JP2014115768A - Log determination system, log determination standard architecting apparatus, and log determination method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a log determination system that can distinguish between unexpected abnormal logs and logs that presage abnormality and make determination.SOLUTION: A log data memory unit 11 acquires log data outputted from a device that records processed contents as a log and stores the acquired log data. An analyzing and learning unit 14 analyzes and learns the types, tendencies and output rules of stored log data. A log determination standard architecting unit 15 architects determination standards for determining whether the acquired log data represents an unexpected abnormal log or a log that presages abnormality. A log determination unit 21 determines whether the acquired log data represents an unexpected abnormal log or a log that presages abnormality on the basis of the architected determination standards.

Description

  Embodiments described herein relate generally to a log determination system, a log determination criterion construction device, and a log determination method for determining a status of a monitoring target from log data to be monitored managed by a monitoring control device.

  In a monitoring control device or a computer having a monitoring control function (hereinafter referred to as a monitoring device), log data indicating a status for each predetermined process or periodically in control of a monitoring target by an OS (Operating System) or an application Is getting. Monitoring this log is one of the important factors for maintaining the stable operation of the monitoring target. In view of this, a monitoring control device is equipped with a log determination function, and an operation status of each process is confirmed by investigating a log in which a warning history is recorded by this function.

  In this log determination, in log monitoring, a process of classifying and recording according to the similarity of logs and the presence / absence of results is performed, and it is possible to determine frequent abnormal logs by investigating the tendency of the recorded logs. Is possible. However, in the conventional log determination, it is extremely difficult to determine a log of an unexpected abnormality or a log that is a precursor of an abnormality.

JP 2008-15733 A

  As described above, in the conventional log determination, it is possible to determine the abnormal log that appears frequently by investigating the tendency of the recorded log, but the log of the unexpected abnormality and the log that is a precursor of the abnormality It was extremely difficult to judge.

  Therefore, in order to solve the above problem, the present embodiment can identify and determine a log of an unexpected abnormality and a log that is a precursor of the abnormality, thereby improving the reliability of the system. An object of the present invention is to provide a possible log determination system, a log determination criterion construction device, and a log determination method.

  According to the present embodiment, the log determination system includes an acquisition unit, an analysis learning unit, a determination criterion construction unit, and a determination unit. The acquisition unit acquires log data output from a device that records the processing content as a log. The analysis learning means performs analysis and learning using the type, tendency, and output rule of the acquired log data as learning data. The determination criterion construction means constructs a determination criterion for determining whether the acquired log data is an abnormal log or a log indicating a sign of abnormality based on the learned result. The determination means determines whether the acquired log data is an abnormal log or a log indicating a sign of abnormality based on the established determination criterion.

The block diagram which shows the structure of the log determination system which concerns on 1st Embodiment. The flowchart which shows the log determination method in the log determination system which concerns on 2nd Embodiment. The block diagram which shows the structure of the log determination reference | standard construction apparatus which concerns on 2nd Embodiment. The block diagram which shows the structure of the log determination system during system operation which concerns on 3rd Embodiment. The sequence diagram which shows the log determination method in the log determination system in operation of the system which concerns on 3rd Embodiment.

  Hereinafter, embodiments will be described with reference to the drawings. In addition, the same code | symbol is attached | subjected to the same part in subsequent figures, the detailed description is abbreviate | omitted, and a different part is mainly described. In the following embodiments, the same description is omitted.

(First embodiment)
FIG. 1 is a block diagram illustrating a configuration of a log determination system according to the first embodiment. This log determination system inputs and records log data of a monitoring target recorded in a monitoring control device (not shown), and from the log data recorded during the operation test period of the monitoring target or during operation of the monitoring target. It is a system for determining the status of a monitoring target from recorded log data based on the learning result while learning the determination criteria. This log determination system roughly includes a log determination reference construction device 1 and a log determination device 2.

  The log determination criterion construction device 1 includes a log data storage unit 11, an input / output unit 12, a learning data extraction unit 13, an analysis learning unit 14, a log determination criterion construction unit 15, and a log determination criterion holding unit 16. And a device for constructing a criterion for determining a log to be recorded.

  The log data storage unit 11 acquires monitoring target log data recorded in the monitoring control device via the input / output unit 12 and stores the acquired log data. The log data includes information such as date and time, event ID, log level, log type, and log contents recorded during the test operation period to be monitored.

  The learning data extraction unit 13 filters the log data stored in the log data storage unit 11 according to an arbitrary period such as date and time, event, log level, and log type, and extracts log data corresponding to the filtering. . The learning data extraction unit 13 rearranges the extracted log data along a time series, and generates an optimized data group. Here, the learning data extraction unit 13 rearranges the extracted log data along a time series and defines an optimized data group as learning data.

  The analysis learning unit 14 inputs the learning data extracted by the learning data extraction unit 13, analyzes the input learning data, and based on the analysis result, the log tendency, the log type, the log output rule, etc. To learn.

  The log determination criterion construction unit 15 constructs a log determination criterion as a learning result by the analysis learning unit 14 and outputs the log determination criterion.

  The log determination criterion holding unit 16 holds the log determination criterion output from the log determination criterion construction unit 15.

  On the other hand, the log determination device 2 includes a log determination unit 21, an input / output unit 22, and a log determination information notification unit 23. Based on the log determination criteria output from the log determination criterion construction device 1, the monitoring device It is an apparatus for determining log data from.

  The log determination unit 21 inputs log data from the monitoring device via the input / output unit 22 and determines the input log data based on the log determination criterion held in the log determination criterion holding unit 16. That is, the log determination unit 21 uses the information of each log data in the learning data included in the log determination criteria, the output order of each log data, and the like as input values, and relates to an abnormality that the input log data does not assume. Whether or not the log indicates a sign of abnormality based on the probability of occurrence of abnormality and the abnormality level determined from the learning result in the analysis learning unit 14 I do.

  The log determination information notification unit 23 notifies the determination result by the log determination unit 21. The log determination information notification unit 23 outputs log determination information for notifying an abnormality when the determination result includes information indicating an abnormal log or information indicating a sign of an abnormality.

  Next, a processing flow of the log determination system having the above configuration will be described.

  FIG. 2 is a flowchart showing a log determination method in the log determination system. As shown in FIG. 2, first, the log determination system reads the log data that is output during the operation test period to be monitored or during operation and stored in the log data storage unit 11 (step S1). In the log determination system, the log determination unit 21 determines whether or not the read log data is an abnormal log based on the log determination criterion (step S2). If the read log data is an abnormality log, the log determination system notifies the abnormality (step S4). If the read log data is not an abnormal log, the log determination system determines whether the log indicates a sign of abnormality based on the log determination criterion (step S3). If the read log data is a log indicating a sign of abnormality, the log determination system notifies the abnormality (step S4). If the read log data is not a log indicating a sign of abnormality, the log determination system returns to step S1 and repeats the operation.

  As described above, in this embodiment, the log determination system learns from the recorded logs and builds a log determination criterion construction that establishes a criterion for determining a log of an unexpected abnormality or a log indicating a precursor of an abnormality. The apparatus 1 and a log determination apparatus 2 that determines a log of an unexpected abnormality or a log indicating an anomaly based on a learning result by the log determination criterion construction apparatus 1. With the above configuration, the log determination system outputs not only logs that can be determined to be abnormal abnormally, such as error logs, but also logs that are recorded with low probability of normal operation and output from usage applications such as monitoring control devices A log with a low possibility can be determined as a log with a high possibility of showing an abnormality or a sign of abnormality. Therefore, the log determination system having the above configuration can prevent the monitoring target from being abnormal, and can improve the reliability.

(Second Embodiment)
FIG. 3 is a block diagram illustrating a configuration of the log determination criterion construction device 1 according to the second embodiment.

  The log determination criterion construction device 1 according to the second embodiment acquires log data input from a plurality of monitoring control devices constituting the monitoring system via the input / output unit 12, and uses the acquired log data as log data. Store in the storage unit 11. The log determination criterion construction device 1 inputs a plurality of log data stored in the log data storage unit 11 to the learning data extraction unit 13, and rearranges and optimizes the plurality of log data in time series. As in the first embodiment, the log determination criterion construction apparatus 1 analyzes and learns the input log data by the analysis learning unit 14 and constructs the log determination criterion (entire monitoring system) by the log determination criterion construction unit 15. .

  Further, the log determination criterion construction device 1 stores log data input from a plurality of devices in the log data storage unit 11 via the input / output unit 12. The log determination criterion construction device 1 inputs a plurality of log data stored in the log data storage unit 11 to the learning data extraction unit 13, and sorts and optimizes the plurality of log data for each device. As in the first embodiment, the log determination criterion construction device 1 analyzes and learns the input log data by the analysis learning unit 14, and constructs the log determination criterion (by device) by the log determination criterion construction unit 15. To do.

  As described above, in the second embodiment, the log determination system uses the two types of log determination criteria for the entire monitoring system and each device, so that an abnormality occurring in each device can be detected in the entire monitoring system. It is possible to determine an abnormality that may occur when a plurality of devices operate simultaneously. Therefore, the log determination system of the present embodiment can improve the reliability of the device alone and the entire monitoring system.

(Third embodiment)
FIG. 4 is a block diagram illustrating a configuration of a log determination system during system operation according to the third embodiment.

  The log determination system according to the third embodiment includes monitoring control devices 31 to 3n in addition to the configuration of the first embodiment. Each unit is connected by a network NW and is sequentially recorded in the monitoring control devices 31 to 3n. Log data to be input to the log determination criterion construction device 1 and the log determination device 2.

  The monitoring control devices 31 to 3n include log data recording units 311 to 3n1, input / output units 312 to 3n2, and determination result notification units 313 to 3n3, which record log data for each monitoring target and determine the determined log This is a device for notifying the operator of the determination result.

  The log data recording units 311 to 3n1 record log data from the monitoring targets of the monitoring control devices 31 to 3n via the input / output units 312 to 3n2. The log data recording units 311 to 3n1 transmit the recorded log data to the log determination criterion construction device 1 to the log determination device 2.

  The determination result notification units 313 to 3n3 notify the operator of log determination information that is output from the log determination device 2 and includes a determination result determined by the log determination unit 21 that there is a possibility of occurrence of abnormality or abnormality.

  Next, the processing flow of the log determination system in the third embodiment will be described with reference to FIG.

  FIG. 5 is a sequence diagram illustrating a log determination method in the log determination system during system operation according to the third embodiment.

  As shown in FIG. 5, first, the monitoring control device 3 records the processing content as a log from the monitoring target (sequence S1). The log determination criterion construction device 1 reads the log data recorded in the monitoring control device 3 (sequence S2). In the log determination criterion construction device 1, the learning data extraction unit 13 extracts learning data from the read log data (sequence S3). The log determination criterion construction apparatus 1 analyzes and learns the learning data in the analysis learning unit 14 (sequence S4). In the log determination criterion construction device 1, the log determination criterion construction unit 15 constructs a log determination criterion from the learning result in the analysis learning unit 14 (sequence S5). The log determination device 2 writes the log data from the monitoring control device 3 (sequence S6). In the log determination device 2, the log determination unit 21 determines the written log based on the log determination criterion constructed by the log determination criterion construction device 1 (sequence S <b> 7). The log determination criterion construction device 1 includes the input log data information output from the log determination unit 21, the log tendency, the log type, the log output rule, the log determination result, and the like in the analysis learning unit 14. From the log determination information, an abnormality log or a log indicating an anomaly sign is sequentially learned, and the log determination reference is updated (sequence S8). When the log determination device 2 determines that there is a possibility of occurrence of abnormality or abnormality, the log determination device 2 sends log determination information indicating that abnormality or abnormality may occur to the monitoring control device 3. Upon receiving the log determination information indicating that an abnormality or an abnormality may occur, the monitoring control device 3 notifies the operator that an abnormality has occurred or an abnormality is likely to occur. (Sequence S9).

  As described above, in the third embodiment, the log determination system reads the log data recorded during operation from the monitoring control device 3 with the log determination criterion construction device 1 connected via the network NW, and the existing log. The criteria are updated sequentially. In addition, the log determination system writes the updated log determination reference to the log determination device 2 at regular intervals.

  As a result, the log determination system can flexibly cope with a change in the tendency of log data recorded in the monitoring control device 3 due to application update, hardware addition or change.

  As described above, in each of the above-described embodiments, the log determination system learns from the recorded log, and builds a reference for determining a log indicating an abnormal log or a log indicating an anomaly log. And a log determination device 2 for determining an abnormal log or a log indicating an anomaly of an abnormal log based on a learning result by the log determination criterion construction device 1. With the above configuration, the log determination system may output not only from errors such as error logs that can be reliably determined as abnormal, but also from logs that are unlikely to be recorded during normal operation and usage applications such as monitoring control devices It is possible to make a determination as a log having a low possibility of showing an abnormality or a sign of abnormality.

  Thereby, the log determination system can prevent the abnormality of the monitoring target in advance, and can improve the reliability.

  Therefore, the log determination system according to the present embodiment can identify and determine a log of an unexpected abnormality and a log that is a precursor of the abnormality, thereby improving the reliability of the system. A determination system, a log determination criterion construction device, and a log determination method can be provided.

  As mentioned above, although some embodiment of this invention was described, these embodiment is shown as an example and is not intending limiting the range of invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the invention described in the claims and equivalents thereof as well as included in the scope and gist of the invention.

  DESCRIPTION OF SYMBOLS 1 ... Log determination standard construction apparatus, 11 ... Log data storage part, 12 ... Input / output part, 13 ... Learning data extraction part, 14 ... Analysis learning part, 15 ... Log judgment standard construction part, 16 ... Log judgment standard holding part DESCRIPTION OF SYMBOLS 2 ... Log determination apparatus, 21 ... Log determination part, 22 ... Input / output part, 23 ... Log determination information notification part, 31-3n ... Monitoring control apparatus, 311-3n1 ... Log data recording part, 312-3n2 ... Input / output Part, 313-3n3 ... determination result notification part, NW ... network.

Claims (12)

Acquisition means for acquiring log data output from a device that records the processing content as a log;
Analysis learning means for performing analysis and learning using the type, tendency and output rule of the acquired log data as learning data;
Based on the learned result, a determination criterion construction means for constructing a determination criterion for determining whether the acquired log data is an abnormal log or a log indicating a sign of abnormality;
A log determination system comprising: determination means for determining whether the acquired log data is an abnormal log or a log indicating a sign of abnormality based on the established determination criterion. The acquisition unit acquires a plurality of log data output from each device when there are a plurality of devices that record the processing contents as a log,
The analysis learning means rearranges the plurality of acquired log data in time series, analyzes and learns the type, tendency and output rule of the log data as learning data,
The log determination system according to claim 1, wherein the determination criterion construction unit constructs a determination criterion for determining whether or not the entire system is an abnormal log and whether or not the log indicates a sign of abnormality. The acquisition unit acquires a plurality of log data output from each device when there are a plurality of devices that record the processing contents as a log,
The analysis learning means rearranges the acquired plurality of log data by device, performs analysis and learning using the type, tendency and output rule of the log data as learning data,
The log determination system according to claim 1, wherein the determination criterion construction unit constructs a determination criterion for determining whether or not each device is an abnormal log and whether or not the log indicates a sign of abnormality. The acquisition means acquires log data recorded during system operation,
The analysis learning means analyzes and learns the acquired log data,
The log determination system according to claim 1, wherein the determination criterion construction unit sequentially updates a determination criterion for determining the log data from the learned result. Acquisition means for acquiring log data output from a device that records the processing content as a log;
Analysis learning means for performing analysis and learning using the type, tendency and output rule of the acquired log data as learning data;
And a criterion construction means for constructing a criterion for judging whether the acquired log data is an abnormal log or a log showing a sign of abnormality based on the learned result. A log criteria creation device. The acquisition unit acquires a plurality of log data output from each device when there are a plurality of devices that record the processing contents as a log,
The analysis learning means rearranges the acquired plurality of log data in time series, and analyzes and learns the log data type, tendency, and output rule as learning data,
6. The log determination standard construction device according to claim 5, wherein the determination standard construction unit constructs a judgment standard for determining whether the entire system is an abnormal log and a log indicating a sign of abnormality. . The acquisition unit acquires a plurality of log data output from each device when there are a plurality of devices that record the processing contents as a log,
The analysis learning means rearranges the acquired plurality of log data by apparatus, performs analysis and learning using the type, tendency and output rule of the log data as learning data,
6. The log criterion construction device according to claim 5, wherein the criterion construction means constructs a criterion for judging whether or not each device is an abnormal log and a log indicating a sign of abnormality. The acquisition means acquires log data recorded during system operation,
The analysis learning means analyzes and learns the acquired log data,
The log determination criterion construction apparatus according to claim 5, wherein the determination criterion construction means sequentially updates a criterion for determining the log data from the learned result. Obtain log data output from the device that records the processing details as a log,
Using the acquired log data type, tendency, and output rule as learning data, analysis and learning,
Based on the learned result, construct a criterion for determining whether the acquired log data is an abnormal log or a log indicating a sign of abnormality,
A log determination method comprising: determining whether the acquired log data is an abnormal log or a log indicating a sign of abnormality based on the established determination criterion. If there are multiple devices that record the processing details as a log, obtain multiple log data output from each device,
Rearranging the acquired plurality of log data in time series, analyzing and learning the type, tendency and output rule of the log data as learning data,
The log determination method according to claim 9, wherein a criterion for determining whether or not the entire system is an abnormal log and whether or not the log indicates a sign of abnormality is established. If there are multiple devices that record the processing details as a log, obtain multiple log data output from each device,
Sorting the acquired plurality of log data by device, performing analysis and learning using the type, tendency, and output rule of the log data as learning data,
The log determination method according to claim 9, wherein a criterion for determining whether or not each apparatus is an abnormal log and whether or not the log indicates a sign of abnormality is established. Get log data recorded while the system is running,
Analyzing and learning the acquired log data;
The log determination method according to claim 9, wherein a determination criterion for determining the log data is sequentially updated from the learned result.

Images