JP2014191799A - Log management device, log management system, log management method and log management program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a log management device capable of efficiently and surely analyzing a log by automatically defining syntax definition information of a log message of which the syntax pattern is not defined yet.SOLUTION: Knowledge storage means stores a plurality of components which are pairs of routine character strings and parameter names. Definition storage means stores a plurality of syntax definitions each including a syntax pattern that is an arrangement order of components, and an identifier of the syntax pattern. Analysis means inputs a log message including a pair of a routine character string and a value, retrieves a syntax pattern of which the arrangement of the routine character string is matched with the log message, from the definition storage means, extracts a value corresponding to the parameter name from the log message and outputs the syntax pattern together with its identifier. If there is not syntax pattern of the matched arrangement, definition means extracts a component including the routine character string in the log message from the knowledge storage means with the arrangement of the routine character string, creates a syntax definition of a new syntax pattern and stores it in the definition storage means.

Description

  The present invention relates to a log management apparatus, a log management system, a log management method, and a log management program for defining the syntax of a log message necessary for log message analysis.

  With the recent increase in the scale of computer systems represented by data centers, the types and number of electronic devices included in computer systems have increased, and the log messages output from each electronic device have become diverse and enormous. It is coming. At the same time, the level of availability required for these computer systems is also increasing, and there is a need for techniques for efficiently collecting and analyzing a wide variety of log messages.

  As such a technique, in Patent Document 1, information that matches a predetermined failure message is identified and collected from log information generated when a failure occurs in the monitoring target device, and a predetermined search term is used. A system that identifies and collects log information that includes

  Patent Document 2 discloses a device that performs format conversion on the log data transmission device side for log messages of a plurality of formats and transmits log data with a unified format to the data collection device. Has been.

  Also, Patent Document 3 collects log information output by products of multiple vendors when a failure occurs, organizes them in time series, and not the importance determined for each product, but the importance of the entire business system A system that organizes log information in accordance with these standards and generates a report of the essential cause of the failure that occurred and how to deal with it is disclosed.

JP 2011-203911 JP 2009-9448 JP2003-216457

  In order for a log message analyzer to analyze a log message output from an electronic device, it is necessary to extract various types of information such as time, host name, directory name, and command type from the log message. In order to extract the information described above, it is possible to prepare syntax definition information that defines the syntax pattern of the log message and collate the log message with the syntax definition information.

  When an operating system, firmware, application software, or the like that operates on an electronic device is updated, the electronic device may output a log message with a new specification. At this time, the log message analysis apparatus receives a log message whose syntax definition information is undefined, and cannot extract the various kinds of information described above. Therefore, the log message cannot be analyzed.

  In recent large-scale computer systems, it is inefficient to manually add new undefined syntax definition information, resulting in a problem that a large work cost occurs. The aforementioned Patent Documents 1 to 3 are not intended to solve the above-described problems.

  An object of the present invention is to provide a log management device, a log management system, a log management method, and a log management program that solve the above-described problems.

  A log management apparatus according to an embodiment of the present invention includes a knowledge storage unit that stores a plurality of components, which is a set of a fixed character string and a variable name, a syntax pattern that is an arrangement order of the components, and an identifier of the syntax pattern A definition storage means for storing a plurality of syntax definitions including, and an electronic device in the system that outputs a log message including a pair of the fixed character string and a value, and the fixed character string included in the log message A search is made from the definition storage means for the syntax pattern in which the sequence matches the sequence of the fixed character string of the component included in the syntax pattern, and corresponds to the variable name of the component included in the syntax pattern A value to be extracted from the log message and output together with an identifier of the syntax pattern, and when the syntax pattern matching the sequence cannot be searched, The component including the fixed character string included in the log message is extracted from the knowledge storage unit according to the arrangement of the fixed character strings, and the syntax definition is created in correspondence with a new syntax pattern, and the definition Defining means for storing in the storage means.

  According to an embodiment of the present invention, a log management method stores a plurality of components in a knowledge storage area, which is a set of a fixed character string and a variable name, and a syntax pattern that is an arrangement order of the components and an identifier of the syntax pattern A plurality of syntax definitions including, are stored in the definition storage area, output by an electronic device in the system, a log message including a pair of the fixed character string and value is input, and the fixed character string included in the log message is input. A search is made from the definition storage area for the syntax pattern in which the sequence matches the sequence of the fixed character strings of the component included in the syntax pattern, and corresponds to the variable name of the component included in the syntax pattern A value to be extracted from the log message and output together with the identifier of the syntax pattern. When a syntax pattern matching the sequence cannot be searched, it is included in the log message. The component including the fixed character string to be extracted is extracted from the knowledge storage area according to the sequence of the fixed character string, and the syntax definition is created corresponding to a new syntax pattern and stored in the definition storage area .

  A log management program according to an embodiment of the present invention is a combination of a fixed character string and a variable name, a knowledge storage process for storing a plurality of components in a knowledge storage area, a syntax pattern that is an arrangement order of the components, and the A definition storage process for storing a plurality of syntax definitions including syntax pattern identifiers in a definition storage area, and an electronic device in the system that outputs a log message including a set of the fixed character string and value, and the log message The syntax pattern in which the sequence of the fixed character strings included in the list matches the sequence of the fixed character strings of the components included in the syntax pattern is searched from the definition storage area, and the syntax pattern includes A value corresponding to the variable name of the constituent element is extracted from the log message and is output together with the identifier of the syntax pattern. When the sentence pattern cannot be searched, the component including the fixed character string included in the log message is extracted from the knowledge storage area in accordance with the sequence of the fixed character string, and the syntax definition corresponding to a new syntax pattern is extracted. And a definition process for storing in the definition storage area is executed by a computer.

  The present invention automatically performs new registration to the syntax definition information of the syntax pattern of the log message whose syntax pattern is not registered based on the knowledge in which the component information of the log component included in the log message is registered. Log analysis can be performed efficiently and reliably.

It is a block diagram which shows the structure of the log management system of 1st Embodiment of this invention. It is a flowchart which shows operation | movement of 1st Embodiment of this invention. It is an example of a structure of the log message syntax definition information in 1st Embodiment of this invention. It is a structural example of the log component component information in 1st Embodiment of this invention. It is a block diagram which shows the structure of the log management apparatus of 2nd Embodiment of this invention.

  A first embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of a log management system 1 of the present embodiment. The log management system 1 of this embodiment includes a log management device 10 and electronic devices 20-1 to 20-n.

  The log management apparatus 10 receives log messages output from the electronic devices 20-1 to 20-n and analyzes the log messages. The log management device 10 includes a knowledge storage unit 11, a definition storage unit 12, a definition unit 13, an analysis unit 14, a knowledge registration unit 15, and a log message storage unit 16. The definition unit 13, the analysis unit 14, and the knowledge registration unit 15 may be electronic circuits or computer programs. The knowledge storage unit 11, the definition storage unit 12, and the log message storage unit 16 are electronic devices such as an electronic circuit or a magnetic disk whose access is controlled by a computer program.

  The log message storage unit 16 stores log messages output from the electronic devices 20-1 to 20-n.

  The definition storage unit 12 stores log message syntax definition information 120 that defines a syntax pattern of log messages output from the electronic devices 20-1 to 20-n. The log message syntax definition information 120 is a part obtained by dividing a log message with a predetermined delimiter as a reference, and the log component including at least one of a fixed character string or a variable value is the value of the variable. This is information that defines a log message syntax pattern in a sequence of log component parts expressed by substituting the name of the variable. A configuration example of the log message syntax definition information 120 is shown in FIG.

  The log message syntax definition information 120 includes a plurality of frame definitions 120-1, 120-2, and the like. Each frame definition is given an identifier. For example, the identifiers of the frame definitions 120-1 and 120-2 are 1 and 2, respectively. Each frame definition includes a plurality of parameter definitions. For example, the frame definition 120-1 includes parameter definitions 120-1-1 and 120-1-2, and the frame definition 120-2 includes a parameter definition. 120-2-1 etc. are included.

  The frame definition is information that defines the overall syntax pattern of the log message, and is output from, for example, an electronic device in which the same OS (Operating System) is operating in the electronic devices 20-1 to 20-n. Syntactic pattern definition information common to log messages. In the case of the example of FIG. 3, the frame definition 120-1 includes log component parts “<timestamp>”, “<hostname>”, “sudu”, “<username>”, and “<parameter>”. Is included.

  “<Timestamp>” is date information of the log message, “<hostname>” is information of the host name of the electronic device that has output the log message, and “<username>” is information of the user name that has output the log message. “Sudo” indicates that the agent that has output the log message is a privileged execution command. “<Parameter>” is information whose details are defined in the parameter definition.

  In the log component parts described above, the portion surrounded by “<>” is a variable, and the character string in “<>” is the name of the variable. Therefore, in the log message in which the syntax pattern is defined by the frame definition 120-1, the parts of “<timestamp>”, “<hostname>”, and “<username>” change for each log message. The date and time, host name, and user name values to be entered are entered.

  The parameter definition is information defining details of the “<parameter>” portion in the frame definition, and the syntax pattern of the log message having a different syntax pattern depending on the type of the event that has occurred in the electronic devices 20-1 to 20-n. Is defined. Each parameter definition is also given an identifier as in the frame definition. For example, the identifiers of the parameter definitions 120-1-1 and 120-1-2 are 1-1 and 1-2, respectively. is there.

  In the case of the example in FIG. 3, the parameter definition 120-1-1 includes log command component parts “command not allowed”, “TTY = <interface>”, “PWD = <directory>”, “RUNAS = <execute_user”. > ”And“ COMMAND = <action> ”.

  Among the log component parts described above, “command not allowed” is composed only of a fixed character string, and the other is composed of a fixed character string and a variable. In a log message in which a syntax pattern is defined by the parameter definition 120-1-1, “<interface>”, “<directory>”, “<execution_user>”, and “<action>” include The interface name, directory name, execution user name, and action name values that change for each log message are entered.

  The knowledge storage unit 11 stores log component component information 110 that is information of log component components corresponding to log component elements that may be included in log messages output from the electronic devices 20-1 to 20-n. doing. The log component part information 110 includes items of a part number 111, a log component part 112, and a model type 113.

  The model type 113 is information indicating the type of the electronic device 20-1 to 20-n that outputs a log message including a log component corresponding to the log component component 112. For example, the OS is UNIX (registered trademark). Server devices, server devices whose OS is Windows (registered trademark), network switch devices, and the like. The model type 113 of log component parts corresponding to a plurality of types of electronic devices includes information on a plurality of model types. In the example of FIG. 4, for example, a log component with a part number of 2 corresponds to a log component of a log message output from electronic devices of two model types A to B.

The definition unit 13 collates the syntax pattern of the log message received from any one of the electronic devices 20-1 to 20-n with the log message syntax definition information 120 in the definition storage unit 12, and the syntax pattern of the log message is the log message. It is confirmed whether or not it has been registered in the syntax definition information 120. Details of the collation operation described above when the defining unit 13 receives the log message sample 1 will be described below.

(Log message sample 1)
May 8 17:24:22 Host1 sudo: user1: command not allowed; TTY = pts / 0; PWD = / prod / home01; RUNAS = wlusr; COMMAND = / usr / bin / ksh;

The definition unit 13 first collates the frame definitions of the log message sample 1 and the log message syntax definition information 120. The definition unit 13 implements a mechanism for extracting date / time information, host name information, and user name information from a log message according to a predetermined standard, and the syntax pattern of the log message sample 1 matches the frame definition 120-1. Make sure you do. In this case, the values of the variables “<timestamp>”, “<hostname>”, and <username> ”in the frame definition 120-1 are“ May 8 17:24:22 ”,“ Host1 ”, and , “User1”.

  Next, the definition unit 13 collates the parameter definitions of the log message sample 1 and the log message syntax definition information 120. In the collation of parameter definitions, the definition unit 13 searches the log message syntax definition information 120 for a parameter definition that matches the sequence of fixed character strings included in the log message.

  The definition unit 13 confirms that the syntax pattern of the log message sample 1 matches the parameter definition 120-1-1. In this case, the values of the variables “<interface>”, “<directory>”, “<execute_user>”, and “<action>” in the parameter definition 120-1-1 are “pts / 0”, “/ Prod / home01”, “wrushr”, and “/ usr / bin / ksh”.

Next, details of the above-described collation operation when the definition unit 13 receives the log message sample 2 will be described below.

(Log message sample 2)
May 8 17:24:22 Host1 sudo: user1: command not allowed; TTY = pts / 0; PWD = / prod / home01; USER = root; COMMAND = / usr / bin / ksh;

The definition unit 13 collates the log message sample 2 with the log message syntax definition information 120, and the syntax pattern of the log message sample 2 matches the frame definition 120-1, but the parameter definition 120-1-1 It is confirmed that the log component of “USER = root” does not match and does not match other parameter definitions included in the frame definition 120-1.

  In the log component component information 110 in the knowledge storage unit 11, the definition unit 13 includes the log message sample 2 from the records in which the device type 113 includes information on the type of electronic device that is the output source of the log message sample 2. Information on log component parts corresponding to log components is extracted.

  The definition unit 13 extracts, from the log component component information 110, log component components that match the portion of the fixed character string of the log component included in the log message sample 2. In the case of the log message sample 2 and the example shown in FIG. 4, the definition unit 13 uses the log component part information 110 to record the log component parts 112 having the part numbers 111 of 1, 2, 3, 6, and 5 records. Extract information in order. The definition unit 13 arranges the log component parts in the above-described order, and generates a parameter definition described by inserting a delimiter “;” after each log component part.

The definition unit 13 newly registers the generated parameter definition in the log message syntax definition information 120 as a parameter definition included in the frame definition 120-1. The parameter definitions generated by the definition unit 13 in response to the log message sample 2 described above are as follows.

PARAMETER = “command not allowed; TTY = <interface>; PWD = <directory>; USER = <execute_user>; COMMAND = <action>;

Next, details of the above-described collation operation when the definition unit 13 receives the log message sample 3 will be described below.

(Log message sample 3)
May 8 17:24:22 Host1 sudo: user1: command not allowed; TTY = pts / 0; PWD = / prod / home01; RUNAS = wlusr; COMMAND = / usr / bin / ksh; CLASS = 0

The definition unit 13 collates the log message sample 3 with the log message syntax definition information 120, and the syntax pattern of the log message sample 3 matches the frame definition 120-1, but the parameter definition 120-1-1 It is confirmed that the log component of “CLASS = 0” does not match and does not match other parameter definitions included in the frame definition 120-1.

  The definition unit 13 tries to extract the log component part having the same part of the fixed character string of the log component included in the log message sample 3 from the log component part information 110, but the log of “CLASS = 0” The log component part corresponding to the component is not registered in the log component part information 110.

  The definition unit 13 instructs the knowledge registration unit 15 to newly register the log component part corresponding to the log component of “CLASS = 0” in the log component part information 110. The definition unit 13 generates a parameter definition using the newly registered log component part after the new registration of the log component part by the knowledge registration unit 15 is completed, and newly registers it in the log message syntax definition information 120.

  The knowledge registration unit 15 receives an instruction from the definition unit 13 and newly registers a log component part in the log component part information 110. When the received log component includes “=” as in “CLASS = 0” described above, the knowledge registration unit 15 regards the part after “=” as a variable value, The character string after “=” is replaced with the variable name assigned to the variable to generate a log component part. For example, the definition unit 13 assigns a variable name “reserve1” to the log component “CLASS = 0”, and encloses the variable name with “<>” before and after the variable name “CLASS = <reserve1>”. Generate log component parts.

  When the received log component does not include “=”, the knowledge registering unit 15 regards that the log component includes only a fixed character string, and determines the character string of the received log component as As it is, it is newly registered in the log component part information 110 as a log component part.

  Note that the knowledge registration unit 15 may distinguish a variable from a standard character string based on a predetermined character string such as “=”, or may use a variable value as a variable value after a predetermined character string of a predetermined number of characters. In some cases, it is possible to distinguish fixed character strings from variables.

  The analysis unit 14 reads out the log messages output from the electronic devices 20-1 to 20-n stored in the log message storage unit 16, and performs the log message syntax definition information 120 and the logical operation similar to the definition unit 13. Match. The analysis unit 14 extracts a value corresponding to the variable name in the syntax pattern that matches the log message from the log message, and stores a database (not shown) that stores information on the content of the response to the log message along with the identifier of the matching syntax pattern. ) And information on the contents of the countermeasure obtained from the database is output to a system administrator's console screen (not shown).

  Next, the operation of this embodiment will be described in detail with reference to the flowchart of FIG.

  The log management apparatus 10 stores the log message received from the electronic device 20-i (i is an integer from 1 to n) in the log message storage unit 16 (S101). The definition unit 13 collates the syntax pattern of the log message received from the electronic device 20-i with the log message syntax definition information 120 in the definition storage unit 12, and the log message syntax pattern is registered in the log message syntax definition information 120. It is confirmed whether or not there is (S102).

  When the syntax pattern of the log message has been registered (Yes in S103), the analysis unit 14 reads the log message from the log message storage unit 16, compares it with the log message syntax definition information 120, and matches the log message. A value corresponding to the variable name in the pattern is extracted from the log message, and is output together with the identifier of the syntax pattern, the log message is analyzed (S109), and the entire process ends.

  If the syntax pattern of the log message has not been registered (No in S103), the definition unit 13 includes information on the device type 113 of the electronic device 20-i in the log component part information 110 in the knowledge storage unit 11. A log component part corresponding to the log component included in the log message is extracted from the record (S104).

  When there is no log component part corresponding to the log component that is not registered in the log component part information 110 (No in S105), the definition unit 13 extracts the syntax pattern of the log message from the extracted log It is generated in a sequence of component parts, an identifier is assigned to the syntax pattern, and it is newly registered in the log message syntax definition information 120 (S108), and the entire process is terminated through S109.

  If there is a log component part corresponding to the log component that has not been registered in the log component part information 110 (Yes in S105), the definition unit 13 sends a log configuration to the knowledge registration unit 15. A new registration of the log component part of the log component whose element part has not been registered to the log component pattern information 110 is instructed (S106).

  When the log component includes a variable, the knowledge registration unit 15 generates a log component component by replacing the value of the variable in the log component with the variable name assigned to the variable, and generates the log component A part number is assigned to the component part and newly registered in the log component part information 110 (S107), and the process returns to S104.

  In this embodiment, based on the knowledge that registered the component information of the log component included in the log message, new registration to the syntax definition information of the syntax pattern of the log message whose syntax pattern is not registered is automatically performed, There is an effect that the log analysis can be performed efficiently and reliably. The reason is that when the definition unit 13 collates the log message received from the electronic devices 20-1 to 20-n with the log message syntax definition information 120 and the log message syntax pattern is unregistered, This is because the log message syntax pattern is generated using the log component parts registered in the log component part information 110 and registered in the log message syntax definition information 120.

  The analysis unit 14 collates the log message output from the electronic devices 20-1 to 20-n stored in the log message storage unit 16 with the log message syntax definition information 120, and sets the value of the variable to the value of the variable. The log message is analyzed in association with the name and extracted. When the syntax pattern of the log message is not registered in the log message syntax definition information 120, the analysis unit 14 cannot analyze the log message with reference to the log message analysis database. It will cause trouble.

  In recent large-scale computer systems, new electronic devices and software upgrades are frequently performed. Therefore, the log management device 10 uses a log message whose syntax pattern is not defined in the log message syntax definition information 120. There is a tendency to increase the number of cases of receiving. It is impractical to manually add new undefined syntax definition information in consideration of work costs and the like.

  In the present embodiment, the log management apparatus 10 can automatically add new undefined syntax definition information by holding the log component part information 110, and as a result, log analysis can be efficiently performed. It is possible to perform reliably.

  In the present embodiment, when the definition unit 13 extracts log component parts from the log component part information 110, the device type 113 in the log component part information 110 is the device of the electronic device from which the log message is output. Search for records that contain type information. If the electronic device type is different, the log component part information is also different. Therefore, the definition unit 13 does not search all records of the log component part information 110, but narrows down the records to be searched, thereby managing the log. The apparatus 10 can perform new registration of syntax definition information more efficiently.

In the present embodiment, when the information of the log component part corresponding to the log component of the log message is not registered in the log component part information 110, the knowledge registration unit 15 issues an instruction from the definition unit 13. In response, a new log component part is generated and registered in the log component part information 110. For log messages that include log components that have not been registered as log component parts, the definition unit 13 can newly register syntax definition information, so that the log message can be analyzed without the syntax pattern being defined. The log management apparatus 10 can more reliably analyze the log message by avoiding the loss.
<Second Embodiment>
Next, a second embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 5 is a block diagram showing the configuration of the log management apparatus 10 according to the second embodiment of the present invention.

  The log management apparatus 10 according to the present embodiment includes a knowledge storage unit 11, a definition storage unit 12, a definition unit 13, and an analysis unit 14.

  The knowledge storage unit 11 stores log component part information 110 including a plurality of records relating to log component parts which are pairs of fixed character strings and variable names.

  The definition storage unit 12 stores log message syntax definition information 120 including a plurality of records related to a syntax definition including a syntax pattern that is an arrangement order of log component parts and an identifier of the syntax pattern.

  The analysis unit 14 outputs the electronic device 20-1 to 20-n, inputs a log message including a set of a fixed character string and a value, and includes the fixed character string included in the log message and the syntax pattern The definition storage unit 12 is searched for a syntax pattern in which the sequence of the fixed character strings of the log component parts to be matched matches. The analysis unit 14 extracts a value corresponding to the variable name of the log component part included in the syntax pattern from the log message, and outputs the value together with the identifier of the syntax pattern.

  When the syntactic pattern with the matching sequence cannot be searched, the definition unit 13 extracts the log component part including the fixed character string included in the log message from the knowledge storage unit 11 according to the fixed character string sequence, and creates a new Information on the syntax definition is created corresponding to the syntax pattern and stored in the definition storage unit 12.

  In the present embodiment, as in the first embodiment, the syntax definition information of the syntax pattern of the log message whose syntax pattern is not registered based on the knowledge in which the component information of the log component included in the log message is registered. New registration is automatically performed, and log analysis can be performed efficiently and reliably. The reason is that when the definition unit 13 collates the log message received from the electronic devices 20-1 to 20-n with the log message syntax definition information 120 and the log message syntax pattern is unregistered, This is because the log message syntax pattern is generated using the log component parts registered in the log component part information 110 and registered in the log message syntax definition information 120.

  While the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

DESCRIPTION OF SYMBOLS 1 Log management system 10 Log management apparatus 11 Knowledge memory | storage part 110 Log component part information 111 Part number 112 Log component part 113 Device classification 12 Definition memory | storage part 120 Log message syntax definition information 120-1 Frame definition 120-2 Frame definition 120 -1-1 Parameter definition 120-1-2 Parameter definition 120-2-1 Parameter definition 13 Definition unit 14 Analysis unit 15 Knowledge registration unit 16 Log message storage unit 20-1 to 20-n Electronic device

Claims (10)

Knowledge storage means for storing a plurality of components, which is a set of a fixed character string and a variable name;
Definition storage means for storing a plurality of syntax definitions including a syntax pattern that is an arrangement order of the constituent elements and an identifier of the syntax pattern;
An electronic device in the system outputs, inputs a log message including a set of the fixed character string and a value, a sequence of the fixed character string included in the log message, and the component included in the syntax pattern The syntax pattern that matches the sequence of the fixed character strings is searched from the definition storage means, a value corresponding to the variable name of the component included in the syntax pattern is extracted from the log message, and the syntax pattern An analysis means for outputting together with the identifier of
When a syntactic pattern that matches the sequence cannot be searched, the component including the standard character string included in the log message is extracted from the knowledge storage unit according to the sequence of the standard character string, and a new syntax pattern is extracted. A definition means for creating the syntax definition correspondingly and storing it in the definition storage means;
A log management device comprising: The knowledge storage means stores the component and the identification information of the type of the electronic device in association with each other,
The definition means extracts from the knowledge storage means the component that matches the output information of the log message and the identification information of the type of the electronic device.
The log management apparatus according to claim 1. When the component including the fixed character string included in the log message is not registered in the knowledge storage unit, the variable name is generated, and the knowledge as a new component together with the fixed character string is generated. The log management apparatus according to claim 1, further comprising knowledge registration means stored in the storage means.   A log management system including the log management apparatus according to claim 1 and the electronic device. Store multiple components in knowledge storage, which are pairs of fixed character strings and variable names,
Storing a plurality of syntax definitions in a definition storage area including a syntax pattern that is an arrangement order of the constituent elements and an identifier of the syntax pattern;
An electronic device in the system outputs, inputs a log message including a set of the fixed character string and a value, a sequence of the fixed character string included in the log message, and the component included in the syntax pattern The syntax pattern that matches the sequence of the fixed character strings is searched from the definition storage area, and a value corresponding to the variable name of the component included in the syntax pattern is extracted from the log message. With the identifier of
When a syntax pattern that matches the sequence cannot be searched, the component including the fixed character string included in the log message is extracted from the knowledge storage area according to the fixed character string sequence, and a new syntax pattern is extracted. The syntax definition is created correspondingly and stored in the definition storage area.
Log management method. Storing the component and identification information of the type of the electronic device in association with each other in the knowledge storage area;
Extracting the component from which the log message output source and the identification information of the electronic device type match from the knowledge storage area;
The log management method according to claim 5. When the component including the fixed character string included in the log message is not registered in the knowledge storage area, the variable name is generated, and the knowledge as a new component together with the fixed character string is generated. Store in storage,
The log management method according to claim 5. Knowledge storage processing for storing a plurality of components in the knowledge storage area, which is a set of fixed character string and variable name,
A definition storage process for storing a plurality of syntax definitions including a syntax pattern that is an arrangement order of the constituent elements and an identifier of the syntax pattern in a definition storage area;
An electronic device in the system outputs, inputs a log message including a set of the fixed character string and a value, a sequence of the fixed character string included in the log message, and the component included in the syntax pattern The syntax pattern that matches the sequence of the fixed character strings is searched from the definition storage area, and a value corresponding to the variable name of the component included in the syntax pattern is extracted from the log message. An analysis process to be output with the identifier of
When a syntax pattern that matches the sequence cannot be searched, the component including the fixed character string included in the log message is extracted from the knowledge storage area according to the fixed character string sequence, and a new syntax pattern is extracted. A definition process for creating the syntax definition correspondingly and storing it in the definition storage area;
Log management program that causes a computer to execute The knowledge storage process for storing the component and the identification information of the type of the electronic device in association with each other in the knowledge storage area;
The definition processing for extracting from the knowledge storage area the component that matches the output information of the log message and the identification information of the type of the electronic device,
The log management program according to claim 8, which causes a computer to execute. When the component including the fixed character string included in the log message is not registered in the knowledge storage area, the variable name is generated, and the knowledge as a new component together with the fixed character string is generated. 10. The log management program according to claim 8, which causes a computer to execute a knowledge registration process stored in a storage area.

Images