JP6446285B2 - Multi-vendor server device remote log collection system and method - Google Patents

Description

  The present invention relates to a remote log collection system and method for multi-vendor server equipment.

  As a hardware maintenance management service system that provides services related to the maintenance of hardware equipment, from receiving faults in hardware such as servers to analysis, diagnosis, and recovery, it has an ASSIST center (automatic analysis system) and a reporting device. For example, a remote maintenance support service system that collects hardware logs and monitors hardware failures, monitors OS live, and enables maintenance of hardware devices has been proposed.

Here, ASSIST (Advanced Service Support Information System Technology) is a technology developed by the present applicant that collects logs of server devices and the like remotely from the ASSIST center via a notification device. With a log collection agent installed on a multi-vendor server device of another company, for example, an “order” from the reporting device, that is, a log collection execution instruction (log collection request) is received, and the session from the reporting device is disconnected once. Log collection processing registered in advance in the log collection agent is executed and transferred to the reporting device (Push method).
According to the Push method, there is an advantage that log collection can be realized by a common interface even in a multi-vendor environment.
However, when collecting the logs of the target server remotely, it is necessary to use the log collection function and tool of the target server vendor made by another company. Some devices do not have a log collection function (not disclosed). Therefore, conventionally, it has been necessary to deal with each vendor individually. For this reason, it is difficult to standardize the log collection function of multi-vendor server equipment.

  In other words, if log data collection of multi-vendor equipment is to be realized remotely with the above-mentioned ASSIST developed by the present applicant, the multi-vendor equipment log is not collected directly by remote operation from the remote center, but automatically on the system side. Log needs to be collected. In order to make it possible to use each vendor's log collection functions and tools for log collection, for example, add a dedicated interface to the reporting device of the target device (multi-vendor server device or virtualized server). There was a need to develop a new one. That is, it is necessary to prepare an interface for each target device, and there is a problem that the system side becomes complicated. In addition, devices without log collection function had to be developed individually. Furthermore, since the work procedure at the time of introduction is different for each vendor, there is a problem that the work becomes complicated.

  In a multi-vendor environment, there is a technique described in Japanese Patent Application Laid-Open No. 2004-164389 (Patent Document 1). This publication states that “a maintenance service method for performing maintenance services for a multi-vendor system, which is composed of various devices delivered from a plurality of vendors and that performs information processing, and is connected to the multi-vendor system. A multi-vendor system monitoring and reporting server that detects a failure of the multi-vendor system and reports failure information, and a primary maintenance person manages and receives the failure information reported from the multi-vendor system monitoring and reporting server and relates to the failure Receives failure information notified from the primary maintenance terminal and the multi-vendor system monitoring and reporting server, which instructs the maintenance company system to perform failure resolution processing and creates and sends a report on the occurrence and resolution of the failure. A maintenance company that performs maintenance of the devices constituting the multi-vendor system It includes a stem ", a fault system manager device, and automatically reported to the primary maintainer terminal, a technique for reducing the trouble of maintenance service and maintenance support to a system administrator of the multi-vendor system is disclosed. In addition, a system has been proposed in which a log collection agent such as a network device instead of a server device catalogs and automates a process of collecting logs from a reporting device via a network for devices to which installation is added (Patent Document 2). ).

JP 2004-164389 A JP 2014-78126 A

  In the above-described prior art, the work procedure at the time of introduction varies from vendor to vendor, and thus there is a problem that the work becomes complicated. In Patent Literature 1, log collection for “fault notification / notification” is not considered. Therefore, the effect of automatic notification of the occurrence of a failure remains.

  Accordingly, an object of the present invention is to realize standardization of multi-vendor server equipment in view of the background art described above.

  In order to solve the above problem, one of the representative remote vendor log collection systems and methods of the present invention is to install a vendor independent log collection agent on the OS (basic software) of the target server device. All other server devices of different vendors can collect logs remotely by the same procedure.

  For example, when a log collection request is received from a reporting device (for example, a monitoring device having a reporting function) on the log collection request side, the vendor-independent log collection agent is a command script on the OS according to the log collection request. This is a function (program) that collects logs via and sends them back to the reporting device on the log collection request side.

Russia received from grayed collecting the requesting device the order containing the log collection request, to collect and archive the log that corresponds to the specified catalog (catalog name) from multi-vendor server equipment group, in a system in which to reply to the log collecting the requesting device ,
Install the log collection agents that do not depend on the multi-vendor server equipment to the log collection target equipment,
The log collection agent is:
Log collection request receiving means for receiving a log collection request from the log collection request side device ;
When you receive the previous Symbol log collection request, and command execution means for executing the log collection command,
A file reading means for reading a catalog file and a collector setting file for each catalog recorded in the storage device when receiving the log collection command;
A logging means for performing a log collected from the multi-vendor server device groups based on the contents of the catalog file and before Kiko collector configuration file,
Means for generating and outputting log collection results and catalog version information for each catalog as an execution log;
It means for receiving said execution log, the execution log and compressed archive, and returns to the log obtaining requesting device,
Is provided.

Further, the remote log collection method for the multi-vendor server device of the present invention is
Multiple systems in a system that receives an order including a log collection request from the log collection requesting device, collects and archives the log corresponding to the specified catalog (catalog name) from the multi-vendor server device group, and returns it to the log collection requesting device. In the remote log collection method for vendor server equipment,
Install a log collection agent that does not depend on the multi-vendor server device on the log collection target device,
The log collection agent is:
Receiving a log collection request from the log collection requesting device;
When receiving the log collection request, execute the log collection command,
When receiving the log collection command, read the catalog file and collector setting file for each catalog recorded in the storage device,
Collect logs from the multi-vendor server device group based on the contents of the catalog file and the log collector setting file,
Generate and output log collection results and catalog version information for each catalog as an execution log,
Receiving the execution log, archiving and compressing the execution log file, and sending it back to the log requesting device;
It is characterized by that.

  According to the present invention, all procedures for introducing multi-vendor server equipment can be standardized, and the period for introduction can be shortened.

  Further, for example, it is possible to add vendor-specific log information collection (supporting the catalog update function), and it is also possible to remotely collect the guest OS log collection of a virtualized server.

  Problems, configurations, and effects other than those described above will become apparent from the following description of embodiments.

FIG. 1 is a block diagram showing a configuration of a target device (multi-vendor server device or virtualized server), a notification device, and a support center (ASSIST center) according to the present invention. FIG. 2 is a functional block diagram illustrating a configuration example of a log collection agent according to the present invention. FIG. 3 is a flowchart showing a log collection processing flow of the log collection agent of the present invention. FIG. 4 is a diagram illustrating an example of a catalog file. FIG. 5 is a diagram illustrating an example of a collected log file. FIG. 6 is a diagram showing an example of a file that outputs an execution result file, an execution result of loss collection, and a version of the agent catalog file.

  The embodiment of the present invention is an example in which a log collection agent is installed in a target server device.

  Hereinafter, description will be given with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a target device (multi-vendor server device or virtualized server) 1, a notification device 2, a router 3, and a support center (ASSIST center) 4 according to the present invention.

  The multi-vendor server device 1 that is the target device is connected to the notification device 2, the router 3, and the support center (ASSIST center) 4 via the network. The target device includes a virtualized server.

The target device 1 has a multi-vendor server device including a plurality of servers. Each server has a log collection agent 11 having a log collection function.
The reporting device 2 includes a log collection processing unit 21 that activates the log collection agent 11 installed on the multi-vendor server device 1 side and issues a log collection instruction, and a storage device 22 that includes a log DB 221 that stores logs.
The support center 4 performs an “order” including a log collection request to the reporting device 2 via the router 3.

  As will be described later, the log collection agent 11 includes a management agent 112 and a log collector 111. For example, the log collection agent 11 includes a program that controls the server device 1. The program is installed in the server device 1. is there. The reporting device 2 is composed of, for example, a log collection processing unit, collects logs via a command / script on the OS in accordance with a request from the support center 4 (log collection request), and sends the logs back to the reporting device. Has a log collection function (program).

(1) The management agent 112 receives a log collection request by “order” from the reporting device and performs IP address authentication. There are two “orders”: “ALL (report log collection order)” and “AGTANS (incoming log collection order)”.
(2) Address If the authentication result is authentication OK, the log collector “LogCollector” of the log collection process is started.
(3) The log collector “LogCollector” 111 follows the definition contents of the catalog file corresponding to “order” and (4) the per-catalog permission / prohibition flag defined in the configuration file.
(5) Execute log collection. Here, if “order” is “ALL” (report log collection order) and “AGTANS” (incoming log collection order), logs for all catalogs are collected.
(6) The log collection result (success / failure / prohibition) and version information for each catalog is output to the execution log “AEXECLOG” (see the execution result file “AEXELOG”).
(7) The management agent 112 archives / compresses other than the execution log “AEXECLOG” (see archive processing).
(8) Transmit to the reporting device 2.

  The multi-vendor server device 1 collects a log based on the log collection agent 11 and records it in the log DB 221 of the target device 2.

  FIG. 2 is a functional block diagram showing a configuration example of the log collection agent 11 of the present invention.

  The log collection agent 11 is installed in the multi-vendor server device 1 of the target device, and has a control device that executes and manages the functions described above based on the catalog file and setting file of the recording device 22. The control device includes a log collector 111 and a management agent 112.

  The storage device 22 includes a log DB 221, a catalog file DB 222, and a log collector setting file DB 223. The log DB 221 stores collected logs, the catalog file DB 222 stores catalog files of a plurality of catalogs, and the log collector setting file DB 223 stores a log collector setting file 2231 corresponding to each catalog.

  The catalog in the catalog file DB 222 includes information such as “item number”, “order”, “catalog name”, “collection contents”, “format”, “timeout”, “maximum capacity (before compression)”, and the like. Including. These contents differ depending on the OS ("Windows" version and "RedHatLinux" version).

  The setting file in the log collector setting file DB 223 is a file that defines a log collection method and parameters at the time of collection.

  The management agent 112 includes an IP authentication processing unit 1121, a command execution processing unit 1122, an execution log archive / compression processing unit 1123, and an execution log transmission processing unit 1124.

  The log collector 111 includes a catalog file read processing unit 1111, a setting file read processing unit 1112, a log collection unit 1113, and an execution log generation processing unit 1114.

  The IP authentication processing unit 1121 in the management agent 112 receives the “order” sent from the command execution processing unit 1122 and the support center 4 via the notification device 2, that is, the address of the notification device 2 when receiving a log collection request. It has a function of authenticating (IP address).

  The command execution processing unit 1122 has a function of starting the log collector 111 when the IP authentication processing unit 1121 has performed IP address authentication.

  The execution log archive / compression processor 1123 has a function of receiving the execution log output from the execution log generation processor 1114 and archiving / compressing the execution log. The archive process archives and compresses all collected logs. For example, an archive / compression method used in the Windows version log collection agent / catalog introduction tool is used.

  In other words, archiving / compression archives / compresses data other than the execution log “AEXECLOG”.

  The execution log transmission processing unit 1124 outputs the execution log output from the execution log archive / compression processing unit 1123, that is, the execution result file “AEXECLOG”, the result of log collection, and the version of the agent catalog file (FIG. 6). Reference) is sent to the reporting device together with the collected log.

  The catalog file read processing unit 1111 in the log collector 111 has a function of reading a catalog file in the catalog file DB 222 in response to a command from the command execution processing unit 1122. The catalog file to be read is a file having a specified catalog name included in the log collection request.

  The setting file reading processing unit 1112 has a function of receiving the read catalog file name and reading the log collector setting file corresponding to the log file name from the log collector setting file DB 223.

  The log collection unit 1113 has a function of collecting logs corresponding to the specified catalog name from the multi-vendor server device 1. The collected log has a function of accumulating in the log DB 22.

  The execution log generation processing unit 1114 has a function of receiving the collected logs and generating and outputting an execution log (see FIG. 6). This execution log is supplied to the execution log archive / compression processor 1123 of the management agent 112.

  FIG. 3 is a flowchart showing a log collection processing flow of the log collection agent of the present invention. The operation based on the flowchart of FIG. 3 is as follows.

  Step S2111: The log collection agent 11 starts log collection processing.

  Step S2112: The management agent 112 receives a log collection request based on the order from the reporting device 2.

  Step S2113: The management agent 112 authenticates the IP address of the received log collection request.

  Step S2114: If the authentication result of the IP address is OK, the management agent 112 executes a command to the log collector 214 side and starts the log collector 111 side.

  Step S2115: The log collector 111 specifies a catalog (catalog name) to be collected and reads the catalog (catalog name) into the catalog file DB 222.

  Step S2116: Next, the log collector 111 reads a setting file corresponding to the read catalog from the log collector setting file DB 223.

  Step S2117: The log collector 111 collects logs of the multi-vendor server device 1 based on the setting file. The multi-vendor server device 1 can collect the logs of each server device by installing the log collection agent 11.

  Step S <b> 2118: The log collector 111 generates an execution log (execution result file “AEXECLOG”) from the collected logs and transmits it to the management agent 112.

  Step S2119: The management agent 112 receives the execution log (execution result file “AEXECLOG” and archives and compresses the execution log. However, at this time, the execution log “AEXECLOG” is excluded.

  Step S2120: The management agent 112 transmits an execution log to the reporting device 2 side.

  In other words, if the log collection agent 11 fails in step S2117, the log collection agent 11 directly writes the error contents to the log file and archives them. In the archive, although the error content varies depending on the factor, a word such as [target log file (/ var / log / message) don't exist.] Is output that makes it easy to determine the factor.

  In step S2120, in step S2118, the execution result file “AEXECLOG”, the execution result of the log collection, and the file that outputs the version of the agent catalog file are transmitted to the notification device 2 together with the collected log.

  In step S2119, the log file collected and generated according to the description content of the catalog file is archived in a format for each OS, and transmitted to the reporting device 2 in step S2120.

  Step S2121: The log collection agent 11 ends the log collection process.

  FIG. 4 is a diagram illustrating an example of a catalog file. The catalog file 2221 includes “catalog name 22211 (“ NETLOG ”,“ SYSLOG ”)”, “catalog file contents (“ echo / sbin / ifconfig> if.log ”,“ cp / var / log / message.log ”)”. 22212.

  FIG. 5 is a diagram illustrating an example of a collected log file. The collection file 2143 includes “item number” 21431, “OS (“ Windows ”,“ RedHatLinux ”)” 21432, “original file (AEXECLOG)” 21433, “file name at center transmission (AEXECLOG)” 21434, “format ( Text) "21435, etc.

  FIG. 6 is a diagram illustrating an example of output data (a file that outputs an execution result file, an execution result of loss collection, and a version of an agent / catalog file) from the execution log generation unit 2144.

  The output data includes “item number” 21441, “OS (“ Windows ”,“ RedHatLinux ”)” 21442, “original file (AEXECLOG)” 21443, “file name at center transmission (AEXECLOG)” 21444, “format (text) ) "21445, and the like.

  According to the embodiment described above, in response to a log collection request from the reporting device (log collection request side), logs corresponding to the specified catalog (catalog name) are collected and archived from the multi-vendor server device group, and the reporting device By installing a vendor-independent log collection agent that returns to the (log collection requesting side) on the log collection target server, for example, OS (basic software), server devices of different vendors can remotely log in the same procedure. Collection is possible. In addition, it is possible to add vendor-specific log information to the catalog file DB 222 (supports a catalog update function). Further, according to the present system, the guest OS of the virtualized server on the multi-vendor device side (the OS operating on the virtual machine in the “virtual machine” environment in which another computer environment is prepared on the computer) Logs can also be collected remotely.

  In addition, this invention is not limited to the Example mentioned above, Various modifications are included. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor. Information such as programs, tables, and files for realizing each function can be stored in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

1: Target device (multi-vendor server device)
2: Reporting device (monitoring device)
3: Router 4: Support center 11: Log collection agent 111: Log collector 112: Management agent 22: Storage device 211: Catalog file DB
212: Log collector setting file DB

Claims (4)

In a system that receives an order including a log collection request from a log collection requesting device, collects and archives a log corresponding to the specified catalog (catalog name) from the multi-vendor server device group, and returns it to the log collection requesting device.
Install a log collection agent that does not depend on the multi-vendor server device on the log collection target device,
The log collection agent is:
Log collection request receiving means for receiving a log collection request from the log collection request side device;
Command execution means for executing a log collection command when the log collection request is received;
A file reading means for reading a catalog file and a collector setting file for each catalog recorded in the storage device when receiving the log collection command;
A logging means for performing a log collected from the multi-vendor server device groups based on the contents of the catalog file and before Kiko collector configuration file,
Means for generating and outputting log collection results and catalog version information for each catalog as an execution log;
It means for receiving said execution log, the execution log and compressed archive, and returns to the log obtaining requesting device,
A remote log collection system for multi-vendor server equipment. In the remote log collection system of the multi-vendor server device according to claim 1,
In addition, a means for authenticating the log collection request,
Means for activating a function of collecting the log when the log collection request is authenticated;
A remote log collection system for multi-vendor server equipment. In the remote log collection system of the multi-vendor server device according to claim 1,
The order includes a report log collection order, an incoming log collection order,
The catalog file Yi Le includes catalog name, the definitions,
The collector setting file includes a permission / prohibition flag for each catalog,
The log collection result includes success, failure, prohibition,
The log collection unit collects logs for all catalogs when the order is the notification log collection order or the incoming log collection order. A remote log collection system for a multi-vendor server device. Multiple systems in a system that receives an order including a log collection request from the log collection requesting device, collects and archives the log corresponding to the specified catalog (catalog name) from the multi-vendor server device group, and returns it to the log collection requesting device. In the remote log collection method for vendor server equipment,
Install a log collection agent that does not depend on the multi-vendor server device on the log collection target device,
The log collection agent is:
Receiving a log collection request from the log collection requesting device;
When receiving the log collection request, execute the log collection command,
When receiving the log collection command, read the catalog file and collector setting file for each catalog recorded in the storage device,
Run the log collected from the multi-vendor server device groups based on the contents of the catalog file and before Kiko collector configuration file,
Generate and output log collection results and catalog version information for each catalog as an execution log,
Receiving the execution log, the execution log and compressed archive, and returns to the log obtaining requesting device,
A remote log collection method for a multi-vendor server device.

Images