JP2005025786A - Method and program for analyzing log - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method and a program for analyzing logs capable of providing useful information for debugging in consideration of differences in items other than object program description and execution sequence. <P>SOLUTION: By repeatedly executing the same program 1a by a plurality of times (i=1 to 3), a plurality of logs 1 to 3 on which occurred events 2a, 2b are respectively recorded according to a chronological order at every number of execution. Where the descriptions (f, g) of the program on the events recorded in all chronological orders are respectively common between the plurality of the logs 1 to 3, the occurrence probability of the respective events is calculated for each of the chronological orders 1 to 3 based on the program description and data (argument) used in executing the description. The information about the events featuring the respective logs is output based on the occurrence probability. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a method and a program for analyzing a log obtained by executing a program.

  In recent years, in the field of software development, there are an increasing number of cases where logs obtained by execution operations of a target program are used for checking the operation of the target program and so-called debugging work. Specifically, a log-based debugging technique has become widespread, in which a log made up of recorded event information is displayed with a dedicated viewer to assist debugging work.

  Examples of collected logs include a record of a series of system call issuance history through an operating system (OS), a record of a series of memory access histories by hardware (or an emulator), and the like. . In these, system calls and memory accesses correspond to events.

  In the case where debugging is performed using a log obtained by the execution operation of the target program, the following two methods are conventionally known.

  (1) Carefully investigate one abnormal operation log to find the cause of the bug.

  (2) Compare the log of the normal operation and the log of the abnormal operation to find the difference, and investigate this intensively.

  With regard to (1), there is no guideline such as which part of the log to focus on, so if the amount of log increases, it will take time and effort to debug. There is a problem that it takes.

  Regarding the above (2), if only the simple difference between the normal operation and the abnormal operation is focused, there is a problem that there are too many portions to be focused on, which does not lead to efficient debugging.

  Therefore, a method that improves debugging efficiency by extracting characteristic logs from multiple logs that record a series of events that occurred during the execution of the target program and preferentially investigating the relevant program code. (Japanese Patent Application No. 2001-060699, Wataru Okamoto, Katsuhiko Ueki et al., “Proposal of a probe type debugging method”, “Science Technical Report, Vol.100, No186, pp1-8 (2000-7) Okamoto Wataru et al., “Realization of a probe type debugging technique (1)-Outline and evaluation” 62nd Information Processing National Conference 2Z-2 (2001-03), Fumitaka Tamura et al., “Realization of a probe type debugging technique (2) -Algorithm ", 62nd National Information Processing Conference 2Z-2 (2001-03).

  In this proposal, the feature of the action log is extracted by calculating the probability of occurrence of a series of events that occurred during execution of the target program. Then, the debugging operator can efficiently debug the program by examining the information about the event that is a feature of the operation log.

   At this time, in the conventional technique, the event is defined in advance in the entire debug environment and is an identifiable event. Then, the features of the action log are extracted in consideration of the difference in the program description to be executed and the difference in the execution order.

  On the other hand, when the target program is executed, various data are exchanged, and data can be recorded as a log. Therefore, if it is possible to extract the characteristics of the action log in consideration of the difference in data in addition to the difference in program description and execution order, it is convenient for debugging work. That is, even if log features cannot be extracted only by considering the difference in program description and execution order, there is a possibility that log features can be extracted if the difference in data is taken into consideration.

In this case, it is important how to consider the difference in data. An example will be described below. For example, f, g, and h are functions executed in the target program, for example. As a result of executing the target program, a series of events occur, and the operation log is recorded as follows in accordance with the order of occurrence of the events.

Log 1: f (-2) g (10) h (14)
Log 2: f (11) g (15) h (18)
Log 2: f (12) g (16) h (19)
Here, the number in parentheses is, for example, an argument. When considering the characteristics of a log by taking the argument as data and considering the difference in the data, even if each log is simply compared, the frequency of occurrence of each event will be the same or similar, and the characteristics of the log will be It may be difficult to extract. On the other hand, if the difference in data is not taken into account, as in the above example, when the program description and execution order are the same (f, g, h), even if there is actually a bug, it is possible to deal with it. Sometimes it is not possible.

  It is also conceivable to access the memory area by executing the function description when executing the target program. Therefore, as in the case of data differences, it is convenient for debugging work if log characteristics can be extracted in consideration of differences in access to memory areas.

  The present invention has been made in consideration of such circumstances. In addition to the description of the target program and the execution order, the present invention can provide information useful for debugging the target program in consideration of differences in other matters. An object of the present invention is to provide a log analysis method and program.

In order to solve the above-mentioned problems, the present invention generates a plurality of logs in which the generated events are recorded in accordance with the generation order for each execution time by repeatedly executing the same program multiple times. When the description of the program related to the event recorded in order is common among the plurality of logs, the occurrence probability of each event is calculated based on the description of the program and the data used when the description is executed. , Calculating for each occurrence order, and outputting information on an event that is a feature of each log based on the occurrence probability.

  In addition, the present invention can calculate a rarity level indicating a low occurrence frequency based on the occurrence probability, and output information on an event that is a feature of each log based on the rarity level.

  Further, the present invention generates an event sequence in which events are recorded in the order of occurrence based on the events constituting each of the plurality of logs, and each of the events in the event sequence and the events constituting each log is generated. Based on the comparison result, each of the plurality of logs is converted into a conversion log, and the occurrence probability of each event is calculated for each occurrence order based on the description of the program related to the event. Based on the occurrence probability, a rarity level indicating a low occurrence frequency is calculated, and it is determined based on the calculated rarity level whether or not a feature of the conversion log exists. Then, it is preferable that the occurrence probability of each event is calculated for each occurrence order based on the description of the program and data used when the description is executed based on the determination result of the determination.

  Further, the present invention designates a memory area that can be referred to when executing a program description related to an event when analyzing a recorded log according to an occurrence order of a series of events generated by executing the program, Each event is classified based on whether or not reference processing for the designated memory area is involved, and a plurality of classification logs in which the classified events are recorded in accordance with the occurrence order for each memory area accompanied by the reference processing. Generating an event sequence in which the events are recorded in the order of occurrence based on the events constituting each of the classification logs, and comparing the events in the event sequence with the events constituting the classification logs, respectively. Then, based on the comparison result, each classification log is converted into a conversion log, and based on the program description related to the event. Then, the occurrence probability of each event is calculated for each occurrence order, a rareness indicating a low occurrence frequency is calculated based on the occurrence probability, and a feature of each conversion log is calculated based on the rareness It outputs the information regarding the event to become.

  At this time, the memory area can be designated, and can be designated for a memory area referred to when executing a predetermined program description related to the event. In addition, the memory area can be designated and designated for a plurality of memory areas having a common area size.

  Further, according to the present invention, the characteristic degree of each conversion log can be calculated based on the calculated occurrence probability of each event, and the characteristic degree of each conversion log can be output.

  As described above, according to the present invention, in addition to the program description and the event occurrence order (program description execution order), the occurrence probability and the rarity are calculated in consideration of the reference to the data and the memory area. Log features can be extracted based on the occurrence probability and rarity of the log, so even if log features cannot be extracted even if the program description and order of occurrence are taken into account, log features can be extracted quickly. Become.

  Therefore, it is possible to provide a log analysis method and program that are more efficient for debugging work than the prior art.

  FIG. 1 is a diagram for explaining a first concept of the present invention. The first concept of the present invention will be described with reference to this figure.

  In the first log analysis method of the present invention, first, the same program (program 1a) is repeatedly executed a plurality of times (three times), thereby causing the generated events (events 2a, 2b, etc.) to be executed once (i = 1 to 3) having a step of generating a plurality of logs (log 1, log 2, log 3) respectively recorded according to the generation order.

  In the log analysis method, the description (f, g, etc.) of the programs related to the events recorded in all occurrence orders (occurrence orders 1, 2, 3,...) Is common among the plurality of logs. Based on the description of the program and the data used when executing the description (arguments of f and g, (10), (20), etc.), the occurrence probability of each event (events 2a, 2b, etc.) is determined. , For each occurrence order (occurrence order 1, 2, 3).

  Then, the log analysis method includes a step of outputting information on the event that is a feature of each log (log 2, the second event in the occurrence order, occurrence probability 15%) based on the occurrence probability. The first embodiment of the present invention will be described based on the concept described above.

  FIG. 2 is a diagram for explaining the second concept of the present invention. The log analysis method according to the present invention is a log analysis method for analyzing a recorded log (5) in accordance with the generation order of a series of events (4a, 4b, 4c, etc.) generated by the execution of the program (3a). , A step of designating a memory area (a1, a2, a3) that can be referred to when executing the program description relating to the event, and whether or not a reference process for the designated memory area (a1, a2, a3) is involved And a plurality of recorded events (4a, 4b, 4c, etc.) classified according to the order of occurrence for each memory area (a1, a2, a3) with reference processing based on the step of classifying each event A step of generating a classification log (classification log 1, classification log 2, classification log 3) and an image constituting each of the classification logs (classification log 1, classification log 2, classification log 3). Event (f (a1), g (a1), h (a1), f (a2), g (a2), h (a2), f (a3), g (a3)...) Generating a predetermined event sequence (6) recorded in a predetermined order, an event of the predetermined event sequence, and an event constituting each of the classification logs, and based on the comparison result, A step of converting the classification log (classification log 1, classification log 2, classification log 3) into a conversion log (conversion log 1, conversion log 2, conversion log 3), respectively, and description of the program related to the event (f, g, etc.) Based on the occurrence probability, the step of calculating the occurrence probability of each event for each of the occurrence order, the step of calculating a rarity level indicating a low occurrence frequency based on the occurrence probability, and based on the rarity level , It will be a feature of each log And a step of outputting information about the vent (conversion log 3, generation order third event, the probability of 33%). The second embodiment of the present invention will be described based on the concept described above.

Embodiment 1 FIG.
(Configuration of log analyzer)
FIG. 3 is a block diagram illustrating a configuration of the log analysis apparatus according to the first embodiment. This device inputs the log output by the operation of the debug target program (hereinafter referred to as the target program), analyzes the log according to various specified conditions given by the debug operator (user), and logs It is a device that outputs information that is characteristic of

  The log analysis device includes an input unit 10 through which an operator inputs logs, a log generation unit 11 that generates a plurality of logs, an event sequence generation unit 12, a log conversion unit 13, an event occurrence probability calculation unit 14, It has a rarity calculation unit 15, a rarity determination unit 16, and an output unit 17.

  The input unit 10 receives a log in which a series of events established at the time of execution of the target program are recorded in the order of occurrence. Here, the type and quantity of the target program are arbitrary, and the execution environment is also arbitrary.

  The execution of the target program for preparing the log is performed by a debugger (not shown). Event collection / recording processing is performed by a “tracer” that is incorporated in a debugger or that operates in a coordinated manner different from the debugger. The tracer tracks the execution operation of the target program, and records a series of established (generated) events as a log in accordance with the generation order for each debug execution operation unit (sequence).

  The log generation unit 11 generates a plurality of logs from the log input by the input unit 10. For example, when the same program is repeatedly executed a plurality of times and a log in which the generated events are recorded in the order of occurrence is input to the input unit 10, the log generation unit 11 generates the log based on the input log. A plurality of logs are generated in which each event is recorded according to the occurrence order for each execution time.

  The event sequence generation unit 12 generates an event sequence in which events are recorded in the order of occurrence based on the event trends of the plurality of logs generated by the log generation unit 11.

  The log conversion unit 13 generates a plurality of conversion logs by performing conversion processing on the plurality of logs generated by the log generation unit 11 by using the event sequence generated by the event sequence generation unit 12. Specific processing will be described later.

  The event occurrence probability calculation unit 14 calculates the occurrence probability of each event for each occurrence order based on the description of the program related to the event. Detailed processing will be described later.

  The rarity calculator 15 calculates the rarity for each event based on the occurrence probability for each event calculated by the event occurrence probability calculator 14. The rarity indicates how rare a phenomenon that the event occurred or did not occur. For example, the higher the rarity value, the rarer the event (occurrence or non-occurrence). In the present embodiment, such a rarity value is used as the basis of the log feature.

  The rarity level determination unit 16 determines whether or not the feature of the conversion log exists based on the rarity level calculated by the rarity level calculation unit 15.

  When the rareness determination unit 16 determines that a feature is present, the output unit 17 outputs information regarding an event that is a feature of the conversion log. For example, as this information, the conversion log name, the content of the conversion log, the occurrence order of the above-described events, the occurrence probability, the rarity level, and the like are output.

  In addition, the log analysis apparatus includes a data value classification unit 18. When the rareness determination unit 16 determines that the feature does not exist, the data value classification unit 18 determines a predetermined classification criterion for each event based on data used when executing the description of the program related to the event. According to the above, classification information is generated. Then, the data value classification unit 18 assigns the generated classification information to each event.

  The event occurrence probability calculation unit 14 described above calculates the event occurrence probability for each occurrence order based on the description of the program related to the event and the given classification information. Specific processing will be described later.

  Then, the rarity calculator 15 described above calculates a rarity indicating a low occurrence frequency (or non-occurrence frequency) based on the calculated occurrence probability. The rarity level determination unit 16 described above determines whether or not a log feature exists based on the rarity level calculated by the rarity level calculation unit 15. The output unit 17 described above outputs information related to an event that is a feature of each log based on the calculated rarity.

(Log analysis method)
FIG. 4 is a flowchart for explaining a log analysis method using the log analysis apparatus having the above-described configuration.

  This target program is not particularly limited in the present embodiment. For this reason, it can be applied to the case where the target program is described in any language, but in the present embodiment, as an example, when the target program described in C language as shown in FIG. 6 is executed. The log analysis method will be described as a specific example.

  In the program shown in FIG. 6, in the function main, the function f and the function k are called with five arguments 0, 4, 8, 12, and 16. Both function f and function k use function g and function h to calculate the tax value while referring to the data in table price and table fee. That is, the same program is repeatedly executed a plurality of times (arguments are 0, 4, 8, 12, 16).

  Here, as described above, f, g, h, and k are descriptions (function descriptions) of the target program. These functions are associated with arguments referenced at runtime. An event is an event that is predefined in the entire debugging environment and can be identified. For example, an event such as a mouse being pressed or a key operation being performed. In order for an event to occur, a program description is required for each event. When the event occurs, the program description is executed, and argument data is referenced as necessary.

  There are various ways of recording an event. In this specification, as an example, an event is recorded by recording using a program description or an argument that is information related to the event that has occurred. The case will be described.

  Hereinafter, the recording of the event means that information related to the event (program description, argument, etc.) is recorded.

  First, in step S10, the worker inputs a log output by the operation of the target program through the input unit 10. For example, by repeatedly executing the program shown in the figure multiple times (by changing the main function i to 0, 4, 8, 12, or 16), a log that records the events that occurred in each order of occurrence is output from the debug Suppose that In this case, the worker inputs the log through the input unit 10.

  In step S15, the log generation unit 11 generates a plurality of logs from the input logs. This process will be specifically described. Consider a case where the log is input by the input unit 10. Based on the log, the log generation unit 11 generates a plurality of logs in which each event is recorded according to the generation order for each execution time (i = 0, 4, 8, 12, 16). A plurality of logs generated in this way are shown in FIG. In FIG. 7, a log that records events that occurred at execution time 1 (i = 0) in accordance with the order of occurrence is referred to as log 1. Similarly, logs 2 to 5 are recorded logs of events that occurred at execution times 2 to 5 in the order of occurrence.

  In step S20, the event sequence generation unit 12 generates an event sequence in which events are recorded in the order of occurrence based on the tendency of events in a plurality of logs. Specifically, the event sequence generation unit 12 generates an event sequence in which information related to events (such as function descriptions) is recorded in the order of occurrence based on the tendency of information related to events (such as function descriptions) in a plurality of logs. .

  This process will be specifically described with reference to the drawings. As shown in FIG. 7, in each log (logs 1 to 5), each event is recorded in the order of occurrence. For example, the plurality of logs are sent to the output unit 17 and output from the output unit 17. Thereby, the worker can understand the tendency of the events in the plurality of logs. Then, for example, the operator designates an event sequence (f g h g h g h g h k g h g h g h g h) in which the program function description related to the event is recorded in the above-mentioned generation order, and inputs that the event sequence is generated.

  Note that the event sequence is a reference for conversion to a conversion log, which will be described later. However, if the characteristics of the converted conversion log can be determined, the method for specifying the event sequence is not limited to this embodiment. The form is not limited.

  Then, based on the input event string generation, the event string generation unit 12 generates an event string. The event sequence generated by the event sequence generation unit 12 and the plurality of logs are sent to the log conversion unit 13.

  In step S30, the log conversion unit 13 compares the event (information related to the event) in the generated event sequence with the event (information related to the event) constituting each log, and determines each log based on the comparison result. Convert each into a conversion log. Specific processing using a plurality of logs shown in FIG. 7 is shown below.

  The log conversion unit 13 compares the program description for each event in the event sequence with the program description for each event in each log for each occurrence order. If the descriptions match, the log conversion unit 13 uses the description as information about the event of the conversion log. If no event is recorded in the log in a certain order of occurrence, information indicating that is used as information related to the event in the conversion log.

  For example, the function description for the second event in the log 1 generation order is g. On the other hand, the function description relating to the second event in the event sequence occurrence order is g. For this reason, the log conversion unit 13 uses g as information related to the second event in the generation order of the conversion log 1.

  For example, when the event of the nth occurrence of a certain log is not recorded and the function description related to the event of the nth occurrence of the event sequence is f, the log conversion unit 13 converts the conversion log of the certain log. As the information regarding the nth event in the generation order, for example, a-mark is used.

  The log conversion unit 13 generates a conversion log by recording information related to events in the order of occurrence through the conversion process.

  A conversion log obtained by converting the logs 1 to 5 as described above is shown in FIG. For each log shown in FIG. 7, since all the function descriptions related to the events in the event sequence are recorded, the log conversion unit 13 generates f g h g h g h g h k g h g h g h g h as the conversion log for each log.

  On the other hand, for example, when there is a log 5X in which an event using the function k does not occur in the middle, such as fghghghg () ghghghgh, instead of the log 5, the conversion log for each log is shown in FIG. As shown.

  Note that there are various other methods for the conversion processing by the log conversion unit 13, and in the present embodiment, the conversion method is not particularly limited to the above-described method. Each conversion log generated by the log conversion unit 13 is sent to the event occurrence probability calculation unit 14. The log conversion unit 13 holds the contents of each conversion log in a register (not shown) or the like.

  In step S40, the event occurrence probability calculation unit 14 calculates the occurrence probability of each event for each occurrence order based on the description of the program related to the event. Each event is each event recorded in the event sequence.

  The event occurrence probability calculation unit 14 refers to all information related to the event of each conversion log generated by the log conversion unit 13 and checks whether an event has occurred in each generation order. Then, the event occurrence probability calculation unit 14 calculates the event occurrence probability in each occurrence order. Since this occurrence probability indicates the probability that an event will occur in a certain occurrence order, it can be determined whether or not the occurrence of the event is unusual based on this occurrence probability and the rarity described below.

  This will be described with reference to FIG. In FIG. 8, the number of conversion logs in which an event using the first function f in the occurrence sequence of the event sequence (hereinafter referred to as event f) has occurred is 5, and the occurrence probability of the event f is 5 (The number of conversion logs in which event f has occurred) / 5 (the total number of conversion logs). FIG. 10 shows the result of calculating the event occurrence probability for all occurrence sequences of the event sequence in this way. As shown in FIG. 10, the occurrence probability of each event is all 1.

  For example, as shown in FIG. 9, when the conversion log 5X is used instead of the conversion log 5, the event k having the tenth occurrence sequence in the event sequence is generated in five conversions. There are four in the log, and the probability of occurrence of the tenth event k in the order of occurrence is 4/5. FIG. 11 shows the result of calculating the event occurrence probability with respect to the conversion log in the case of FIG. Then, the occurrence probability of each event is sent to the rarity calculator 15. Further, the event occurrence probability calculation unit 14 holds the occurrence probability of each event in a register or the like (not shown).

  In step S50, the rarity calculation unit 15 indicates a low event occurrence frequency or a low event non-occurrence frequency based on the occurrence probability for each event calculated by the event occurrence probability calculation unit 14. Calculate rarity.

  Here, the rarity level of an event indicates how unusual the occurrence of the event or the absence of the event is. There are various methods for defining the degree of rarity, and this embodiment is not particularly limited. Here, as an example, the degree of rarity is defined by the following formula, and it is assumed that the event is rare (occurrence or non-occurrence) as the rarity degree value increases.

  When the occurrence probability of an event in a certain occurrence order is p, a rarity R1 (low frequency of occurrence) indicating how rare the event has occurred is represented by p as the occurrence probability of the event. It is given by the following formula.

R1 = −log (p)
Here, log is a natural logarithm.

  On the other hand, when the occurrence probability of an event in a certain occurrence order is p, the rarity R2 (low frequency of non-occurrence) indicating how rare it is that the event has not occurred is the occurrence probability of the event. For example, p is given by the following equation.

R2 = -log (1-p)
Here, log is a natural logarithm.

  Then, the rarity level calculation unit 15 calculates the rarity level R1 when an event has occurred for each occurrence order in the conversion log, and calculates the rarity level R2 when no event has occurred. To do. These calculation results are associated with the conversion log and the generation order. FIG. 12 shows the result of calculating the rarity for the plurality of conversion logs shown in FIG. As shown in the figure, the rarity is 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 for all occurrence orders of the conversion logs 1 to 5.

  On the other hand, FIG. 13 shows the result of calculating the rarity for the plurality of conversion logs shown in FIG. As shown in the figure, the rarity is 0 0 0 0 0 0 0 0 0 0 0.1 0 0 0 0 0 0 0 for all occurrence orders of the conversion logs 1 to 4, but the conversion log 5X Is 0 0 0 0 0 0 0 0 0 0 0.7 0 0 0 0 0 0 0. The rarity associated with the conversion log and the occurrence order is sent to the rarity determination unit 16.

  In step S <b> 60, the rarity level determination unit 16 determines whether or not there is a feature of each conversion log based on the rarity level of each event calculated by the rarity level calculation unit 15. When it exists, it transfers to step S120. If not, the process proceeds to step S70.

  First, the case of the conversion logs 1 to 5 shown in FIG. 8 will be described. As shown in FIG. 12, the rarity level determination unit 16 has a calculated rarity level of 0 as shown in FIG. 12. Therefore, the frequency of occurrence of each event is high, and each event occurs. What you do is not unusual. In this case, the rarity level determination unit 16 determines that there is no feature of each conversion log.

  On the other hand, consider the case of the conversion log (1, 2, 3, 4, 5X) shown in FIG. In this case, in each conversion log, the rarity other than the 10th occurrence order is 0. On the other hand, the tenth rarity in the generation order is 0.1 for the conversion logs 1 to 4 and 0.7 for the conversion log 5X. Since there is a conversion log having a high rarity value, the rarity determination unit 16 determines that there is a conversion log characteristic, and that the 10th event k in the generation order of the conversion log 5X has not occurred. Is determined.

  If it is determined that there is a feature, the rarity degree determination unit 16 sends to the output unit 17 a feature of the conversion log 5X (the occurrence of the tenth event k in the generation order of the conversion log 5X has not occurred). Further, the rarity degree determination unit 16 reads the content of the conversion log (5X) from the log conversion unit 13 and sends the content to the output unit 17. In addition, the rarity degree determination unit 16 reads out the occurrence probability of the event (event k) in the occurrence order (tenth), which is a feature of the conversion log, from the event occurrence probability calculation unit 14 and sends it to the output unit 17. Further, the rarity degree determination unit 16 also sends the output unit 17 the rarity degree of the occurrence order (tenth) event (event k) that is a feature of the conversion log.

  In step S120, the output unit 17 outputs the conversion log name, the content of the conversion log, the occurrence order, the event, the occurrence probability (or non-occurrence probability), the rarity level, and the like. For example, in the above-described case, the output unit 17 includes the information sent from the rarity degree determination unit 16 (characteristics of the conversion log 5X (the event k of the tenth occurrence order of the conversion log 5X has not occurred). The contents of the conversion log (5X), the generation order (10th) that is a feature of the conversion log (5X), the generation probability of the event (event k) in that generation order, and the rarity level are output. When the rarity level determination unit 16 determines that the feature of the conversion log does not exist, the rarity level determination unit 16 notifies the data value classification unit 18 to that effect.

  In step S70, when it is determined by the rarity determination unit 16 that the feature does not exist, the data value classification unit 18 is configured for each event based on the data used when executing the description of the program related to the event. Classification information is generated according to a predetermined classification standard. Then, the data value classification unit 18 assigns the generated classification information to each event.

  This will be specifically described with reference to FIG. The data value classification unit 18 generates classification information as a predetermined classification standard, for example, according to a standard of whether the data value of the argument is 0 or more or less than 0. For example, the data value classification unit 18 indicates that the argument value 70 of the function h used for generating the fifth event in the log 1 generation order shown in FIG. + Mark) is generated. Then, the data value classification unit 18 gives the classification information to the function h used for generating the fifth event in the log 1 generation order.

  In the same manner, the data value classifying unit 18 classifies information indicating that the argument value −10 of the function h used for occurrence of the ninth event in the log 3 occurrence order is less than 0, and is less than 0 ( -Mark). Then, the data classification unit gives the classification information to the function h used for occurrence of the ninth event in the log 3 generation order.

  FIG. 14 shows the log result after the classification information is given to the function used to generate each event in this way.

  Note that the classification criteria are not particularly limited in the present embodiment as long as the classification criteria are such that log features exist. For example, based on the result of statistical processing of data values, it is also possible to determine the classification criteria by using a boundary value analysis or the like using a program source code. Also, a plurality of classification criteria can be set, and the data value classification unit 18 can generate classification information according to the plurality of classification criteria.

Then, the data value classification unit 18 sends each log given the classification information to the event occurrence probability calculation unit 14. The data value classifying unit 18 holds each log given classification information in a register or the like (not shown).
In step S80, the event occurrence probability calculation unit 14 calculates the event occurrence probability for each occurrence order based on the description (f, g, h, k) of the program related to the event and the given classification information (+, −). To calculate.

  This will be described with reference to FIG. In FIG. 14, the event occurrence probability calculation unit 14 calculates the occurrence probability of the first event in the occurrence order as follows. That is, the number of logs in which an event using the function f given the classification information + (hereinafter referred to as event f +) has occurred is 5, and the occurrence probability of the event f + is 5 (event f + occurs) Number of logs) / 5 (total number of logs).

  On the other hand, the occurrence probability of the ninth occurrence event is calculated as follows. That is, the number of logs in which an event using the function h to which the classification information + is given (hereinafter referred to as event h +) has occurred, and the occurrence probability of the event h + is 4 (event h + has occurred) The number of logged logs / 5 (the number of all logs).

When the occurrence probability of each event is calculated for all occurrence orders in this way, the result is as shown in FIG. The event occurrence probability calculation unit 14 sends the occurrence probability of each event to the rarity degree calculation unit 15. The event occurrence probability calculation unit 14 holds the occurrence probability of each event in a register (not shown) or the like.
In step S90, the rarity calculation unit 15 calculates a rarity indicating low occurrence frequency or low occurrence frequency based on the occurrence probability for each event calculated by the event occurrence probability calculation unit 14. To do. The event rarity R1 and R2 can be expressed by, for example, the expression shown in step S50.

  For example, in the logs 1, 2, 4, and 5 as shown in FIG. 14, when an event occurs in the generation order (1 to 18), the rarity level R 1, and when an event does not occur, it is rare When the degree R2 is calculated, the rarity degree is 0 0 0 0 0 0 0 0 0.1 0 0 0 0 0 0 0 0 0 with respect to the generation order as shown in FIG.

  On the other hand, in the log 3, in the occurrence order (1 to 18), when an event occurs, the rarity R1 is calculated. When the event does not occur, the rarity R2 is calculated, as shown in FIG. , 0 0 0 0 0 0 0 0 0 0 0.7 0 0 0 0 0 0 0 with respect to the generation order. Each degree of rarity calculated is associated with the log and the occurrence order, and sent to the rarity degree determination unit 16.

  In step S100, the rarity determination unit 16 determines whether or not there is a feature of each log based on the rarity of each event calculated by the rarity calculation unit 15. When it exists, it transfers to step S120. If not, the process proceeds to step S110.

  The case of logs 1 to 5 shown in FIG. 14 will be described. In each log, the rarity other than the ninth occurrence order is 0. On the other hand, the ninth degree of rarity is 0.1 for logs 1, 2, 4, and 5, and 0.7 for log 3. Since the 9th rarity of the log 3 generation order is high, the rarity determination unit 16 determines that there is a log characteristic, and determines that the 9th event h + of the log 3 occurrence order has not occurred. .

  If it is determined that there is a feature, the rarity level determination unit 16 sends to the output unit 17 the feature of the log 3 (the event h + in the generation order 9 of the log 3 has not occurred). Further, the rarity degree determination unit 16 reads the contents of the log 3 to which the classification information is given from the data value classification unit 18, and sends it to the output unit 17. Further, the rarity degree determination unit 16 reads out the occurrence probability of the occurrence order (9th) event (event h +), which is a feature of the log 3, from the event occurrence probability calculation unit 14 and sends it to the output unit 17. In addition, the rarity level determination unit 16 also sends the rarity level of the occurrence order (9th) event (event h +), which is a feature of the log 3, to the output unit 17. If it is determined that there is no feature, a message to that effect is sent to the output unit 17.

In step S110, the output unit 17 outputs that there is no feature. As a result, the worker performs an operation such as inputting another log or inputting that the classification standard is changed.

  In step S120, the output unit 17 outputs a log name, log contents, occurrence order, event, occurrence probability (or non-occurrence probability), rarity level, and the like. For example, in the above-described case, the output unit 17 indicates the information sent from the rarity degree determination unit 16 (the characteristic of the log 3 (the occurrence of the ninth event h + in the log 3 generation order has not occurred), The contents of the log (3), the occurrence order (9th) which is the characteristic of the log 3, and the occurrence probability (rareness) of the event (event h +) in the occurrence order are output.

  This provides debugging support information that is useful to the operator who examines the log. The operator can obtain a guideline that the log 3 should be scrutinized in consideration of the above-described characteristics, and can perform debugging work efficiently. For example, since the ninth event h + does not occur for the log 3, the operator sets 0 as the argument of the function h that appears in the ninth occurrence order among the functions related to event occurrence in the program execution related to the log 3. With respect to the use of data values less than that, if debugging work is performed, there is a high possibility that debugging can be eliminated, and debugging work can be performed efficiently.

  As the first process for analyzing the log, the log analysis is performed without considering the data value (argument value) in the following processes from step S10 to S60. This is because log characteristics can be correctly extracted by performing log analysis in consideration of differences in functions and execution order of the functions (event occurrence order) in preference to data differences.

(Function and effect)
According to the present embodiment, first, the occurrence probability or rareness of an event is calculated for each occurrence order based on the program description related to the event, and it is rare that an event does not occur or does not occur for each occurrence order (feature) And whether or not there is a feature of the conversion log. If there is a feature, information about the event that is the feature is output.

  Thus, in the present embodiment, first, it is determined whether or not there is a feature of the conversion log based on the calculated rarity without considering the data used in executing the program description. Even when there is no feature, the log can be efficiently analyzed as follows without considering the input log or the log analysis method again.

  That is, even when the above feature does not exist, the occurrence probability of each event is calculated for each occurrence order based on the description of the program related to the event and the data used when the description is executed. Based on the rarity level, it is possible to output information about the event that is characteristic of each log. Therefore, in addition to program description and event occurrence order (program description execution order), data is also taken into consideration to calculate the occurrence probability and rarity, and to extract log features based on these occurrence probabilities and rarity Therefore, even when the log feature cannot be extracted even if the program description and the occurrence order are taken into consideration, the log feature can be quickly extracted.

  Therefore, it is possible to provide a log analysis apparatus and method that are more efficient for the debugging work for the worker as compared with the prior art.

(Modification 1 of Embodiment 1)
Note that the log analysis apparatus may be provided with a determination unit (not shown) that determines whether or not the program descriptions related to events recorded in all occurrence orders are common among the plurality of logs.

  Then, after step S10, the determination unit (not shown) makes the above determination for a plurality of logs, and in the case where they are common (for example, the case of FIG. In this case, the program descriptions (f, g, etc.) are common to all occurrence orders 1 to 18), the processing from step S10 to step S60 is not performed, and the processing from step S70 to S120 is performed. It may be. In this case, log characteristics cannot be extracted even if log analysis is performed considering only the program description. On the other hand, if not common, the processing from step S20 to S60 is performed.

(Modification 2 of Embodiment 1)
The log analysis apparatus may be provided with a feature degree calculation unit (not shown). The feature degree calculation unit can calculate the feature degree of each log (conversion log or the like) based on the calculated occurrence probability of each event. In the flowchart shown above, for example, after calculating the occurrence probability for each event in step S80, the following processing may be performed.

  That is, the probability of occurrence for each event is sent to the feature calculation unit. The feature calculation unit calculates the occurrence probability of an event when an event has occurred with respect to the occurrence order of each log, and 1-occurrence probability (non-occurrence probability) when no event has occurred. Is generated (FIG. 17).

  Then, as shown in FIG. 17, the feature degree calculation unit calculates the feature degree by multiplying each log by the occurrence probability or non-occurrence probability given to each occurrence order. For example, in the case shown in FIG. 17, the logs 1, 2, 4, and 5 are 0.8, whereas the log 3 is 0 and 2. For this reason, if this characteristic degree is output, the log 3 can be judged as a characteristic log and an operator.

  Similarly, in the flowchart shown above, after calculating the occurrence probability for each event in step S40, the characteristic degree of each conversion log is calculated by the characteristic degree calculating unit, and the characteristic degree is output by the output unit 17. You may be made to do. The feature calculation unit can also calculate the feature level of each log based on the calculated rarity levels.

  In the above-described flowchart, for example, the following processing may be performed after calculation for each rarity in step S90. This will be specifically described with reference to FIG. Each rarity calculated by the rarity calculator 15 is sent to the feature calculator. The feature calculation unit calculates the feature by adding the rarity given to each generation order for each log.

  For example, in the case shown in FIG. 18, the logs 1, 2, 4, and 5 are 0.1, whereas the log 3 is 0 and 7. For this reason, if this characteristic degree is output, the log 3 can be judged as a characteristic log and an operator.

  Similarly, in the flowchart shown above, after calculating the occurrence probability for each event in step S50, the characteristic degree of each conversion log is calculated by the characteristic degree calculating unit, and the characteristic degree is output by the output unit 17. You may be made to do. Using the calculation result by such a feature degree calculation unit, the operator can quickly know the feature of the log.

Embodiment 2. FIG.
In the second embodiment, even when the log feature cannot be extracted even if the description of the program and the execution order are taken into consideration, the log analysis device that extracts the log feature by performing the log analysis in consideration of the reference to the memory area Aims to provide a way.

  FIG. 19 is a diagram illustrating a configuration of a log analysis apparatus according to the second embodiment. In the figure, the same components as those of the first embodiment are denoted by the same reference numerals, and the description thereof is omitted. The configuration of the log analysis device according to the second embodiment is different from the configuration of the log analysis device according to the first embodiment in the following points.

  The log analysis apparatus does not include the log generation unit 11, but includes an area specification unit 20, a log classification unit 21, a classification log generation unit 22, and a feature calculation unit 19.

  Using the area designating unit 20, an operator designates a memory area that can be referred to when executing a program description used for generating an event. For example, an operator specifies an array variable used in the target program. This is recorded as a log as to what function is referred to during execution for the memory area of the array variable. For this reason, for example, when information indicating that a predetermined array variable is likely to have a bug is acquired in advance, the operator designates the array variable by using the area designating unit 20 to perform log analysis described later. This is because there is a possibility that information useful for debugging work can be obtained.

The log classification unit 21 classifies each event based on whether or not a reference process for the designated memory area is involved. The classification log generation unit 22 generates a plurality of classification logs in which the classified events are recorded in accordance with the generation order for each memory area with reference processing. Specific processing will be described later. The feature calculation unit calculates the feature level of each log based on each rarity level calculated by the rarity level calculation unit 15.
(Log analysis method)
FIG. 20 is a flowchart showing a log analysis method using the log analysis apparatus described above. In this embodiment, as an example, a log analysis method obtained when a target program described in C language as shown in FIG. 21 is executed will be described as a specific example.

  In the above target program, the functions init, clean, and calc are executed 12 times (i = 1 to 12), 3 times (i = 4, 8, 12), and 4 times (i = 3, 6, 9) from the function main. 12) Calling. In this program, when a memory area with functions init and clean is referenced, the function calc must not be referenced for that memory area, but for i = 12, the memory area for vals [12] Have been referred to. Hereinafter, the log analysis method according to the second embodiment will be described using a process of outputting information effective for finding the bug as a log feature as a specific example.

  First, in step S10 shown in the first embodiment, the operator inputs a recorded log through the input unit 10 in accordance with the order of occurrence of a series of events generated by the execution of the target program. FIG. 22 shows a log of the result of executing the target program shown in FIG. When only such a log is obtained as an execution result, or when information indicating that there is a bug in the reference stage to a predetermined array variable has been acquired in advance, the operator will indicate that fact. Input is performed by the input unit 10. As a result, the fact is sent to each unit, and the following processing is performed instead of the processing of the first embodiment described above. This is because, for such a log, log features cannot be extracted by the conventional technique or the log analysis method of the first embodiment.

  In step S <b> 200, the operator designates a predetermined array variable area (hereinafter simply referred to as an array variable) used in the program, using the area designation unit 20.

  When the log shown in FIG. 22 is obtained, for example, the operator uses the area specification unit 20 to refer to array variables vals [1] to [12] (commonly refer to any function or description code in the program). Global array variable). All the specified array variables and the input log are sent to the log classification unit 21.

  In step S <b> 210, the log classification unit 21 classifies each event in the log based on whether or not a reference process for the array variable designated by the region designation unit 20 is involved when each event occurs. This will be described with reference to FIG.

  For example, the program description relating to the event involving the reference processing of the array variable vals [1] is init; vals [1], and the program description relating to the event involving the reference processing of the array variable vals [2] is init; vals [2 ], And the program description regarding the event accompanied by the reference processing of the array variable vals [3] is init; vals [3], calc; vals [3],. . . As described above, the log classification unit 21 classifies each event based on the array variable vals [i] (i = 1 to 12) being referred to.

  In step S220, the classification log generation unit 22 generates a plurality of classification logs in which the classified events are recorded according to the generation order. This will be specifically described with reference to FIG. Based on each event classified in step S210, the classification log generation unit 22 generates a classification log 1 that is a log in which program descriptions related to events involving reference processing of the array variable vals [1] are recorded in the order of occurrence. Generate. Similarly, the classification log generation unit 22 generates a classification log 2 which is a log in which program descriptions related to events involving reference processing of the array variable vals [2] are recorded in the order of occurrence. In this way, the classification log generation unit 22 generates a plurality of classification logs 1 to 12 (FIG. 23). Then, the classification log generation unit 22 sends the generated plurality of classification logs to the log conversion unit 13.

  In step S230, the log conversion unit 13 converts each classification log into a conversion log. First, when a plurality of classification logs are sent from the classification log generation unit 22 to the log conversion unit 13, the log conversion unit 13 instructs the event sequence generation unit 12 to generate a predetermined event sequence. The event sequence generation unit 12 generates an event sequence based on the tendency of events (information on events) of a plurality of classification logs generated by the classification log generation unit 22. For example, in the case as shown in FIG. 23, the event sequence generator 12 records an event sequence (init; vals, clean; vals, calc; vals) in which program descriptions related to events recorded in each classification log are recorded in the order of occurrence. ) Is generated.

  The log conversion unit 13 compares the program description for each event in the event sequence with the program description for each event in each classification log for each occurrence order. If the descriptions match, the log conversion unit 13 uses the description as information about the event of the conversion log. If no event is recorded in the classification log in a certain order of occurrence, information indicating that fact is used as information related to the event in the conversion log.

  For example, the description related to the first event in the recording order of the classification log 1 is init; vals (the number of arrays is not considered), and the description related to the first event in the event sequence generation order is init; vals. Therefore, the log conversion unit 13 uses init; vals as information related to the first event in the generation order of the conversion log 1.

  For example, when the second event in the recording order of the classification log 1 is not recorded and the description regarding the second event in the event sequence occurrence order is “clean; vals”, the log conversion unit 13 As the information related to the second event in the generation order of the conversion log 1, a -mark indicating that no event exists is used.

  In addition, when the description regarding the second event in the recording order of the classification log 3 is calc; vals, the description regarding the second event in the event sequence occurrence order does not match the description clean; vals, but the event sequence occurrence order is third. The log conversion unit 13 uses calc; vals as information regarding the third event in the generation order of the conversion log 3 because it matches the description calc; vals regarding the event. In this case, the log conversion unit 13 uses a -mark indicating that there is no event as information regarding the second event in the generation order of the conversion log 3.

  FIG. 24 shows conversion logs 1 to 5 in which the log conversion unit 13 performs conversion processing on the classification logs 1 to 5 in accordance with such conversion rules.

  Note that there are various other methods for the conversion processing by the log conversion unit 13, and in the present embodiment, the conversion method is not particularly limited to the above-described method. Each of the generated conversion logs is sent to the event occurrence probability calculation unit 14. In addition, the log conversion unit 13 holds the contents of each conversion log in a register or the like (not shown).

  In step S240, the event occurrence probability calculation unit 14 calculates the occurrence probability of each event for each occurrence order based on the description of the program related to the event. This will be described with reference to FIG. In FIG. 24, the number of conversion logs in which an event using the first init; vals in the event sequence is generated (hereinafter referred to as event init) is 12, and the occurrence probability of the event init is 12 (The number of conversion logs in which an event has occurred) / 12 (the number of all conversion logs). The number of conversion logs in which an event using the second clean; vals in the event sequence occurrence order (hereinafter, event clean) has occurred is three, and the probability of occurrence of the event is 3 (the event has occurred) Number of conversion logs) / 12 (the total number of log conversions).

  The number of conversion logs in which an event using the third calc; vals of event sequence (hereinafter referred to as event calc) has occurred is four, and the occurrence probability of the event is 4 (the event has occurred) Number of conversion logs) / 12 (number of all conversion logs).

  FIG. 25 shows the occurrence probability of each event calculated in this way. The calculated occurrence probability of each event is sent to the rarity calculation unit 15. The event occurrence probability calculation unit 14 holds the occurrence probability of each event in a register (not shown) or the like.

  In step S250, the rarity calculation unit 15 calculates a rarity indicating low occurrence frequency or low occurrence frequency based on the occurrence probability for each event calculated by the event occurrence probability calculation unit 14. To do.

  For example, in the conversion logs 1 to 12 as shown in FIG. 24, in the occurrence order (1 to 3), when an event occurs in the same manner as in step S50, the rarity R1 and the event does not occur When the rarity level R2 is calculated, the rarity level is the result shown in FIG. 26 for all occurrence orders (1 to 3) of the conversion logs 1 to 12. Each of the calculated rarity levels is sent to the rarity level determination unit 16 in association with the conversion log and the generation order.

  In step S <b> 255, the rarity level determination unit 16 determines whether or not there is a feature of each conversion log based on the rarity level of each event calculated by the rarity level calculation unit 15. When it exists, it transfers to step S257. If not, the process proceeds to step S260.

  If it exists, in step S257, information related to the event that is a feature of the conversion log is output from the output unit 17. Here, as with the case of the first embodiment, the information regarding the event serving as a feature is sent from each unit to the output unit 17 via the rarity degree determination unit 16.

  In the case of FIG. 26, the rarity level that is a feature (a rarity level having a large value) and the rarity level that cannot be a feature (a rarity level having a small value) are mixed at an equal ratio. The unit 16 determines that no feature exists. If it does not exist, the rarity determination unit 16 sends the fact and the rarity associated with the log and the generation order to the feature calculation unit 19.

  In step S260, the feature calculation unit 19 calculates the feature of each log based on each calculated rarity. This will be specifically described with reference to FIG. Each rarity calculated by the rarity calculator 15 is sent to the feature calculator 19. Note that the contents of all conversion logs are sent from the log conversion unit 13 to the feature degree calculation unit 19, and the occurrence probabilities of each event are also sent from the event occurrence probability calculation unit 14.

  For example, the feature degree calculation unit 19 calculates the feature degree by taking the sum of the rarity levels given to each generation order for each log. For example, in the case as shown in FIG. 26, the feature level of the conversion log 1 is 0 (rareness of occurrence order 1) +0.12 (rareness of occurrence order 2) +0.17 (rareness of occurrence order 3) = 0.29. The characteristics of all the conversion logs 1 to 12 calculated in this way are shown in FIG. The feature degree calculation unit 19 sends the conversion log having the maximum feature degree among the calculated feature degrees, the content of the conversion log, the rarity in the generation order, and the feature degree to the output unit 17. In the case shown in FIG. 27, since the characteristic degree of the conversion log 12 is 1.08, which is higher than the characteristic degree of other conversion logs, information related to the conversion log 12 is sent to the output unit 17.

  In step S265, the output unit 17 includes information related to the conversion log having the maximum characteristic (the conversion log name having the maximum characteristic, the characteristic of the conversion log, and the content of the conversion log (event recorded in the log). , The rarity of each occurrence order, etc.) is output. Note that if there is no conversion log having the maximum feature value (when the feature values of all the conversion logs are 0), information about all the conversion logs is sent to the output unit 17 from the feature value calculation unit. Then, the output unit 17 may output information on all the conversion logs.

  This provides debugging support information that is useful to the operator who examines the log. The operator can obtain a guideline that the conversion log 12 should be scrutinized in consideration of the above-described characteristics, and the debugging work can be efficiently performed.

  In the area specifying unit 207, the area from vals [1] to vals [12] is specified. Instead, vals [i] referenced by the function calc is specified, and vals [3], vals [6 ], Vals [9], and vals [12] can also be specified. For example, in step S265, if the maximum feature value is smaller than other feature values, or if all feature values are the same, in step S200, the operator It is also possible to specify another arrangement area and perform the above-described processing (steps S200 to S265).

  Similarly to the second modification of the first embodiment, the feature calculation unit 19 can also calculate the feature of each conversion log based on the calculated occurrence probability of each event. For example, the feature degree calculation unit 19 determines the occurrence probability of an event when an event has occurred in the order of occurrence of each conversion log, and 1−occurrence probability ( A matrix given non-occurrence probability is generated (FIG. 28).

  Then, the feature degree calculation unit 19 multiplies the occurrence probability or non-occurrence probability given to each occurrence order for each conversion log in the same manner as the second modification of the first embodiment, thereby calculating the feature degree. calculate. Then, information regarding the conversion log of the minimum characteristic degree among the calculated characteristic degrees may be output to the output unit 17.

  Similarly to the first embodiment, when the program descriptions related to the recorded events are common among the plurality of classification logs in all the occurrence orders, the data stored in the memory area is considered, and step S70 is performed. It is also possible to perform the processing from step S120 to step S120.

(Function and effect)
In the present embodiment, a memory area that can be referred to when executing a program description related to an event that has occurred is specified, and a plurality of events that are classified according to the occurrence order are recorded for each memory area that accompanies reference processing. Generate a classification log. Then, after the classification log is converted into the conversion log, the occurrence probability of each event is calculated for each occurrence order based on the description of the program related to the event, and based on the occurrence probability or rarity, Information about events that are characteristic of the conversion log can be output. Therefore, in addition to the program description and event occurrence order (program description execution order), the occurrence probability and rarity are calculated in consideration of the reference processing for the memory area, and the log is calculated based on these occurrence probabilities and rarity. Since the feature can be extracted, the log feature can be quickly extracted even if the log feature cannot be extracted even if the program description and the order of occurrence are taken into consideration.

  Therefore, it is possible to provide a log analysis apparatus and method that are more efficient for the debugging work for the worker as compared with the prior art.

(Application Example 1 of Embodiment 2)
In the application example 1, a case where an operator designates a memory area referred to when executing a predetermined program description related to an event as designation by the area designation unit 20 will be described below.

  Using the area designating unit 20, the worker designates a memory area to be referred to when executing a predetermined program description used for generating an event. For example, a variable used as an argument of a predetermined function used in the target program is designated. This designation is for the following reason. That is, what function description or the like has referred to the memory area of the variable is recorded as a log. For this reason, when information indicating that there is a possibility that there is a bug in the use of a variable used as an argument of a predetermined function has been acquired in advance, the operator designates the variable using the area designating unit 20 to be described later. This is because the log analysis is more likely to extract log features.

(Log analysis method)
A log analysis method using the log analysis apparatus according to Application Example 1 described above will be described below.

  First, the worker acquires a log output by executing the program. For example, consider the program shown in FIG. 29 as the target program. In this program, with respect to class A type variables a1 and a3, the variable a1 is referred to by the function main and the function g, and the variable a3 is referred to by the function main. Further, the class A type variable a2 is referred to by the function f and the function g.

  FIG. 30 shows a log recorded by a tracer or the like when the target program is executed. In this log, a program description used for generating an event, a memory area referred to when the description is executed, and a data value stored in the memory area are recorded in the order of generation. For example, the record relating to the third event in the occurrence order is “a1.height = 10; a1: 0x10010, a1.height: 0x10010 = 10”. Here, when the third event occurs, the program description “a1.height = 10;” is executed, the variable a1 whose start address is 0x10010 is referenced, and a1.height whose start address is 0x10010 It is recorded that the data value 10 is stored.

  A log analysis method according to Application Example 1 will be described below with reference to a flowchart shown in FIG. In step S <b> 200, the operator designates a predetermined variable area (hereinafter simply referred to as a variable) used in the program using the area designation unit 20.

  In the case where the log shown in FIG. 30 is obtained, for example, the worker considers a case where an A type variable “a” that is an argument of the function g is designated. In the program shown in FIG. 29, the variable of type A that is an argument of the function g is assumed to be variables a1 and a2 from the contents (g (a1); a1: 0x10010, g (a2); a2: 0x10020) in the log. Thus, the operator designates the variable area a1: 0x10010 and the variable area a2: 0x10020 using the area designation unit 20.

  The operator may automatically specify the variables a1 and a2 by specifying “g ((a)”, that is, the log content is sent to the area specifying unit 20. Based on the operator's designation of g ((a)), the area designation unit 20 may search the log contents to designate the variable area a1: 0x10010 and the variable area a2: 0x10020. All the variables and the input logs are sent to the log classification unit 21.

  In step S210, the log classification unit 21 classifies each event in the log based on whether or not a reference process for the variable designated by the area designation unit 20 is involved when each event occurs. This will be described with reference to FIG.

  For example, in the log, the program description regarding the event accompanied by the reference processing of the variable a1 is A a1, a1.height, a1.width, g (a1), area = a1.height * a1.width shown in the figure, and The description of the program related to the event involving the reference processing of the variable a2 is A a2, a2. Height, a2. Width, g (a2), area = a2. Height * a2.width, and the log classification unit 21 Classifies each event based on the reference processing to the variables a1 and a2.

  In step S220, the classification log generation unit 22 generates a plurality of classification logs in which the classified events are recorded according to the generation order. This will be specifically described with reference to FIG. The classification log generation unit 22 generates a classification log 1 that is a log in which program descriptions related to events involving reference processing of the variable a1 are recorded in accordance with the generation order for each event classified in step S210. Similarly, the classification log generation unit 22 generates the classification log 2. An example of the generated plurality of classification logs is shown in FIGS. The form of the classification log may be any form. Then, the classification log generation unit 22 sends the generated plurality of classification logs to the log conversion unit 13.

  Thereafter, the processing after step S230 is performed. The method of each process is as described in the second embodiment. At this time, differences in data values are not taken into account when identifying events.

  In the case shown in FIG. 32, in step S230, the event sequence is A a, a.height, a.width, g, area = a.height * a.width, and classification is performed as shown in the second embodiment. The log may be converted into a conversion log, the occurrence probability or rarity of each event may be calculated, and the log characteristics may be output. In the case of FIG. 32, since the probability of occurrence of all events is 1, in S260, the feature level of all conversion logs is 0, and even if the information about all conversion logs is output to the output unit 17, the work is performed. The person can determine that there is no feature of the conversion log. Thereafter, as in the first embodiment, in consideration of the data values of the arguments (a1, a2), the processing from step S70 onward may be performed. Note that after step S220, the contents of each classification log may be output by the output unit 17, and the presence or absence of features in the program description may be output.

(Application example 2 of Embodiment 2)
In the application example 2, a case where the operator performs designation for a plurality of memory areas having a common area size as designation by the area designation unit 20 will be described below.

  The area designating unit 20 allows the operator to designate a plurality of memory areas having a common area size. For example, an integer type variable area, a character type variable area, or the like can be designated. Here, as an example, consider the case where a class A variable area is specified.

(Log analysis method)
A log analysis method using the log analysis apparatus according to Application Example 2 described above will be described below.

  First, the worker acquires a log output by executing the program. The target program and the log recorded during the program execution are the same as those in the first application example. A log analysis method according to Application Example 2 will be described below with reference to a flowchart shown in FIG.

  In step S <b> 200, the operator designates a predetermined variable area (hereinafter simply referred to as a variable) used in the program using the area designation unit 20.

  When the log shown in FIG. 30 is obtained, the worker considers, for example, the case where a class A type variable area is designated. In the program shown in FIG. 29, class A type variables are variables a1, a2, and a3 from the contents (A a1; a1: 0x10010, A a2; a2: 0x10020, A a3; a2: 0x10030, and so on) in the log. Therefore, the operator uses the area designating unit 20 to designate the variable area a1: 0x10010, the variable area a2: 0x10020, and the variable area a3: 0x10030.

  As in Application Example 1, the variables a1, a2, and a3 may be automatically specified by the operator specifying “class A type”. In other words, the log contents are sent to the area designating unit 20. Then, based on the operator's specification, the area specifying unit 20 may search the log contents and specify the variable area a1: 0x10010, the variable area a2: 0x10020, and the variable area a3: 0x10030. All the specified variables and the input log are sent to the log classification unit 21.

  In step S210, the log classification unit 21 classifies each event in the log based on whether or not a reference process for the variable designated by the area designation unit 20 is involved when each event occurs. This will be described with reference to FIG.

  In the log shown in FIG. 30, the program description regarding the event accompanied by the reference processing of the variable a1 is A a1, a1.height, a1.width, g (a1), area = a1.height * a1.width shown in the figure. In addition, the description of the program related to the event involving the reference processing of the variable a2 is A a2, a2. Height, a2.width, g (a2), area = a2.height * a2.width, and the reference processing of the variable a3 The description of the program related to the event is A a3, a3.height, area = a3.height * a3.width, and the log classification unit 21 is based on the reference processing to the variables a1, a2, and a3. Categorize each event.

  In step S220, the classification log generation unit 22 generates a plurality of classification logs (1 to 3) in which the classified events are recorded according to the generation order. An example of the generated plurality of classification logs is shown in FIGS. The form of the classification log may be any form. Then, the classification log generation unit 22 sends the generated plurality of classification logs to the log conversion unit 13. Thereafter, the processing after step S230 is performed. The method of each process is as described in the second embodiment.

  At this time, differences in data values are not taken into account when identifying events. In the case shown in FIG. 34, in step S230, the event sequence is A a, a.height, a.width, g, area = a.height * a.width, and classification is performed as shown in the second embodiment. The log may be converted into a conversion log, the occurrence probability or rarity of each event may be calculated, and the log characteristics may be output. In the case of the figure, the rarity level determination unit 16 determines that there is a feature of the conversion log (or the output unit 17 outputs that the feature level of the conversion log 3 is maximum). That is, the operator can convert a. It can be seen that it is rare that an event using width and an event using g do not occur.

  Then, the operator examines the conversion log 3 and the reason that the event using g does not occur is that the area is calculated without using the function g. Judge that there is no. On the other hand, the worker can: a. It can be determined that there is an error in programming because no event using width occurs because only the height value is set to calculate area. Note that after step S220, each classification log may be output by the output unit 17 to output the presence or absence of features in the program description.

(Modification of Embodiment 2)
The rarity determination unit 16 can also determine whether or not a log feature exists according to a predetermined reference value when determining the log feature. This predetermined reference value can be held by the rarity degree determination unit 16 when the operator inputs the value using the input unit 10. For example, in step S255 shown in FIG. 20, if there is a log having a rarity level equal to or higher than a predetermined reference value 0.6, it can be determined as a log feature.

  Further, the log analysis apparatus may be provided with a sorting unit. In other words, when there are a plurality of rarities exceeding the predetermined reference value among the rarities calculated by the rarity calculator 15, the sorting unit sorts the rarities in descending order. Then, the sorting unit may cause the output unit 17 to output information on events in the sorted order of the rarity. Thereby, the operator can perform debugging work in the sorted order, and the efficiency of debugging work can be improved.

  In addition, the sorting unit can sort the features in descending order when the feature values calculated by the feature value calculation unit include a plurality of feature values exceeding a predetermined reference value. Then, the sorting unit may cause the output unit 17 to output information related to the log in descending order of the feature level.

(Embodiment of log analysis program)
The steps described in the log analysis method can be realized by executing a log analysis program on a computer.

  The configuration of this computer is shown in FIG. The computer performs various operations such as a hard disk 100 that stores the log analysis program 1 and the log analysis program 2 such as various data, a memory 120 that temporarily stores data read from the hard disk 100 and operation results by the CPU 130. It has a CPU 130 to perform, an input / output unit 110 for inputting / outputting predetermined data, and a bus 140 for connecting these devices to each other. Hereinafter, the log analysis program 1 and the log analysis program 2 will be described separately.

(Log analysis program 1)
The input / output unit 110 inputs and outputs predetermined data. For example, a display device that displays data contents, a keyboard and mouse for inputting various data by key operations, and a printer device that prints data information I / O devices such as

  The input / output unit 110 has functions of an input unit 110a and an output unit 110b. The operator inputs a log output from a debugger (not shown) using the input unit 110a. The output unit 110b outputs information on events that are characteristic of each log and each conversion log based on the occurrence probability or rareness of each event.

  The CPU 130 functions as various processing units by executing the log analysis program 1 installed in the hard desk 100. Specifically, the CPU 130 repeatedly executes the same debug target program (hereinafter referred to as the target program) a plurality of times, thereby generating a plurality of logs in which the generated events are recorded according to the generation order for each execution time. A log generation unit 130g, an event sequence generation unit 130a that generates an event sequence in which events are recorded in the order of occurrence based on the events that constitute each of the plurality of logs, an event in the event sequence, and each log Each event to be configured is compared, and based on the comparison result, the log conversion unit 130b that converts each of the plurality of logs into a conversion log, and the occurrence probability of each event based on the description of the target program related to the event Event occurrence probability calculation unit 130c for calculating the occurrence order for each occurrence order, and A rarity calculation unit 130d that calculates a rarity indicating low occurrence frequency based on the occurrence probability, and a rarity determination that determines whether or not a feature of the conversion log exists based on the calculated rarity It functions as the unit 130e. The CPU 130 also has a function of a data value classification unit 130i.

  When the rareness determination unit 130e determines that the feature does not exist, the data value classification unit 130i uses a predetermined classification criterion for each event based on data used when executing the description of the program related to the event. According to the above, classification information is generated. Then, the data value classifying unit 130i gives the generated classification information to each event.

  The event occurrence probability calculation unit 130c described above also has a function of calculating the event occurrence probability for each occurrence order based on the description of the program related to the event and given classification information. The rarity level calculation unit 130d described above also has a function of calculating a rarity level indicating a low occurrence frequency based on the calculated occurrence probability. The rarity level determination unit 130e described above also has a function of determining whether or not a log feature exists based on the rarity level calculated by the rarity level calculation unit 130d.

  In this embodiment, the log analysis program 1 installed on the computer hardware having the above configuration can be executed by the following procedure. First, the worker inputs the log output by the operation of the target program through the input unit 110a. Then, the fact that it has been input by the input unit 110a is sent to the CPU 130 via the bus 140 (hereinafter omitted through the bus). The CPU 130 reads the log analysis program 1 from the hardware 100 and decodes it, thereby setting the functions of the respective units of the CPU 130 described above to be executable.

  Next, the CPU 130 (log generation unit 130g) generates a plurality of logs from the input logs. Specifically, the input log is sent to the CPU 130. The CPU 130 (log generation unit 130g) repeatedly executes the same target program a plurality of times based on the input log, thereby generating a plurality of logs each recording an event that has occurred according to the generation order for each execution time. Generate.

  Next, the CPU 130 (event sequence generation unit 130a) generates an event sequence in which events are recorded in the order of occurrence based on the tendency of events in a plurality of logs generated by the log generation unit 130g.

  Next, the CPU 130 (log conversion unit 130b) compares the event (information related to the event) of the generated event sequence with the event (information related to the event) constituting each log, and based on the comparison result, Each log is converted into a conversion log.

  Next, the CPU 130 (event occurrence probability calculation unit 130c) calculates the occurrence probability of each event for each occurrence order based on the description of the target program related to the event.

  Next, the CPU 130 (rareness calculation unit 130e) determines whether the event occurrence frequency is low or the event non-occurrence frequency is low based on the occurrence probability for each event calculated by the event occurrence probability calculation unit 130c. Calculate the rarity indicating.

  Next, the CPU 130 (rareness determination unit 130e) determines whether or not a feature of each conversion log exists based on the rarity of each event calculated by the rarity calculation unit 130d. If it is determined that it exists, a message to that effect is sent to the output unit 110b. The output unit 110b outputs information related to an event that is a feature of each conversion log. On the other hand, if it is determined that the event does not exist, the CPU 130 (data value classification unit 130i) determines a predetermined classification criterion for each event based on the data used when executing the description of the target program related to the event. According to the above, classification information is generated. Then, the data value classifying unit 130i gives the generated classification information to each event.

   Next, the CPU 130 (event occurrence probability calculation unit 130c) calculates the event occurrence probability for each occurrence order based on the description of the target program related to the event and given classification information.

  Next, the CPU 130 (rareness calculation unit 130d) indicates a rarity level indicating a low occurrence frequency or a low occurrence frequency based on the occurrence probability for each event calculated by the event occurrence probability calculation unit 130c. Calculate

Next, the CPU 130 (rareness determination unit 130e) determines whether or not there is a feature of each log based on the rarity of each event calculated by the rarity calculation unit 130d. If it does not exist, the fact is sent to the output unit 110b, and the output unit 110b outputs that there is no feature. On the other hand, when it exists, CPU130 sends the information regarding the event used as the characteristic of a log to the output part 110b, and the output part 110b outputs the sent information.

  Note that the CPU 130 may have a function of a determination unit (not shown) that determines whether or not a program description related to events recorded in all occurrence orders is common among the plurality of logs.

  Then, after the log input by the operator, the CPU 130 (determination unit) performs the above-described determination in each of the plurality of logs, and in the case of common, the classification information generation processing by the CPU (data value classification unit 130i) and thereafter. You may make it perform the process of. On the other hand, if not common, the CPU 130 may perform the determination process by the rarity determination unit 130e from the process by the log generation unit 130g (step S15 to step S60 in FIG. 4).

  The CPU 130 may also have a function of a feature degree calculation unit 130j that calculates a feature degree indicating the degree of feature of each conversion log based on the calculated occurrence probability of each event. The CPU 130 (feature degree calculating unit 130j) calculates the characteristic degree of each log based on the calculated occurrence probability of each event. The CPU 130 (feature degree calculation unit 130j) sends the calculated characteristic degree of each log to the output unit 110b. The output unit 110b outputs the feature level of each conversion log.

  According to such a log analysis program according to the present embodiment, in addition to the target program description and the event occurrence order (target program description execution order), the occurrence probability and the rarity are calculated in consideration of the data. Log features can be extracted based on the occurrence probability and rarity of log, so even if log features cannot be extracted even if the target program description and occurrence order are considered, log features can be extracted quickly The log analysis device and the log analysis method that achieve the operational effect can be easily realized by a general-purpose computer.

(Log analysis program 2)
The input / output unit 110 has functions of an input unit 110a and an output unit 110b. The operator inputs a log output from a debugger (not shown) using the input unit 110a.

  Here, the input / output unit 110 has a function of an area designation unit 110c that designates an area of the memory 120 that can be referred to when executing the target program description related to the event.

  The operator uses the input / output unit 110 (region specifying unit 110) to refer to an area of the memory 120 that is referred to when executing a predetermined target program description related to an event, or a plurality of memories 120 having a common area size. Can be specified.

  The output unit 110b outputs information on events that are characteristic of each log and each conversion log based on the occurrence probability or rareness of each event. The output unit 110b outputs the feature level of each conversion log calculated by the feature level calculation unit 130j.

  The CPU 130 classifies each event according to a designation input by the area designation unit 110c based on whether or not a reference process for the designated memory area is involved, and a memory area with a reference process. An event that generates an event sequence in which events are recorded in the order of occurrence based on the event that constitutes each classification log, and a classification log generation unit 130h that generates a plurality of classification logs in which the recorded events are recorded according to the occurrence order A column generation unit 130a, a log conversion unit 130b that compares the events of the event sequence with the events that constitute the classification logs, and converts the classification logs into conversion logs based on the comparison results, and an event Based on the description of the target program regarding the occurrence probability of each event for each occurrence order Having an event occurrence probability calculating unit 130c, based on the occurrence probability, the function of the rare calculation unit 130d for calculating a rare degree indicating a low frequency of occurrence that. Further, the CPU 130 has a function of a feature degree calculation unit 130j that calculates a feature degree indicating the feature degree of each conversion log based on the calculated occurrence probability of each event.

  In this embodiment, the log analysis program 2 installed in the computer hardware 100 having the above configuration can be executed by the following procedure.

  First, the worker inputs the log output by the operation of the target program through the input unit 110a. Then, the fact that it has been input by the input unit 110a is sent to the CPU 130 via the bus 140 (hereinafter omitted through the bus). The CPU 130 reads the log analysis program 2 from the hardware 100 and sets it in a state where the functions of the respective units of the CPU 130 described above can be executed.

  Next, the worker inputs (specifies) a predetermined variable area used in the target program using the input / output unit 110 (area specifying unit 110c). Next, the CPU 130 (log classification unit 130f) classifies each event in the log on the basis of whether or not a reference process for the variable specified by the area specifying unit 110c is involved when each event occurs.

   Next, the CPU 130 (classification log generation unit 130h) generates a plurality of classification logs in which the classified events are recorded in the order of occurrence. Next, the CPU 130 (log conversion unit 130b) converts each classification log into a conversion log. The processing of the CPU 130 will be described in detail below.

  First, the log conversion unit 130b instructs the event sequence generation unit 130a to generate a predetermined event sequence. The event sequence generation unit 130a generates an event sequence based on the tendency of events (information about events) of a plurality of logs generated by the log generation unit 130g.

  The log conversion unit 130b compares the target program description related to each event in the event sequence with the target program description related to each event in each log for each occurrence order. If the descriptions match, the log conversion unit 130b uses the description as information related to the event of the conversion log. If no event is recorded in the log in a certain order of occurrence, information indicating that is used as information related to the event in the conversion log.

  Next, the CPU 130 (event occurrence probability calculation unit 130c) calculates the occurrence probability of each event for each occurrence order based on the description of the target program regarding the event.

  Next, the CPU 130 (rareness calculation unit 130d) calculates the rarity indicating low occurrence frequency or low occurrence frequency based on the occurrence probability for each event calculated by the event occurrence probability calculation unit 130c. calculate.

  Next, the CPU 130 (rareness determination unit 130e) determines whether or not a feature of each conversion log exists based on the rarity of each event calculated by the rarity calculation unit 130d. If it exists, the CPU 130 sends information related to the event that is characteristic of the conversion log to the output unit 110b, and instructs the output unit 110b to output the information. The output unit 110b outputs the information.

  If not, the CPU 130 (feature degree calculating unit 130j) calculates the characteristic degree of each log based on the calculated rarity degrees. The calculated feature value of each log is sent to the output unit 110b, and the CPU 130 instructs the output unit 110b to output the feature value. The output unit 110b outputs the feature level of each log. Note that the CPU 130 (feature degree calculation unit 130j) can also calculate the characteristic degree of each conversion log based on the calculated occurrence probability of each event.

  According to such a log analysis program according to the present embodiment, in addition to the target program description and the event generation order (target program description execution order), the occurrence probability is considered in consideration of the reference to the memory area at the time of the event Since the log features can be extracted based on the occurrence probability and the rarity, even if the log features cannot be extracted even if the target program description and the occurrence order are taken into consideration, A log analysis device and a log analysis method that have the effect of being able to extract log features can be easily realized by a general-purpose computer. The log analysis programs 1 and 2 described above have been described as separate configurations, but may be realized as a single program.

  The log analysis program can be recorded on a recording medium. Examples of the recording medium include a flexible disk 400, a compact disk 500, an IC chip 600, and a cassette tape 700 as shown in FIG. According to the recording medium in which such a log analysis program is recorded, the log analysis program can be easily stored, transported, sold, and the like.

  Note that the configuration illustrated in the embodiment of the present invention is an example, and is not intended to exclude other configurations, and a part of the illustrated configuration may be replaced with another or one of the illustrated configurations. Other configurations obtained by omitting a part, adding another function or element to the illustrated configuration, or combining them are also possible. Also, another configuration that is logically equivalent to the exemplified configuration, another configuration that includes a portion that is logically equivalent to the exemplified configuration, another configuration that is logically equivalent to the main part of the illustrated configuration, and the like are possible. is there. Further, another configuration that achieves the same or similar purpose as the illustrated configuration, another configuration that achieves the same or similar effect as the illustrated configuration, and the like are possible. In addition, various variations of various components illustrated in the embodiment of the present invention can be implemented in appropriate combination.

  Further, the embodiment of the present invention is an invention of an invention as an individual device, an invention of two or more related devices, an invention of the entire system, an invention of components within an individual device, or a method corresponding thereto. The invention includes inventions according to various viewpoints, stages, concepts, or categories. Therefore, the present invention can be extracted from the contents disclosed in the embodiments of the present invention without being limited to the exemplified configuration.

It is a figure for demonstrating the 1st concept of this invention. It is a figure for demonstrating the 2nd concept of this invention. 1 is a diagram illustrating a configuration of a log analysis apparatus according to a first embodiment. FIG. 3 is a flowchart for explaining a log analysis method according to the first embodiment. FIG. 3 is a flowchart for explaining a log analysis method according to the first embodiment. 3 is an example of a target program for explaining a log analysis method according to the first embodiment; 3 is a diagram illustrating an example of a plurality of logs generated by a log generation unit according to Embodiment 1. FIG. 6 is a diagram illustrating an example of a plurality of conversion logs converted by a log conversion unit according to the first embodiment. FIG. 6 is a diagram illustrating an example of a plurality of conversion logs converted by a log conversion unit according to the first embodiment. FIG. It is a figure which shows the generation | occurrence | production probability calculated by the event generation | occurrence | production probability calculation part which is Embodiment 1 matched with an occurrence order and an event. It is a figure which shows the generation | occurrence | production probability calculated by the event generation | occurrence | production probability calculation part which is Embodiment 1 matched with an occurrence order and an event. It is a figure which shows the rare degree calculated by the rare degree calculation part which is Embodiment 1 in association with an occurrence order and a conversion log. It is a figure which shows the rare degree calculated by the rare degree calculation part which is Embodiment 1 in association with an occurrence order and a conversion log. It is a figure which shows the recording content of each log to which classification information was given by the data value classification | category part which is Embodiment 1. FIG. It is a figure which shows the generation | occurrence | production probability calculated by the event generation | occurrence | production probability calculation part which is Embodiment 1 matched with an occurrence order and an event. It is a figure which shows the rare degree calculated by the rare degree calculation part which is Embodiment 1 in association with an occurrence order and a log. FIG. 11 is a supplementary diagram for explaining a calculation process of a feature degree calculation unit according to the second modification of the first embodiment. FIG. 11 is a supplementary diagram for explaining a calculation process of a feature degree calculation unit according to the second modification of the first embodiment. FIG. 6 is a diagram illustrating a configuration of a log analysis apparatus according to a second embodiment. FIG. 10 is a flowchart for explaining a log analysis method according to the second embodiment. 12 is an example of a target program for explaining a log analysis method according to the second embodiment. It is a figure which shows the recorded content of the log obtained as a result of performing the target program used by description of the log analysis method of Embodiment 2. FIG. It is a figure which shows the some classification log produced | generated by the classification log production | generation part of Embodiment 2. FIG. It is a figure which shows the some conversion log obtained by the log conversion part of Embodiment 2. FIG. It is a figure which shows the generation | occurrence | production probability calculated by the event generation probability calculation part which is Embodiment 2 matched with an occurrence order and an event. It is a figure which shows the rare degree calculated by the rare degree calculation part which is Embodiment 2 in association with an occurrence order and a conversion log. It is a figure which shows the characteristic degree of each conversion log calculated by the characteristic degree calculation part of Embodiment 2. FIG. FIG. 10 is a supplementary diagram for explaining calculation processing by a feature degree calculation unit according to the second embodiment. 12 is an example of a target program for explaining a log analysis method according to application example 1 of the second embodiment. It is a figure which shows the recorded content of the log obtained as a result of performing the target program used by description of the log analysis method of the application example 1 of Embodiment 2. FIG. FIG. 10 is a diagram illustrating a plurality of classification logs generated by a classification log generation unit according to the application example 1 of the second embodiment. FIG. 10 is a diagram illustrating a plurality of classification logs generated by a classification log generation unit according to the application example 1 of the second embodiment. FIG. 10 is a diagram showing a plurality of classification logs generated by a classification log generation unit of application example 2 of the second embodiment. FIG. 10 is a diagram showing a plurality of classification logs generated by a classification log generation unit of application example 2 of the second embodiment. 2 is a diagram illustrating a configuration of a computer in which a log analysis program according to Embodiments 1 and 2 is installed. FIG. 6 is a diagram showing a recording medium storing a log analysis program according to Embodiments 1 and 2. FIG.

Explanation of symbols

  1a, 3a Target program, 2a, 2b, 4a, 4b, 4c Event, 5 log, 6 Event sequence, 10, 110a Input unit, 11, 130g Log generation unit, 12, 130a Event sequence generation unit, 13, 130b Log conversion 14, 130c Event occurrence probability calculation unit, 15, 130d Rareness calculation unit, 16, 130e Rareness determination unit, 17, 110b Output unit, 18, 130i Data value classification unit, 19, 130j Feature degree calculation unit, 20 , 110c area specification unit, 21, 130f log classification unit, 22, 130h classification log generation unit, 100 hard disk, 100a, 100b log analysis program, 110 input / output unit, 120 memory, 130 CPU, 140 bus, 400 flexible disk, 500 Compact disc, 600 IC chip 700 cassette tape

Claims (8)

A log analysis method for analyzing a recorded log of a series of events generated by execution of a program according to the occurrence order of the events,
A designation step for designating a memory area that can be referred to when executing the program description relating to the event;
Classifying each event of the series of events based on a reference process for a specified memory area;
Generating a plurality of classified logs in which the classified events are recorded in accordance with the occurrence order of the events for each memory area with reference processing;
Generating an event sequence in which the events are recorded according to the order of occurrence based on the events constituting each of the generated plurality of classification logs;
Comparing the events of the event sequence with the events constituting each of the plurality of classification logs and converting the plurality of classification logs into a plurality of conversion logs based on the comparison results;
Calculating an occurrence probability of the event for each occurrence order based on a description of a program related to an event in the event sequence;
A rarity calculation step for calculating a rarity indicating a low occurrence frequency based on the calculated occurrence probability;
And a step of outputting information on an event that is characteristic of each conversion log of the plurality of logs based on the calculated rarity.   2. The log analysis method according to claim 1, wherein the designation in the designation step is for a memory area referred to when executing a predetermined program description relating to an event.   2. The log analysis method according to claim 1, wherein the designation in the designation step is for a plurality of memory areas having a common area size. The feature degree for calculating the feature degree of the conversion log indicating the feature of the conversion log in the plurality of conversion logs based on the rarity degree in all the occurrence orders calculated by the rare degree calculation step. A calculation step;
The log analysis according to any one of claims 1 to 3, further comprising a step of outputting a characteristic degree of each of the plurality of conversion logs calculated by the characteristic degree calculating step. Method. A log analysis program for analyzing a recorded log of a series of events generated by the execution of the program according to the occurrence order of the events,
A designation step for designating a memory area that can be referred to when executing the program description relating to the event;
Classifying each event of the series of events based on a reference process for a specified memory area;
Generating a plurality of classified logs in which the classified events are recorded in accordance with the occurrence order of the events for each memory area with reference processing;
Generating an event sequence in which the events are recorded according to the order of occurrence based on the events constituting each of the generated plurality of classification logs;
Comparing the events in the event sequence with the events constituting each of the plurality of classification logs, and converting the plurality of classification logs into a plurality of conversion logs based on the comparison results;
Calculating an occurrence probability of the event for each occurrence order based on a description of a program related to an event in the event sequence;
A rarity calculation step for calculating a rarity indicating a low occurrence frequency based on the calculated occurrence probability;
A log analysis program for executing a process including a step of outputting information on an event that is a characteristic of each conversion log of the plurality of logs based on the calculated rarity.   6. The log analysis program according to claim 5, wherein the designation in the designation step is for a memory area that is referred to when a predetermined program description relating to an event is executed. 6. The log analysis program according to claim 5, wherein the designation in the designation step is for a plurality of memory areas having a common area size. The feature degree for calculating the feature degree of the conversion log indicating the feature of the conversion log in the plurality of conversion logs based on the rarity degree in all the occurrence orders calculated by the rare degree calculation step. A calculation step;
The log according to any one of claims 5 to 7, for executing a process including a step of outputting a characteristic degree of each of the plurality of conversion logs calculated by the characteristic degree calculating step. Analysis program.

Images