JP2003141075A5

JP2003141075A5 -

Info

Publication number: JP2003141075A5
Application number: JP2001341113A
Authority: JP
Filing date: 2001-11-06
Publication date: 2005-07-07
Anticipated expiration: 2021-11-06

Description

【０００８】
【課題を解決するための手段】
本発明のログ情報管理装置は、ネットワークで接続される送信元機器から発生したイベントのシスログデータを受信する手段と、該受信したシスログデータ及び該シスログデータに付加された受信時刻及び該イベントが発生した送信元機器を特定可能なデータに基づき、ログ情報を取得する手段と、取得した該ログ情報を記憶する手段と、所要の検索条件の入力に応じて、該検索条件に適合するログ情報を記憶しているログ情報の中から抽出する手段とを有することを特徴とする。例えばログ情報は検索用としてデータベースに格納される。又、ログ情報は、例えばＸＭＬとすると他のアプリケーションでも使用可能で汎用性に優れるので好適であるが、論理的に意味を保持させられるツリー構造の形式であれば適宜使用可能であって、例えばＬＩＳＰ言語とすることができ、又、前記ツリー構造以外の情報の形式とすることも可能である。 0008
[Means for solving problems]
The log information management device of the present invention has a means for receiving syslog data of an event generated from a source device connected by a network, the received syslog data, a reception time added to the syslog data, and the event are generated. transmits on the basis of the data capable of identifying the source device has means for obtaining the log information, and means for memorize the acquired said log information in response to the input of the required search, matching the log information to the search condition It is characterized by having a means for extracting from the log information that stores the data. For example, log information is stored in a database for search. Further, the log information is preferable because it can be used in other applications and has excellent versatility, for example, XML, but it can be appropriately used as long as it is in the form of a tree structure that can logically retain its meaning. It can be in a LISP language, or it can be in a form of information other than the tree structure.

また、本発明のログ情報管理装置は、ネットワークで接続される送信元機器から発生したイベントのシスログデータを受信する手段と、該受信したシスログデータ及び該シスログデータに付加された受信時刻及び該イベントが発生した送信元機器を特定可能なデータに基づき、該受信時刻及び該送信元機器を特定可能なデータ及びファシリティ及びプライオリティ及びアプリケーション名及びプロセスＩＤ及びメッセージの各データを有する基本事項と、該メッセージから抽出したタグ名及びタグ名の対象データを有する動作関連事項と、該メッセージから抽出したキーワードとを有するログ情報を取得する手段と、取得した該ログ情報を記憶する手段と、所要の検索条件の入力に応じて、該検索条件に適合するログ情報若しくはその基本事項を記憶しているログ情報の中から抽出する手段とを有することを特徴とする。本発明に於けるログ情報には適宜の形式のログ情報を使用可能であるが、ＸＭＬのログ情報とするとログ情報の各項目或いは各事項に意味内容を付加し、統一的に管理することができると共に多様な検索等の処理が可能になって好適である。更に、本発明のログ情報管理装置は、アプリケーション名と対応するアプリケーションの正規表現と、アプリケーション動作名と対応するアプリケーション動作の正規表現と、タグを識別する正規表現とを記憶する手段と、シスログデータと、アプリケーションの正規表現、アプリケーション動作名の正規表現及びタグを識別する正規表現とを比較して、その合致に基づき、基本事項のアプリケーション名、動作関連事項のアプリケーション動作名、タグ名を取得する手段とを有することを特徴とする。 Further, the log information management device of the present invention has a means for receiving cis log data of an event generated from a source device connected by a network, the received cis log data, a reception time added to the cis log data, and the event. Based on the data that can identify the source device in which the occurrence occurred, the basic matter having the reception time, the data that can identify the source device, the facility and priority, the application name, the process ID, and the message data, and the message. and operation-related matters with the data to be extracted tag name and tag name from the means for obtaining a Carlo grayed information having a a keyword extracted from the message, and means for storing the acquired said log information, the required It is characterized in that it has a means for extracting from log information that matches the search condition or log information that stores basic items thereof in response to input of the search condition. Although log information in an appropriate format can be used for the log information in the present invention, if it is XML log information, it is possible to add meaning to each item or item of the log information and manage it in a unified manner. It is suitable because it can perform various searches and other processes. Further, the log information management device of the present invention provides a means for storing a normal expression of an application corresponding to an application name, a normal expression of an application operation corresponding to an application operation name, and a normal expression for identifying a tag, and cis log data. Is compared with the application name, the application action name normal expression, and the normal expression that identifies the tag, and based on the match, the application name of the basic item, the application action name of the operation-related item, and the tag name are acquired. It is characterized by having means.

また、本発明のログ情報管理プログラムは、ネットワークで接続される送信元機器から発生したイベントのシスログデータを受信する手段と、該受信したシスログデータ及び該シスログデータに付加された受信時刻及び該イベントが発生した送信元機器を特定可能なデータに基づき、ログ情報を取得する手段と、取得した該ログ情報を記憶する手段と、所要の検索条件の入力に応じて、該検索条件に適合するログ情報を記憶しているログ情報の中から抽出する手段としてコンピュータ若しくはネットワークで接続されるコンピュータを機能させることを特徴とする。 Further, the log information management program of the present invention has a means for receiving cis log data of an event generated from a source device connected by a network, the received cis log data, a reception time added to the cis log data, and the event. There based the source device that have occurred can be specified data, and means for acquiring log information, and means for memorize the acquired said log information in response to the input of the required search conditions, conforms to the search condition It is characterized in that a computer or a computer connected by a network functions as a means for extracting log information from the stored log information.

また、本発明のログ情報管理プログラムは、ネットワークで接続される送信元機器から発生したイベントのシスログデータを受信する手段と、該受信したシスログデータ及び該シスログデータに付加された受信時刻及び該イベントが発生した送信元機器を特定可能なデータに基づき、該受信時刻及び該送信元機器を特定可能なデータ及びファシリティ及びプライオリティ及びアプリケーション名及びプロセスＩＤ及びメッセージの各データを有する基本事項と、該メッセージから抽出したタグ名及びタグ名の対象データを有する動作関連事項と、該メッセージから抽出したキーワードとを有するログ情報を取得する手段と、取得した該ログ情報を記憶する手段と、所要の検索条件の入力に応じて、該検索条件に適合するログ情報若しくはその基本事項を記憶しているログ情報の中から抽出する手段としてコンピュータ若しくはネットワークで接続されるコンピュータを機能させることを特徴とする。 Further, the log information management program of the present invention has a means for receiving cis log data of an event generated from a source device connected by a network, the received cis log data, a reception time added to the cis log data, and the event. Based on the data that can identify the source device in which the problem occurred, the basic matter having the reception time, the data that can identify the source device, the facility and priority, the application name, the process ID, and the message data, and the message. and operation-related matters with the data to be extracted tag name and tag name from the means for obtaining a Carlo grayed information having a a keyword extracted from the message, and means for storing the acquired said log information, the required The feature is that a computer or a computer connected by a network functions as a means for extracting from the log information that matches the search condition or the log information that stores the basic items in response to the input of the search condition. To do.

Claims

Means for receiving syslog data of an event that has occurred from a transmission source device connected via a network, the received syslog data, the reception time added to the syslog data, and data that can identify the transmission source device in which the event has occurred the basis, and means for acquiring the log information, and means for memorize the log information acquired in response to the input of the required search conditions, in the log information stored conforming log information to the search condition log information management apparatus characterized by comprising a means for extracting from.

Means for receiving syslog data of an event that has occurred from a transmission source device connected via a network, the received syslog data, the reception time added to the syslog data, and data that can identify the transmission source device in which the event has occurred And the basic items having the data and facility, priority, application name, process ID, and message data that can specify the reception time and the transmission source device, and the tag name and tag name target data extracted from the message and operation-related matters and means for acquiring Carlo grayed information having a a keyword extracted from the message, and means for storing the acquired said log information in response to the input of the required search conditions, the search extracted from the log information stored in the matching log information or the basics to conditions Log information management apparatus characterized by having means for.

Means for storing a regular expression of the application corresponding to the application name, a regular expression of the application action corresponding to the application action name, and a regular expression for identifying the tag; a syslog data; a regular expression of the application; A means for comparing a regular expression and a regular expression for identifying a tag and obtaining an application name of a basic item, an application operation name of an operation-related item, and a tag name based on the match. 2. The log information management device according to 2.

Means for storing the set detection condition, claim 1, characterized in that it comprises a means for executing a predetermined process to recognize the occurrence of detection items corresponding to the detection condition based on the log information, 2 or 3. The log information management device according to 3 .

At least the means for generating the log information, according to claim 1 and 2 means for storing the log information, characterized in that it is connected via a network, 3 or 4 log information management apparatus according.

Means for receiving syslog data of an event that has occurred from a transmission source device connected via a network, the received syslog data, the reception time added to the syslog data, and data that can identify the transmission source device in which the event has occurred the basis, and means for acquiring the log information, and means for memorize the log information acquired in response to the input of the required search conditions, in the log information stored conforming log information to the search condition A log information management program for causing a computer or a computer connected via a network to function as means for extracting from the log.

Means for receiving syslog data of an event that has occurred from a transmission source device connected via a network, the received syslog data, the reception time added to the syslog data, and data that can identify the transmission source device in which the event has occurred And the basic items having the data and facility, priority, application name, process ID, and message data that can specify the reception time and the transmission source device, and the tag name and tag name target data extracted from the message and operation-related matters and means for acquiring Carlo grayed information having a a keyword extracted from the message, and means for storing the acquired said log information in response to the input of the required search conditions, the search extracted from the log information stored in the matching log information or the basics to conditions Log information management program for causing a computer to function that are connected by a computer or a network as a means of.