JP2000207254A - Server management device, method therefor and recording medium recorded with server managing program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce management cost and to facilitate maintenance management. SOLUTION: A controller 10 sets definition information for making classification items and analysis items of a log data base needed to analyze a log file, correspond to items of the log file in a log gathering rule setting process by using the field numbers of the log file. In a gathering process for the log file, a web server device 200 is accessed, and the data of the log file are transferred via a network 300 and received. In a generating process and a storing process for the log data base, the definition information is referred to according to the data of the received log file to calculate the statistic data of the analysis items by the classification items of the log data base, thereby generating a log data base including statistical data. In a data analyzing process and an output processing for its result, an analyzing process is carried out, on the basis of the generated log data base and data on the analysis result is generated and outputted.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a server management apparatus and method for collecting and managing log files of a plurality of server apparatuses such as a Web server apparatus, and a recording medium storing a server management program.

[0002]

2. Description of the Related Art For example, in an intranet used in an in-house system, a WWW (World Wide Web) Web is used to provide and collect various kinds of information. The WWW aims at constructing hypertext on a network so that all information can be accessed seamlessly. Here, hypertext is expressed using a tag language called HTML.

In order to provide and collect various information using the WWW, a Web server device is provided on an intranet. The Web server program and other application programs executed by the Web server device generate and store various log files as history information related to the execution of the program.

Since these log files are enormous in volume, software for analyzing the log files is used to analyze them. However, when the log file analysis software is used to analyze the log file, the software may not be compatible with a specific Web site.
There was a problem that only log files of server programs could be handled. In addition, since a log file containing all items is collected by a computer that manages a database, there is a problem in that the hard disk memory of the analysis machine is squeezed.

To solve this problem, Japanese Patent Laid-Open No.
In Japanese Patent No. 293704 (hereinafter referred to as a conventional example),
In the Web server device of each agent, a value corresponding to a predefined data item is cut out from the log data in the log file to be monitored, and the normalized log data in which the values of the specified data item are arranged is converted. It is disclosed to generate and send the generated normalized log data to a computer that performs a function of a manager via a network.

[0006]

However, in the conventional example, it is necessary to create a dedicated analysis program to be used by the management apparatus for each Web server apparatus having log files of different specifications. Costs (for example, about 3 million yen / 1 server device),
There was a problem that management cost became large. Also,
Since dedicated software is used in each Web server device, when performing maintenance such as version upgrade, it is necessary to go to each Web server device, and there is a problem that maintenance management is complicated.

SUMMARY OF THE INVENTION An object of the present invention is to solve the above problems, to reduce the management cost as compared with the conventional example, and to record a server management apparatus and method, and a server management program, in which maintenance is easy. It is another object of the present invention to provide a recording medium that has been designed.

[0008]

According to a first aspect of the present invention, there is provided a server management apparatus in which a plurality of server apparatuses each having a log file in a predetermined log file format are connected via a network. The definition information for associating the plurality of classification items and the plurality of analysis items of the log database necessary for analyzing the log file with the items of the log file by using the field numbers of the log file, Setting means for setting each of the server devices; communication means for accessing each of the server devices and transferring and receiving data of the log file from each of the server devices to a server management device via a network; Based on the data in the log file that was created, refer to the set Generating means for calculating a statistical data of each analysis item for each classification item to generate a log database including the statistical data and storing the log database in the first storage device, and based on the generated log database; Analyzing means for executing analysis processing on a preselected analysis item of the plurality of analysis items with respect to a preselected classification item of the plurality of classification items, and generating and outputting analysis result data And characterized in that:

According to a second aspect of the present invention, in the server management apparatus according to the first aspect, the setting unit stores the definition information in advance with respect to a predetermined log file format. Based on the device and the format of the log file input for each server device,
When the definition information in the format of the input log file is stored in the second storage device, the stored definition information is read from the second storage device and set as the definition information for the server device. And means for performing the operation.

Further, in the server management apparatus according to the third aspect, in the server management apparatus according to the first or second aspect, the analysis means may change the classification items in the analysis processing from a plurality of predetermined classification items. It is characterized by further comprising a first selecting means for selecting and a second selecting means for selecting an analysis item in the analysis processing from a plurality of predetermined analysis items.

According to a fourth aspect of the present invention, there is provided a server management method for a server management apparatus in which a plurality of server apparatuses each having a log file of a predetermined log file format are connected via a network. In, the definition information for associating a plurality of classification items and a plurality of analysis items of the log database required to analyze the log file with the log file items by using the log file field numbers, A setting step of setting for each of the server devices, a communication step of accessing each of the server devices, transferring and receiving data of the log file from each of the server devices to a server management device via a network, Based on the received log file data, refer to the definition information set above, Generating a log database including the statistical data by calculating statistical data of each of the analysis items for each classification item of the log database, and storing the log database in the first storage device; Based on the log database, perform an analysis process on a pre-selected analysis item of the plurality of analysis items with respect to a pre-selected classification item of the plurality of classification items, and generate analysis result data. And outputting the data.

In the server management method according to a fifth aspect, in the server management method according to the fourth aspect, the setting step includes the step of:
Storing the definition information in a second storage device in advance, and, based on the log file format input for each server device, storing the definition information in the input log file format in the second storage device. And reading the stored definition information from the second storage device and setting the same as the definition information for the server device.

Further, in the server management method according to the sixth aspect, in the server management method according to the fourth or fifth aspect, the analyzing step includes the step of changing a classification item in the analysis processing from a plurality of predetermined classification items. The method further includes a selecting step and a step of selecting an analysis item in the analysis processing from a plurality of predetermined analysis items.

According to a seventh aspect of the present invention, there is provided a recording medium storing a server management program, wherein a server management program including the server management method according to any one of the fourth to sixth aspects is recorded. I do.

[0015]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing the configuration of a server management system according to an embodiment of the present invention. The server management system according to the present embodiment includes a plurality of Web server apparatuses 200-1 to 200 that store log files of a predetermined log file format in the log file memory 51.
0-N (hereinafter, generically referred to as 200), the plurality of Web server devices 200, and, for example, a WAN or a LAN.
And a server management apparatus 100 that is connected via a network 300 such as an in-house network and executes server management processing of a plurality of Web server apparatuses 200. Here, the controller 10 of the server management apparatus 100 executes (a) the log collection rule setting process of FIG. 2 and (b) the analysis rule setting process of FIG. 3 in advance based on the instruction of the operator. According to the collection schedule set in the log collection rule setting process, as shown in FIG. 4, (c) log file collection process (step S12)
And (d) log database generation processing (step S1)
3) and (e) log database storage processing (step S
14) and (f) data analysis processing (step S15)
And (g) data analysis result output processing (step S16)
And performing the following.

Various web server software for generating log files is used in each of the web server apparatuses 200. In the present embodiment, in particular, a common file is created based on the log files of a plurality of web server apparatuses 200. The following process is performed to generate a log database. In the log collection rule setting process, the controller 10 stores a plurality of classification items and a plurality of analysis items (specifically, items in FIG. 6) of the log database necessary for analyzing the log file. Using the field number, the definition information for associating with the log file item is stored in each Web server 200.
It is set every time and stored in the setting information memory 22. Here, when specifying the default log file format,
The operator can specify a desired log file format of the Web server 200 based on the default definition information in the default definition information memory 21 without specifying the field number. Next, in the log file collection process (step S12 in FIG. 4), each web server device 200 is accessed and data of the log file is transmitted from each web server device 200 to the network 30.
0 and transferred to the server management apparatus 100 and received.
Further, a log database generation process (step S13)
In the log database storing process (step S14), based on the received log file data,
By referring to the set definition information and calculating the statistical data of each analysis item for each classification item of the log database, a log database including the statistical data is generated, and the log database including the statistical data is generated. It is stored in the log database memory 23. Further, in the data analysis process (step S15) and the data analysis result output process (step S16), the plurality of analysis items for a preselected one of the plurality of classification items are determined based on the generated log database. An analysis process is performed on an analysis item selected in advance among the items, data of an analysis result is generated, output to the CRT display 33 and the printer, and displayed and printed.

In FIG. 1, each Web server 200
(A) Web page information expressed by using, for example, HTML, data reception processing, data transfer processing, etc.
b. Controller 50 for controlling operation of server device
And (b) a log file memory 51 connected to the controller 50 and generated by the controller 50 to store a history (history) executed by the Web server device 200 and stored as a log file, and (c) a server connected to the controller 50 and It includes a communication interface 52 that executes processes such as signal conversion and signal modulation / demodulation for performing bidirectional communication such as data transfer with the management device 100 via the network 300. Here, the controller 50 includes:
For example, a server management application program executed on an OS such as Windows NT, for example, (a) Microsoft Internet I
nformation Server, (b) Nati
onal Center for Supercomp
uting Application and (c) O
racle Web Application Ser
ver3.0 is installed and executed. As a result, the history (history) executed by the Web server 200 is generated by the controller 50 and stored in the log file memory 51 as a log file.
According to an instruction by FTP from the server management device 100,
The log file is transferred from the controller 50 to the controller 10 via the communication interface 52, the network 300, and the communication interface 30 in the server management device 100.

The server management apparatus 100 includes a controller 10 which is constituted by a CPU and executes server management processing including log file management processing. Here, the controller 10 performs a plurality of We via a communication interface 52 that executes processes such as signal conversion and signal modulation and demodulation for performing bidirectional communication such as data transfer, and a network 300.
b Connected to the server device 200. The controller 10 has a ROM 11 for storing an OS program and a processing program for server management processing including log file management processing.
And the main memory (working memory) of the controller 10
A RAM 12 that operates as a temporary storage memory and a hard disk memory 13 that stores various data are connected via a bus 20. Further, a timer 14 for measuring the current time is connected to the controller 10. here,
The hard disk memory 13 includes a default definition information memory 21, a setting information memory 22, a log database memory 23, an analysis rule memory 24, and an analysis result memory 25. Further, a keyboard 31 and a mouse 32 are connected to the controller 10 as data input devices, and a CRT display 33 and a printer 34 are connected as data output devices.

In this embodiment, as shown in step S3 of FIG. 2, (a) Micr is used as a default Web server program used in each Web server device 200.
osoft Internet Information
n Server, (b) National Center
er for Supercomputing App
ligation (NCSA) and (c) Orac
le Web Application Server
3.0 (hereinafter referred to as default software) is specified, but other types of software can also be used. The following table shows the log file format for these three default softwares. In these tables, the entry is F
The field numbers are described in ascending order from 1 when the data is transferred in the TP format. That is, in Table 1, the client IP address is field number 1, the user name is field number 2, and so on. In addition,
In the following table, the client is a connection source computer which is not shown in FIG. 1 but is connected to and accesses each Web server device 200.

[0021]

[Table 1] Microsoft IIS standard log file format (one of the formats used by Microsoft's Internet Information Server (IIS)) ――――――――――――――――――――― ――――――――――――― Item Description ―――――――――――――――――――――――――――――――――― IP address IP address of the connection source machine Client user name User name of the connection source machine Date Connection date Time Connection time Service name Displays the requested service name. For example, WWW (W3SVC), FTP, Gopher Computer name Computer name of server device IP address of server device IP address of server device Processing time (ms) Time when connection request is processed, for example, image transfer time, etc. Number of received bytes The amount of information received by the server from the connection source machine The number of bytes transmitted The amount of information transmitted from the server device to the connection source machine For example, the size of an image Service status code An error code defined by the WWW standard 404: Windows NT status code, such as no corresponding page NT unique code Operation name Command name requested from the connection source to the server For example, POST, GET, etc. Operation target Displays the file name, program, and parameter names required by the connection source ―――――――――――――――― ―――――――――――――――――― (Note) Output example of IIS standard log file format (I) 172.23.xxx.128,-, 98/11 / 26,0: 51: 35, W3SVC, DMC2,172.21.yy.226,203,380, 877,200,0, GET, / enegi / Gif / mente.gif,-, (II) 172.23.xxx.128,-, 98/11 / 26,0: 51: 36, W3SVC, DMC2,172.21.zz.226,94,453,2244, yyy, 0, GET, / Scripts / counter / count.exe, df = enegi.dat, (III) 172.21.xx.166, administrator, 98 / 11 / 26,4: 00: 43, MSFTPSVC, DMC2,-, 0,2 0,0, zz, 0, [1741] USER, administrator,-,

[0022]

[Table 2] NCSA combined log file format ―――――――――――――――――――――――――――――――― Item Description ――――― ――――――――――――――――――――――――――――――― IP address of client IP address or computer name of connection source machine Date and time Connection date and time For example, [dd / mm / yyyy: hour: minutes: seconds GMT offset] Request (operation name + operation target) Command name requested by the connection source, file name, program, parameters, etc. All service status codes Error codes defined by WWW standard For example , 200: Successful connection, 404: No corresponding page, etc. Number of bytes transmitted Information amount to be transmitted from server to connection source machine, eg, image size Reference path Path of file referenced by URI Server name WWW server name ― ―――――――――――――――――――――――――――――― (Note) Output example of NCSA combined log file format (I) 172.23.xxx. 128, [19 / Sep / 1995: 15: 19: 07-0500], “GET / images / icon.gif H TTP / 1.0”, 200,1656, “http: // aboutus /”, “NCSA Mosaic / 2.7 b1 (X11; IRIX5.3IP 22) Iibwww / 2.12modified ”

[0023]

[Table 3] The log file output by the Oracle Web Application Server 3.0 log file format (Web Application Server 3.0 (a Web server manufactured by Oracle)) is selected from the following items by the server administrator. ―――――――――――――――――――――――――――――――――― Item Description ――――――――――― ――――――――――――――――――――――― DNS name of the client Domain name of the connecting machine IP address of the client IP address of the connecting machine Client authentication ID Content with authentication User name when request is made Date and time Connection date and time For example, [dd / mm / yyyy: hour: minutes: seconds GMT offset] request (operation name + operation target) Command name, file name, program, parameter, etc. Service status code Error code defined by WWW standard. For example, 200: Connection successful, 404: No corresponding page, etc. Transmission bytes Number of bytes transmitted from server to connection source machine Yes Information amount For example, image size Transaction date Transaction completion date Transaction time Transaction completion time Processing time Time required for connection DNS name of server device Domain name of server device IP address of server device IP address of server device Comment Service status code Comment added to the field Operation name Displays the request from the connection source to the server For example, POST, GET, etc. Operation target (main part) Character string required by the connection source, excluding the parameter name For example, file name Program name Operation target (question part) Character string required by the connection source, excluding file name / program name For example, parameter string ―――――――――――――――――――――― ―――――――――――――― (Note) Example of Oracle Web Application Server 3.0 log file format (From the above fields, client IP, user name, date and time, operation name, service status code, transmission (When the number of bytes is selected) (I) 192.xxx.29.35- [03 / Jun / 1998: 15: 09: 07 + 0900] ”GET / og-img / help ico.gif HTTP / 1.0” 200 891 (II ) 192.168.yy.35- [03 / Jun / 1998: 15: 09: 07 + 0900] “GET / og-img / title a.gif HTTP / 1.0” 200 8349 (III) 192.168.zz.35- [03 / Jun / 1998: 15: 09: 15 + 0900] “POST / garireo / plsql / sho hin.a kiki HTTP / 1.0” 200 1623

The default definition information for the above three default software is stored in the default definition memory 21 in advance as shown in the following table.

[0025]

[Table 4] Example of default definition information ―――――――――――――――――――――――――――――――― Item IIS NCSA Oracle ――― ――――――――――――――――――――――――――――――― Server IP 7−12 Client IP 1 1 2 Date 3 − − Time 4 − − Date and time −2 4 Requests 13,14 3 5 Number of transmitted bytes 10 5 7 ――――――――――――――――――――――――――――――――――

As apparent from Table 4, in the default definition information in the default definition information memory 21, log database items (classification items and analysis items) necessary for analyzing a log file are provided for each default software. Item) is stored using the field number of the log file, and the definition information for associating the item with the item of the log file. In the present embodiment, the Web to be set
When the server device 200 uses default software, as shown in step S3 of FIG. 2, if the operator selects the default log file format, the process of specifying the field number in step S4 is performed. At this time, the controller 10 reads the corresponding definition information from the default definition information memory 21 and sets the same in the setting information memory 22. This simplifies the setting operation and improves the operability.

In the hard disk memory 13, a setting information memory 22 stores setting information which is a log collection rule for which a log collection rule is set. The log database memory 22 stores a log database generated in the log database generation process. The log database is shown in FIG.
As an example, (a) date, (b) time, (c) server IP, (d) client IP, and (e) site are pre-selected as classification items, and (f) as analysis items Hits, (g) bytes sent,
And (h) the processing time is selected in advance. As shown in FIG. 3, the analysis rule memory 24 stores analysis items and classification items set in the analysis rule setting process, which correspond to the vertical and horizontal axes of the analysis result, respectively. Further, the analysis result memory 25 stores data of a processing result of the data analysis processing.

In this embodiment, the log database shown in FIG. 6 is used. However, the classification items and the analysis items may be changed, and the server management device 100 may have a processing program for the change.

FIG. 2 is a flowchart showing a log collection rule setting process executed by the controller 10 of FIG. 1 and a front view showing an example of a display screen on the CRT display 33 at the time of setting. In FIG. 2, first, in step S1, a Web server device 200 having a log file
Is entered using the keyboard 31 and the ID and password used to access the Web server 200 when the log file is transferred from the Web server 200 to the server management apparatus 100 in the FTP format in step S2. Input using 31. Next, in step S3, the directory and file name of the log file are input using the keyboard 31, and the log file format is set using the mouse 32.
In the case of default software, a selection is made from the above three default software. On the other hand, if the software is not the default software, the other is clicked, and the process proceeds to step S4.

In step S4, software other than the default software is transferred to the Web server 20.
When 0 is used, the definition information of the log file format is set. In the present embodiment, as described above, the field number in the data transferred by FTP is specified for each classification item and each analysis item. The date and time are specified by date + time or date and time. Here, the format of the date and time is selected from a predetermined format together with the field number. Also, the request is
As is clear from Tables 1 to 3, specific operation names and operation targets to be analyzed are shown. The following table shows an example of the format of this request.

[0031]

[Table 5] Example of request format ―――――――――――――――――――――――――――――――― “Operation name (POST / GET) ) Operation target ”→ Example:“ GET / images / water.gif ”―――――――――――――――――――――――――――――――――― “Operation name (POST / GET) operation target? Parameter” → Example: “POST / cgi-bin / conuntcgi? Number = 2” ――――――――――――――――――――――― ――――――――――――― “Operation name (POST / GET) operation target? Parameter, protocol name” → Example: “POST / cgi-bin / countcgi? Number = 2, HTTP / 1.0” ― ―――――――――――――――――――――――――――――――――

When the setting is completed in step S4, if OK is clicked on the mouse 32, the process returns to step S3. If the setting in step S3 is completed, the collection schedule is set in step S5, and if OK is clicked, the controller 10 executes server management processing including log file management processing. The setting information set in the above log collection rule setting process is stored in the setting information memory 22.

FIG. 3 is a graph showing an example of a display screen and an analysis result when setting the analysis rule setting process executed by the controller 10 of FIG. This analysis rule setting process may be performed prior to the server management process or after the log database storage process (step S14) in FIG. 4 ends. In the latter case, by clicking OK shown in FIG. 3, the data analysis processing (step S
15) is executed, and the analysis result as shown on the right side of FIG. 3 is displayed on the CRT display 33 and printed out on the printer 34.

In FIG. 3, in the analysis rule setting process,
While inputting the collection period using the keyboard 31,
The items on the horizontal axis and the vertical axis of the analysis result corresponding to the classification item and the analysis item are set by clicking with the mouse 32. In FIG. 3, black squares and black circles are set items. Furthermore, the IP and site of the server that performs the analysis (in this embodiment, indicates the directory where the file is stored in the URL of WWW. The item transferred by FTP corresponds to the request, for example, operation name + operation Is set using the keyboard 31. The setting items set in the above analysis rule setting process are stored in the analysis rule memory 24.

FIG. 4 is a flowchart showing a log file management process executed by the controller 10 of FIG. In FIG. 4, first, in step S11, the timer 1
It is determined whether or not the current time is the set time set in the schedule setting based on the measured time of the current time of 4, and if it is the collection set time, the log file collecting process is executed in step S12. Specifically, the controller 10
Accesses each Web server 200 based on the setting information stored in the setting information memory 22, and transmits the log file data from each Web server 200 to the server management device via the network 300 by FTP. 100 and received. Then, step S1
3, a log database generation process is executed, and based on the data of the received log file, referring to the set definition information, for each classification item of the log database, the statistics of each analysis item By calculating the data, a log database including the statistical data is generated. Then, in step S14, a log database storage process is executed, and the generated log database is stored in the log database memory 23 in the hard disk memory 13. Further, in step S15, based on the log database in the log database memory 23, the analysis process is executed by using the analysis rule previously set in the analysis rule setting process and stored in the analysis rule memory 24. Specifically, information corresponding to the set analysis rule is obtained from the log database, for a classification item selected and set in advance.
Data is collected for analysis items that are selected and set in advance, and are graphed, for example, as shown in FIG. This analysis result data is stored in the analysis result memory 25, displayed on the CRT display 33, and
Is printed out.

FIG. 5 is a flowchart showing a log database generation process which is a subroutine of FIG. FIG.
First, in step S21, a site extraction process is executed to extract information on a corresponding site from the log database. Here, “site” indicates a directory in which files are stored in the URL of WWW as shown in the following table.

[0037]

[Table 6] Example of site ―――――――――――――――――――――――――――――――― http: // www. example. com / ―――――――――――――――――――――――――――――――― http: // www. example. com / system / ――――――――――――――――――――――――――――――――――

Next, in step S 22, a hit count statistical calculation process is executed, the number of times of requesting the top page of “site” is calculated and calculated, and stored in the log database memory 23. Specifically, the file name of the top page of WWW (index.htm, welcome.h)
tm) by the date, time,
The total is calculated separately for each site, client IP, and server IP. Also, in step S23, a transmission byte count statistical calculation process is executed, and the total of the transmission byte counts is calculated as a date,
The time, the site, the client IP, and the server IP are obtained in total and stored in the log database memory 23.
Further, in a step S24, a processing time statistical calculation processing is executed, a total of the processing time is calculated and stored in the log database memory 23. Specifically, the processing time is obtained by summing up the date, time, site, client IP, and server IP. With the above processing, the log database generation processing ends, and the processing returns to the original main routine.

As described above, according to the present embodiment, the controller 10 determines the classification items and analysis items of the log database necessary for analyzing the log file.
The definition information for associating with the log file item is set using the log file field number, the Web server 200 is accessed, and the log file data is transferred and received via the network 300 (FIG. 4). Step S12), the statistical data of each analysis item is calculated for each classification item of the log database with reference to the definition information based on the received log file data, and a log database including the statistical data is generated (step S12). Step S13,
S14) The analysis process is executed based on the generated log database to generate and output analysis result data (steps S15 and S16). Therefore, the server management processing program need only be installed in the server management apparatus 100, and does not need to be installed in each Web server apparatus 200, and only the server management processing program of the server management apparatus 100 needs to be managed. The management cost can be reduced as compared with the conventional example in which a program for processing the log file is created for each application, and the maintenance management is simple. Further, by simply setting the definition information for various log file formats, it is possible to generate a common log database in which the log file information is aggregated, and the operation of the operator is extremely simple.

In this embodiment, the Web to be set
When the server device 200 uses default software, as shown in step S3 of FIG. 2, if the operator selects the default log file format, the process of specifying the field number in step S4 is performed. Can be omitted. This simplifies the operation of setting the definition information and improves the operability.

Further, in the present embodiment, in the analysis rule setting process of FIG. 3, a classification item in the analysis process is selected from a plurality of predetermined classification items using the mouse 32, and the analysis item in the analysis process is selected. Is selected using the mouse 32 from a plurality of predetermined analysis items. Accordingly, the operator only has to select an item of the analysis processing, and thus the operation of item selection is simplified, and the operability is improved.

<Modification> In the above embodiment, the network 3 such as an in-house network is used for the in-house system.
00, but the present invention is not limited to this.
Communication networks of various communication lines may be used.

In the above embodiment, the processing program of the server management processing including the log file management processing is the ROM 1
1, the present invention is not limited to this, and may be stored in the hard disk memory 13 or may be stored in a CD.
-Even if the data is stored in a computer-readable recording medium which is an optical disk memory such as a ROM, a CD-R, a CD-RW, and an MO, and loaded into the hard disk memory 13 via a disk drive (not shown). Good.

In the above embodiment, the server management process for the log file of the Web server 200 has been exemplified. However, the present invention is not limited to this, and the log file is not limited to the intranet server or the Web server. The present invention can be widely applied to server apparatuses that execute a predetermined application program.

[0045]

As described above in detail, according to the present invention, in a server management device in which a plurality of server devices each having a log file of a predetermined log file format are connected via a network, the log file is analyzed. The definition information for associating a plurality of classification items and a plurality of analysis items of the log database required for the log file with the items of the log file using the field numbers of the log file is set for each of the server devices. Communication means for accessing each server device, transferring the log file data from each server device to the server management device via the network, and receiving the log file data. The above definition information is referred to based on the Generating means for calculating a statistical data of an item to generate a log database including the statistical data and storing the generated log database in the first storage device; and Analyzing means for executing analysis processing on a preselected analysis item among the plurality of analysis items with respect to a preselected classification item, and generating and outputting data of an analysis result;

Therefore, according to the present invention, the server management processing program is installed only in the server management apparatus, and does not need to be installed in each server apparatus. Only the server management processing program of the server management apparatus is managed. Therefore, the management cost can be reduced as compared with the conventional example in which a program for processing the log file is created for each application, and the maintenance management is simple. Further, by simply setting the definition information for various log file formats, it is possible to generate a common log database in which the log file information is aggregated, and the operation of the operator is extremely simple.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a server management system according to an embodiment of the present invention.

FIG. 2 is a front view showing a flowchart illustrating a log collection rule setting process executed by a controller 10 of FIG. 1 and a display screen at the time of setting.

FIG. 3 is a graph showing an example of a display screen and an analysis result when setting an analysis rule setting process executed by the controller 10 of FIG. 1;

FIG. 4 is a flowchart showing a log file management process executed by the controller 10 of FIG.

FIG. 5 is a flowchart showing a log database generation process which is a subroutine of FIG. 4;

FIG. 6 is a table showing an example of a log database stored in a log database memory 23 of FIG. 1;

[Explanation of symbols]

10: Controller, 11: ROM, 12: RAM, 13: Hard disk memory, 14: Timer, 20: Bus, 21: Default definition information memory, 22: Setting information memory, 23: Log database memory, 24: Analysis rule memory, 25: Analysis result memory, 30: Communication interface, 31: Keyboard, 32: Mouse, 33: CRT display, 34: Printer, 50: Controller, 51: Log file memory, 52: Communication interface, 100: Server management device, 200 , 200-1 to 200-N: Web server device; 300: Network.

Claims (7)

[Claims] 1. A server management apparatus, in which a plurality of server devices each having a log file of a predetermined log file format are connected via a network, a plurality of classification items of a log database necessary for analyzing the log files. And setting means for setting, for each of the server devices, definition information for associating a plurality of analysis items with the log file items using the field numbers of the log file, and accessing the server devices. Communication means for transferring and receiving the data of the log file from each of the server devices to the server management device via the network, and referring to the set definition information based on the received data of the log file. Then, for each classification item of the log database, the statistical data of each analysis item is calculated. A generating unit configured to generate a log database including the statistical data and store the generated log database in the first storage device, based on the generated log database, A server management device comprising: an analysis unit configured to execute an analysis process on an analysis item selected in advance among the plurality of analysis items to generate and output data of an analysis result. 2. The method according to claim 1, wherein the setting unit is configured to input a predetermined log file format based on a second storage device that stores the definition information in advance, and a log file format input for each server device. When the defined definition information of the log file format is stored in the second storage device, the stored definition information is read from the second storage device,
2. The server management apparatus according to claim 1, further comprising: means for setting as definition information for the server apparatus. 3. The analysis means comprises: first selection means for selecting a classification item in the analysis processing from a plurality of predetermined classification items; and analyzing the analysis items in the analysis processing by a plurality of predetermined classification items. 3. The server management apparatus according to claim 1, further comprising a second selection unit that selects from analysis items. 4. A server management method for a server management device in which a plurality of server devices each having a log file of a predetermined log file format are connected via a network, wherein a log necessary for analyzing the log file is provided. A setting step of setting definition information for associating the plurality of classification items and the plurality of analysis items of the database with the items of the log file using the field numbers of the log file, for each of the server devices; A communication step of accessing each server device and transferring and receiving the data of the log file from each server device to the server management device via the network; and performing the setting based on the received data of the log file. By referring to the defined information, each analysis item is classified for each classification item of the log database. Generating a log database including the statistical data by calculating statistical data of the eyes, and storing the log database in the first storage device; and, based on the generated log database, Performing an analysis process on a preselected analysis item of the plurality of analysis items with respect to a preselected classification item, and generating and outputting data of an analysis result. Management method. 5. The method according to claim 1, wherein the setting step includes the step of storing the definition information in a second storage device in advance for a predetermined log file format, based on the log file format input for each server device. When the definition information in the format of the input log file is stored in the second storage device, the stored definition information is read from the second storage device,
5. The server management method according to claim 4, further comprising the step of setting as definition information for the server device. 6. The analysis step includes: selecting a classification item in the analysis process from a plurality of predetermined classification items; and selecting an analysis item in the analysis process from a plurality of predetermined analysis items. 6. The server management method according to claim 4, further comprising the step of: 7. A recording medium storing a server management program, wherein the server management program includes the server management method according to any one of claims 4 to 6.