JP2006201890A - Device for taking countermeasures against program abnormality - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a device for taking countermeasures against program abnormality for easily monitoring the status of various programs installed in each computer terminal, and for executing measure processing corresponding to circumstances. <P>SOLUTION: A log file monitoring part 101 of a system 100 for taking countermeasures against program abnormality reads a log file to be outputted by a client program to be monitored, and detects the addition of a new log. A log pattern comparing part 102 compares the new log detected by the log file monitoring part 101 with the monitor object log stored in a measures database 104, and determines abnormality. A measure executing part 103 executes measure processing according to a measure procedure prestored in the measure database 104 in response to the comparison result of the log pattern comparing part 102, and outputs a measure result file 110. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a program that detects an abnormal operation by referring to a log output by a program and dynamically takes measures.

Conventionally, as a configuration for detecting an illegal operation / failure of a program or the like, a state monitoring means for monitoring the state of software, hardware and network of the client terminal on a client terminal connected to the center server via a network And a means for comparing the output log of the state monitoring means with the failure pattern stored in the failure pattern database and notifying the center server of a warning when the failure pattern matches, becomes known. (For example, refer to Patent Document 1).
JP 2004-013411 A

However, in the configuration described in Patent Document 1, it is necessary to incorporate in advance state monitoring means for monitoring the software, hardware, and network state of the client terminal, but the software provided in each client terminal is constant. Therefore, it is not always easy to prepare state monitoring means corresponding to each software. In particular, when new software is added, it is difficult to make the state monitoring means correspond.
In addition, when an unauthorized operation or failure is detected, only a process for notifying the center server of a warning is performed, so that a predetermined response is taken after the center server administrator confirms the notified warning content. For this reason, it is not always possible to take a quick response, and further, if a warning cannot be sent to the center server due to a network failure or the like, the response cannot be taken.

  The present invention is for solving the above-described problems, and makes it possible to easily monitor the status of various programs provided in each computer terminal and to execute countermeasure processing according to the situation. An object is to provide a program abnormality countermeasure device.

  In order to solve the above problems, the present invention provides a log output destination of the program, together with a countermeasure information storage unit that stores a log pattern corresponding to an error log and a countermeasure procedure corresponding to the log pattern for each program in advance. Log file monitoring means for monitoring the update of the log file, and when the log file monitoring means detects an update of the log file, the update portion of the log file is acquired and stored in the countermeasure information storage unit Log pattern comparison means for comparing with a log pattern, and countermeasure execution means for sequentially executing countermeasure procedures corresponding to the log pattern from the countermeasure information storage section when the updated part matches the log pattern as a result of comparison; It is characterized by providing.

With the above configuration, in the present invention, the log file that is the output destination of the log of each program is monitored for detection of abnormal operation and the like, so that status monitoring corresponding to various programs provided in each computer terminal Without providing any means, it is possible to detect an abnormal operation or the like simply by specifying a log file as a log output destination. Therefore, it is possible to easily cope with addition of a new program or the like.
In addition, since the countermeasure processing is executed in accordance with the countermeasure procedure defined in advance associated with each log pattern, it is possible to deal with an abnormal operation or the like for which the countermeasure procedure is defined without notifying the administrator. It becomes possible to do.

Hereinafter, a program abnormality countermeasure system according to an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a schematic configuration of a program abnormality countermeasure system according to the present embodiment.
The program abnormality countermeasure system 100 includes a processing unit such as a log file monitoring unit 101, a log pattern comparison unit 102, and a countermeasure execution unit 103, and a countermeasure database 104 defined in advance by an administrator or the like.
The log file monitoring unit 101 reads a log file output by a program to be monitored and detects the addition of a new log.
The log pattern comparison unit 102 compares the new log detected by the log file monitoring unit 101 with the monitoring target log stored in the countermeasure database 104 and performs abnormality determination.
The countermeasure execution unit 103 executes the countermeasure process according to the countermeasure procedure stored in advance in the countermeasure database 104 according to the comparison result of the log pattern comparison unit 102 and outputs the countermeasure result file 110.

FIG. 2 is a block diagram showing a schematic configuration of the countermeasure database 104.
In the present embodiment, the countermeasure database 104 includes a monitoring target management table 201 and a countermeasure procedure table 202.
The monitoring target management table 201 stores program identification information, a log file to be monitored, and new log identification information for a program to be monitored.
The countermeasure procedure table 202 stores a log pattern for abnormality determination and a countermeasure procedure corresponding to each log pattern for each program to be monitored.

FIG. 3 is a diagram illustrating an example of the data structure of the monitoring target management table 201.
The monitoring target management table 201 determines, for example, whether a program ID 301 and a monitoring target program name 302 that uniquely identify a program to be monitored, a log file name 303 indicating a log file to be monitored, and a new log. Each data item with the last read position 304.
Based on the information stored in the monitoring target management table 201, the log file monitoring unit 101 monitors the log file of each program and detects a new log. In this case, the final read position 304 of the monitoring target management table 201 is compared with the end position in the log file, and if the end position is different, it is determined that a new log has been output.
By registering information about a plurality of programs in the monitoring target management table 201, the program abnormality countermeasure system 100 can monitor a plurality of programs.

FIG. 4 is a diagram illustrating an example of the data structure of the countermeasure procedure table 202.
The countermeasure procedure table 202 is prepared in advance for each monitored program, and includes a program ID 401, a log character string 402 and a conditional expression 403 as a log pattern for performing abnormality determination, a countermeasure procedure 404, and a countermeasure ID 405. Each data item.
A log character string 402 indicates a pattern of an operation log output by a program to be monitored, and a variable character portion in the operation log is designated by a special character such as “% 1”. Conditional expression 403 indicates a character string corresponding to a variable character portion in the action log, and indicates a selection condition when there are a plurality of countermeasure procedures for one action log.
The countermeasure procedure 404 shows the contents of the countermeasure process corresponding to each operation log pattern. Here, the contents shown in the countermeasure procedure include, for example, processing such as changing the communication port and performing transmission / reception again when a communication failure occurs in the communication program. Further, in the case of a log that does not correspond to a specific conditional expression, it is defined as default processing that the program is forcibly terminated and an e-mail is transmitted to the administrator terminal.
The countermeasure ID 405 is used to uniquely identify each countermeasure procedure for each program, and is included in the information output to the countermeasure result file 110.

FIG. 5 is a block diagram illustrating a schematic configuration of a client terminal including the program abnormality countermeasure system 100 according to the present embodiment.
The client terminal 500 includes a plurality of monitoring target programs 501,..., And each monitoring target program 501 outputs a new log to each log file 502,.
The log file monitoring unit 101 of the program abnormality countermeasure system 100 monitors each log file 502 and detects a new log. The log pattern comparison unit 102 compares the new log with the log pattern defined in the countermeasure database 104 to detect an operation abnormality. The countermeasure execution unit 103 performs a defined countermeasure execution process corresponding to the log pattern.

FIG. 6 is a flowchart showing an abnormality countermeasure processing procedure performed by the program abnormality countermeasure system 100.
The log file monitoring unit 101 of the program abnormality countermeasure system 100 refers to each log file 502 based on the log file name 303 of the monitoring target management table 201.
The end position in the referenced log file 502 is compared with the final reading position 304 of the monitoring target management table 201 (step 602). If they match, the log file 502 is again waited for a predetermined time (step 603). (Step 601).
On the other hand, if the end position and the final reading position 304 do not match, one record of the operation log is read from the final reading position 304 as a new log (step 604), and the final reading position 304 of the monitoring target management table 201 is updated. (Step 605).
The log file monitoring unit 101 notifies the log pattern comparison unit 102 of the read operation log and monitoring target program name, and continues monitoring the log file.
The log pattern comparison unit 102 acquires the countermeasure procedure table 202 based on the program ID 301 of the monitoring target program 501 corresponding to the referenced log file 502 (step 606). Referring to the acquired countermeasure procedure table 202, the action log read by the file monitoring unit 101 and the log character string 402 are sequentially compared to identify the corresponding countermeasure procedure 404 (step 607). Here, when the conditional expression 403 is set, the variable character part included in the log character string 402 is evaluated and the corresponding countermeasure procedure 404 is specified.
The countermeasure execution unit 103 executes the countermeasure according to the contents described in the identified countermeasure procedure 404 (step 608).
Here, when a failure occurs during the countermeasure execution process, the occurrence of the failure is notified to the system administrator or the like by e-mail or the like (step 609).
After the countermeasure processing, the countermeasure execution unit 103 outputs the countermeasure time, the monitoring target program name, the countermeasure ID, and the countermeasure result to the countermeasure result file 110 and ends the process (step 610).

FIG. 7 is a diagram illustrating an example of a data structure of the countermeasure result file 110 output from the countermeasure execution unit 103.
The countermeasure result file 110 includes a countermeasure time, a monitoring target program name, a countermeasure ID, and a countermeasure result.
The countermeasure result includes a simple display of the contents of the countermeasure process together with the result of either success (OK) or failure occurrence (NG) of the countermeasure process.

As described above, in the program abnormality countermeasure device according to the present embodiment, the log file that is the output destination of the log of each program is monitored in order to detect an operation abnormality or the like. Without providing state monitoring means corresponding to various programs, it is possible to detect an abnormal operation or the like simply by specifying a log file as a log output destination. Therefore, it is possible to easily cope with addition of a new program or the like.
In addition, since the countermeasure processing is executed in accordance with the countermeasure procedure defined in advance associated with each log pattern, it is possible to deal with an abnormal operation or the like for which the countermeasure procedure is defined without notifying the administrator. It becomes possible to do.

Note that the present invention is not limited to the configuration shown in the above embodiment, and the configuration of each processing unit, the data structure of the database, and the like may be changed as long as similar processing is possible.
The countermeasure result file output by the countermeasure execution unit may include other information. For example, when default processing (program forced termination and warning notification) is performed as countermeasure processing, even if only the countermeasure ID is output, the specific log is unclear. It is also possible to include the newly created log in the countermeasure result file.

It is a block diagram which shows schematic structure of the program abnormality countermeasure system which concerns on one embodiment of this invention. It is a block diagram which shows schematic structure of a countermeasure database. It is a figure which shows an example of the data structure of a monitoring object management table. It is a figure which shows an example of the data structure of a countermeasure procedure table. It is a conceptual diagram which shows the flow of a process in the client terminal provided with the program abnormality countermeasure system. It is a flowchart which shows the abnormality countermeasure processing procedure which a program abnormality countermeasure system performs. It is a figure which shows an example of the countermeasure result file which a program abnormality countermeasure system outputs.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Program abnormality countermeasure system 101 Log file monitoring part 102 Log pattern comparison part 103 Countermeasure execution part 104 Countermeasure database 110 Countermeasure result file 201 Monitoring object management table 202 Countermeasure procedure table

Claims (1)

Along with a countermeasure information storage unit that stores a log pattern corresponding to an error log and a countermeasure procedure corresponding to the log pattern for each program in advance,
Log file monitoring means for monitoring update of a log file as a log output destination of the program;
When the log file monitoring unit detects an update of the log file, a log pattern comparison unit that acquires an updated part of the log file and compares it with a log pattern stored in the countermeasure information storage unit;
When the updated part matches the log pattern as a result of comparison, the program abnormality countermeasure device comprises countermeasure execution means for sequentially executing countermeasure procedures corresponding to the log pattern from the countermeasure information storage unit .

Images