JP2001184235A - Device for obtaining and analyzing log information - Google Patents

Abstract

PROBLEM TO BE SOLVED: To correctly connect log information separately outputted to plural files along the time base, and to accurately grasp the order of the generation of events from the connected log information. SOLUTION: Each program 101, 102, and 103 in a software system 111 obtains a shared counter value for specifying the order of output of log information held by a shared counter 110, and outputs the value by including it in log information, and stores it in a log information file. The shared counter value obtained by the shared library 103 at the time of outputting the log information is notified through a shared counter value notifying means 108 to the program 102 calling another program (the shared library 103 in Figure), and the notified shared counter value is outputted so as to be included in the log information. Thus, the order of output of the log information can be uniquely specified, and the relevance among the plural log information can be clarified by using the shared counter values recorded on the plural log information in the plural log information files and the notified shared counter value.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention uniquely identifies the output order of log information from a plurality of pieces of log information that record the operating status of each program in a software system composed of a plurality of programs, and based on the same factors. The present invention relates to a log information acquisition and analysis device that searches and associates a plurality of pieces of log information output and output.

[0002]

2. Description of the Related Art In analyzing a log information in a trouble investigation work of a software system, the output contents of the log information are associated with the position on the source program to which the log information is output. When associating with a source program, the log information needs to be able to accurately specify the order in which the phenomena occurred. If the order of occurrence of the phenomena is not accurate, the result of association with the source program will also be inaccurate, and it will not be possible to correctly grasp the phenomena that are causing problems and the status of processing, and as a result, it will not be possible to identify the cause of the abnormality Or a process that is operating normally may be mistaken as an abnormal process.
It is important to associate the log information with the source program in the trouble investigation work of the software system.

Japanese Patent Application Laid-Open No. 9-259011 describes a log information collection / analysis device for associating a chart showing the execution status of a program with a source program. Generate a chart graphed along. Furthermore, by embedding information that uniquely defines the relationship with the source program in the log information, the relationship between the chart and the source program can be clearly defined. as a result,
It is possible to reliably associate the log information with the chart and the source program.

When the prior art is applied, the correspondence between the acquired log information and the source program becomes clear,
The log information can be accurately analyzed. Further, since the chart is generated, it is possible to visually know the operation status of the software system.

[0005]

The prior art disclosed in Japanese Patent Application Laid-Open No. 9-259011 is based on the premise that all log information is output along a time axis. Investigation into the cause at the time of occurrence of an abnormality is performed depending on the output order of the log information. The chart is also created depending on the output order of the log information. However, the conventional technique disclosed in Japanese Patent Application Laid-Open No. 9-259011 is a software system in which a plurality of programs operate in cooperation with each other.
It is not assumed that log information is stored in separate files for each program. Therefore, the prior art has the following problems.

At present, a plurality of programs often operate in cooperation with each other. At this time, since the contents of information that needs to be output as log information differ in each program, the log information is often output to a separate file. Further, in a large-scale software system, a file storing log information for each function may exist even in the same software system. When the log information is divided and stored in a plurality of files as described above, it is necessary to collate the output contents between the log information and to combine them as one log information.

However, in a large-scale software system, a plurality of failure investigators are generally present, and perform failure investigations for programs having different functions. Therefore, there is a problem that a complicated procedure such as the following example must be performed in order to perform collation between log information.

As an example, consider a procedure for analyzing log information in a program that calls a function held by another program. The two programs store log information in separate files. First, the program that calls the function of another program checks the log information of the own program. As a result, when it is determined that the cause of the abnormality is in the function of the other program called by the own program, the failure investigator of the called program is requested to investigate the phenomenon.
On the other hand, when the failure investigator of the called program receives a phenomenon investigation request from the failure investigator of the calling program, it analyzes the log information of the called program. However, from the log information of the called program, it is not possible to know how the function in question was called and under what circumstances it was used. Therefore, the fault investigator of the called program requests the fault investigator of the calling program to provide necessary information. Upon receiving a request for providing information from the failure investigation worker of the called program, the failure investigation worker of the calling program investigates and provides the requested information. The failure investigator of the called program receives the information and continues analyzing the log information again. Usually, such an exchange is performed a plurality of times for one phenomenon. As a result, it takes a considerable amount of time before the phenomenon is elucidated.

In order to apply the prior art disclosed in Japanese Patent Application Laid-Open No. 9-259011, it is necessary to combine log information stored in different files for each program into one log information along a time axis. Generally, the log information records the output time of the log information. Therefore, when a plurality of pieces of log information are combined into one, the log information output time is used as a key. However, when a plurality of processes operating in parallel output log information at the same time, the output times of the log information recorded on the log information are all the same. In this case, the output order of the log information cannot be determined from the output time of the log information. If the accuracy of the time measurement function supported by software or hardware is low, the output times of a large amount of log information output in a very short time may be the same. Such a phenomenon may occur universally. For the reasons described above, there is a problem that the output order of a plurality of log information may not be uniquely specified only by the output time of the log information.

As described above, the prior art shown in Japanese Patent Application Laid-Open No. 9-259011 is based on the premise that the order of occurrence of events is the same as the order of output of log information. Therefore, in the related art, when a plurality of programs output log information to separate files, it is necessary to accurately combine log information along a time axis. However, there is a problem that it takes a long time to correctly combine a plurality of pieces of log information because a complicated procedure is required. An object of the present invention is to correctly combine log information separately output to a plurality of files along a time axis, and to accurately grasp the order of occurrence of events from the combined log information.

[0011]

In order to achieve the above object, the present invention provides log information of each program of a software system including a plurality of programs, and outputs log information between the plurality of log information. Log information acquisition and analysis device for log information having a shared counter value that uniquely specifies a shared counter value, the shared counter value notifying means for notifying the shared counter value among a plurality of programs, and a shared counter value from another program. Means for generating log information including the notified shared counter value as log information of the program whose value has been notified, and, for a plurality of pieces of log information, the shared counter value of the log information and the notified shared counter value And has log information relevance analysis means for searching and associating log information output for the same cause using .

A log corresponding to log information of each program of the software system including a plurality of programs, the log information having a shared counter value for uniquely specifying the output order of the log information among the plurality of log information. The information acquisition analysis device includes a log information relevance analysis unit that searches for log information output from the log information for the same cause and associates the log information with a plurality of log information.

[0013] Further, there is provided a log information analysis result correcting means for manually correcting the result of association of the displayed log information output due to the same cause.

[0014] Further, information of the correction made by the log information analysis result correcting means is stored as log information relevance information,
Log information relevance information management means for extracting the stored log information relevance information when analyzing other log information;
There is provided a log information interrelation analysis means for correcting another similar analysis result correction point using the log information interrelation information extracted from the log information interrelation information management means.

Further, there is provided a log information interrelation analysis means for analyzing other log information using the stored log information interrelation information.

[0016]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The outline of log information output means and log information analysis means according to the present invention will be described below. FIG. 1 shows a log information output unit 1 according to the present invention.
12 shows an outline. The software system 111 of FIG. 1 is a software system configured by a plurality of programs. Software system 11
1 operates independently without calling other program functions in the software system 111. Further, the program 102 uses the other program function calling means 104 to
Call the function held by Each program in the software system 111 has its own log information output unit 105, 106, 107. Also,
The shared counter 110 exists at a position where all programs in the software system 111 and other software systems can refer to. As means for accessing the shared counter 110, there is a shared counter value acquiring means 109. The program 102 and the shared library 10
There is a shared counter value notifying unit 108 for notifying the shared counter value from the shared library 103 to the program 102 between 3.

The shared counter 110 is mounted at a position that can be commonly referred to between software systems and programs. When acquiring a value from the common counter 110, the common counter value acquiring means 109 is always called and acquired. The common counter value acquisition means 109 receives a common counter value acquisition request from each program, and returns the common counter value to the requesting program. At this time, the common counter value is incremented. Shared counter value is shared counter 1
Initialization is performed when access is first made to 10. Also, in the shared counter value acquisition means 109,
Exclusive control processing is performed to control the acquired shared counter values so that they do not overlap. By using the shared counter value acquisition unit 109, a program that outputs log information can acquire a value that can uniquely specify the output order of log information. The acquired shared counter value is stored in the log information output unit 1
05, 106 and 107 are recorded on the log information file. The program that has output the log information suspends the processing at that point. If the program whose processing has been interrupted is called from another program, control is transferred to the calling program after the interruption.

In FIG. 1, a shared library 103 is called from a program 102. Therefore, when the log information is output in the shared library 103, the processing in the shared library 103 is interrupted, and the control is passed to the program 102 that is the calling source. As a result, the log information output by each program is recorded almost in the order in which the phenomena occurred.

The log information file output by the log information output unit shown in FIG. 1 is analyzed by using the log information analysis unit 208 shown in FIG. When there are a plurality of pieces of log information output based on a certain event, it can be considered that there is a relationship between the pieces of log information. In FIG. 1, it is assumed that the operation of the program 102 has become illegal. When the log information analyst examined the log information output by the program 102, it was found that the operation of the shared library 103 called in the program 102 was incorrect. Next, an analyst of the log information searches and investigates the log information of the shared library 103 that can be considered to be related to the log information output by the program 102. As a result, the cause of the improper operation of the program 102 can be pursued in more detail.

The log information analyzing means 208 receives a plurality of files storing the log information, a log information storage file input means 201, and a log information analyzing the output order of the log information recorded in the plurality of log information files. Output order analysis means 202, log information relationship analysis means 203 for analyzing the relationship between log information from the log information in which the output order is determined, registration and reference of information used when analyzing the relationship between log information Log information relevance information management means 2 for performing
04, log information relevance information 205 used when analyzing the relevance between log information, log information analysis result display means 206 for displaying the log information analysis result, and correction of the displayed log information analysis result And log information analysis result correcting means 207 for processing the information at the time of performing.

The log information analysis means 208 receives a plurality of log information files output by the log information output means through the log information storage file input means 201. The plurality of input log information are combined as one log information by the log information output order analysis means 202, and are rearranged using the shared counter value as a key. By this processing, the log information divided into a plurality of files is combined into one information using the shared counter value as a key.

Next, the log information is analyzed by the log information relevance analysis means 203 for each piece of log information. At the time of analysis of relevance, information used for analysis processing is acquired from the inter-log information relevance information 205 through the inter-log information relevance information management unit 204. The analyzed result is displayed in the log information analysis result display means 20.
6 and output. If any correction is made to the output result, the log information analysis result correction unit 207
Call. The correction result of the log information is transmitted to the log information relevance information 20 through the log information relevance information managing unit 204.
5 is fed back. In the log information analysis processing, the log information analysis result correcting unit 207, the log information interrelation information management unit 204, and the log information interrelation information 20
5 functions effectively especially when the shared counter value notified from the related program is not recorded in the log information file.

Next, the processing flow of the log information output means and the log information analysis means will be described. FIG. 3 is a flowchart showing an outline of a processing flow in the log information output means described in FIG. In the log information output means, the program which outputs log information first confirms whether or not a notification that the log information has been output has been received from the called program (step 301). When the log information is output from the called program, the calling program receives the shared counter value notified by the called program (step 302). The program 102 calls the shared library 103. Therefore, program 1
02 receives the shared counter value notified by the shared library 103 through the shared counter value notifying unit 108. The notified shared counter value is a value acquired from the shared counter 110 through the shared counter value acquiring means 109 when the called program outputs the log information.

On the other hand, if there is no notification that the log information has been output from the called program, step 30 is executed.
Step 2 is not executed. When the calling program outputs log information independently of the operation of the called program, or when a program that operates without calling a function of another program, such as the program 101 or the shared library 103 in FIG. Is output, there is no notification that the log information has been output. Steps 301 and 302 are not executed in a software system that does not use a means for notifying that log information has been output between programs or notifying a shared counter value acquired by a called program. In this case, the log information does not include the shared counter value acquired by the called program.

Next, the program for outputting the log information acquires the shared counter value from the shared counter 110 through the shared counter value acquiring means 109 in FIG. 1 (step 3).
03). The process of step 303 is executed by the log information output unit of the program that is to output log information. Therefore, the log information output unit 105 for the program 101, the log information output unit 106 for the program 102, and the log information output unit 107 for the shared library 103 execute the processing of step 303. The shared counter value acquired here is added to the log information that the calling program is currently outputting.

After obtaining the shared counter value to be added to the log information to be output at present, the log information is actually output (step 304). The log information is output by the log information output unit 105, the log information output unit 106, and the log information output unit 107. When the log information is output, the shared counter value notified from the call destination program acquired from the shared counter value notifying unit 108 in step 302 and the shared counter value added to the current log information acquired from the shared counter 110 in step 303 are also displayed. Output in the log information. On the other hand, if the notification that the log information has been output is not received from the called program in step 301, the log information is output without being affected by the called program instead of the shared counter value notified. Output a value indicating that

After the execution of the log information output process in step 304, the program that calls the function of the program that output the log information is notified that the log information has been output (step 305). At this time, a shared counter value to be added to the current log information acquired in step 303 is also notified. The shared library 103 in FIG. Therefore, when the process of step 305 is executed by the shared library 103, the shared counter value is notified to the program 102.
The program 102 receives the shared counter value notified from the shared library 103 in the process of step 302. The program 102 is not called from another program. Therefore, when the process of step 305 is executed by the program 102, the notified shared counter value is lost because there is no receiver. The program that has notified that the log information has been output suspends the processing at that time. The log information analysis means shown in FIG. 2 analyzes the relevance between the log information for the plurality of log information created by the log information output means described above.

The log information analyzing means will be described below. FIG. 4 is a flowchart showing an outline of the processing flow of the log information analyzing means described in FIG. The log information analysis means 208 of FIG.
01, the log information is read from the file in which the log information is recorded (step 401). The log information storage file input unit 201 can read log information from a plurality of log information storage files. The log information read by the log information storage file input means 201 is analyzed by the log information output order analysis means 202 for the output order (step 402). The log information output order analysis means 202
When a plurality of log information is received, the output order of the log information is determined by paying attention to the shared counter value added to each log information acquired in step 303 of FIG. After the common counter value is obtained, the common counter value obtaining means 10 shown in FIG.
9 is incrementing. Therefore, it can be determined that the smaller the shared counter value is, the earlier the log information is output. After specifying the output order among the plurality of log information based on the shared counter value, the log information output order analysis unit 202 rearranges and combines the log information in the output order, and combines the plurality of log information into one log information. (Step 403). Next, the combined log information is sent to the log information relevance analysis unit 203.

The log information interrelation analysis means 203 first checks whether or not the shared counter value notified from the called program is recorded in the log information for the combined log information (step S1). 404).
If the shared counter value reported from the called program is recorded, the value is used to analyze the relationship between log information (step 405). Each log information includes a shared counter 110 shown in FIG.
The shared counter value obtained from the above is added. Also,
The value is notified to the calling program, and is also recorded in the log information of the calling program. Therefore, the shared counter value added to each log information,
The association between log information is analyzed based on the association with the shared counter value notified from the called program.

When the log information interrelation analysis means 203 finds that the shared counter value notified from the call destination program is not recorded in the log information, the other log information output contents are used. Analysis of the relationship between log information is performed (step 406). At this time, the log information interrelationship information management means 204 is checked to see if information relating to the linking of log information to be analyzed is registered in the log information interrelationship information 205 (described later) (step 407). If the relevance information between the log information is stored for the log information to be analyzed, the analysis result of the log information created in step 406 is corrected using the information (step 408). After the analysis of the relationship between log information is completed, the analysis result is displayed on the log information analysis result display means 206 (step 409). The analysis result is displayed in a format that allows a person who performs a log information analysis operation to easily grasp the relationship between the log information.

The log information analyst analyzes the log information based on the analysis result displayed in step 409. However, as the analysis proceeds, it may be necessary to correct the displayed log information analysis result. In particular, when the shared counter value notified from the called program is not recorded in the log information, the relation between the log information is analyzed by inferring from the output contents of other log information.
Therefore, there may be a case where an error occurs in the analysis result.

In this case, the log information analyst reviews the log information analysis result and determines whether the analysis result is correct (step 410). As a result, when it is determined that the analysis result of the log information needs to be corrected, the analysis result of the log information displayed by the log information analysis result display means 206 is added to the log information analysis result correction means 207. A correction is made using (step 411). Step 411
When the correction is made in step (2), the information of the correction is notified to the inter-log information relevance information management means 204, and
05 (step 412). The correction information stored here is used when analyzing the association between log information in step 408. In the log information analysis result corrected in step 411, the same error is automatically searched and corrected (step 413).
After the correction, the analysis result of the log information is displayed again in step 409.

Next, an embodiment of the present invention will be described.
In the present invention, the relevance analysis processing of log information changes depending on whether the shared counter value notifying unit 108 in FIG. 1 is implemented in the software system 111 or not.

When the shared counter value notifying means 108 is installed, a notification process of the shared counter value acquired by the shared library 103 is performed between the calling program 102 and the shared library 103. As a result, the log information output by the program 102 records the shared counter value acquired by the shared library 103. Therefore, the relevance analysis processing of the log information is performed based on the shared counter value of the shared library 103 recorded on the log information of the program 102.

When the shared counter value notifying means 108 is not installed, the information acquired by the shared library 103 is not recorded in the log information output from the program 102. In this case, the relevance analysis processing of the log information is performed based on information embedded in the log information. Also,
The log information relevance information management unit 204 and the log information relevance information 205 shown in FIG.
In some cases, it is necessary to make correction using the log information analysis result correction unit 207.

In the following, the shared counter value notifying means 108
Examples of the log information output process and the analysis process for the case where is implemented in the software system 111 and the case where it is not implemented will be described. First, an embodiment in which the shared counter value notification unit 108 is implemented in the software system 111 will be described.

The log information output means shown in FIG.
FIG. 5 shows log information output means of this embodiment. FIG. 5 shows the log information output unit 112 of a program that operates by calling a function in a shared library commonly used in the software system 111. In the software system 111, there is a shared library 103 commonly used between the program 102 and each program. The program 102 is a program module 501
(Name: MainModule) and program module 502
(Name: SubModule) and program log information output means 1
06. Also, the shared library 103
Is the shared library module 503 (name: Lib_ope
n) and the shared library module 504 (name: initial
ize) and the shared library log information output means 107. In addition, in the software system, a shared library module calling means 1 for controlling a calling process between the program 102 and the shared library 103
04, program log information 505 for storing log information of the program 102, and shared library log information 506 for storing log information of the shared library 103.

The program module 501 in the program 102 calls the shared library module 503 using the shared library module calling means 104. The program module 502 operates without calling a module in the shared library 103.
On the other hand, the shared library module 503 in the shared library 103 is called from the program module 501 in the program 102 via the shared library module calling means 104. The shared library module 504 operates without being called from the program 102 side.

The software system 111 includes a shared counter 110 that can be commonly referred to by the program 102 and the shared library 103 and a shared counter value acquisition unit 109 that controls processing of the shared counter 110.
And a shared counter value notifying unit 108 for notifying the program 102 of the shared counter value obtained by the shared library 103 and the shared library 103.

Next, the flow of log information output processing in the software system 111 will be described with reference to FIG. The shared library 10 called by the program module 501 (name: MainModule) in the program 102 of FIG.
3 shared library module 503 (Name: Lib_open)
It is assumed that an abnormality has occurred. In this case, the shared library module 503 detects the occurrence of the abnormality, and calls the shared library log information output means 107 to output the fact as log information of the shared library.

The shared library 103 does not call the function of another program. Therefore, the shared library 103 does not need to check whether or not a notification that log information has been output from another program has been received. Therefore, the shared library log information output means 107 acquires the shared counter value to be added to the log information output this time as soon as it is called.

Shared library log information output means 107
Acquires the value of the shared counter 110 using the shared counter value acquiring means 109. After acquiring the shared counter value, the shared counter value acquiring unit 109 sets the shared counter 11
The counter value held at 0 is incremented. The shared counter value acquisition unit 109 performs an exclusive control process when acquiring the counter value. This is a process performed so that the value obtained from the shared counter 110 is always a unique value. By performing the exclusive control process, other processes and other threads cannot access the shared counter 110 during the process of acquiring the shared counter value. Next, the process or thread that needs to acquire the counter value waits until the exclusion is released. The exclusion is released after the value is obtained from the shared counter 110 and the counter value is incremented.

By the above processing, the value obtained from the common counter 110 is always different. This ensures that shared counter values are always unique within the system. Further, by incrementing the counter value, it is possible to uniquely define the output order of the log information from the counter value.

How to implement the shared counter 110 is determined according to the extent to which the shared counter 110 is shared inside and outside the system. When it is sufficient to share only within a process (multithread)
May be implemented as static variables in the shared library 103. In addition, when it is necessary to share between processes (multi-process), it is necessary to mount on a resource that can be shared between processes. Software system 11
When the common counter value acquisition unit 109 is first called in step 1, the common counter 110 needs to initialize the counter value. The timing of the initialization is the same as that of the implementation method of the common counter 110.
It depends on the extent to which 10 is shared. The shared library log information output unit 107 outputs the shared counter value acquired from the shared counter value acquisition unit 109 together with other log information to the shared library log information 506. After the log information is output, the program 102 is notified that an error has occurred. In this case, the shared counter value acquired by the shared library 103 is also notified to the program 102 at the same time. For the notification of the shared counter value, the shared counter value notifying unit 108 is used.

From the shared library 103 to the program 10
There is an exception mechanism as a means for notifying the occurrence of an abnormality to the second. The exception mechanism is a mechanism that exists in an object-oriented programming language such as C ++ language or Java language, Ada, or the like. In the C ++ language and the Java language, a plurality of information can be notified to another program in the form of an object by using an exception mechanism. Therefore, by including the shared counter value acquired by the shared library 103 in the exception information notified from the shared library 103 to the program 102, the shared counter value can be notified. The processing executed by the shared library 103 ends when the shared counter value is notified to the program 102. Thereafter, control is returned to the calling program 102.

On the other hand, the program module 501 in the program 102 receives the notification of the occurrence of the abnormality from the shared library module 503 in the shared library, and records the fact in the program log information 505. The program module 5 for recording in the program log information 505
01 calls the program log information output means 106.
The program log information output means 106 calls the shared counter value acquisition means 109 like the shared library log information output means 107 to acquire the shared counter value. The acquired shared counter value is recorded in the program log information 505 together with other log information. Also, the shared library 1 notified from the shared counter value notifying unit 108
The shared counter value on the 03 side is also recorded in the program log information 505 at the same time.

In the above example, the log information is output on the program 102 side in response to the notification from the shared library 103. However, there is a case where the log information is independently output when the program 102 does not need the notification from the shared library 103. In this case, instead of the shared counter value notified from the shared counter value notifying means 108, the program 102
A value indicating that the output of the log information has been started without receiving the notification of the shared counter value from is output to the program log information output means.

In FIG. 5, the program module 50
2 (name: SubModule) does not call a module in the shared library 103. Therefore, when outputting log information, the program module 50
2 notifies the program log information output means 106 that it has started outputting log information without receiving the notification of the shared counter value from the shared counter value notification means 108. Upon receiving the notification, the program log information output means 106 outputs a value indicating that log information output has been started without receiving notification of the shared counter value from the shared counter value notification means 108, instead of the shared counter value. 505 is output.

The shared library 103 does not call the function of another program. Therefore, the shared library 103 is not always notified of the shared counter value from the shared counter value notifying unit 108. Therefore, in the shared library log information 506, the shared library 103 does not receive the notification of the shared counter value from the shared counter value notifying unit 108 instead of the shared counter value notified from the shared counter value notifying unit 108. Is output to indicate that the output of.

FIG. 6 shows an output example of the log information of the program 102 output by the processing described above. The program log information 601 is the program log information 505 in FIG.
This is a part of the log information output above. The log information shown in FIG. 6 includes a module name 602, a shared counter value 60
3. The common counter value 604 of the related module and the log information output content 605 are recorded. Module name 6
In 02, the name of the module that has output the log information is recorded. The shared counter value 603 is stored in the program 10 of FIG.
2 records the value acquired from the shared counter 110 when the log information is output. Shared counter value of related module 6
Reference numeral 04 denotes a shared counter value received by the program 102 in FIG. 5 from the shared counter value notifying unit 108 in FIG. Also, 606 in FIG. 6 includes “no_val
ue ". This indicates that the log information is output without receiving the notification of the shared counter value from the shared counter value notifying unit 108. The log output content 605 The log information 601 shown in Fig. 6 records the log information 607 output by the program module 501 and the log information 608 output by the program module 502. Have been.

FIG. 7 shows an example of log information output from the shared library 103. The shared library log information 701 is a part of the log information output on the shared library log information 506 in FIG. Each column of the shared library log information 701 includes the module name 602, the shared counter value 603, and the shared counter value 6 of the related module as in FIG.
04 and log information output contents 605. FIG.
All of the shared counter values 604 of related modules of "n"
o_value ". The shared library 103 always outputs the shared counter value notifying means 108.
This is because log information is output without receiving a notification of the shared counter value from. Shared library log information 70
1, log information 704 output by the shared library module 503 of FIG. 5 and log information 705 output by the shared library module 504 of FIG. 5 are recorded.

When analyzing an abnormality that has occurred in the program, log information analysis processing is performed on the log information output using the log information output means described with reference to FIG. Next, the log information analysis processing shown in the embodiment will be described with reference to the flowchart of the log information analysis means shown in FIG. The log information analysis means 208 of FIG. 2 receives the program log information 601 shown in FIG. 6 and the shared library log information 701 shown in FIG. Next, the output order of the two received log information is analyzed using the shared counter value as a key (step 402 and step 4).
03).

An outline of the log information output order analysis processing will be described with reference to FIG. In the analysis of the log information output order, the shared counter value 603 recorded in the plurality of log information files received by the log information storage file input unit 201
And rearrange the log information using the value as a key (step 801). In the embodiment, the shared counter value is incremented each time the value is obtained.
Therefore, it can be determined that the smaller the shared counter value is, the earlier the output is. Therefore, the log information is rearranged so that the shared counter values recorded in the shared counter value 603 of the program log information 601 shown in FIG. 6 are in ascending order. As a result, the log information is arranged in the output order. Similarly, the log information of the shared library log information 701 in FIG. 7 is rearranged based on the shared counter value recorded in the shared counter value 603. The rearranged two pieces of log information are combined as one piece of log information (Step 802).

FIG. 9 shows the result of executing the log information output order analysis processing on the program log information 601 in FIG. 6 and the shared library log information 701 in FIG. The log information output order analysis result 901 shown in FIG.
Are rearranged in the order of output and combined. The log information output order analysis result 901 includes items such as a module name 602, a shared counter value 603, a shared counter value 604 of a related module, log information output contents 605, and a relevance analysis result 904.
Focusing on the column of the common counter value 603, it can be seen that the log information is rearranged in ascending order of the common counter value and is combined.

Next, the log information output order analysis result 901 shown in FIG. 9 is subjected to log information relevance analysis processing (steps 404 and 405 in FIG. 4). As shown in the program log information 601 of FIG. 6 and the shared library log information 701 of FIG. 7, in this embodiment, the shared counter value 603 notified from the call destination program is recorded on the log information. Therefore,
In this embodiment, step 405 is executed after step 404.

FIG. 10 shows an outline of the log information relevance analysis processing when the shared counter value notified from the called program is recorded in the log information. In the log information relevance analysis process, first, one log information is taken out from the beginning of the log information recorded in the log information output order analysis result 901 in FIG. 9 (step 1001). next,
The log information which is the same value as the shared counter value recorded in the column of the shared counter value 603 of the extracted log information is recorded in the column of the shared counter value 604 of the related module (step 1002). If the corresponding log information is found in step 1002, it is considered that there is a relationship between the log information and the log information extracted in step 1001, and information for linking the two pieces of log information is generated. (Step 1003). The information generated here is recorded in the relevance analysis result 904. After the process of searching for log information relevant to the log information extracted in step 1001 is completed, it is checked whether the next log information exists (step 1004). If there is log information for which search processing for relevant log information has not been completed, the process returns to step 1001. When the search process of the log information related to all the log information is completed, the process of analyzing the relevance between log information is completed.

Focusing on the log information 704 at the head in FIG. 9, the same value as the shared counter value 902 of the log information 704 is recorded in the shared counter value 903 of the related module in the log information 607. Therefore, the log information 704 and the log information 607 can be considered to be related.

Also, the shared counter value 6 of the related module
In the column of 04, the common counter value notified from the called program module is recorded. Therefore, the module that has output the log information 607 (the program module 501 in FIG. 5) is the module that has output the log information 704 (the shared library module 5 in FIG. 5).
03), and the log information 607 is the log information 7
As a result of the occurrence of the phenomenon recorded in 04, it can be determined that the event is output by the calling program module 501. The result of the above-described inter-log information relevance analysis processing is stored in the relevance analysis result 904.

The module that has output the log information 704 is
Since the module was output from the module that output the log information 607 having the shared counter value of 2, the relevance analysis result 9
05 indicates a value indicating that it is a "call destination of the shared counter value 2". Further, a value indicating “caller of the shared counter value 1” is entered in the relevance analysis result 906 of the log information 607 output by the caller module. The result of the log information relevance analysis process described above is transferred to the log information analysis result display means 206 in FIG. 2 and displayed (step 409 in FIG. 4). The log information analysis result display means 206 needs to display the relevance between log information in a format that is easy for the person in charge of analyzing the log information to understand. In the present embodiment, the relationship between log information is displayed in a tree structure format.

FIG. 11 shows a display example of the result of the analysis of the relationship between log information. Log information analysis result display 11 shown in FIG.
01, a log information analysis result 1102 corresponding to the analysis result of the log information 607 in FIG. 9, a log information analysis result 1103 corresponding to the analysis result of the log information 704 in FIG. 9, and an analysis result of the log information 608 in FIG. Log information analysis result 11
04, a log information analysis result 1105 corresponding to the analysis result of the log information 705 in FIG. 9 is displayed.

The log information 607 and log information 704 in FIG. 9 recognized as relevant in the processing of step 405 in FIG. 4 correspond to the log information analysis result 1102 and log information analysis result in FIG. 11 corresponding to each log information. 110
3. Join in the format shown in 3. This is the log information analysis result 1
Numeral 102 indicates that the phenomenon or process recorded in the log information analysis result 1103 of the call destination shared library is output as a result of occurrence. Also, the log information analysis result 1104 and the log information analysis result 110
5 are independently connected to the tree. Therefore, the log information corresponding to these log information analysis results is:
Independent of the event that occurred in the called program,
It can be seen that the log information is output alone. As described above, the log information analysis result display 1101 illustrated in FIG. 11 displays the analysis result of the log information in a format in which the relevance between a plurality of pieces of log information can be visually grasped.

In the above, the common counter value notifying means 108
Has been described in the case where is implemented in the software system 111. Next, another embodiment, in which the shared counter value notifying unit 108 is not implemented in the software system 111, will be described. In an object-oriented language such as the C ++ language or the Java language, there is an exception mechanism. Therefore, by using this mechanism, the notification process of the shared counter value between the programs can be realized. However, in a language that does not have an exception mechanism, such as the C language, it is difficult to realize notification processing of a shared counter value between programs. As described above, in the log information in the software system in which the shared counter value notifying unit 108 of FIG. 1 does not exist, the shared counter value notified from another program operating in association is not recorded.

FIG. 12 shows log information when the program 102 of FIG. 5 does not record the shared counter value of the related module. The log information in which the shared counter value of the related module is not recorded is output by a procedure in which steps 301, 302 and 305 in the flowchart of the log information output means shown in FIG. 3 are omitted.
Also, comparing with the log information in FIG. 6, it can be seen that the column of the shared counter value 604 of the related module does not exist. FIG. 13 shows log information when the shared library 103 in FIG. 5 does not record the shared counter value of the related module. Similar to the difference between FIG. 6 and FIG. 12, when compared with the log information of FIG. 7, the column of the shared counter value 604 of the related module does not exist.

Next, the log information analysis procedure shown in FIGS. 12 and 13 will be described with reference to the log information analysis processing flowchart shown in FIG. The log information analysis processing in the present embodiment is performed in the same procedure as the log information analysis procedure in the above embodiment. The processing of steps 401 to 403 in FIG. 4 is executed in the same manner as in the embodiment in which the common counter value of the related module described above is recorded in the log information. In this processing, the log information is rearranged and joined in ascending order of the value of the shared counter value, focusing on the column of the shared counter value 603 in FIGS. 12 and 13. FIG. 14 shows steps 401, 402, and 40 of FIG. 4 for the log information of FIGS.
This is the result of applying the processing of No. 3.

In FIG. 14, there is no column for recording the shared counter value of the related module. Therefore, in the log information analysis processing, the relation between log information is analyzed from the output contents of the log information (step 406 in FIG. 4). Step 40
FIG. 15 shows an outline of the process in FIG. In the analysis process of the log information in which the shared counter value of the related module is not recorded, first, the log information is extracted one by one from the top of the log information output order analysis result shown in FIG. 14 (step 1501).

Next, the relevance between log information is analyzed by focusing on the module name 602 column and the log information output content 605 column in FIG. 14 (step 1502). Step 15
When the log information extracted in 01 is log information 1402, the name “Lib_open” of the shared library module 503 in FIG. Therefore, in the process of step 1502, the log information 1
For log information output after 402, "Lib_ope
A search is performed for log information that has output log information including a character string of “n”. This search process finds the first log information that matches the search condition or reaches the end of the log information output order analysis result 1401. As a result of the search, log output contents including the character string “Lib_open” are found in the log information output contents 1407. Therefore, log information 1402 including the module name 1406 and log information including the log information output contents 1407 It is considered that there is a relationship between the data 1403 and the data 1403 (step 1503), and the above analysis results are stored in the column of the relationship analysis result 904. The search process ends when the log information 1403 is found.

On the other hand, the module name of the log information 1404 "
SubModule "and module name" i of log information 1405
The log information output contents including “initialize” are not found in the log information output order analysis result 1401. Therefore, the log information 1404 and the log information 1405 are independent of each other without being affected by the called program. Judge that the log information is output.

Step 1502 or 1503
Is completed, the log information output order analysis result 14
It is checked whether log information for which the search process has not been executed remains in 01 (step 1504). If unsearched log information remains in the log information output order analysis result 1401, the process returns to step 1501 to continue the search processing. If the search processing has been completed for all the log information, the relevance analysis processing between the log information is ended.

After the analysis of the relationship between log information is completed in step 406 of FIG. 4, a check is made on the analysis result (step 407). Check the analysis results, see Figure 2.
This is performed using the information held in the log information relevance information 205 of FIG. Here, the log information relevance information 20
It is assumed that information that corrects the result of the analysis of the relevance between log information processed in step 406 has not been registered in 5. After the checking process of the log information relevance analysis result is completed, the log information analysis result is output in a format that is easy for the log information analyst to understand (step 409). In this embodiment, the data is output in the format shown in FIG. The log information analyst checks the displayed result, and if it is determined to be correct, terminates the log information analysis processing (step 41).
0).

By the processing described above, the shared counter value notifying means 108 of FIG.
Even if it is not implemented inside, it is possible to execute the relevance analysis processing between log information. In this embodiment, the relevancy analysis processing is executed by focusing on the module name 602 and the log information output content 605 in FIG. In addition, the analysis process can be executed by focusing on various information (ID values of processes and threads) that can be output as log information.

Next, a case where the result of the analysis of the relation between log information displayed in step 410 of FIG. 4 is incorrect will be described. As a situation where correct results cannot be obtained in the analysis of the relationship between log information, there are cases where related log information is regarded as “unrelated” and cases where irrelevant log information is “related”. Is sometimes considered to be. The former phenomenon occurs when information that can be used for analysis is not embedded in a character string of log information output content, or when the expression format of information that can be used for analysis is different. The latter phenomenon occurs when similar phenomena occur successively and many similar log information output contents are output.

FIG. 16 shows a log information output order analysis result in a case where the information usable for the log information relevance analysis processing is not included in the log information output contents. This analysis result has been completed up to the process of step 403 in FIG. The log information output order analysis result 1601 contains the module name “Li”.
b_open ”output log information 1602, module name”
It consists of log information 1603 output by “MainModule”, log information 1604 output by module name “SubModule”, and log information 1605 output by module name “initialize”.
1 is the log information 1 output by the module name “MainModule” in comparison with the log information output order analysis result 1401 in FIG.
Only the character strings of the log information output contents 1607 of 603 are different ("Lib_open" is expressed in Japanese). The log information output content 1607 of the log information 1603 does not include the module name of the related module (“Lib_open” included in the log information output content 1407 in FIG. 14). However, actually, the log information 1402 and the log information 140 are located between the log information 1602 and the log information 1603.
There is a relevance equivalent to 3.

When the processing of step 406 in FIG. 4 is performed on the log information output order analysis result 1601, log information including the module name 1606 of the log information 1602 extracted first in the log information output content 605 column not exist. Therefore, log information 1602, log information 160
3. The log information 1604 and the log information 1605 are all recognized as being independently output. When the related correction information is not registered in the log information relevance information 205 of FIG. 2, the display of the analysis result is as shown in FIG.

A log information analysis result display 1701 shown in FIG.
The log information analysis result 1702 corresponding to the analysis result of the log information 1602 in FIG. 16, the log information analysis result 1703 corresponding to the analysis result of the log information 1603 in FIG.
A log information analysis result 1704 corresponding to the analysis result of the log information 1604 shown in FIG. 16 and a log information analysis result 1705 corresponding to the analysis result of the log information 1605 in FIG. 16 are displayed. Comparing the log information analysis result display 1701 in FIG. 17 with the log information analysis result display 1101 in FIG.
It can be seen that the log information output by “MainModule” (the log information analysis result 1703 in FIG. 17) and the log information output by the module name “Lib_open” (the log information analysis result 1702 in FIG. 17) are not associated with each other.

The log information analyzer analyzes the log information analysis result display 1701 shown in FIG.
Then, the operation of the shared library 103 is analyzed. However, during the analysis, the log information analysis result 1
It is noticed that the association between the log information analysis result 702 and the log information analysis result 1703 is incorrectly analyzed. In this case, the log information analyzer corrects the log information analysis result display 1701 (step 411 in FIG. 4). In the correction, the log information analysis result 1 incorrectly displayed as unrelated log information
702 and the log information analysis result 1703 are handled as relevant log information. At this time, the log information analysis result 1702 is associated as log information output by a module that is called and operated by the module that has output the log information analysis result 1703.

The corrected information is stored in the log information relevance information 205 of FIG. 2 (step 412 of FIG. 4). FIG.
Indicates a storage format of log information relevance information in the present embodiment. Log information relevance information storage format 1801
Is composed of an operation type 1802, a module name 1803, and log information output contents 1804. Module name 1
The fields of 803 and log information output contents 1804 are always set in pairs. Also, the pair of the module name 1803 and the log information output contents 1804 is 2 for one log information relevance information.
Is set. Of the two pairs of log information storage areas, the log information of the module to be called is stored in the upper part, and the log information of the module to be called is stored in the lower part. The column of operation type 1802 indicates the type of operation performed on two registered pieces of log information. In this embodiment, two types of operation types, “connection” and “split”, are defined. The operation type “connection” means that there is a relationship between the two pairs of registered log information. The operation type “split” means that there is no relationship between the two pairs of registered log information. Therefore, when "connection" is specified in the operation type 1802, the processing is performed on the assumption that there is always a relevance without depending on the analysis result of the log information. Conversely, “split” into operation type 1802
If is specified, processing is always performed assuming that there is no association.

In this embodiment, the log information analysis result 1702 and the log information analysis result 1703 displayed in FIG.
There is an association between and must be connected.
Therefore, in the log information relationship information storage format 1801 shown in FIG. 18, “connection” is stored in the operation type storage column 1805, and “MainMotion” is displayed in the upper row 1806 of the module name storage column.
dule ”and“ Lib_
"open", log information output contents of module name "MainModule" in the upper part 1808 of the log information output contents storage column, lower part 18
The log information output contents of the module name “Lib_open” is stored in the module 09 (step 412 in FIG. 4). In the inter-log information relevance information 205 of FIG. 2, a plurality of inter-log information relevance information in the format shown in FIG. 18 is accumulated. These pieces of information are used in the processing of steps 407 and 408 in FIG. 4 when the relevance analysis processing between the log information is executed next.

In the log information analysis result display 1701 corrected in step 411 in FIG. 4, the same error is automatically searched and corrected (step 413 in FIG. 4). After the end of the correction processing, the analysis result corrected in step 409 in FIG. 4 is displayed again.

Next, the log information output order analysis result 1601 shown in FIG.
5 will be described with reference to FIG. First, the log information output order analysis result 1601 is checked for whether the shared counter value notified from the called program is included in the log information, as in the case where the log information relevance information 205 does not exist. (Step 404 in FIG. 4), since the shared counter value is not included, the analysis of the relevance between the log information is performed from the output contents of the log information (Step 40 in FIG. 4).
6). At this point, log information 1602 and log information 160
3 is analyzed as unrelated log information.

Next, the log information relevance information 205 shown in FIG.
It is checked whether or not there is any correction information of the analysis result in step (step 407 in FIG. 4). In this analysis, since the inter-log information relevance information shown in FIG. 18 is registered in the inter-log information relevance information 205 of FIG. 2, the analysis result is corrected using the registered information ( Step 40 of FIG.
8).

The outline of the processing in step 408 is shown in FIG.
This will be described in Section 9. In step 408, the result of the relevancy analysis between the log information generated by the processing in step 406 is received as input, and the log information is extracted one by one from the beginning (step 1901). Next, the combination of the module name of the extracted log information and the log information output content (the module name 1806 and the log information output content 1808 in the upper part of FIG. 18) is used as the log information relevance information 205 of FIG.
Is searched to see if it is registered in the server (step 19)
02). If the log information has been registered, a combination of the module name of the log information and the log information output content registered as a pair in the log information relevance information storage format 1801 (the module name 1807 and the log information The output contents 1809) are taken out, and a search is made retrospectively to see if the log information is included in the relevance analysis result of the log information received as input (step 1903).

As a result of the search, if log information registered as a pair in the log information relation information storage format 1801 is found, the result of the relation analysis between the log information is It is checked whether the contents are the same as those described in the operation type column of the gender information 205 (step 1904). If the result of the relevance analysis between log information is different from the content described in the operation type column of the inter-log information relevance information storage format 1801, the result is the same as the information in the inter-log information relevance information storage format 1801. The result of the analysis of the relationship between log information is corrected (step 1905). When the check on the result of the analysis of the relationship between the pieces of log information is completed, it is checked whether the result of the analysis of the relationship between the pieces of log information that has not been checked remains (step 19).
06). If it remains, the process returns to step 1901 to continue the process.

According to the processing described above, even if there is an error in the result of the analysis of the relationship between the log information, the analysis result can be corrected and the correct analysis result can be displayed by using the relationship information between the log information. Become. In the above-described embodiment, the log information combining / analyzing process in one system has been described. However, by maintaining a shared counter on a resource that can be shared between the systems, log information between a plurality of systems can be obtained. Can be combined and analyzed. Also, by using the distributed object technology and implementing the shared counter as one of the objects, the present invention can be applied to a plurality of machines.

[0084]

As described above, by using the log information acquisition and analysis apparatus of the present invention, the output order of log information can be uniquely specified among a plurality of log information output by a plurality of programs. become. By analyzing the log information output contents of each program, the log information output for the same cause can be associated between the programs in the calling relationship. as a result,
Since the relationship between a plurality of pieces of log information is clarified, the contents of events recorded in the log information and the cause of the occurrence can be easily specified.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating an overview of a log information output unit.

FIG. 2 is a diagram illustrating an outline of log information analysis means.

FIG. 3 is a flowchart showing an outline of a processing flow of a log information output unit.

FIG. 4 is a flowchart illustrating an outline of a processing flow of a log information analyzing unit according to the present invention.

FIG. 5 is a diagram illustrating an embodiment of a log information output unit.

6 is a diagram illustrating an example of log information output by the program 102 in FIG. 5 when a shared counter value of a related module is output on log information.

FIG. 7 shows the shared library 10 of FIG. 5 when a shared counter value of a related module is output on log information.
FIG. 3 is a diagram illustrating an example of log information output by an example 3;

FIG. 8 is a flowchart showing an outline of processing of a log information output order analyzing means 202 of FIG. 2;

FIG. 9 is a diagram showing an analysis result of an output order in the log information shown in FIGS. 6 and 7;

FIG. 10 is a flowchart illustrating an outline of log information relevance analysis processing when a shared counter value of a related module is output on log information.

11 is a diagram illustrating an example of a result of a log information relevance analysis with respect to a log information output order analysis result illustrated in FIG. 9;

FIG. 12 is a diagram illustrating an example of log information output by a program 102 in FIG. 5;

13 is a diagram illustrating an example of log information output by the shared library 103 in FIG. 5 when a shared counter value of a related module is not output on log information.

FIG. 14 is a diagram illustrating an example of an analysis result of a log information output order for the log information illustrated in FIGS. 12 and 13;

FIG. 15 is a flowchart illustrating an outline of log information relevance analysis processing when a shared counter value of a related module is not output on log information.

FIG. 16 is a diagram illustrating an example of a log information output order analysis result in which log information relevance analysis cannot be performed correctly;

17 is a diagram illustrating an example of a result of a log information relevance analysis with respect to a log information output order analysis result illustrated in FIG. 16;

FIG. 18 is a diagram illustrating an example of a storage format of log information relevance information.

FIG. 19 is a flowchart illustrating an outline of a log information relevance analysis process using log information relevance information.

[Explanation of symbols]

 101, 102 program 103 shared library 105, 106, 107 log information output means 108 shared counter value notifying means 109 shared counter value acquisition means 110 shared counter 201 log information storage file input means 202 log information output order analysis means 203 relation between log information Sex analysis means 204 log information relevance information management means 205 log information relevance information 206 log information analysis result display means 207 log information analysis result correction means

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Yuji Fujiwara 5030 Totsukacho, Totsuka-ku, Yokohama-shi, Kanagawa Prefecture F-term in the Software Division of Hitachi, Ltd. 5B042 MA08 MA12 MA35 MC35 MC40

Claims (5)

[Claims] 1. A log for log information of each program of a software system including a plurality of programs, the log information having a shared counter value for uniquely specifying an output order of the log information among the plurality of log information. An information acquisition / analysis device, comprising: a shared counter value notifying means for notifying a shared counter value among a plurality of programs; and the shared counter notified as log information of a program notified of the shared counter value by another program. Means for generating log information including a value, for a plurality of log information, using the shared counter value of the log information and the notified shared counter value to search for log information output for the same cause. A log information acquisition / analysis device comprising a log information relevance analysis unit for performing association. 2. A log for log information of each program of a software system including a plurality of programs, the log information having a shared counter value for uniquely specifying an output order of the log information among the plurality of log information. An information acquisition / analysis device, comprising: log information relevance analysis means for searching and associating log information output for the same cause with respect to a plurality of log information from output contents of the log information. Log information acquisition and analysis device. 3. The log information acquisition / analysis device according to claim 2, further comprising: a log information analysis result correction unit that manually corrects the displayed result of association of the log information output due to the same cause. Log information acquisition and analysis device. 4. The log information acquisition / analysis apparatus according to claim 3, wherein information on the correction made by said log information analysis result correcting means is stored as log information relevance information. Log information relevance information management means for extracting relevance information when analyzing other log information, and other similar analysis results using log information relevance information extracted from the log information relevance information management means A log information acquisition / analysis apparatus characterized by having log information relevance analyzing means for correcting the correction point of the log information. 5. The log information acquisition / analysis device according to claim 4, further comprising: a log information interrelation analysis means for analyzing other log information using the stored log information interrelation information. A log information acquisition / analysis device characterized by the above-mentioned.