryption unit 14 include a processor including a CPU (not shown), a memory for work, and a computer program executed by the CPU. It is constituted by a computer circuit provided with a stored recording medium (not shown). The computer circuit may include an interface circuit for connecting to the failure information relay device 300 and the control unit 200. The log information storage unit 12 is a storage unit included in the computer circuit. However, the configuration of the user terminal 100 is not limited to the above computer circuit.

  For example, the failure occurrence notification unit 11, the log information creation unit 16, the log information automatic collection unit 13, the function of the log information encryption unit 14, and the log information storage unit 12 may be realized by hardware combining logic circuits. .

  The failure occurrence notification unit 11 monitors the processor usage rate, the memory usage state, and the temperature of each device in the user terminal 100, and if it detects a state that deviates abnormally from the normal state, it regards this as occurrence of failure information. Note that a failure is defined as an event that prevents execution of a process defined by a computer program. The target to be monitored is not necessarily limited to the above.

  When the failure notification unit 11 detects the occurrence of a failure, the failure notification unit 11 instructs the log information creation unit 16 to create log information. In addition, as described later, the failure occurrence notifying unit 11 receives a log information saving completion notification from the log information encryption unit 14 and notifies the control unit 200 of the occurrence of the failure.

  In response to the notification from the failure occurrence notifying unit 11, the log information creating unit 16 creates a failure log as failure log information by executing a computer program of the CPU. Alternatively, the failure log may be created by hardware that combines logic circuits.

  The log information storage unit 12 stores therein the failure log created by the log information creation unit 16.

  The log information automatic collection unit 13 constantly monitors whether the log information is stored in the log information storage unit 12, and when the storage is detected, the log information is recorded by a unit other than the failure occurrence notification unit 11 (not shown) that occurred in the latest time zone. Collected logs as related logs. The log information automatic collection unit 13 stores the related log together with the failure log in the log information storage unit 12. Information that combines the failure log and the related log is called log information.

  The log information encryption unit 14 encrypts log information so that it can be decrypted by the maintenance center 400 in accordance with the encryption method set by the maintenance center 400. In addition, the log information encryption unit 14 transmits the encrypted log information (hereinafter referred to as an encrypted log) to the failure record relay device 300 after the encryption. The log information transmission / reception unit 32 of the failure record relay device 300 receives this and stores it in the log information saving unit 33. The log information encryption unit 14 includes a save destination information storage unit (not shown) that stores information such as location and capacity regarding the log information save unit 33. The log information encryption unit 14 obtains information necessary for transmission from the save destination information storage unit. When the log information encryption unit 14 receives a notification of the completion of saving of the encrypted log from the log information transmission / reception unit 32, the log information encryption unit 14 notifies the failure occurrence notification unit 11 that the saving has been completed.

  The power supply unit 15 supplies power necessary for operation from the user terminal 100 to the failure record relay device 300. In addition, the power supply unit 15 supplies power for charging to the rechargeable battery 36 of the failure record relay device 300. A solid line 150 indicates a signal for monitoring the operation of the power supply unit 15, and broken lines 151 and 152 indicate power supply.

  In response to the log information saving completion notification from the log information encryption unit 14 of the user terminal 100, the control unit 200 sends the encrypted log to the maintenance center 400 of the encrypted log to the log information transmission instruction unit 31 of the failure record relay device 300. Command transmission.

  The failure record relay device 300 includes a log information transmission instruction unit 31, a log information transmission / reception unit 32, a log information save unit 33, a log information deletion unit 34, a power supply determination unit 35, and a rechargeable battery 36. The failure record relay device 300 can be connected to a network.

  The log information transmission instructing unit 31, the log information transmitting / receiving unit 32, the log information erasing unit 34, and the power supply determining unit 35 include a CPU (not shown), a processor including a memory for the operation, and a computer program executed by the CPU. It is constituted by a computer circuit provided with a stored recording medium (not shown). The computer circuit may include an interface circuit for connecting to the user terminal 100 and the control unit 200. The log information saving unit 33 is a storage unit included in the computer circuit. However, the configuration of the failure record relay device 300 is not limited to the computer circuit described above.

  For example, the functions of the log information transmission instructing unit 31, the log information transmitting / receiving unit 32, the log information erasing unit 34, the power supply determining unit 35, and the log information saving unit 33 may be realized by hardware combining logic circuits.

  In response to an instruction from the control unit 200, the log information transmission instruction unit 31 instructs the log information transmission / reception unit 32 to transmit an encrypted log to a maintenance center (also referred to as a maintenance device) 400.

  The log information transmission / reception unit 32 stores the encrypted log received from the log information encryption unit 14 in the log information saving unit 33 and notifies the log information encryption unit 14 of completion of saving after the storage is completed. Further, the log information transmission / reception unit 32 receives an instruction from the log information transmission instruction unit 31, acquires the encrypted log from the log information saving unit 33, and transmits this to the maintenance center 400. Further, the log information transmitting / receiving unit 32 receives the encrypted log reception notification from the maintenance center 400 and instructs the log information erasing unit 34 to erase the encrypted log in the log information saving unit 33.

  The log information saving unit 33 stores the encrypted log stored by the log information transmitting / receiving unit 32.

  The log information erasure unit 34 erases the encrypted log stored in the log information saving unit 33 according to an instruction from the log information transmission / reception unit 32.

  The power supply determination unit 35 determines whether or not the power supply from the power supply unit 15 is stopped. If the power supply determination unit 35 has stopped, the log information deletion unit 34 sends the encryption in the log information saving unit 33. Instructs to clear the log. The power supply determination unit 35 switches the power supply source to the rechargeable battery 36 when the power supply from the power supply unit 15 is stopped. The power supply determination unit 35 switches the power supply source from the rechargeable battery 36 to the power supply unit 15 when the power supply from the stopped power supply unit 15 is restored.

  The rechargeable battery 36 supplies power to the failure record relay device 300 instead of the power supply unit 15 when the power supply determination unit 35 determines that the power is stopped.

  The maintenance center 400 is located on the network, analyzes the logs sent from various terminals, identifies the cause of the failure, and notifies each terminal of the countermeasure via the failure record relay device 300. The maintenance center 400 has a log record analyzed in the past as a history. The maintenance center 400 searches the history for the same event as the event recorded in the sent log, and notifies each terminal of the recorded cause and the measures taken to solve it.

  FIG. 2 is a flowchart showing processing of the first embodiment of the present invention. The failure occurrence notifying unit 11 of the user terminal 100 constantly monitors for failures (step S1, hereinafter “step” is omitted). The types of failures to be monitored include an excessively high usage rate of the processor, an excessively high occupation rate of the memory, and a temperature rise of various devices such as a CPU. When the failure occurrence notifying unit 11 confirms the occurrence of a failure (S2 YES), it outputs a log information creation command to the log information creation unit 16. In response to this creation command, the log information creation unit 16 creates a failure log, and stores the created failure log in the log information storage unit 12 (S3). FIG. 4 is a diagram illustrating an example of a failure log stored in the failure log storage unit 12. This example is a failure log when a case where the CPU usage rate exceeds 90% is defined as an abnormal situation. This failure log includes the occurrence date and time of the abnormal situation (2010.10.20, 12:12:15 (indicating hour: minute: second)), detection unit (CPU usage rate measurement unit), and status (90% or more) Is recorded.

  In order to analyze the log information and identify the cause, the maintenance server 400 not only provides information on sensors managed by the failure notification unit 11, but also log information (other events that have occurred in the user terminal 100 at the time of failure ( Related logs) may also be required. In this example, it is assumed that, in addition to the above failure log, an application usage log and a virus scan log are recorded as related logs in the log information storage unit 12 in the most recent time zone. FIG. 5 shows an example of an application usage log in a time period including a time point when the CPU usage rate exceeds 90%. Note that the example of FIG. 5 takes 3 minutes before and after the failure occurrence time as the time zone width, but the time zone width is limited to this width as long as it includes the failure occurrence time. It is not a thing. Further, the related log may be an application usage log at a time immediately before the failure occurrence time. This log information records information that identifies the use date and time of the application, the application name, events such as storage, editing, and deletion, and the location where the event occurred. For example, just before 12:12:15 when the abnormal situation shown in FIG. 4 has occurred, the attached file of the e-mail is downloaded and opened (12:11:00).

  Also, the virus scan log (FIG. 6) of 12:11:30, which is the latest time, indicates that one file infected with a virus has been found and this virus has not been disinfected. Note that FIG. 6 shows only the virus scan log recorded at the time immediately before the failure occurrence time, but the related log need not necessarily be only the virus scan log recorded at the time immediately before the failure occurrence time. . The related log may be all virus scan logs recorded in a predetermined time zone including the failure occurrence time.

  Based on the operation of the CPU, the log information automatic collecting unit 13 searches for related logs generated in the time zone immediately before the failure of FIG. 4 as shown in FIG. 5 and FIG. (S4). The log information automatic collection unit 13 stores related log information as shown in FIGS. 5 and 6 together with the failure log of FIG. 4 as log information and stores it in the log information storage unit 12.

  The log information encryption unit 14 encrypts the log information stored in the log information storage unit 12 by a method that enables the maintenance center 400 to decrypt the log information (S5) to obtain an encrypted log, and the log information of the failure record relay device 300 It transmits to the transmission / reception part 32 (S6), and waits until it receives an encryption log evacuation notification.

  The log information transmission / reception unit 32 stores the encrypted log in the log information saving unit 33 (S7), and transmits an encryption log saving notification to the log information encryption unit 14 of the user terminal 100 when the log is completed, and the saving is completed. Is notified (S8). Thereafter, the log information transmission / reception unit 32 waits until receiving an instruction to transmit an encrypted log from the control unit 200 to the maintenance center 400 via the log information transmission instruction unit 31. The end point detection flag is set in the encrypted log, and by confirming the end point detection flag, the log information transmitting / receiving unit 32 recognizes that all the encrypted logs have been received (evacuation completed).

  Upon receiving this encrypted log save notification, the log information encryption unit 14 notifies the failure completion notification unit 11 of the completion of the save (S9), and the failure occurrence notification unit 11 notifies the control unit 200 of the completion of the save (S10). ). Upon receiving this notification, the control unit 200 instructs the failure record relay device 300 to transmit the encrypted log to the maintenance center 400 (S11). Upon receiving this instruction, the log information transmission instruction unit 31 of the failure record relay device 300 instructs the log information transmission / reception unit 32 to transmit the encrypted log to the maintenance center 400.

  The log information transmitting / receiving unit 32 acquires the stored encrypted log from the log information saving unit 33 and transmits it to the maintenance center 400 (S12). After receiving the notification of reception of the encrypted log from the maintenance center (S13), the log information transmitting / receiving unit 32 instructs the log information deleting unit 34 to delete the encrypted log stored in the log information storage unit 12 ( S14).

  FIG. 9 is a sequence chart showing the operation of the first exemplary embodiment of the present invention. In the user terminal 100, the failure occurrence notifying unit 11 detects a failure (SQ1) and notifies the log information creating unit 16 of this. The log information creation unit 16 creates a failure log and stores it in the log information storage unit 12 (SQ2). The failure log has information for investigating the cause of the failure. When the log information automatic collection unit 13 detects the storage of the failure log, the log information automatic collection unit 13 collects related logs, and stores them in the log information storage unit 12 together with the failure log as log information (SQ3).

  The log information encryption unit 14 encrypts the log information and transmits the encrypted log to the log information transmission / reception unit 32 of the failure record relay device 300 (SQ4). Information such as an address necessary for transmission to the failure record relay device 300 is stored in, for example, a memory (not shown) in the user terminal 100 that cannot be rewritten.

  When the log information transmitting / receiving unit 32 acquires the encrypted log from the log information encrypting unit 14, the log information transmitting / receiving unit 32 stores the encrypted log in the log information saving unit 33 (SQ5). When the storage of the encrypted log in the log information saving unit 33 is completed, the log information transmitting / receiving unit 32 transmits an encrypted log saving notification to the log information encryption unit 14 (SQ6).

  Upon receiving the encrypted log save notification, the log information encryption unit 14 sends a save completion notification to the failure occurrence notification unit 11 (SQ7). The failure occurrence notifying unit 11 notifies the control unit 200 of the completion of saving to the log information saving unit 33 of the failure recording relay device 300 (SQ8). Information such as an address necessary for transmission to the control unit 200 is stored in a memory (not shown) in the user terminal 100 that cannot be rewritten.

  Upon receiving this notification, the control unit 200 instructs the log information transmission instruction unit 31 of the failure record relay device 300 to transmit the encrypted log information stored in the log information saving unit 33 to the maintenance center 400. (SQ9).

  Upon receiving the instruction, the log information transmission instruction unit 31 instructs the log information transmission / reception unit 32 to transmit the encrypted log to the maintenance center 400. The log information transmitting / receiving unit 32 that has received the command acquires the encrypted log from the log information saving unit 33 and transmits it to the maintenance center 400 (SQ10). Information such as an address necessary for transmission to the maintenance center 400 is stored in a memory (not shown) that cannot be rewritten in the failure record relay device 300.

  The maintenance center 400 that has received the encrypted log returns an encrypted log reception notification to the log information transmission / reception unit 32 (SQ11), decrypts the encrypted log (SQ12), and then identifies the cause of the failure. The log information is analyzed (SQ13).

  Receiving the encrypted log reception notification, the log information transmitting / receiving unit 32 instructs the log information deleting unit 34 to delete the encrypted log in the log information saving unit 33 (SQ14). The log information erasure unit 34 erases the encrypted log in the log information saving unit 33 (SQ15).

  According to the above embodiment, the failure log can be automatically sent to the maintenance center 400, so that the failure recovery process can be shortened. The reason is that the failure information relay apparatus 300 according to the present embodiment includes information related to the event (failure log) transmitted from the user terminal 100 in which an event that prevents the execution of information processing has occurred, every time this event occurs. The log information saving unit 33 that stores the log information, the log information is acquired from the user terminal 100 and stored in the log information saving unit 33, and the log information is brought from the log information saving unit 33 to the same situation as this event. This is because it has a log information transmitting / receiving unit 32 that transmits to the maintenance center 400 that searches from the history of past events.

Further, according to the above processing, the log information is encrypted, and the failure record relay apparatus 300 isolated from the user terminal 100 receives an instruction from the control unit 200 that receives the notification of the user terminal 100. It is sent to the maintenance center 400 on the network for the first time. Therefore, even if the log information includes an electronic mail address (FIG. 9 (b) taro@nec.com) or a description relating to personal information such as a customer list, the risk of leakage is extremely low. When there is a possibility that the encrypted log itself is infected with the virus, the log information transmitting / receiving unit 32 of the failure record relay device 300 is infected with the virus before transmitting the encrypted log to the maintenance center 400. A comment tag indicating that the password is attached can be attached to the encrypted log.
The failure record relay device 300 may have a mobile phone function.

  In addition, a volatile memory can be used for the log information saving unit 33. In this case, since the encrypted log is lost when the failure information relay apparatus 300 is powered off, the log information erasing unit 34 is not necessarily required. However, when it is necessary to erase the encrypted log information without turning off the power, the log information erasure unit 34 is necessary. Further, when the log information erasure unit 34 is not installed, it is possible to confirm that the contents of the log information evacuation unit 33 are surely erased when power supply to the log information evacuation unit 33 is stopped. Is desirable.

  In this embodiment, the control unit 200 is provided separately from the failure information relay device 300, but the control unit 200 may be a part of the failure information relay device 300.

Further, the control unit 200 and the log information transmission instruction unit 31 are not necessarily provided. In the embodiment in which the control unit 200 and the log information transmission instruction unit 31 are not used, the log information encryption unit 14 sequentially transmits the encrypted log data to the log information transmission / reception unit 32 and detects the end point of the encrypted log data. In this case, an end notification is output to the log information transmitting / receiving unit 32. The log information receiving unit 32 receives the end notification and transmits the encrypted log stored in the log information saving unit 33 to the maintenance center 400. However, in the embodiment using the control unit 200 and the log information transmission instruction unit 31, unintended transmission can be prevented more reliably. The reason is that the failure occurrence notifying unit 11 receives a log information saving completion notification generated based on the end of saving log information, and the log information transmission instructing unit of the 200 failure recording relay device 300 via the control unit 200. This is because the transmission of the encrypted log to the maintenance center 400 is instructed to 31. In this embodiment, the log information is encrypted, but the log information does not necessarily need to be encrypted. When the user terminal 100 stores only information with low confidentiality, encryption is not necessary.
(Second Embodiment)
The above embodiment is an embodiment related to a case where power supply to the failure record relay device 300 continues even if a failure has occurred. However, if the failure record relay device 300 depends on the power supply unit 15 of the user terminal 100 to supply power necessary for operation, the power supply to the failure record relay device 300 stops depending on the type of failure. Things happen. If the interruption of the power supply occurs before receiving the encrypted log reception notification from the maintenance center 400, the encrypted log is stored in the log information saving unit 33 for a long time, and there is a risk of information leakage. There is also.

  The present embodiment is an embodiment in the case where the power supply is stopped in the first embodiment. FIG. 3 is a flowchart when the power supply to the failure record relay device 300 is interrupted. The power supply determination unit 35 monitors a signal indicating the power supply capability from the power supply unit 15. When the power supply determination unit 35 determines that the power supply value has fallen below a certain threshold value (S20 YES), the power supply unit 15 is disconnected from the failure record relay device 300, and the rechargeable battery 36 is connected as the current power source. (S22).

  Subsequently, the power supply determining unit 35 instructs the log information deleting unit 34 to delete the encrypted log stored in the log information saving unit 33 (S24). After that, the power supply determination unit 35 continuously monitors the signal of the power supply unit 15 and confirms that the power has been restored (NO in S20). Then, the rechargeable battery 36 is disconnected and the power supply source to the failure record relay device 300 is disconnected. Then, the power supply unit 15 is connected (S21). The power supply determination unit 35 notifies the log information transmission / reception unit 32 of the recovery of the power supply unit 15.

  Upon receiving this notification, the log information transmitting / receiving unit 32 determines whether or not an encrypted log reception notification has been received from the maintenance center 400 for the transmitted encrypted log (S25). If received (YES), the log information transmitting / receiving unit 32 stands by until the next encrypted log is received from the log information encrypting unit 14 of the user terminal 100. If not received (NO), the log information encryption unit 14 is requested to retransmit the encrypted log. In this case, the processing from S6 in FIG. 2 is repeated again.

  FIG. 8 is a flowchart showing the operation of the failure record relay device 300 when the power supply is interrupted or restarted. When the power supply determination unit 35 detects that the power supply from the power supply unit 15 to the failure record relay device 300 has fallen below a certain value (S30), the power supply determination unit 35 switches the supply power to the rechargeable battery 36 ( S31). Subsequently, the power supply determination unit 35 instructs the log information deletion unit 34 to delete the encrypted log stored in the log information saving unit 33 (S32).

  At the time when the power recovery determination is made (S33), the power supply determination unit 35 stops the power supply from the rechargeable battery 36 and switches to the power supply unit 15 (S34). Is notified (S35).

  At this time, when it is determined that the log information transmission / reception unit 32 has not received the encrypted log reception notification from the maintenance center 400 (S36), the log information transmission / reception unit 32 stores the encrypted log in the log information encryption unit 14. A retransmission is instructed (S37). The log information encryption unit 14 performs the process of SQ4 in FIG. If the log information transmission / reception unit 32 has received an encrypted log reception notification from the maintenance center 400 at the time of S35, the log information transmission / reception unit 32 waits until the next encrypted log is received.

  According to the above embodiment, the confidentiality of the log information is protected even if the power supply from the user terminal 100 is cut off. In addition, after restarting the power supply, the failure record relay device 300 can immediately resume the process.

The reason is that the failure information relay apparatus 300 according to the present embodiment receives the supply of power necessary for execution of storage, acquisition, and transmission from the user terminal 100, and monitors whether or not the power is supplied from the user terminal 100. , A power supply determination unit 35 for sending a supply cutoff notification and a supply restart notification to the log information transmission / reception unit 32. When the log information transmission / reception unit 32 receives the supply cutoff notification, the log information deletion unit 34 After the log information is deleted from the log information saving unit 33 and the log information transmission / reception unit 32 receives the notification of resumption of supply, the log information of the user terminal 100 is stored in the log information saving unit 33 and the failure log is saved as log information. This is because the failure information relay device 300 is transmitted from the unit 33 to the maintenance center 400.
(Third embodiment)
FIG. 9 shows the configuration of the third embodiment of the present invention. The third embodiment of the present invention
A log information saving unit 33 for storing log information including a log (failure log) related to the event transmitted from the user terminal 100 in which an event preventing execution of information processing has occurred, and the log information Is received from the user terminal 100 and stored in the log information saving unit 33, and the log information saving unit 33 transmits the failure log from the event to the maintenance center 400 that searches for the cause of the occurrence of the event. The fault information relay device 300 includes an information transmitting / receiving unit 32.

  According to the above embodiment, it is possible to shorten the trouble information acquisition process of the computer system.

DESCRIPTION OF SYMBOLS 100 User terminal 200 Control part 300 Failure recording relay apparatus 400 Maintenance center 11 Failure occurrence notification part 12 Log information storage part 13 Log information automatic collection part 14 Log information encryption part 15 Power supply part 31 Log information transmission instruction part 32 Log information transmission / reception Unit 33 log information saving unit 34 log information erasing unit 35 power supply determining unit 36 rechargeable battery

Claims (10)

  A log information saving unit for storing log information including a log (failure log) related to the event transmitted from the user terminal in which an event preventing the execution of information processing has occurred, and the log information Log information transmission / reception received from the user terminal, stored in the log information saving unit, and sent from the log information saving unit to the maintenance device that searches the cause of the occurrence of the event from the event And a failure information relay device.   The failure information relay apparatus according to claim 1, further comprising log information erasing means for erasing the log information transmitted to the maintenance apparatus from the log information saving unit.   The failure information relay device according to claim 1, wherein the log information includes a log other than the failure log that has occurred in the user terminal in a time zone including the occurrence time of the event. The failure information relay apparatus according to claim 1, wherein the log information is encrypted by a log information encryption unit of the user terminal. Receiving power from the user terminal for storage, acquisition, and execution of transmission,
A power supply determination unit that monitors whether or not the power is supplied from the user terminal and sends a notification of supply interruption and a notification of supply resumption to the log information transmission / reception unit, and the log information transmission / reception unit includes the supply When the notification of blocking is received, the log information erasing unit erases the log information from the log information saving unit, and after the log information transmitting / receiving unit receives the notification of resumption of supply,
The failure information relay apparatus according to claim 2, wherein log information of the user terminal is stored in the log information saving unit, and the failure log is transmitted from the log information saving unit to the maintenance terminal. Log information saving processing for storing, in a log information saving unit, log information including a log (failure log) related to the event, which is transmitted every time the event occurs from a user terminal in which an event that prevents the execution of information processing has occurred , Acquiring the log information from the user terminal and storing it in the log information saving unit,
Log information transmission / reception processing for transmitting, from the log information saving unit, the failure log to a maintenance device that searches the history of past events for events that have occurred in the past that bring the same situation as the event, to a computer Fault information relay program to be executed.   The failure information relay program according to claim 6, which causes the computer to execute log information deletion processing for deleting log information transmitted to the maintenance terminal from the log information saving unit.   The failure information relay program according to claim 6 or 7, wherein the log information includes a log other than the failure log that has occurred in the user terminal in a time zone including the occurrence time of the event.   Log information including a log (failure log) related to the event transmitted from the user terminal in which an event that hinders the execution of information processing has occurred is acquired from the user terminal, and log information saving unit A failure information relay method for transmitting the failure log from the log information saving unit to a maintenance device that searches for a past event that causes the same situation as the event from a history of past events.   The failure information relay method according to claim 9, wherein the log information is deleted from the log information saving unit after being transmitted to the maintenance terminal.

Images