JP2013114372A - Log analysis device, log analysis method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce costs required to detect the presence of abnormal sequences and a performance change.SOLUTION: The log analysis device for analyzing a log output from a system comprises: an analysis part for converting a log output in the case that a sequence has been executed normally in the system, into a coordinate value of a point on a predetermined function having periodicity in a time domain, on the basis of time information included in the log, converting a log output in cases other than the case that the sequence has been executed normally in the system into the coordinate value of the point on a position other than the predetermined function in the time domain, on the basis of the time information included in the log, and calculating a coordinate value in a frequency domain by applying Fourier transform to the converted coordinate values; and an output part for performing output for externally giving a notice of information on the basis of the coordinate value calculated at the analysis part.

Description

  The present invention relates to a log analysis device, a log analysis method, and a program for analyzing a log output from a large-scale distributed processing system.

  2. Description of the Related Art In recent years, research and development of large-scale distributed processing technology that performs distributed processing of large-scale data in parallel using a large number of PC (Personal Computer) servers represented by a Google search system has been actively conducted.

  In the large-scale distributed processing technology, large-scale data processing can be executed as a whole by causing each of a large number of PC servers to execute small-scale data processing. Further, in the large-scale distributed processing technology, when it is desired to improve the data processing performance or increase the data storage capacity, it is possible to cope by adding a PC server.

  Furthermore, since a large-scale distributed processing technique uses a large number of PC servers, it can flexibly cope with PC server failures. Specifically, in a large-scale distributed processing system to which a large-scale distributed processing technology is applied, a fault that automatically disconnects the failed PC server from the system when a PC server fails and does not affect the processing of the entire system. Tolerant property is ensured.

  On the other hand, when using and operating a large-scale distributed processing system, it is necessary to perform cause analysis at the time of failure, performance analysis when expected performance is not exhibited, and the like. When performing such an analysis, it is necessary to analyze a large number of logs output from a large number of processes operating on each of a large number of PC servers, and this analysis itself requires a large-scale distributed processing technique. It often happens.

  For example, Non-Patent Document 1 discloses a technique for improving the efficiency of failure analysis work of a large-scale distributed processing system.

Mikifumi Shikita, Hiroshi Goto, "Log Management Support Method Based on Component Dependency Between Large Servers", Transactions of Information Processing Society of Japan, 49, 3, 1081, 9, 2008/03

  As described above, in order to perform cause analysis and performance analysis at the time of failure in a large-scale distributed processing system, it is necessary to analyze a large amount of logs output from the large-scale distributed processing system.

  Here, attention is focused on processing that is repeatedly performed in a large-scale distributed processing system, such as writing to and reading from a database and writing and reading of data to a file system. In such a process, let us consider detection of presence / absence of an abnormal sequence (sequence different from normal) and detection of a change in performance.

  First, the presence or absence of an abnormal sequence can be detected relatively easily by finding this error message when an error message is shown in the log, for example.

  However, the large-scale distributed processing system is designed so that it can flexibly cope with a failure of a PC server or the like as described above. Therefore, it may appear that the entire system has been processed normally by processing such as retransmission and failure avoidance. In this case, there is a possibility of missing an abnormal sequence.

  In order to avoid this, it is necessary to classify a large amount of logs into a plurality of sequences and analyze the processing process for each sequence to detect the presence or absence of abnormal sequences. Takes a long time.

  The change in performance can also be detected by an application that can measure the performance of a large-scale distributed processing system. However, the application does not always operate constantly. In this case as well, there is a possibility that a change in performance may be missed.

  To avoid this, as in the case of detecting an abnormal sequence, a large amount of logs are classified for each sequence and the time required for each process is analyzed. This is a very labor intensive work.

  As described above, detecting the presence or absence of an abnormal sequence or a change in performance has a problem in that it requires enormous time and labor costs.

  An object of the present invention is to provide a log analysis device, a log analysis method, and a program that can reduce the cost required for detecting the presence or absence of an abnormal sequence or a change in performance.

In order to achieve the above object, a log analysis apparatus of the present invention is a log analysis apparatus that analyzes a log output from a system,
A log output when the sequence is executed normally in the system is converted into a coordinate value of a point on a predetermined function having periodicity in the time domain based on time information included in the log, and the system The log output except when the sequence is normally executed in the step is converted into the coordinate value of the point other than the predetermined function in the time domain based on the time information included in the log, and the converted An analysis unit that calculates a coordinate value in the frequency domain by performing a Fourier transform on the coordinate value;
And an output unit that performs output for notifying the outside of information based on the coordinate value calculated by the analysis unit.

In order to achieve the above object, the log analysis method of the present invention is a log analysis method in a log analysis device for analyzing a log output from a system,
A log output when the sequence is executed normally in the system is converted into a coordinate value of a point on a predetermined function having periodicity in the time domain based on time information included in the log, and the system A process of converting a log output other than when the sequence is normally executed in step 1 to a coordinate value of a point other than on the predetermined function in the time domain based on time information included in the log;
A process of calculating coordinate values in the frequency domain by performing a Fourier transform on the transformed coordinate values;
And a process of performing an output for notifying the outside of information based on the calculated coordinate value.

In addition, in order to achieve the above object, the program of the present invention provides a log analysis device for analyzing a log output from the system.
A log output when the sequence is executed normally in the system is converted into a coordinate value of a point on a predetermined function having periodicity in the time domain based on time information included in the log, and the system A function of converting a log output except when the sequence is normally executed in step 1 to a coordinate value of a point other than on the predetermined function in the time domain based on time information included in the log;
A function of calculating coordinate values in the frequency domain by performing Fourier transform on the converted coordinate values;
And a function of performing output for notifying the outside of information based on the calculated coordinate value.

  Since the present invention is configured as described above, it is not necessary to classify and analyze a large number of logs for each sequence in order to detect the presence or absence of an abnormal sequence or a change in performance.

  Therefore, it is possible to reduce the cost required for detecting the presence or absence of an abnormal sequence or a change in performance.

It is a block diagram which shows the structure of one Embodiment of the log analysis apparatus of this invention. It is a figure which shows an example of the some log which the log input part shown in FIG. 1 accepts. It is a figure for demonstrating the sine function used when the analysis part shown in FIG. 1 converts a log into the coordinate value in a time domain. It is a figure for demonstrating the operation | movement which the analysis part shown in FIG. 1 converts a log into the coordinate value of the point on a sine function. It is a figure which shows an example of the graph of the frequency domain displayed on the screen with which the output part shown in FIG. 1 is provided. It is a figure which shows the other example of the graph of the frequency domain displayed on the screen with which the output part shown in FIG. 1 is provided. It is a flowchart for demonstrating the operation | movement which the log analyzer shown in FIGS. 1-6 analyzes the log output from the large-scale distributed processing system.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of an embodiment of a log analysis apparatus of the present invention.

  As shown in FIG. 1, the log analysis apparatus 10 according to the present embodiment includes a log input unit 11, an analysis unit 12, and an output unit 13.

  The log input unit 11 receives a log output from the large-scale distributed processing system 20 including a large number of PC servers via the network 50. Then, for example, when the number of received logs reaches a predetermined number, the log input unit 11 outputs the received plurality of logs to the analysis unit 12. Note that the log input unit 11 may output a plurality of received logs to the analysis unit 12 at a predetermined time, for example. Here, the log input unit 11 receives the log output from the large-scale distributed processing system 20 via the network, but the method of receiving the log is not limited to this. The log input unit 11 can also accept a log stored in, for example, a storage device that stores a log output from the large-scale distributed processing system 20.

  FIG. 2 is a diagram illustrating an example of a plurality of logs received by the log input unit 11 illustrated in FIG.

  Each of the plurality of logs received by the log input unit 11 illustrated in FIG. 1 includes time information indicating a time and a message indicating the contents of the log, as illustrated in FIG. The time information is, for example, information indicating the time when the log is output from the large-scale distributed processing system 20 and the time when the process corresponding to the log is executed in the large-scale distributed processing system 20.

  Referring to FIG. 1 again, the analysis unit 12 converts the log into a coordinate value of a point on a function having periodicity in the time domain composed of the x axis (time) and the y axis. Specifically, the analysis unit 12 converts the log into a coordinate value of a point on a sine function in the time domain.

  FIG. 3 is a diagram for explaining a sine function used when the analysis unit 12 shown in FIG. 1 converts a log into coordinate values in the time domain. FIG. 3A shows a sequence in the large-scale distributed processing system 20. The figure which shows an example of the time information contained in each of the some log assumed to be output when it performs normally, (b) was based on the some log containing the time information shown to (a) It is a figure which shows a sine function.

  Here, the time information and the message included in the log that is assumed to be output when the sequence is executed normally in the large-scale distributed processing system 20 are expressed as (time1, message1), (time2, message2), ( (time3, message3),... (timeN, messageN). The time information used is not a character string but converted to an integer value. The integer value may be, for example, the number of seconds based on time1.

  The log that is assumed to be output when the sequence is normally executed in the large-scale distributed processing system 20 is a sine function (y = sin (2π × f) of the frequency f in the time domain composed of the x-axis and the y-axis. Xx) (0 ≦ x <2π)).

  Specifically, the value (x_timeX) of x at time (timeX) is calculated using the following equation (1).

x_timeX = (timeX-time1) / (timeN-time1) Expression (1)
Then, the calculated value of x_timeX is substituted into the following equation (2).

y_messageX = sin (2π × f × x_timeX) (2)
The analysis unit 12 stores in advance a sine function represented by the above equation (2). The analysis unit 12 stores the type of log output when the sequence is executed normally. The analysis unit 12 receives a plurality of logs output from the log input unit 11. Then, the analysis unit 12 selects one of the received plurality of logs, and checks whether the selected log is a log output when the sequence is normally executed. As a result of the confirmation, when the selected log is a log that is output when the sequence is executed normally, the analysis unit 12 calculates x_timeX using Expression (3) shown below.

x_timeX = ((timeX mod (timeN-time1)) / (timeN-time1)) (3)
Note that ((timeX mod (timeN-time1)) in Equation (3) indicates that the value of x_timeX is included between 0 and 2π when the log is converted into the coordinate value of a point on the sine function. It is for doing so.

  Then, the analysis unit 12 substitutes the calculated value of x_timeX into the above equation (2). As a result, the log output when the sequence is normally executed in the large-scale distributed processing system 20 is the sine function (y = sin (2π × f × x) (0 ≦ x <2π)) and the frequency described above. It is converted into the coordinate value of a point on a sine function (y = sin (2π × f × x + θ) (0 ≦ x <2π)) having the same component but different only in phase θ.

  4 is a diagram for explaining the operation of the analysis unit 12 shown in FIG. 1 for converting the log into the coordinate value of the point on the sine function. FIG. 4A is a diagram illustrating a plurality of logs received by the analysis unit 12. The figure which shows an example of the time information contained in each, (b) is a figure which shows the state into which the several log containing the time information shown to (a) was converted into the coordinate value of the point on a sine function.

  FIG. 4 shows a case where three different sequences are executed in the large-scale distributed processing system 20. That is, each of the logs 1-1 to 1-7, logs 2-1 to 2-7, and logs 3-1 to 3-7 shown in FIG. This log is output by

  All three sine functions shown in FIG. 4B have the same frequency. In this case, when a Fourier transform described later is executed, a single spectrum appears as a frequency component in the frequency domain.

  Here, if the selected log is not the log that was output when the sequence was executed normally as a result of the confirmation described above, it was output except when the sequence was executed normally, such as a retransmission process or an error. In the case of a log, the analysis unit 12 converts the log into a coordinate value of a point in the time domain without using the above equation (2). That is, the analysis unit 12 converts the selected log into a coordinate value of a point other than on the sine function represented by the above equation (2). Specifically, for example, (x, y) = (x_timeX, 0). As a result, when a Fourier transform described later is executed, a spectrum different from the single spectrum described above appears as a frequency component in the frequency domain. The analysis unit 12 repeatedly performs the above-described confirmation and conversion to the coordinate values of the points in the time domain for all of the received logs.

  Next, the analysis part 12 calculates the coordinate value in a frequency domain by performing a Fourier transformation with respect to each of the converted several coordinate value. Then, the analysis unit 12 outputs the calculated coordinate values in the frequency domain to the output unit 13.

  Note that if the number of logs output when the sequence is executed normally is not sufficient and a sufficient number of coordinate points cannot be obtained when the Fourier transform is executed, the sequence is executed normally. In this case, one log output in this case may be converted into coordinate values of a plurality of consecutive points on the above equation (2).

  Referring to FIG. 1 again, the output unit 13 includes a screen (not shown). The output unit 13 receives the coordinate value output from the analysis unit 12 and displays a frequency domain graph indicating the received coordinate value on the screen.

  FIG. 5 is a diagram illustrating an example of a frequency domain graph displayed on the screen included in the output unit 13 illustrated in FIG. 1. FIG. 5A illustrates a case where the sequence is normally executed in the large-scale distributed processing system 20. FIG. 8B is a diagram illustrating a case where there is a sequence that has not been normally executed in the large-scale distributed processing system 20.

  When the sequence is normally executed in the large-scale distributed processing system 20, as shown in FIG. 5A, only a single spectrum of the frequency f appears as a frequency component.

  On the other hand, when there is a sequence that has not been normally executed in the large-scale distributed processing system 20, as shown in FIG. 5B, a spectrum other than a single spectrum of the frequency f appears as a frequency component. Thereby, for example, the administrator of the large-scale distributed processing system 20 can grasp that there is a sequence that has not been normally executed in the large-scale distributed processing system 20.

  The output unit 13 can also display the spectrum in a logarithmic display. In this case, a minute frequency component is enlarged and displayed. Thereby, for example, the administrator of the large-scale distributed processing system 20 can more easily grasp that there is a sequence that has not been normally executed in the large-scale distributed processing system 20.

  FIG. 6 is a diagram illustrating another example of the frequency domain graph displayed on the screen included in the output unit 13 illustrated in FIG. 1.

  In FIG. 6, the frequency when the sequence is normal and is executed with the performance assumed in advance is f.

  When the sequence is normally executed in the large-scale distributed processing system 20, but the processing time is slower than expected, for example, a spectrum whose center frequency is smaller than f as shown by a solid line in FIG. It will appear as a component. On the other hand, when the sequence is normally executed in the large-scale distributed processing system 20 and the processing time is faster than expected, for example, a spectrum whose center frequency is larger than f as shown by a broken line in FIG. It will appear as a component.

  Further, when the sequence is normally executed in the large-scale distributed processing system 20, but the variation in the processing time is larger than expected, for example, a spectrum with a wide line width shown in FIG. 6B appears. On the other hand, when the sequence is normally executed in the large-scale distributed processing system 20 and the variation in processing time is smaller than expected, for example, a spectrum with a narrow line width shown in FIG. 6B appears as a frequency component.

  Thereby, for example, an administrator of the large-scale distributed processing system 20 can grasp a change in performance of the large-scale distributed processing system 20.

  Below, the operation | movement which the log analyzer 10 comprised as mentioned above analyzes the log output from the large-scale distributed processing system 20 is demonstrated.

  FIG. 7 is a flowchart for explaining an operation in which the log analysis apparatus 10 shown in FIGS. 1 to 6 analyzes the log output from the large-scale distributed processing system 20.

  First, the log input unit 11 receives a plurality of logs output from the large-scale distributed processing system 20 (step S1).

  Then, the log input unit 11 outputs the received plurality of logs to the analysis unit 12.

  The analysis unit 12 that has received the plurality of logs output from the log input unit 11 selects one unselected log from the plurality of received logs (step S2).

  And the analysis part 12 confirms whether the selected log is a log output when the sequence was performed normally (step S3).

  As a result of the confirmation in step S3, when the selected log is a log output when the sequence is executed normally, the analysis unit 12 selects the log using the above formula (2) and formula (3). The log is converted into a coordinate value of a point on a sine function in the time domain (step S4).

  On the other hand, as a result of the confirmation in step S3, when the selected log is not a log output when the sequence is executed normally, the analysis unit 12 converts the selected log into the above equation (2) in the time domain. It is converted into coordinate values other than the point (step S5).

  After step 4 or step 5, the analysis unit 12 confirms whether all of the accepted logs have been selected (step S6).

  As a result of the confirmation in step S6, if all of the accepted logs have not been selected, the process proceeds to the operation in step S2.

  On the other hand, as a result of the confirmation in step S6, when all of the received plurality of logs have been selected, the analysis unit 12 performs a Fourier transform on each of the plurality of coordinate values converted in step S4 and step S5. Thus, the coordinate value in the frequency domain is calculated (step S7).

  Then, the analysis unit 12 outputs the calculated coordinate value to the output unit 13.

  The output unit 13 that has received the coordinate value output from the analysis unit 12 displays a frequency domain graph indicating the received coordinate value on the screen. That is, the output unit 13 displays a frequency domain graph indicating the coordinate values calculated by the analysis unit 12 on the screen (step S8).

  As described above, in the present embodiment, the log analysis apparatus 10 uses the log output when the sequence is normally executed in the large-scale distributed processing system 20 based on the time information included in the log in the time domain. Is converted into the coordinate value of a point on a predetermined function.

  Further, the log analysis apparatus 10 outputs the log output except when the sequence is normally executed in the large-scale distributed processing system 20 based on the time information included in the log in the time domain. Convert to a coordinate value of a point other than on the function.

  Then, the log analysis device 10 calculates a coordinate value in the frequency domain by executing a Fourier transform on the converted coordinate value, and performs an output for notifying information based on the calculated coordinate value to the outside. .

  Thus, it is not necessary to classify and analyze a large number of logs for each sequence in order to detect the presence or absence of abnormal sequences and changes in performance.

  Therefore, it is possible to reduce the cost required for detecting the presence or absence of an abnormal sequence or a change in performance.

  In this embodiment, the case where the analysis unit 12 converts the log into the coordinate value of the point on the sine function has been described. However, the analysis unit 12 converts the log into the coordinate value of the point on the cosine function, for example. May be.

  In the present embodiment, the case where the output unit 13 displays a frequency domain graph indicating the received coordinate values on the screen has been described. However, the output unit 13 only needs to be able to notify the outside of the normality of the sequence, such as whether the sequence has been executed normally in the large-scale distributed processing system 20 or whether the performance has changed. Therefore, the output unit 13 may have a printing function, for example, and print and output a frequency domain graph indicating the received coordinate values. The output unit 13 may have a communication function, and may transmit information on a graph in the frequency domain indicating the received coordinate value to a predetermined device or the like.

  Further, the output unit 13 determines the normality of the sequence executed in the large-scale distributed processing system 20 from the characteristics of the received coordinate value and the comparison between the received coordinate value and the coordinate value when the sequence is executed normally. You may make it confirm. When the normality of the sequence executed in the large-scale distributed processing system 20 is not confirmed, the output unit 13 may issue an alarm, for example.

  Further, in the present embodiment, it is assumed that the log output timing pattern from the large-scale distributed processing system 20 is one. When there are a plurality of log output timing patterns from the large-scale distributed processing system 20, the analysis unit 12 stores in advance a plurality of sine functions including a plurality of mutually different frequencies. And the analysis part 12 determines the pattern of each output timing of the received several log, The log is made into the coordinate value in a time domain using the sine function according to the determined result among several sine functions. What is necessary is just to convert. Thereby, a plurality of different frequency components appear in the frequency domain.

  In the present invention, the processing in the log analysis device is recorded on a recording medium readable by the log analysis device, in addition to the processing realized by the dedicated hardware described above. The program recorded on the recording medium may be read by a log analysis device and executed. The recording medium that can be read by the log analysis apparatus refers to a transfer medium such as a flexible disk, a magneto-optical disk, a DVD, and a CD, and an HDD built in the log analysis apparatus.

DESCRIPTION OF SYMBOLS 10 Log analyzer 11 Log input part 12 Analysis part 13 Output part 20 Large scale distributed processing system 50 Network

Claims (6)

A log analysis device for analyzing a log output from a system,
A log output when the sequence is executed normally in the system is converted into a coordinate value of a point on a predetermined function having periodicity in the time domain based on time information included in the log, and the system The log output except when the sequence is normally executed in the step is converted into the coordinate value of the point other than the predetermined function in the time domain based on the time information included in the log, and the converted An analysis unit that calculates a coordinate value in the frequency domain by performing a Fourier transform on the coordinate value;
A log analysis device comprising: an output unit configured to output information for notifying outside of information based on the coordinate value calculated by the analysis unit. The log analysis apparatus according to claim 1,
The log analysis device that displays a graph of a frequency domain indicating the coordinate value calculated by the analysis unit. The log analysis apparatus according to claim 1,
The log analysis device, wherein the output unit confirms the normality of a sequence executed in the system based on the coordinate value calculated by the analysis unit, and performs output for notifying the result of the confirmation to the outside. In the log analysis device according to any one of claims 1 to 3,
The log analysis apparatus, wherein the predetermined function is a sine function or a cosine function. A log analysis method in a log analysis device for analyzing a log output from a system,
A log output when the sequence is executed normally in the system is converted into a coordinate value of a point on a predetermined function having periodicity in the time domain based on time information included in the log, and the system A process of converting a log output other than when the sequence is normally executed in step 1 to a coordinate value of a point other than on the predetermined function in the time domain based on time information included in the log;
A process of calculating coordinate values in the frequency domain by performing a Fourier transform on the transformed coordinate values;
And a process of performing an output for notifying the outside of information based on the calculated coordinate value. In the log analysis device that analyzes the log output from the system,
A log output when the sequence is executed normally in the system is converted into a coordinate value of a point on a predetermined function having periodicity in the time domain based on time information included in the log, and the system A function of converting a log output except when the sequence is normally executed in step 1 to a coordinate value of a point other than on the predetermined function in the time domain based on time information included in the log;
A function of calculating coordinate values in the frequency domain by performing Fourier transform on the converted coordinate values;
A program for realizing an output for notifying the outside of information based on the calculated coordinate value.

Images