JP2018064230A - Generation device, generation method, and generation program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To generate a work flow even if an ID associated with a normal process is not included in a log.SOLUTION: A generation device 1 includes: a log acquisition unit 121 for acquiring logs generated by a plurality of communication apparatuses included in a communication network N if a prescribed process to use the communication network N completed normally a plurality of times; an identifying unit 122 for identifying frequencies of occurrence order of a plurality of logs corresponding to a plurality of respective processes on the basis of generation time of the logs; and a generation unit 123 for generating a work flow indicating occurrence order of logs when the prescribed process has completed normally on the basis of the identified frequencies of occurrence order.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a generation device, a generation method, and a generation program for generating a workflow.

  Conventionally, based on a log related to a communication network, a workflow indicating an output order of logs output by a plurality of communication devices corresponding to normal processing has been created. For example, Non-Patent Document 1 represents a normal execution operation of a system based on a log generated by normal processing on the assumption that an ID associated with normal processing is included in a plurality of logs. A method for generating a workflow is disclosed. In this way, by creating a log workflow corresponding to normal processing and monitoring whether or not logs are output in the order shown in the workflow, it is detected early that an abnormality has occurred on the communication network. be able to.

Qiang Fu, Jian-Guang Lou, Yi Wang, Jiang Li, “Execution Anomaly Detection in Distributed Systems through Unstructured Log Analysis” [online], December 9, 2009, Microsoft (registered trademark), [September 2016 15th search], Internet <URL: https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/DM790-CR.pdf>

  However, the method shown in Non-Patent Document 1 has a problem that a workflow cannot be generated if an ID associated with normal processing is not included in the log. For such a problem, it is conceivable to manually specify a log corresponding to normal processing and manually create a workflow. However, since the logs corresponding to normal processing and logs corresponding to routine processing etc. are mixed in the multiple logs output by the communication device, only logs corresponding to normal processing are included. There is a problem that it is difficult to extract manually.

  Therefore, the present invention has been made in view of these points, and a generation device capable of generating a workflow from a plurality of logs even when an ID associated with normal processing is not included in the log, It is an object to provide a generation method and a generation program.

  The generation apparatus according to the first aspect of the present invention provides a log for acquiring logs generated by each of a plurality of communication devices constituting the communication network when a predetermined process using the communication network is normally completed a plurality of times. An acquisition unit; a specifying unit that specifies a frequency of appearance order of a plurality of logs corresponding to each of a plurality of processes based on a generation time of the log; and a predetermined unit based on the frequency of the specified appearance order And a generation unit that generates a workflow indicating the order of appearance of the logs when the processing is normally completed.

  For each log indicating the same processing content, the specifying unit aggregates the accompanying log output after the log for each processing content of the accompanying log, and determines the appearance probability of the accompanying log that appears after the log. The frequency of the appearance order may be specified by calculating for each processing content of the accompanying log.

  For each log indicating the same processing content, the specifying unit aggregates the accompanying log output before the log for each processing content of the accompanying log, and the appearance of the accompanying log that appears before the log The frequency of the appearance order may be specified by calculating the probability for each processing content of the accompanying log.

For each log indicating the same processing content, the specifying unit may count the accompanying log generated at a time within a predetermined range from the generation time of the log for each processing content of the accompanying log.
The specifying unit may specify information indicating the processing content of the log by removing information that changes according to a log generation timing from each of the plurality of logs acquired by the log acquiring unit.

The specifying unit may calculate the similarity of the character strings included in the log, and a log having the similarity equal to or higher than a predetermined value may be a log having the same processing content.
The generation unit may generate one or more workflows indicating the appearance order of the logs when the predetermined process is executed based on the identified appearance order frequency.

  The generation method according to the second aspect of the present invention is generated by each of a plurality of communication devices constituting the communication network when a predetermined process using the communication network executed by a computer is normally completed a plurality of times. Acquiring a log, identifying a frequency of appearance order of a plurality of logs corresponding to each of a plurality of processes based on a generation time of the log, and based on a frequency of the identified appearance order, Generating a workflow indicating the appearance order of the logs when the predetermined processing is normally completed.

  The generation program according to the third aspect of the present invention is a program for generating a log generated by each of a plurality of communication devices constituting the communication network when a predetermined process using the communication network is normally completed a plurality of times. Based on the log acquisition unit to be acquired, the specifying unit that specifies the frequency of appearance order of a plurality of logs corresponding to each of a plurality of processes based on the generation time of the log, and the frequency of the specified appearance order , And function as a generation unit that generates a workflow indicating the order of appearance of the logs when the predetermined processing is normally completed.

  According to the present invention, there is an effect that a workflow can be generated from a plurality of logs even when an ID associated with normal processing is not included in the log.

It is a figure which shows the outline | summary of the production | generation apparatus which concerns on this embodiment. It is a figure which shows the structure of the production | generation apparatus which concerns on this embodiment. It is a figure which shows the example which the specific part which concerns on this embodiment classifies a some log. It is a figure which shows the example which linked | related the accompanying log with the selected log which concerns on this embodiment. It is a figure which shows the example of calculation of each appearance probability of the accompanying log which concerns on this embodiment. It is a figure which shows the example of the directed graph which concerns on this embodiment. It is a flowchart which shows the flow of a process of the production | generation apparatus which concerns on the production | generation of the workflow which concerns on this embodiment.

[Outline of Generation Device 1]
FIG. 1 is a diagram illustrating an overview of a generation apparatus 1 according to the present embodiment. The generation device 1 is a computer that generates a workflow indicating the order of appearance of logs generated by each of the plurality of communication devices 4 configuring the communication network N when a predetermined process using the communication network N is executed. Here, the communication network N is, for example, a network constructed by a communication carrier, and is configured by a plurality of communication devices 4 such as base stations and repeaters. Here, it is assumed that each of the plurality of communication devices 4 includes a clock and the clock is synchronized.

  In generating a workflow in the generation device 1, first, the user of the generation device 1 causes the predetermined device 2 such as a terminal to execute predetermined processing a plurality of times ((1) in FIG. 1). The predetermined process is a process that uses the communication network N and is executed between the predetermined device 2 and the server 3, for example, a virtual server construction process.

  The generation device 1 acquires logs generated by a plurality of communication devices 4 configuring the communication network N when a predetermined process executed a plurality of times is normally completed ((2) in FIG. 1). The generation device 1 specifies the frequency of the appearance order of a plurality of logs corresponding to each of the plurality of processes based on the acquired log generation time ((3) in FIG. 1). The generation device 1 generates a workflow indicating the order of appearance of logs when the predetermined process is normally completed based on the frequency of the specified appearance order ((4) in FIG. 1).

In this way, the generation device 1 generates a workflow based on the frequency of appearance order for each log indicating the same processing content, so even if the ID associated with normal processing is not included in the log Workflows can be generated from multiple logs.
Hereinafter, the structure of the production | generation apparatus 1 is demonstrated.

[Configuration Example of Generating Device 1]
FIG. 2 is a diagram illustrating a configuration of the generation apparatus 1 according to the present embodiment.
The generation device 1 includes a storage unit 11 and a control unit 12.

  The storage unit 11 is, for example, a ROM and a RAM. The storage unit 11 stores various programs for causing the generation device 1 to function. For example, the storage unit 11 stores a workflow generation program that causes the control unit 12 of the generation apparatus 1 to function as a log acquisition unit 121, a specification unit 122, a generation unit 123, and an output unit 124 described later. In addition, the storage unit 11 stores logs generated by the plurality of communication devices 4.

  The control unit 12 is a CPU, for example. The control unit 12 controls functions related to the generation device 1 by executing various programs stored in the storage unit 11. The control unit 12 functions as a log acquisition unit 121, a specification unit 122, a generation unit 123, and an output unit 124 by executing a workflow generation program.

  The log acquisition unit 121 acquires a log generated by each of the plurality of communication devices 4 configuring the communication network N when the predetermined process using the communication network N is normally completed a plurality of times. Specifically, the log acquisition unit 121 accesses each of the plurality of communication devices 4 when the predetermined processing is executed normally in the predetermined device 2 and the predetermined processing is normally completed, and the plurality of communication devices 4 are accessed. Get logs generated by each of. The log acquisition unit 121 stores the acquired log in the storage unit 11. Here, it is assumed that the log includes information that changes according to the log generation timing, such as the time when the log was generated, and information indicating the processing content.

  A plurality of communication devices 4 that operate according to a predetermined process executed in the predetermined device 2 are specified, and the log acquisition unit 121 acquires logs generated in the specified plurality of communication devices 4. It may be. By doing in this way, the production | generation apparatus 1 can reduce the processing load of the production | generation apparatus 1 by not acquiring the log which is not clearly related to a predetermined process.

  Alternatively, the communication network N may be a local network that is not connected to the Internet or the like, and the log acquisition unit 121 may acquire logs generated by each of the plurality of communication devices 4 in the local network. By doing in this way, since the communication apparatus 4 does not communicate with the external apparatus connected via the internet etc., the production | generation apparatus 1 can make it not acquire the log which concerns on the said communication.

  The specifying unit 122 specifies the frequency of the appearance order of the plurality of logs corresponding to each of the plurality of processes based on the log generation time. Thereby, the specifying unit 122 can specify the order of logs having a relatively high frequency of appearance order, that is, the order of logs output in response to the execution of the predetermined process.

  First, the specifying unit 122 specifies information indicating the processing content from each of the plurality of logs acquired by the log acquiring unit 121. Specifically, the specifying unit 122 indicates each processing content of the plurality of logs by removing information that changes according to the log generation timing from each of the plurality of logs acquired by the log acquisition unit 121. Identify information. Subsequently, the specifying unit 122 classifies the log based on information indicating the processing content.

  FIG. 3 is a diagram illustrating an example in which the specifying unit 122 according to the present embodiment classifies a plurality of logs. For example, the character string that configures the log A1 and the character string that configures the log A2 include at least information that changes according to the log generation timing and information that indicates the processing content. The log A1 and the log A2 Is not exactly the same. On the other hand, the specifying unit 122 removes information that changes in accordance with the log generation timing from the log, and then indicates the processing content of a character string that is common to both the log A1 and the log A2. Identify with information. Then, the specifying unit 122 classifies the log A1 and the log A2 as the log A.

  In addition, although the specific | specification part 122 removed the information which changes according to the production | generation timing of a log about each of several logs, and specified the information which shows the processing content, it is not restricted to this. For example, the specifying unit 122 may calculate the similarity of a character string included in the log, and classify logs having a similarity greater than or equal to a predetermined value into logs having the same processing content. By doing in this way, the specific | specification part 122 can classify | categorize a log with high similarity into the log of the same processing content.

  Subsequently, based on the log generation time and the information indicating the processing content, the specifying unit 122 displays the accompanying log output before the log for each log indicating the same processing content (log after classification). , Aggregate for each processing content of the accompanying log. Similarly, for each log indicating the same processing content, the specifying unit 122 adds up the accompanying log output after the log for each processing content of the accompanying log. Here, for each log indicating the same processing content, the specifying unit 122 sets the accompanying log generated immediately before or immediately after the log as an aggregation target.

  For example, the specifying unit 122 selects a log that has not been selected and has the oldest generation time among the plurality of logs. The specifying unit 122 specifies the log generated immediately before the selected log and the log generated immediately after as the accompanying log, and associates them with the selected log. FIG. 4 is a diagram illustrating an example in which an accompanying log is associated with a selected log according to the present embodiment. In the example shown in FIG. 4, it can be confirmed that the log C and the log B are associated with the log A as the accompanying log generated immediately before. In the example illustrated in FIG. 4, it can be confirmed that the log B and the log D are associated with the log A as an accompanying log generated immediately after.

  When the identifying unit 122 associates the accompanying log with the selected log, the identifying unit 122 selects a log that has not been selected and has the oldest generation time among the plurality of logs. Then, the identification unit 122 repeats the same processing, thereby totaling the accompanying logs that appear before and after the log indicating the same processing content for each processing content of the accompanying log.

  For each log (selected log) indicating the same processing content, the specifying unit 122 sets a log generated within a predetermined range from the generation time of the log as an accompanying log, and uses the accompanying log as an associated log. You may make it total for every processing content. By doing in this way, the specifying unit 122 responds to normal processing even when unnecessary logs such as regular logs are mixed between logs that are sequentially executed according to normal processing. Logs that are executed in order can be counted as accompanying logs.

  Subsequently, the specifying unit 122 specifies the appearance order frequency by calculating the appearance probability of the accompanying log appearing before and after the log indicating the same processing content for each processing content of the accompanying log. For example, based on the result of association of the accompanying logs shown in FIG. 4, the specifying unit 122 associates the accompanying log that appears immediately before the log that shows the same processing content and the accompanying log that appears immediately after the log that shows the same processing content The appearance probability of each log is calculated. FIG. 5 is a diagram illustrating an example of calculating the appearance probability of each accompanying log. In the example shown in FIG. 5, it can be confirmed that immediately after the log A, the log B appears with a probability of 90% and the log D appears with a probability of 5%.

  The generation unit 123 generates one or more workflows indicating the appearance order of logs when the predetermined process is normally completed based on the frequency of the appearance order specified by the specifying unit 122. For example, the generation unit 123 specifies the appearance order of logs indicating an appearance probability higher than a predetermined value based on the appearance probability for each accompanying log illustrated in FIG. For example, when the predetermined value is 80%, in the example illustrated in FIG. 5, the generation unit 123 generates log appearances of log A to log B, log B to log C, and log E to log C as the log appearance order. Identify the order.

  Subsequently, the generation unit 123 generates a directed graph based on the identified log appearance order. FIG. 6 is a diagram illustrating an example of the directed graph according to the present embodiment. Subsequently, the generation unit 123 generates one or more workflows based on the generated directed graph. In the example illustrated in FIG. 6, the generation unit 123 identifies a workflow indicating the order of log A, log B, and log C and a workflow indicating the order of log E and log C as the workflow. Here, the generation unit 123 can identify all workflows that are likely to occur when normal processing is executed by generating one or more workflows.

  The output unit 124 outputs information indicating one or more workflows generated by the generation unit 123. For example, the output unit 124 displays information indicating the workflow on a display unit (not shown) provided in the generation device 1, or transmits information indicating the workflow to a terminal connected to be able to communicate with the generation device 1. To do.

[Flow of processing related to workflow generation]
Next, the flow of processing related to workflow generation will be described. FIG. 7 is a flowchart showing a processing flow of the generation apparatus 1 related to generation of a workflow according to the present embodiment.

  First, when the predetermined process using the communication network N is normally completed a plurality of times, the log acquisition unit 121 acquires a log generated by each of the plurality of communication devices 4 configuring the communication network N (S10).

Subsequently, the specifying unit 122 extracts information indicating the processing content from the log acquired in S10, and classifies the log based on the information indicating the processing content (S20).
Subsequently, the specifying unit 122 selects one log from the plurality of acquired logs (S30). For example, the specifying unit 122 selects a log with the oldest generation time among unselected logs.

Subsequently, the specifying unit 122 associates the accompanying log appearing before and after the log with the processing content (classification log) of the selected log (S40).
Subsequently, the specifying unit 122 determines whether all logs have been selected (S50). If the identifying unit 122 determines that all logs have been selected, the process proceeds to S60. If the identifying unit 122 determines that all logs have not been selected, the process proceeds to S30.
Subsequently, the specifying unit 122 calculates the appearance probability of the accompanying log for each processing content of the log (S60).

Subsequently, the generation unit 123 specifies the appearance order of logs having an appearance probability equal to or higher than a predetermined value based on the calculation result of S60 (S70).
Subsequently, the generation unit 123 generates a directed graph based on the identified log appearance order (S80).
Subsequently, based on the generated directed graph, the generation unit 123 generates one or more workflows indicating the order of appearance of logs when the predetermined process is normally completed (S90).

[Effect in this embodiment]
As described above, the generation device 1 according to the present embodiment generates logs generated by each of the plurality of communication devices 4 configuring the communication network N when the predetermined process using the communication network N is normally completed a plurality of times. The frequency of appearance order of a plurality of logs corresponding to each of the plurality of processes is identified based on the generation time of the log, and the predetermined process is normally completed based on the frequency of the identified appearance order A workflow indicating the order of appearance of logs is generated.

  Since the log acquired from the communication device 4 when the predetermined process is normally completed a plurality of times includes a relatively large number of logs when the predetermined process is normally completed, the generation apparatus 1 appears relatively. The appearance order of logs with high frequency can be specified as the appearance order of logs when the predetermined process is normally completed. Accordingly, the generation device 1 can generate a workflow from a plurality of logs even when an ID associated with a series of processes is not included in the log.

  As mentioned above, although this invention was demonstrated using embodiment, the technical scope of this invention is not limited to the range as described in the said embodiment. It will be apparent to those skilled in the art that various modifications or improvements can be added to the above embodiment. In particular, the specific embodiments of the distribution / integration of the devices are not limited to those illustrated above, and all or a part thereof may be arbitrarily selected according to various additions or according to the functional load. It can be configured to be functionally or physically distributed and integrated in units.

  For example, in the above-described embodiment, the generation device 1 accesses each of the plurality of communication devices 4 and acquires the logs generated by each of the plurality of communication devices 4, but is not limited thereto. For example, a log acquisition device that acquires logs generated by each of the plurality of communication devices 4 and the generation device 1 are provided, and the generation device 1 generates each of the plurality of communication devices 4 from the log acquisition device. A log may be acquired.

DESCRIPTION OF SYMBOLS 1 ... Generation apparatus, 11 ... Memory | storage part, 12 ... Control part, 121 ... Log acquisition part, 122 ... Identification part, 123 ... Generation part, 124 ... Output part, 2 ... predetermined device, 3 ... server, 4 ... communication equipment, N ... communication network

Claims (9)

A log acquisition unit for acquiring a log generated by each of a plurality of communication devices constituting the communication network when a predetermined process using the communication network is normally completed a plurality of times;
A specifying unit that specifies the frequency of appearance order of a plurality of logs corresponding to each of a plurality of processes based on the generation time of the log;
A generating unit that generates a workflow indicating the order of appearance of the log when the predetermined processing is normally completed based on the frequency of the identified order of appearance;
A generating device comprising: For each log indicating the same processing content, the specifying unit aggregates the accompanying log output after the log for each processing content of the accompanying log, and determines the appearance probability of the accompanying log that appears after the log. By calculating each processing content of the accompanying log, the frequency of the appearance order is specified,
The generation device according to claim 1. For each log indicating the same processing content, the specifying unit aggregates the accompanying log output before the log for each processing content of the accompanying log, and the appearance of the accompanying log that appears before the log Specifying the frequency of the appearance order by calculating the probability for each processing content of the accompanying log,
The generating apparatus according to claim 1 or 2. For each log indicating the same processing content, the specifying unit aggregates the accompanying log generated at a time within a predetermined range from the generation time of the log for each processing content of the accompanying log.
The generation device according to claim 2 or 3. The specifying unit specifies information indicating the processing content of the log by removing information that changes according to the log generation timing from each of the plurality of logs acquired by the log acquisition unit.
The generation device according to any one of claims 1 to 4. The specifying unit calculates the similarity of a character string included in the log, and sets a log having the similarity equal to or higher than a predetermined value as a log having the same processing content.
The generation device according to any one of claims 1 to 5. The generation unit generates one or more workflows indicating the appearance order of the logs when the predetermined processing is executed based on the frequency of the specified appearance order;
The generating apparatus according to claim 1 or 2. The computer runs,
Acquiring a log generated by each of a plurality of communication devices constituting the communication network when a predetermined process using the communication network is normally completed a plurality of times; and
Identifying the frequency of appearance order of a plurality of logs corresponding to each of a plurality of processes based on the generation time of the logs;
Generating a workflow indicating the appearance order of the log when the predetermined processing is normally completed based on the identified frequency of the appearance order;
A generation method comprising: Computer
A log acquisition unit that acquires logs generated by each of a plurality of communication devices constituting the communication network when a predetermined process using the communication network is normally completed a plurality of times;
Based on the generation time of the log, a specifying unit that specifies the frequency of appearance order of a plurality of logs corresponding to each of a plurality of processes, and
A generating unit that generates a workflow indicating the order of appearance of the logs when the predetermined process is normally completed based on the frequency of the identified order of appearance;
Generator program to function as.

Images