JP2005284520A - Method, program, program recording medium, apparatus and system for log collection - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To facilitate collection and analysis of a log in the event of a fault in a system having computers distributed in a plurality of countries and time zones. <P>SOLUTION: A log collector 1 receives a log from a log collection target unit 2N in which the fault has occurred. The log collector refers to a relating node definition file group 14, and requests other log collection target units belonging to the identical group to the log collection target unit of interest to transfer a log. Thus, the logs of the other log collection target units are automatically collected. Each log collection target unit transmits to the log collector time of the log collection target unit, time zone information and locale information simultaneously with the log transfer. The log collector preserves a difference between the time of the log collector and the time of the log collection target unit, the received time zone information and locale information, together with the collected log file, into a log file group 13M of a group M. When referring to the collected logs, the log collector performs time correction and language correction by referring to the log file group of the group M. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  In the present invention, in order to improve reliability and load distribution, a system (cluster system) that plays a role in a plurality of computers and a plurality of computers constituting the system are distributed in a plurality of languages and a plurality of time zones. In particular, the present invention relates to a failure information management system that supports collecting and analyzing a log when a failure occurs.

  A business system is composed of several computers specialized for a certain function, such as a file server and a printer server, even if it is a small system. And hundreds of computers. When a failure occurs in any one of these computers, it is inefficient to collect the log in each computer. Therefore, the efficiency of failure analysis is usually achieved by using a means for collecting logs via a network.

In order to improve the efficiency of log collection and analysis, Japanese Patent Laid-Open No. 2003-216457 (Patent Document 1) discloses a method of organizing collected error logs in a time series and outputting a possible cause of failure from a report as a report. Has been. Japanese Patent Laid-Open No. 2001-282671 (Patent Document 2) discloses a method of collecting appropriate failure information when a failure occurs by distributing an application that collects failure information according to the failure content to a computer in which a failure has occurred. It is disclosed.
JP 2003-216457 A JP 2001-282671 A Japanese Patent Laid-Open No. 2003-132019

  In recent years, computer systems communicate between departments and companies via WAN (Wide Area Network) and LAN (Local Area Network), duplex systems and dual systems (cluster) for the purpose of improving reliability and load distribution. System). Therefore, in failure analysis, not only failure information of a certain computer is analyzed, but there are many cases where logs of computers connected via a network and computers constituting a cluster system are required at the same time. Also, in recent years, with the expansion of infrastructure such as the expansion of network line transmission capacity, companies that operate in multiple countries have computers installed in multiple countries and multiple time zones via the network. May have been.

  In the computer system as described above, when conventional techniques such as the inventions described in Patent Document 1 and Patent Document 2 are used, the following problems occur.

  First, in the conventional log collection method, the computer logs related to the computer in which the failure has occurred cannot be collected at the same time as the time at which the failure has occurred.

  This is because the conventional log collection method does not consider a method of reliably collecting logs at the same time in a system that realizes one function with a plurality of computers like a cluster system.

  For example, in the invention described in Japanese Patent Laid-Open No. 2003-132019 (Patent Document 3), after collecting a log of a computer in which a failure has occurred, the contents of the log are analyzed by a program or an operator, and another computer is used as necessary A method for collecting the logs is disclosed. In some cases, valid information cannot be collected unless the log is overwritten or collected as soon as possible when a failure occurs. May not be collected immediately when a failure occurs, that is, a valid log may not be collected.

  Secondly, when analyzing failures of computers distributed in a plurality of countries and a plurality of time zones, it is difficult to organize garbled characters and trace logs in a time series.

  This is because the conventional log collection method does not consider collective management of computer logs distributed in a plurality of countries and a plurality of time zones.

  An object of the present invention is to provide a method for facilitating the collection and analysis of logs when a failure occurs in a computer system comprising a plurality of computers distributed in a plurality of countries and a plurality of time zones.

  In order to achieve the above object, according to the present invention, when a failure occurs in the log collection device, the log collection unit of the log collection device first receives a log from the log transfer unit of the log collection device. Next, the log collection unit of the log collection device refers to the related node definition file group, and transfers the log to the log transfer unit of another log collection device belonging to the same group as the log collection device in which the failure occurred. A request is made, and the logs of other log-collected devices associated with the log-collected device in which a failure has occurred are automatically collected.

  Further, the log transfer unit of the log collection device transmits the time, time zone information, and locale information of the log collection device to the log collection unit of the log collection device simultaneously with the log transfer. The log collection unit of the log collection device stores the difference between the time of the log collection device and the time of the log collection device, the received time zone information, and locale information in the log file group of the group M together with the collected log files. When referring to the collected logs, the log reference unit of the log collection device performs time correction and language correction by referring to the group M log file group.

  As described above, according to the present invention, the following effects can be obtained.

  First, it is possible to automatically select and collect computer logs related to the computer in which the failure has occurred. If a failure occurs in one of the computers that make up the cluster system, all the logs of other computers that make up the cluster system can be automatically collected, reducing the work of the maintenance personnel.

  Second, a computer that refers to a log (log collection) even if it is a log of computers distributed in different time zones or a log of a plurality of computers having the same time zone but different time between computers. Since the time is corrected with respect to the time on the device), the log can be arranged in time series without being influenced by the time difference. Thereby, the time for failure analysis can be shortened.

  Thirdly, even computer logs distributed in a plurality of time zones can correct garbled characters due to differences in languages recorded in the logs. As a result, it is possible to improve maintainability and shorten the time for failure analysis.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

  Referring to FIG. 1, a log collection system according to an embodiment of the present invention operates a business application, and outputs a trace log and a plurality of log collection apparatuses 2N (N = 1) that output a log for failure analysis when a failure occurs. 2,..., And a log collection device 1 that collects and manages logs output from the log collection device 2N (N = 1, 2,...), The log collection device 1, and the log collection device 2N (N = 1, 2,...) Is connected.

  The log collection device 1 includes a log reference unit 11 that corrects the display of the time and language of the collected logs, and a log collection unit 12 that collects logs from the log collection device 2N (N = 1, 2,...). The log file group of the group M that stores the logs of the log collection devices 2N (N = 1, 2,...) Belonging to the group M (M = 1, 2,...) Collected by the log collection unit 12. 13M (M = 1, 2,...) And a related node definition file group 14 that defines a group M (M = 1, 2,...).

  The log collection device 2N (N = 1, 2,...) Is a log file 2N2 (N = 1, 2,...) Including a trace log output by a business application and a failure information log output when a failure occurs. And a log transfer unit 2N1 (N = 1, 2,...) For transferring the log file to the log collection device 1.

  Referring to FIG. 2, details of the log file group 13M (M = 1, 2,...) Of the group M are shown. The log file group 13M (M = 1, 2,...) Of the group M has a log collection device 2N (N = 1, 2,...) Belonging to the group M (M = 1, 2,...). ) And the time difference table 13M1 (M = 1, 2,...) For recording the difference between the time of the log collection device 1 and the log collection belonging to the group M (M = 1, 2,...). A time zone table 13M2 (M = 1, 2,...) For recording time zone information of the device 2N (N = 1, 2,...) And a group M (M = 1, 2,...) A locale table 13M3 (M = 1, 2,...) For recording locale information of log collection devices 2N (N = 1, 2,...) Belonging to the group M (M = 1, 2,. ..) log file 2N2 (N = 1, 2,...) Of the log collection device 2N (N = 1, 2,...) Belonging to Log file 13M4 (M = 1,2, ···) that was collected, including the. Here, the time zone information is time change information specific to the region where the log collection device 2N (N = 1, 2,...) Is installed, such as daylight saving time. The locale information is language information used in the log collection device 2N (N = 1, 2,...).

  Referring to FIG. 3, details of the related node definition file group 14 are shown. The related node definition file group 14 includes a table 14M (M = 1, 2,...) For grouping the log collection devices 2N (N = 1, 2,...) Constituting the cluster (group). Yes. For example, the log collection devices 21, 23, and 29 are grouped in the group 1. When a failure is detected in any one of the log collection devices 21, 23, and 29, the log collection device 1 collects logs from all of the log collection devices 21, 23, and 29.

  Next, when the log collection device 1 detects a failure from one of the grouped log collection devices 2N (N = 1, 2,...), All the grouped log collection devices are grouped. The operation of collecting logs from 2N (N = 1, 2,...) Will be described with reference to FIGS.

  For load distribution, it is assumed that a Web server group composed of a plurality of computers is composed of, for example, a log collection device 21, a log collection device 23, and a log collection device 29. In the table 141 of the related node definition file group 14, 21, 23, and 29 are registered in advance. When a failure occurs in the log collection device 21, the log collection device 21 outputs a failure log, and the log transfer unit 211 transfers the trace log and the failure log to the log collection device 1. The log collection device 1 stores the log of the log collection device 21 and, at the same time, refers to the related node definition file group 14 and searches for a node (log collection device) associated with the log collection device 21. . Since the log collection device 23 and the log collection device 29 associated with the log collection device 21 exist in the table 141, the log collection instruction is issued to the log collection device 23 and the log collection device 29. In response to this, the log transfer unit 231 and the log transfer unit 291 transfer the trace log to the log collection device 1.

  Next, regarding the log collected by the log collection device 1 from the log collection device 2N (N = 1, 2,...), Refer to the log file group (M = 1, 2,...) Of the group M. An operation for correcting the log will be described with reference to FIGS.

  For example, it is assumed that the log collection device 22 and the log collection device 25 are installed in remote places with different languages and time zones and are communicating with each other. In the table 142 of the related node definition file group 14, 22 and 25 are registered in advance. Here, when a failure occurs in the log collection device 22, the log collection device 22 outputs a failure log, and the log transfer unit 221 causes the log collection device 1 to send a trace log and a failure log to the log collection device 1. 22 times, time zone information, and locale information are transferred together.

  First, the log collection device 1 stores the difference between the transferred time of the log collection device 22 and the time of the log collection device 1 in the time difference table 1321 of the log file group 132 of the group 2. For example, there is a difference of 6 hours in the standard time between the area where the log collection device 1 is installed and the area where the log collection device 22 is installed, and the system time of the log collection device 1 and the log collection device 22 is 3 When there is a difference of minutes, the time difference between the log collection device 1 and the log collection device 22 is 6 hours and 3 minutes.

  Further, the time zone information, locale information, and log file of the log collection device 22 are stored in the time zone table 1322, the locale table 1323, and the log file 1324 of the log file group 132 of the group 2, respectively.

  Next, the log collection device 1 refers to the table of the related node definition file group 14 and searches for a node (log collection device) associated with the log collection device 22. Since the log collection device 25 associated with the log collection device 22 exists in the table 142, the log transfer unit 251 issues a log collection instruction to the log collection device 25, and the log transfer unit 251 that receives the instruction collects the trace log. Transfer to the log collection device 1. Thereafter, the same processing (time difference, time zone information, locale information, and log file storage) as in the case of the log collection device 22 is performed.

  When referring to the log collected by the log collection device 1, first, the log reference unit 11 uses a time difference table 13M1 and a time zone table 13M2 (in this case, M = 2) as shown in FIG. The time in the master log file 41 is corrected to the system time of the log collection device 1. To cite the example of the log collection device 22 described above, the time difference table 1321 stores 6 hours and 3 minutes, so the time of the master log file 41 in FIG. 4 is shifted by 6 hours and 3 minutes. Next, using the time zone table 1322, if there is an area-specific time change such as daylight saving time in the area where the log collection device 22 is installed, the time is corrected. For example, in the area where the log collection device 22 is set, when daylight saving time is introduced and there is a difference of one hour, another one hour, a total of seven hours and three minutes is corrected with respect to the time of the master log file 41, A log file 42 after time correction is generated.

  Next, as illustrated in FIG. 5, the log reference unit 11 corrects the characters of the time-corrected log file 42 using the locale table 1323. When the locale used in the log collection device 1 and the locale used in the log collection device 22 are different, the character string used in the time-corrected log file 42 is converted to Unicode using the locale information. The language-corrected log file 43 is generated and can be displayed in the characters used in the log collection device 22.

  The log collection device 1 records a program for realizing its function on a computer-readable recording medium in addition to being realized by dedicated hardware, and the program recorded on the recording medium is It may be realized by being read and executed by a computer to be the log collection device 1. The computer-readable recording medium refers to a recording medium such as a floppy disk, a magneto-optical disk, a CD-ROM, or a storage device such as a hard disk device built in a computer system. Furthermore, a computer-readable recording medium is a medium that dynamically holds a program (transmission medium or transmission wave) in a short time, as in the case of transmitting a program via the Internet. Such as a volatile memory, which holds a program for a certain period of time.

It is the figure which showed the structure of the log collection system of one Embodiment of this invention. 6 is a diagram showing details of a log file group of group M. FIG. It is the figure which showed the detail of the related node definition file group. It is a figure showing time correction of a master log file. It is the figure which showed the language correction of the log file after time correction.

Explanation of symbols

1 Log Collection Device 11 Log Reference Unit 12 Log Collection Unit 13M Group M Log File Group
13M1 time difference table
13M2 time zone table
13M3 locale table
13M4 log file 14 Related node definition file group
14M Table 2N Logged Device 2N1 Log Transfer Unit 2N2 Log File 3 Network 41 Master Log File 42 Time Corrected Log File 43 Language Corrected Log File

Claims (9)

Log collection performed by a log collection device that collects logs related to the occurrence of a failure from the plurality of computers via the network when a failure occurs in a computer system configured by a plurality of computers interconnected by a network A method,
A first step of registering the identifiers of the plurality of computers constituting the computer system in association with each other;
Upon receipt of an identifier indicating a failed computer and a log indicating the occurrence of a failure transmitted by the failed computer, all computers having an identifier associated with the failed computer identifier are A log collection method comprising a second step of requesting transmission of a log held by the computer. In the second step, the log collection device causes the computer to further transmit a system time of the computer and time zone information of the computer in addition to the computer log,
The log collection device further includes a third step of correcting the time included in the log of the computer to the system time of the log collection device based on the system time of the computer and the time zone information of the computer. The log collection method according to claim 1. In the second step, the log collection device causes the computer to further transmit locale information of the computer in addition to the computer log,
The log collection method according to claim 1, wherein the log collection device further includes a fourth step of Unicode conversion of the computer log based on locale information of the computer.   The program which makes the computer which should become the said log collection apparatus perform each step of any one of Claim 1 to 3.   A computer-readable recording medium on which a program for causing a computer to be the log collecting apparatus to execute each step according to claim 1 is recorded. A log collection device for collecting logs related to the occurrence of a failure from the plurality of computers via the network when a failure occurs in a computer system configured by a plurality of computers connected to each other via a network,
First means for previously registering identifiers of the plurality of computers constituting the computer system in association with each other;
Upon receipt of an identifier indicating a failed computer and a log indicating the occurrence of a failure transmitted by the failed computer, all computers having an identifier associated with the failed computer identifier are A log collection device having second means for requesting transmission of a log held by the computer. The second means further includes means for causing the computer to further transmit a system time of the computer and time zone information of the computer in addition to the log of the computer,
The system according to claim 6, further comprising third means for correcting the time included in the log of the computer to the system time of the log collection device based on the system time of the computer and the time zone information of the computer. Log collector. The second means further includes means for causing the computer to further transmit locale information of the computer in addition to the computer log,
The log collection device according to claim 6 or 7, further comprising a fourth means for Unicode-converting the computer log based on locale information of the computer. A plurality of computers connected to each other by a network, which form a computer system;
The log having the log collection device according to any one of claims 6 to 8, wherein when a failure occurs in the computer system, a log related to the failure occurrence is collected from the plurality of computers via the network. Collection system.

Images