JP2011244381A - Information processing unit, information processing system, information processing method and program thereof - Google Patents

Abstract

PROBLEM TO BE SOLVED: To properly report an alert or the like even if occurrence of alerts is in the tendency of rising.SOLUTION: The information processing unit is connected to a plurality of electronic devices for recording predetermined information through a communication circuit. It includes information acquiring means which acquires predetermined information recorded by the plurality of electronic devices from the plurality of electronic devices, analyzing means which applies analysis on a searching object information contained in the predetermined information of respective electronic devices that is acquired by the information acquiring means, reporting means which, after reporting is determined to be required as a result of analysis by the analyzing means, generates report information and reports it, and threshold value resetting means which changes and resets a threshold value applied to each of predetermined information of respective electronic devices so that the fluctuation in detection content about the searching object information available as a result of analysis by the analyzing means is reflected.

Description

  The present invention relates to an information processing apparatus, an information processing system, an information processing method, and a program thereof.

  2. Description of the Related Art Conventionally, there is an apparatus that records information such as information about an error that has occurred and information about security as a log. For example, in Patent Document 1, information after comprehensive inspection of an image forming apparatus designated from a terminal device is periodically acquired and accumulated for a certain period, and the accumulated time series data is analyzed and designated every certain period. If there is an abnormality in the image forming apparatus, and if it is diagnosed, there is a request for maintenance or repair of the image forming apparatus to the terminal device at the service base that is in charge of the maintenance or repair of the image forming apparatus. A management apparatus that transmits information necessary for maintenance or repair of the corresponding image forming apparatus is disclosed.

  In an apparatus for diagnosing and managing an abnormality or the like of a device to be managed, such as the management apparatus disclosed in Patent Document 1, in general, whether or not there is an abnormality is determined based on a predetermined data Often this is done by exceeding the threshold or vice versa.

  Therefore, in the conventional apparatus, even if the occurrence of an abnormality tends to increase, it cannot be determined as abnormal unless the data that is the basis of diagnosis exceeds a predetermined threshold, for example.

  The present invention has been made in view of the above, and an information processing apparatus, an information processing system, an information processing method, and an information processing apparatus that can appropriately report a warning or the like even when the occurrence of an abnormality or the like tends to increase The purpose is to provide the program.

  In order to solve the above-described problems and achieve the object, an information processing apparatus of the present invention is an information processing apparatus connected to a plurality of electronic devices that record predetermined information via a communication line, and An information acquisition unit that acquires predetermined information recorded by the plurality of electronic devices from an electronic device, and analysis on search target information included in the predetermined information of each electronic device acquired by the information acquisition unit based on a threshold value An analysis means for performing the analysis, a report means for generating and reporting report information when it is determined that the report is necessary as a result of the analysis by the analysis means, and detection of search target information obtained as a result of the analysis by the analysis means Threshold value resetting means is provided for changing and resetting the threshold value applied to each of the predetermined information of each electronic device so as to reflect the change in contents.

  The information processing system according to the present invention includes a plurality of electronic devices that record predetermined information, and information that acquires the predetermined information recorded by the plurality of electronic devices from the plurality of electronic devices via a communication line. An acquisition unit, an analysis unit that analyzes the search target information included in the predetermined information of each electronic device acquired by the information acquisition unit based on a threshold, and a result of the analysis by the analysis unit, and determines that the report is necessary And applying to each of the predetermined information of each of the electronic devices so as to reflect the change of the detection contents related to the search target information obtained as a result of the analysis by the analysis means and the report means for generating and reporting the report information And an information processing apparatus having threshold resetting means for changing and resetting the threshold.

  The information processing method of the present invention is an information processing method executed in an information processing apparatus connected via a communication line to a plurality of electronic devices that record predetermined information, and the information acquisition means of the information processing apparatus However, the information acquisition step of acquiring predetermined information recorded by the plurality of electronic devices from the plurality of electronic devices, and the analysis unit of the information processing apparatus acquired in the information acquisition step based on a threshold value An analysis step for analyzing the search target information included in the predetermined information of each electronic device, and when the report means of the information processing apparatus determines that the report is necessary as a result of the analysis in the analysis step, the report information And a threshold resetting means of the information processing apparatus for generating a report and reporting the search target information obtained as a result of the analysis in the analysis step. To reflect the change of the contents, characterized in that it comprises a said threshold resetting step of resetting to change the threshold value to be applied to each of the predetermined information of each electronic device.

  In addition, the program of the present invention is configured so that an information processing apparatus connected to a plurality of electronic devices that record predetermined information via a communication line is transmitted from the plurality of electronic devices to the plurality of electronic devices. Information acquisition means for acquiring information, analysis means for analyzing the search target information included in the predetermined information of each electronic device acquired by the information acquisition means on the basis of a threshold value, the result of analysis by the analysis means, and its report When the information is determined to be necessary, the predetermined information of each electronic device is reflected so as to reflect the change in the detection contents related to the search target information obtained as a result of the analysis by the analysis unit and the report unit that generates and reports the report information Is a program that functions as threshold resetting means for changing and resetting the threshold applied to each of the above.

  According to the present invention, the threshold used for analysis is changed and reset so as to reflect the variation of the detection content related to the search target information obtained as a result of the analysis of the predetermined information acquired from a plurality of electronic devices. It is possible to automatically report warnings according to fluctuations. As a result, the administrator can appropriately manage each electronic device.

FIG. 1 is a block diagram showing the overall configuration of a log analysis system including a log analysis server which is an embodiment of an information processing apparatus of the present invention. FIG. 2 is a block diagram illustrating a schematic configuration of the log analysis server. FIG. 3 is a block diagram illustrating a schematic configuration of a server to be managed. FIG. 4 is a flowchart for explaining operations of the log analysis server and the management target server in the log analysis system. FIG. 5 is a flowchart for explaining threshold resetting processing executed in the log analysis server. FIG. 6 is a graph showing in time series the relationship between the threshold and the number of detections when the threshold is fixed. FIG. 7 is a graph showing, in time series, the relationship between the threshold and the number of detections when the threshold resetting process is performed.

  Hereinafter, a log analysis server according to an embodiment of the present invention and a log analysis system including the log analysis server and a plurality of servers to be managed will be described in detail with reference to the accompanying drawings.

(Log analysis system)
First, the overall configuration of a log analysis system including a log analysis server according to an embodiment of the present invention will be described. FIG. 1 is a block diagram showing an overall configuration of a log analysis system including a log analysis server and a plurality of servers to be managed according to an embodiment of the present invention.

  As shown in FIG. 1, the log analysis server 100 includes a plurality of servers to be managed (server 1, server 2,...) Via a communication network such as a WAN (Wide Area Network), a LAN (Local Area Network), and the Internet. It is connected to a server n (n is an integer equal to or greater than 2) 200. Each server 200 records predetermined information to be managed such as information on security, information on various errors / abnormalities, and information including these information. The log analysis server 100 acquires the log file recorded from each server 200. Then, each log file is analyzed (details will be described later), and a report such as a warning is generated according to the analysis result. The generated report is sent to a predetermined destination such as an administrator, etc. Note that this report is analyzed by log analysis. This method may be performed by displaying it on the server 100. In this embodiment, a report is sent to the administrator's E-mail address by e-mail or the like to the administrator in the remote place. Report by sending.

  In addition, as the log analysis server 100 and the server 200, a server computer that is widely used or an information processing apparatus having an equivalent function can be used. In the present embodiment, the electronic device that is managed by the log analysis server 100 is described as an information processing apparatus such as the server 200, but the present invention is not limited to this. The electronic device to be managed by the log analysis server 100 can record predetermined information to be managed such as information on security, information on various errors / abnormalities, and information including these information, and this information can be recorded via a communication line network. Any electronic device that can be provided to the log analysis server 100 may be used, and this electronic device may be a device that manages the state of other electronic devices. Such an electronic device and an apparatus whose state is managed by the electronic device may be, for example, an image processing apparatus that can be connected to a network, an image forming apparatus such as an MFP (Multi Function Printer), or the like.

(Log analysis server 100)
Next, a schematic configuration of the log analysis server 100 will be described with reference to FIG. FIG. 2 is a block diagram illustrating a schematic configuration of the log analysis server 100.

  As shown in the figure, the log analysis server 100 includes a processing unit 110 that executes a predetermined process according to an installed program, a storage unit 120 that stores various files and programs in which information is recorded, and a communication line network. And a communication unit 130 which is an interface for communicating with each of the servers (server 1, server 2,..., Server n) 200.

  The processing unit 110 includes a log acquisition unit 111 that acquires log files from the plurality of servers 200 via the communication unit 130 and the communication network, a log analysis unit 112 that analyzes the acquired log files (details will be described later), A report generation / transmission unit 113 for generating a report such as a warning required by the analysis by the log analysis unit 112 and transmitting the generated report to a predetermined destination, and used by the log analysis unit 112 for analysis And a threshold resetting unit 114 that resets the threshold (details will be described later).

  A ROM (not shown) provided in the storage unit 120 or the processing unit 110 stores a program that realizes the functions of the above-described units. The program is loaded into the RAM of the main memory provided in the processing unit 110 for processing. The functions of the above-described units are achieved by execution of a CPU (none of which is shown) included in the unit 110.

  The storage unit 120 includes a nonvolatile storage device such as an HDD (Hard Disk Drive) or an SDD (Solid State Drive), and includes a management file group (management file 1, management file 2,... In addition, a log file group (log file 1, log file 2,..., Log file n) acquired from each server 200 indicated by reference numeral 122 is stored.

  In the example shown in the figure, the management file 1 records a log file name, a log type, an initial threshold, and the like, and the management file 2 records a log file name, an administrator E-mail address, and the like. In the management file 3, log types, keyword codes (described later), and the like are recorded. These management files 1, 2, and 3 are set in advance by the administrator. The log file name, log type, and initial threshold value of the management file 1 are associated and recorded. The same applies to the log file name and the administrator E-mail address of the management file 2, the log type and the keyword code of the management file 3. The example shown in FIG. 2 is only an example, and what information is recorded in which management file is arbitrary.

(Server 200)
Next, a schematic configuration of the server 200 will be described with reference to FIG. FIG. 3 is a block diagram illustrating a schematic configuration of the server 200. FIG. 3 illustrates the server n.

  The server n 200 includes a processing unit 210 that executes predetermined processing according to an installed program, a storage unit 220 that stores various files and programs in which information is recorded, and the log analysis server 100 via a communication line network. And a communication unit 230 that is an interface for communication.

  The processing unit 210 includes a log recording unit 211 that stores in the storage unit 220 a log file in which predetermined information to be managed, such as information on security, information on various errors / abnormalities, and information including these information, and the log And a transfer unit 212 that transfers the file to the log analysis server 100 via the communication unit 230 and the communication line network. The transfer of the log file by the transfer unit 212 may be transferred to the log analysis server 100 in response to an acquisition request from the log acquisition unit 111 of the log analysis server 100, or under a predetermined condition ( For example, the data may be transferred at regular time intervals such as every other day or at a predetermined time.

  A ROM (not shown) provided in the storage unit 220 or the processing unit 210 stores a program that realizes the functions of the above-described units. The program is loaded into the RAM of the main memory provided in the processing unit 210 for processing. The functions of the above-described units are achieved by execution by a CPU (none of which is shown) included in the unit 210.

  The storage unit 220 includes a nonvolatile storage device such as an HDD (Hard Disk Drive) or an SDD (Solid State Drive), and stores a log file (log file n 221 in FIG. 3) in which information to be managed is recorded. To do.

(Operation of log analysis system)
Next, operations of the log analysis server 100 and the management target server 200 in the log analysis system will be described with reference to FIGS. 4 and 5. FIG. 4 is a flowchart for explaining operations of the log analysis server 100 and the management target server 200 in the log analysis system, and FIG. 5 is a diagram for explaining threshold resetting processing executed in the log analysis server 100. It is a flowchart. The operation of the management target server in FIG. 4 is executed in each of the plurality of servers 200.

  First, the administrator makes a pre-setting on each of the log analysis server 100 side and the management target server 200 side (steps S411 and S421). As this pre-setting, management files 1, 2, and 3 are set on the log analysis server 100 side. In the example described above with reference to FIG. 2, the management file 1 is set with the log file name and log type of the log file 221 recorded in each server 200 to be managed, the initial threshold value, and the like. Is set with the log file name and the e-mail address of the administrator who is the transmission destination of the report. The management file 3 has a log type and a keyword code (for example, search target information corresponding to this log type). , A keyword or code indicating abnormality) is set. On the other hand, on each server 200 to be managed, settings for file transfer to the log analysis server 100 using FTP (File Transfer Protocol), syslog, and the like are made.

  Thereafter, in each server 200 to be managed, the log recording unit 211 records predetermined information to be managed such as information on security, information on various errors / abnormalities, and information including these information in the log file 221 as needed. (Step S422).

  Then, the transfer unit 212 of each server 200 responds to an acquisition request from the log acquisition unit 111 of the log analysis server 100 or under a predetermined condition (for example, at a certain time interval or a predetermined time) ), The log file 221 is transferred to the log analysis server 100 (step S423).

  The log acquisition unit 111 of the log analysis server 100 acquires the log files (log file 1, log file 2,..., Log file n) transferred from each server 200 (step S412).

  Next, the log analysis unit 112 of the log analysis server 100 reads each management file and acquires information necessary for analysis, such as a log file name, a log type, an initial threshold, an administrator E-mail address, and a keyword / code ( Step S413).

  Next, the log analysis unit 112 of the log analysis server 100 searches the search target information in each log file for the log file group 122 acquired from each server 200 (step S414). Specifically, for each log file, a keyword code serving as search target information corresponding to the log type of the log file to be searched is searched, and the number is counted.

  Next, the log analysis unit 112 of the log analysis server 100 records the number of keyword codes detected in step S414 (step S415).

  Next, the log analysis unit 112 of the log analysis server 100 compares the number of detections with a threshold value (step S416). The threshold used for the first time is an initial threshold set in the management file 1. Note that this threshold is reset as will be described later.

  Next, as a result of the comparison in step S416, if the number of detections is equal to or greater than the threshold value, the report generation / transmission unit 113 of the log analysis server 100 generates a report such as a warning for the corresponding managed server 200 and generates The report is transmitted to a predetermined destination such as an administrator (in this example, to the administrator E-mail address set in the management file 2) (step S417). Then, the process proceeds to step S418. On the other hand, when the number of detections is less than the threshold value as a result of the comparison in step S416, the process proceeds to step S418.

  In step S418, the log analysis unit 112 of the log analysis server 100 determines whether there is an unanalyzed log file. If there is, the process returns to step S413, and the processing after step S413 is executed for the unanalyzed log file. . On the other hand, if there is no unanalyzed log file, the process proceeds to step S419.

  In step S419, the threshold resetting unit 114 of the log analysis server 100 executes the following threshold resetting process.

  Note that the processing of steps S412 to S419 in the log analysis server 100 is performed periodically, for example.

(Threshold reset process)
Details of the threshold resetting process by the threshold resetting unit 114 of the log analysis server 100 will be described with reference to FIG. FIG. 5 is a flowchart for explaining threshold resetting processing in the log analysis server 100.

  First, the number of detected keyword codes for the log file group (log file 1, log file 2,... Log file n) 122 recorded in step S415 is checked (step S501).

  Next, it is determined whether or not the detected number satisfies a threshold value changing condition (step S502). When the threshold value changing condition is satisfied (OK in the same step), the process proceeds to the next step S503. On the other hand, when the threshold value changing condition is not satisfied (NG in the same step), the threshold value resetting process is terminated. Although the threshold value changing condition is arbitrarily set, for example, whether or not the current detection number has changed with respect to the previous detection number for a certain log file can be set as the threshold value changing condition.

  In step S503, a new threshold value for a certain log file is calculated. In the present embodiment, a weighted moving average (below) of the number of detections described above for a certain period (m days; m is an integer of 2 or more) is calculated, and a value obtained by adding this weighted moving average to the initial threshold is calculated as a new threshold. To do.

  Weighted moving average = {c1 * n + c2 * (n-1) + c3 * (n-2) + c4 * (n-3) + c5 * (n-4) + ... + cn * n} / (1 + 2 + 3 + 4 + 5 + ... + n)

  However, cn is the number of detections n-1 days ago, c1 is the number of detections on the current day, and the current day is 1, and calculation is performed for n days including the current day. As shown in the above equation, the weighted moving average is a value obtained by increasing the importance (weighting) as the closest to the current day and averaging the number of detections for a certain period (n days).

  Next, the new threshold value calculated in step S503 is set as a threshold value used in the comparison in step S416 described above with reference to FIG. 4 (step S504).

  Next, a report for reporting the reset threshold value to the administrator is generated, and the report is transmitted to the administrator E-mail address (step S505).

  The operation of the log analysis server 100 and the management target server 200 in the log analysis system and the details of the threshold resetting process executed in the log analysis server 100 have been described above.

  Here, the difference in the number of detected errors occurring in a certain managed server 200 is compared between the case where the threshold is fixed and the case where the threshold reset processing in the present embodiment is performed. FIG. 6 is a graph showing the relationship between the threshold and the number of detections in a time series when the threshold is fixed, and FIG. 7 is a graph showing the relationship between the threshold and the number of detections in a time series when the threshold resetting process is performed. It is. The vertical axis represents the number of detections, the horizontal axis represents the date, and the graph represents the change in the detection number in time series. Moreover, all are the results of analyzing log files every other day.

  When the threshold value is fixed, as shown in FIG. 6, as a matter of course, an abnormality can be detected only when the number of detections exceeds the threshold value. On the other hand, if the threshold value is automatically increased or decreased by the threshold resetting process using the weighted moving average of this embodiment, it is possible to capture the movement when the number of errors increases, and such a case is also detected as an abnormality. can do.

  As described above, in the present embodiment, the log analysis server 100 detects keyword codes, etc. as search target information from log files acquired from a plurality of servers 200 to be managed, and automatically according to the number of detections. A warning or other report is generated and sent to the administrator. In the above detection, after the initial detection, the threshold value reset by the threshold resetting process using the weighted moving average is used, so that the abnormality is detected more than in the case of detecting an abnormality with a fixed threshold value as in the past. There is a possibility that the number of errors (number of detections) starts to increase, and the administrator can recognize the abnormality of the plurality of servers 200 that are electronic devices to be managed at an early stage and deal with it. can do.

(Other embodiments)
A program that is executed by the log analysis server 100 according to the present embodiment and that realizes the log acquisition unit 111, the log analysis unit 112, the report generation / transmission unit 113, and the threshold resetting unit 114 is an installable format or an executable format. Are recorded on a computer-readable recording medium such as a CD-ROM, a flexible disk (FD), a CD-R, and a DVD (Digital Versatile Disk).

  Alternatively, the program may be provided or distributed by storing it on a computer connected to a network such as the Internet and downloading it via the network.

100 log analysis server 110 processing unit 111 log acquisition unit 112 log analysis unit 113 report generation / transmission unit 114 threshold resetting unit 120 storage unit 121 management file group 122 log file group 130 communication unit 200 server 210 processing unit 211 log recording unit 212 Transfer unit 220 Storage unit 221 Log file 230 Communication unit

Japanese Patent No. 3831143

Claims (9)

An information processing apparatus connected via a communication line to a plurality of electronic devices that record predetermined information,
Information acquisition means for acquiring predetermined information recorded by the plurality of electronic devices from the plurality of electronic devices;
Analyzing means for analyzing the search target information included in the predetermined information of each electronic device acquired by the information acquiring means with reference to a threshold value;
As a result of analysis by the analysis means, when it is determined that the report is necessary, report means for generating and reporting report information;
Threshold value resetting means for changing and resetting the threshold value applied to each of the predetermined information of each electronic device so as to reflect the variation in the detection contents regarding the search target information obtained as a result of analysis by the analysis means. An information processing apparatus characterized by that.   The information processing apparatus according to claim 1, wherein the reporting unit performs the report by transmitting the generated report information to a predetermined destination.   The analysis unit searches for search target information included in predetermined information of each electronic device during the analysis, and compares the number of detections of the search target information with the threshold value. Alternatively, the information processing apparatus according to claim 2.   The information processing apparatus according to claim 3, wherein it is determined that a report is necessary when the number of comparison results detected by the analysis unit exceeds a threshold value or more than a threshold value.   The threshold resetting means changes the threshold applied in the analysis by the analysis means to a value obtained by adding a weighted moving average of the number of detections obtained by the analysis by the analysis means over a predetermined number of times to the initial threshold. The information processing apparatus according to claim 3 or 4, wherein the information processing apparatus is characterized in that   The information processing apparatus according to claim 1, wherein the predetermined information is information including information regarding an abnormality that has occurred in each electronic device. A plurality of electronic devices that record predetermined information; and
Information acquisition means for acquiring predetermined information recorded by the plurality of electronic devices from the plurality of electronic devices via a communication line;
Analyzing means for analyzing the search target information included in the predetermined information of each electronic device acquired by the information acquiring means with reference to a threshold value;
As a result of analysis by the analysis means, when it is determined that the report is necessary, report means for generating and reporting report information,
Threshold value resetting means for changing and resetting the threshold value applied to each of the predetermined information of each electronic device so as to reflect the variation in the detection content related to the search target information obtained as a result of analysis by the analysis means. An information processing system comprising an information processing apparatus. An information processing method executed in an information processing apparatus connected via a communication line to a plurality of electronic devices that record predetermined information,
An information acquisition step in which the information acquisition means of the information processing apparatus acquires predetermined information recorded by the plurality of electronic devices from the plurality of electronic devices;
An analysis step in which the analysis unit of the information processing apparatus analyzes the search target information included in the predetermined information of each electronic device acquired in the information acquisition step with reference to a threshold;
When the reporting means of the information processing apparatus determines that the report is necessary as a result of analysis in the analysis step, a report step for generating and reporting report information;
The threshold value resetting unit of the information processing apparatus changes the threshold value applied to each of the predetermined information of each electronic device so as to reflect the variation in the detection content regarding the search target information obtained as a result of the analysis in the analysis step. And a threshold resetting step for resetting. An information processing method comprising: An information processing apparatus connected via a communication line to a plurality of electronic devices that record predetermined information,
Information acquisition means for acquiring predetermined information recorded by the plurality of electronic devices from the plurality of electronic devices;
Analyzing means for analyzing the search target information included in the predetermined information of each electronic device acquired by the information acquiring means with reference to a threshold value;
As a result of analysis by the analysis means, when it is determined that the report is necessary, report means for generating and reporting report information;
Function as threshold resetting means for changing and resetting the threshold applied to each of the predetermined information of each electronic device so as to reflect the variation of the detection content related to the search target information obtained as a result of analysis by the analysis means program.

Images