JP2009009448A - Data transmission device, data transmission method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To achieve common formats of log messages by performing format conversion of log messages for a plurality of kinds of formats by adding a mechanism to an existing system. <P>SOLUTION: In each node 100 to be monitored, respective programs 104 to be monitored output log files 105 different in date-and-time formats, and a log file change monitoring part 109 uses contents of date-and-time format information stored in a date-and-time format definition storage part 110 to convert date-and-time formats of respective log files 105 so that date-and-time formats of all log files coincide with a reference format, and the log file change monitoring part 109 generates a log file 111 for monitoring which comprises log files having the common date-and-time format, and a log monitoring agent 106 transfers log messages in the log file 111 for monitoring to a log monitoring manager 107 on an operation monitoring server 101. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention, in a system composed of a node device that transmits data such as log messages and a server device that collects data transmitted from the node device, performs format conversion on data of a plurality of types of formats, The present invention relates to a technique for sharing a data format.

In the conventional log integrated monitoring system, means for unifying log messages of different formats depending on the OS (Operating System) of the computer and the application program used has been proposed by converting the log format.
For example, Patent Document 1 proposes a method in which after a log is transferred from a node device to an operation management server device (log monitor), logs having different formats are unified into a predetermined format on the operation management server device side.
Further, in Patent Document 2, a method of receiving normalized log data which is log data normalized according to a common data format defined in advance and has a log output corrected based on a reference time of a manager Has been proposed.
JP, 2003-99295, A page 5, page 7, FIG. 1, FIG. 2, FIG. JP-A-2002-366394, pages 2 to 3, FIGS. 1 and 2

In the conventional log processing method (Patent Document 1), since the log format is converted on the operation management server (log monitor) side, either the log file for which the date and time are not output, either date or time It is not possible to deal with logs that are only output, and when there is an ambiguous description in the date specification in the log.
In the conventional log data collection and management method (Patent Document 2), when a system is constructed using a commercially available operation monitoring tool, the user of the tool cannot change the structure of the agent. Therefore, such a configuration cannot be realistically taken. Even when a commercially available tool is not used, it cannot be realized without changing the structure of the existing operation monitoring system.
Therefore, there is a problem that the configuration as in Patent Document 2 cannot be applied to an operation monitoring system that is currently operating.

  One of the main objects of the present invention is to solve the above-described problems. By adding a mechanism to an existing operation management system, format conversion can be performed on data of a plurality of types of formats. The main purpose is to make the data format common, and more specifically, integrated management by complementing the date and time of events (log messages) on monitored node devices for which the exact date and time cannot be specified The main purpose is to do.

A data transmission apparatus according to the present invention is as follows.
A data transmission device for transmitting data to a data collection device,
A plurality of data output units for outputting data of a plurality of types of data formats;
A data format of data output from the plurality of data output units is converted into a reference data format serving as a reference, and data of a plurality of types of data formats output from the plurality of data output units is respectively converted into a reference data format. A format conversion unit for data;
A data transmission unit configured to transmit data of a reference data format after the format conversion by the format conversion unit to the data collection device.

  According to the present invention, since data conversion is performed on the data transmission device side and data whose format is unified is transmitted to the data collection device, it is not necessary to perform format conversion in the data collection device, and data collection is already in operation. Data in the reference data format can be obtained without changing the configuration of the apparatus.

Embodiment 1 FIG.
FIG. 1 is a system configuration diagram showing a configuration example of a message monitoring system according to Embodiment 1 of the present invention.
In FIG. 1, reference numeral 100 denotes a monitoring target node device group, 101 denotes an operation monitoring server device that monitors the monitoring target node device 100 group, and 102 denotes a monitoring terminal that displays a monitoring status, each connected by a WAN (Wide Area Network) 103. Has been.
Hereinafter, the monitoring target node device 100 is also simply referred to as the monitoring target node 100, and the operation monitoring server device 101 is also simply referred to as the operation monitoring server 101.
The monitoring target node device 100 is an example of a data transmission device, and the operation monitoring server device 101 is an example of a data collection device.

On the monitoring target node 100, there is a monitoring target program 104 group.
The monitoring target program 104 group is an application program or an operating system (OS).
Each of the monitoring target programs 104 outputs an individual log file 105 when an event occurs.
Each log file 105 has a different data format, and in this embodiment, the data format of the date / time data for displaying the date / time of the log (hereinafter referred to as the date / time format) is different.
The monitoring target program 104 group outputs data of a plurality of types of data formats, and is an example of a plurality of data output units.

The log file change monitoring unit 109 is a mechanism for monitoring the log file 105, and uses the contents of the date / time format information stored in the date / time format definition storage unit 110 to set the date / time format of all log files as a standard format. The date and time format of each log file 105 is converted so as to match, and a monitoring log file 111 composed of log files having a common date and time format is generated.
The log file change monitoring unit 109 converts the date format of the group of log files 105 including a plurality of types of date formats into a reference format, and is an example of a format conversion unit.

The date and time format definition storage unit 110 stores date and time format definition information (data format definition information) that defines each of a plurality of types of date and time formats.
The date / time format definition storage unit 110 is an example of a data format definition information storage unit.

Further, the monitoring target node 100 has a log monitoring agent 106 for monitoring the monitoring log file 111, and the log monitoring agent 106 transfers the log message to the log monitoring manager 107 on the operation monitoring server 101 through the WAN 103. To do.
The log monitoring agent 106 transmits the log message after the date / time format has been converted by the log file change monitoring unit 109 from the monitoring log file 111 to the log monitoring manager 107 on the operation monitoring server 101.
The log monitoring agent 106 is an example of a data transmission unit.

  In the operation monitoring server 101, the log monitoring manager 107 stores the log message transferred from the log monitoring agent 106 in the log DB 108.

  The monitoring terminal 102 is a terminal device that is used by a system operation manager to confirm the monitoring state of the information system.

  Next, the operation in the message monitoring system according to the present embodiment will be outlined with a focus on the operation of the monitoring target node device 100, using the flowchart of FIG.

The monitoring target program 104 outputs an individual log file 105 when an event occurs (S101) (data output step).
The log file change monitoring unit 109 monitors the change of the log file 105. If there is a change, the format of the date / time data of the log message is converted based on the contents indicated in the date / time format definition information or the date / time data. Is stored and output to the monitoring log file 111 (S102) (S103) (format conversion step).

Specifically, in the date / time format definition information, the date / time format of each log file 105 is defined as shown in FIG. Reference numeral 200 denotes a name for identifying a log file, and 201 defines a date and time format in each log file.
In the date and time format, YY is the last two digits of the year, YYYY is the fourth digit, MM is the month, DD is the day, hh is the hour, mm is the minute, ss is the second, <TEXT> is the log message body, and <NONE> is Indicates that there is no date / time, and /,:, and space are used as delimiters to identify them.

In the example of FIG. 2, the log file A has a date and time description in the format of YY / MM / DD hh: mm: ss, and the log message body is described after a blank.
The log file B has a date and time description in the format of YYYY / MM / DD hh: mm: ss, and the log message body is described after blank.
The log file C has a time description in the format of hh: mm: ss, and the log message body is described after a blank (date is not entered).
The log file D has no date and time, and only the log message body is described.

Specific log file contents are shown in FIG. 3 as an example of log file A, FIG. 4 as an example of log file B, FIG. 5 as an example of log file C, and FIG.
FIG. 7 shows an example of the monitoring log file 111 in which the date / time format of the log file 105 is converted by the log file change monitoring unit 109 and the date / time format is unified with the reference data format. In the example of FIG. 7, the standard data format of the date / time format is YYYY / MM / DD hh: mm: ss, and the date / time format of all log files is in a state in which it conforms to the standard data format.

  Next, the log monitoring agent 106 transmits the log message of the monitoring log file 111 in which the date and time format is standardized to the reference data format by the log file change monitoring unit 109 to the log monitoring manager 107 of the operation monitoring server 101 ( S104) (data transmission step) In the operation monitoring server 101, the log monitoring manager 107 stores the log message transferred from the log monitoring agent 106 in the log DB 108.

Next, a flowchart showing details of the operation of the log file change monitoring unit 109 is shown in FIG.
The operation of the log file change monitoring unit 109 will be described with reference to FIG.

First, the system administrator defines the date format according to the log file format of the programs A to D as described above (S801). The date and time format definition is stored in the date and time format definition storage unit 110 as date and time format definition information.
Next, the log file change monitoring unit 109 is activated (S802). The activation may be started manually by the system administrator or automatically when the OS is started.
The log file change monitoring unit 109 monitors changes in log files (log files A to D in this embodiment) described in the date / time format definition information. When there is a change in each file, the difference from the previous time is read for the log message of the changed file (S803).
Next, the log file change monitoring unit 109 refers to the date and time format definition corresponding to the log file from which the difference is read (S804), and supplements the date and time by the method of S806 to S809 depending on the type of the log file, and then monitors Log messages are written to the log file 111 (S805 to S810).
Next, when there is a stop request of the log file change monitoring unit 109, the log file change monitoring unit 109 is stopped, and when there is no stop request, after waiting for a certain period, the process returns to S803 (S811 to S812). ).

With the above operation, when the log file change monitoring unit 109 detects a change in the log file A, the remaining two digits are complemented to the two-digit year YY and a log message is output to the monitoring log file 111 ( S806).
When the log file change monitoring unit 109 detects a change in the log file B, the log message is output to the monitoring log file 111 without being supplemented or changed (S807).
When the log file change monitoring unit 109 detects a change in the log file C, it complements the current date (YYYY / MM / DD) and outputs a log message to the monitoring log file 111 (S808).
When the log file change monitoring unit 109 detects a change in the log file D, the date and time of the current monitoring target node is complemented in the format of YYYY / MM / DD hh: mm: ss, and the monitoring log file 111 is obtained. A log message is output (S809).
As a result, the log file of FIG. 3, FIG. 4, FIG. 5, and FIG. 6 is integrated and output to the monitoring log file in the format of FIG.

When the log monitoring agent 106 detects a change in the monitoring log file 111, the log monitoring agent 106 transfers a log message to the log monitoring manager 107 on the operation monitoring server 101.
The log monitoring manager 107 stores the transferred log message in the log DB 108.
The system administrator confirms the monitoring status of the information system from the monitoring terminal 102. At this time, the monitoring terminal 102 communicates with the log monitoring manager 107 on the operation monitoring server 101, and displays the log messages of a plurality of monitoring target nodes stored in the log DB 108 in an integrated manner.

As described above, in the log file output from the program, even if the description of date and time varies, the description of date and time is ambiguous, or either or both of the date and time are missing, a certain format As a result, the log can be integrated and monitored, so that it is possible to accurately grasp the event when a failure occurs in the information system, thereby speeding up the failure response.
The log file change monitoring unit, date / time format definition information, and monitoring log file mechanism can be added to existing log monitoring mechanisms (commercial operation monitoring tools and existing operation monitoring systems). It can be incorporated in the operation monitoring tool of the above, and can also be applied to an operation management system that is already operating.
In other words, in this embodiment, since the log message whose format is unified by performing format conversion on the monitoring target node side is sent to the operation monitoring server, it is not necessary to perform format conversion in the operation monitoring server, and it is already operating. A log file with a common format can be obtained without changing the system configuration of the operation monitoring server.

As described above, in the present embodiment, in an operation management system including a plurality of monitoring target nodes distributed in the network and an operation monitoring server device that monitors the plurality of monitoring target nodes,
(A) a log file change monitoring mechanism for monitoring changes of a plurality of log files in one monitoring target node;
(B) Date / time format defining means for defining the date / time format of the log message described in the log file;
(C) the monitoring log file generated by (a) and (b);
When integrating and monitoring multiple log files of multiple monitored nodes, it is possible to specify the exact event occurrence date without changing the configuration of existing operation management tools. A message monitoring system was explained.

In the above description, the example using the date / time format definition information shown in FIG. 2 has been described, but date / time format definition information of other formats may be used.
For example, as shown in FIG. 15, date format definition information indicating a date format complement method may be used. FIG. 15 shows the contents of the processing of S806 to S809 in FIG. 8, and the log file change monitoring unit 109 processes the log file date and time format to match the reference data format according to this.

In the above description, an example in which the date and time format of log files is shared has been described. However, the data format to be shared is not limited to the date and time format.
FIG. 16 shows a common arrangement of employee code arrangements when employee codes are included in the log messages of the respective log files, and the arrangement order of employee codes in the log messages is different for each log file. Indicates data format definition information.
For example, in the log file B, the employee code is arranged at the head of the log message, and when this is the standard data format, for the log file A, the employee code is arranged second in the log message. In accordance with this information, the log file change monitoring unit 109 can move the second item (employee code) to the top of the log message to match the reference data format. .
Similarly, for the log file C, it is indicated that the employee code is arranged at the end of the log message, and the log file change monitoring unit 109 is an item arranged at the end according to this information. (Employee code) can be moved to the beginning of the log message to match the reference data format.
Further, regarding the log file D, it is indicated that the employee code is arranged at the fifth position of the log message, and the log file change monitoring unit 109 follows the information in the fifth item ( Employee code) can be moved to the beginning of the log message to match the reference data format.

Also, FIG. 17 shows data format definition information for sharing the position information expression format when the position information is included in the log message of each log file and the position information expression format is different for each log file. Indicates.
For example, in the log files B and D, the position information is indicated by latitude and longitude, and when this is the standard data format, the log file A includes the notation “building A” as the position information. If “building A” is converted to latitude / longitude notation (AAA, BBB) of the location of “building A”, and “building B” is included as location information Indicates that the notation “building B” should be converted into the notation of latitude and longitude (CCC, DDD) of the location of “building B”, and the log file change monitoring unit 109 follows this information. , “Building A” and “building B” can be converted into corresponding latitude / longitude to match the reference data format.
Similarly, for the log file C, when “XX town 1-chome” is included as position information, the notation “XX town 1-chome” is changed to a predetermined value in “XX town 1-chome”. If it is converted to the location latitude / longitude notation (EEE, FFF) and the location information includes “XX town 2-chome”, the notation “XX town 2-chome” It is shown that the latitude / longitude notation (GGG, HHH) of a predetermined place in “XX town 2-chome” should be converted, and the log file change monitoring unit 109 follows this information according to “XX town 1-chome”. ”And“ XX town 2-chome ”can be converted into the corresponding latitude / longitude to match the reference data format.

Embodiment 2. FIG.
FIG. 9 shows an embodiment when the date / time format definition information described in Embodiment 1 is changed from the outside.

In FIG. 9, a date / time format definition changing unit 112 is a mechanism for changing the contents of date / time format definition information.
The operation management terminal 301 is connected to the WAN 103 and can communicate with the monitoring target node 100 group.
The date / time format definition change notifying unit 302 can exchange processing with the date / time format definition changing unit 112 of the monitoring target node 100 group.
In other words, the date / time format definition changing unit 112 receives one of the date / time format definition storage unit 110 (data format definition information storage unit) from the date / time format definition change notification unit 302 of the operation management terminal 301 which is an external device. An update instruction for the date / time format definition information (data format definition information) is received, and the corresponding data format definition information is updated according to the received update instruction. The date / time format definition changing unit 112 is an example of a data format information updating unit.
Other reference numerals are the same as those in FIG.

An example of a screen for changing the date / time format definition displayed by the date / time format definition change notifying unit 302 is shown in FIG.
In FIG. 10, 1000 is a user interface (screen) of the date / time format definition change notifying unit 302, 1001 is a log file input unit for designating a log file, and 1002 is designating a date / time format or the date / time format of a designated log file. A date / time format display / setting unit to be displayed, a display button 1003 for instructing the date / time format display of the specified log file, and an application button 1004 for applying the date / time format to the specified log file.

Next, the operation will be described.
When referring to the date / time format definition information in the first embodiment, the system operation manager activates the date / time format definition change notification unit 302 on the operation management terminal 301.
On the screen 1000 of the date / time format definition change notification unit 302, the log file selection unit 1001 is described with the name of the log file (log files A to D) and the display button 1003 is pressed. The date / time format definition change unit 112 of the monitoring target node 100 performs communication, and the name of the log file input on the screen 1000 is notified from the date / time format definition change notification unit 302 to the date / time format definition change unit 112.
The date / time format definition changing unit 112 reads the date / time format definition information entry of the specified log file from the date / time format definition information and returns it to the date / time format definition change notifying unit 302.
The date / time format definition change notification unit 302 displays the notified date / time format entry on the date / time format display / setting unit 1002 of the screen 1000.

In addition, when there is a need to change the date / time format definition information of the first embodiment, such as when there is an addition to the log file to be monitored, the system administrator can notify the date / time format definition change notification unit on the operation management terminal 301. 302 is started.
On the screen 1000 of the date / time format definition change notification unit 302, the name of the log file to be added / changed is described in the log file selection unit 1001, and the date / time format to be newly defined is described in the date / time format display / setting unit 1002 and applied. A button 1004 is pressed.
By this operation, the date / time format definition change notification unit 302 and the date / time format definition change unit 112 of the monitoring target node 100 communicate with each other, and the name of the log file to be added / changed input on the screen 1000 and the date / time format to be newly defined. Is notified from the date / time format definition change notifying unit 302 to the date / time format definition changing unit 112, and the date / time format definition changing unit 112 changes or adds the date / time format of the specified log file.

  As described above, since the date and time format definition change unit and the date and time format definition change notification unit are provided in the first embodiment, the operation manager can refer to and define the date and time format as necessary. When a log file is monitored or added or changed, it is possible to respond quickly.

  As described above, in the present embodiment, it has been described that the definition of the date format definition information can be changed from outside the monitoring target node.

  In the above description, the example of updating the contents of the date / time format definition information has been described. However, the contents of the information shown in FIGS. 16 and 17 are not limited to the date / time format definition information, for example, from outside the monitoring target node. It may be changed.

Embodiment 3 FIG.
FIG. 11 shows an example in which the same log message is repeatedly output due to an application error in the log file B (FIG. 4) of the first embodiment.
Here, FIG. 12 shows an example in which a duplicate identifier is added to the log message output in duplicate for the monitoring log file (111 in FIG. 1) of the first embodiment.
In the example of FIG. 12, “B157 Application B system error” on the third line is also duplicated on the fourth and fifth lines, and duplicate identifiers (DUP: 1 and DUP: 2) indicating data duplication are output. ) Is added.
Then, the log monitoring agent 106 transmits a log message with such a duplicate identifier added from the monitoring log file 111 to the operation monitoring server 101.
FIG. 13 shows the operation of the log file change monitoring unit 109 for realizing the output of the monitoring log file 111 as shown in FIG.
The operations in S801 to S812 are the same as those in the first embodiment and FIG.

The log file change monitoring unit 109 records the difference log message when the difference between the log messages is read in S803 after performing the processing of S801 and S802 (S1300).
Further, after processing the log message in S806 to S809, the log file change monitoring unit 109 searches the log message recorded in S1300 for a message other than the current log message except for the date and time. S1301).
If there is the same log message in S1301, a duplicate identifier indicating duplication is added to the log message as in the example of FIG. 12 (S1302).

As described above, by recording the difference of the log message by the operation of the log file change monitoring unit, it becomes possible to notify the administrator of information indicating the log message content when there is a duplicate, Since the system administrator can know how many times the same failure has occurred during failure analysis, the response to the failure is speeded up.
Further, the system administrator can detect weak points of the system from the tendency of the same failure by collecting statistics of these duplicate messages.

  As described above, in the present embodiment, it has been described that a monitoring log file to which information indicating duplication of the same log message is added is generated when the monitoring log file is generated.

Finally, a hardware configuration example of the monitoring target node 100, the operation monitoring server 101, the monitoring terminal 102, and the operation management terminal 301 described in the first to third embodiments will be described.
FIG. 18 is a diagram illustrating an example of hardware resources of the monitoring target node 100, the operation monitoring server 101, the monitoring terminal 102, and the operation management terminal 301 described in the first to third embodiments.
The configuration in FIG. 18 is merely an example of the hardware configuration of the monitoring target node 100, the operation monitoring server 101, the monitoring terminal 102, and the operation management terminal 301. The monitoring target node 100, the operation monitoring server 101, and the monitoring The hardware configurations of the terminal 102 and the operation management terminal 301 are not limited to the configurations illustrated in FIG. 18 and may be other configurations.

In FIG. 18, a monitoring target node 100, an operation monitoring server 101, a monitoring terminal 102, and an operation management terminal 301 are a CPU 911 (Central Processing Unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, A processor). The CPU 911 is connected to, for example, a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903, and a magnetic disk device 920 via a bus 912. Control hardware devices. Further, the CPU 911 may be connected to an FDD 904 (Flexible Disk Drive), a compact disk device 905 (CDD), a printer device 906, and a scanner device 907. Further, instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of the storage device.
The communication board 915, the keyboard 902, the scanner device 907, the FDD 904, and the like are examples of input devices.
The communication board 915, the display device 901, the printer device 906, and the like are examples of output devices.

As shown in FIG. 1, the communication board 915 is connected to a network. For example, the communication board 915 may be connected to a LAN (local area network), the Internet, etc. in addition to the WAN 103.
The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924. The programs in the program group 923 are executed by the CPU 911, the operating system 921, and the window system 922.
Further, the magnetic disk device 920 may store, for example, log files A to D105, a monitoring log file 111, date format definition information, and the like. When storing the date / time format definition information, the magnetic disk device 920 plays the role of the date / time format definition storage unit 110.

  The program group 923 stores programs that execute the functions described as the log file change monitoring unit, the log monitoring agent, and the date format definition changing unit in the description of the first to third embodiments. The program is read and executed by the CPU 911.

In the file group 924, in the description of the first to third embodiments, “determination of”, “conversion of”, “processing of”, “comparison of”, “update of”, “setting of” are set. ”,“ Addition ”, etc., information, data, signal values, variable values, and parameters indicating the results of processing are stored as items of“ ˜file ”and“ ˜database ”.
The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, Used for CPU operations such as calculation, calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
In addition, arrows in the flowcharts described in the first to third embodiments mainly indicate input / output of data and signals, and the data and signal values are the memory of the RAM 914, the flexible disk of the FDD904, the compact disk of the CDD905, and the magnetic field. Recording is performed on a recording medium such as a magnetic disk of the disk device 920, other optical disks, mini disks, DVDs, and the like. Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In the description of the first to third embodiments, what is described as “to part”, “to agent”, and “to manager” are “to circuit”, “to device”, and “to device”. Alternatively, “˜step”, “˜procedure”, and “˜processing” may be used. That is, what is described as “˜part”, “˜agent”, and “˜manager” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, only hardware such as elements, devices, substrates, wirings, etc., or a combination of software and hardware, and further a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. In other words, the program causes the computer to function as “to part”, “to agent”, and “to manager” in the first to third embodiments. Alternatively, the procedures and methods of “˜unit”, “˜agent”, and “˜manager” in the first to third embodiments are executed by a computer.

  As described above, the monitoring target node 100, the operation monitoring server 101, the monitoring terminal 102, and the operation management terminal 301 shown in the first to third embodiments are a CPU as a processing device, a memory as a storage device, a magnetic disk, and the like as a keyboard as an input device. , A mouse, a communication board, etc., a display device that is an output device, a computer equipped with a communication board, etc., and as described above, the functions indicated as "~ part", "~ agent", "~ manager" This is realized by using a storage device, an input device, and an output device.

1 is a diagram illustrating a configuration example of a message monitoring system according to Embodiment 1. FIG. FIG. 5 is a diagram showing an example of date / time format definition information according to the first embodiment. FIG. 4 is a diagram showing an example of a log file A according to the first embodiment. FIG. 3 is a diagram showing an example of a log file B according to the first embodiment. FIG. 3 is a diagram showing an example of a log file C according to the first embodiment. FIG. 3 is a diagram illustrating an example of a log file D according to the first embodiment. FIG. 3 is a diagram showing an example of a monitoring log file according to the first embodiment. FIG. 6 is a flowchart showing an operation example of a log file change monitoring unit according to the first embodiment. The figure which shows the structural example of the message monitoring system which concerns on Embodiment 2. FIG. FIG. 10 shows an example of a display screen for changing the date / time format definition according to the second embodiment. The figure which shows the example in which the same log message which concerns on Embodiment 3 is output repeatedly. FIG. 10 is a diagram illustrating an example of a monitoring log file according to the third embodiment. FIG. 10 is a flowchart showing an operation example of a log file change monitoring unit according to the third embodiment. FIG. 3 is a flowchart showing an operation example of the monitoring target node device according to the first embodiment. FIG. 5 is a diagram showing an example of date / time format definition information according to the first embodiment. FIG. 5 is a diagram showing an example of data format definition information according to the first embodiment. FIG. 5 is a diagram showing an example of data format definition information according to the first embodiment. The figure which shows the hardware structural examples, such as the monitoring object node apparatus which concerns on Embodiment 1-3, and an operation | use monitoring server apparatus.

Explanation of symbols

  100 monitoring target node device, 101 operation monitoring server device, 102 monitoring terminal, 103 WAN, 104 monitoring target program, 105 log file, 106 log monitoring agent, 107 log monitoring manager, 108 log DB, 109 log file change monitoring unit, 110 Date / time format definition storage unit, 111 monitoring log file, 301 operation management terminal, 302 date / time format definition change notification unit.

Claims (7)

A data transmission device for transmitting data to a data collection device,
A plurality of data output units for outputting data of a plurality of types of data formats;
A data format of data output from the plurality of data output units is converted into a reference data format serving as a reference, and data of a plurality of types of data formats output from the plurality of data output units is respectively converted into a reference data format. A format conversion unit for data;
A data transmission device comprising: a data transmission unit that transmits data of a reference data format after the format conversion by the format conversion unit to the data collection device. The plurality of data output units are:
Output log files containing date and time data in different data formats,
The format converter
The data format of the date and time data of the log file output from the plurality of data output units is converted into a reference data format serving as a reference, and the log file output from the plurality of data output units is converted to the date and time of the reference data format respectively. A log file containing the data,
The data transmitter is
The data transmission apparatus according to claim 1, wherein a log file including date and time data of a reference data format after the format conversion by the format conversion unit is transmitted to the data collection apparatus. The data transmission device further includes:
A data format definition information storage unit for storing data format definition information defining each of the plurality of types of data formats;
Data format information for receiving an update instruction for any data format definition information stored in the data format definition information storage unit from a predetermined external device and updating the corresponding data format definition information in accordance with the received update instruction The data transmission device according to claim 1, further comprising an update unit. The format converter
When two or more pieces of data with common contents are output from any of the data output units, a duplicate identifier representing the duplication of data is added to the duplicate data,
The data transmitter is
The data transmission device according to any one of claims 1 to 3, wherein data to which a duplicate identifier is added by the format conversion unit is transmitted to the data collection device. The data transmission device includes:
5. The data transmission device according to claim 1, wherein the data transmission device is included in a communication system including the data collection device and a plurality of data transmission devices that transmit data to the data collection device. A data transmission method in which a computer transmits data to a data collection device,
A plurality of data output steps in which the computer outputs data of a plurality of types of data formats;
The computer converts the data format of the data output from the plurality of data output steps into a reference data format serving as a reference, and each of the data of a plurality of types of data formats output from the plurality of data output steps A format conversion step for converting the data into a reference data format;
A data transmission method comprising: a data transmission step in which the computer transmits data of a reference data format after the format conversion in the format conversion step to the data collection device. To a computer that sends data to the data collector,
Multiple data output processes that output data in multiple types of data formats;
A data format of data output from the plurality of data output processes is converted into a reference data format serving as a reference, and data of a plurality of types of data formats output from the plurality of data output processes is converted into a reference data format. Format conversion processing as data,
A program for causing the computer to execute data transmission processing for transmitting data of a reference data format after format conversion by the format conversion processing to the data collection device.

Images