JP2015212877A - Log management method, log management system, log management device, and log management program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To flexibly analyze log data.SOLUTION: A log management method is implemented by a log management system, and includes a conversion process of converting log data output by a computer into an intermediate log of one of a predetermined preset number of kinds, and a relating process of relating the intermediate log to another intermediate log different from the intermediate log by using a pattern in which a relating process corresponding to the kind of the intermediate log is predetermined.

Description

  Embodiments described herein relate generally to a log management method, a log management system, a log management apparatus, and a log management program.

  In recent years, appropriate information handling has been demanded from the viewpoint of information security. For example, prior measures and subsequent measures have been proposed for information leakage.

  For example, as a prior measure, there is a technique for preventing information leakage by monitoring content passing through a network. In this technique, for example, an event for accessing content is detected and interrupted, and it is checked whether the detected event violates a policy in which appropriate handling of information is defined. Here, if the detected event violates the policy, for example, a response according to the policy such as a warning or a block is performed. In this technique, a policy needs to be defined according to a configuration change of a system (apparatus) to be applied. However, it is difficult to cover a policy for every configuration change.

  In order to solve such a problem, there is a technique for analyzing log data generated by a computer, for example, as a subsequent measure. This technology, for example, collects log data from a computer in a company and examines the relationship between the collected log data to clarify how the content has been handled. This technology, for example, reveals the course of information leakage even if not covered by content monitoring technology.

Toshihiro Motoda, Takeshi Nagayoshi, Junya Akiba, Masaru Takeuchi, “Traceability Platform TRX”, NTT Technical Journal, March 2014 issue, pp. 57-62

  However, the above-described conventional technology has a problem that it is difficult to analyze log data flexibly.

  For example, in order to identify the location of information leakage, analysis may be performed while adding the type of log data to be analyzed until the location can be identified. Here, in order to analyze log data, a processing program for performing a series of processes (normalization, association, graphing, etc.) until an analysis result is obtained is required for each type of log data. For this reason, every time log data to be analyzed is added, there is a problem that it takes effort to prepare a processing program. Further, for example, since the processing program is executed according to the type of log data, there is a problem that it is difficult to associate different types of log data.

  Therefore, the present invention has been made to solve the above-described problems of the prior art, and an object thereof is to flexibly analyze log data.

  A log management method according to an embodiment is a log management method executed by a log management system, wherein log data output from a computer is stored as an intermediate log of any kind among a predetermined number of kinds set in advance. An association step for associating the intermediate log with another intermediate log different from the intermediate log using a pattern in which an association process corresponding to the type of the intermediate log is defined. including.

  According to one aspect of the technology disclosed in the present application, there is an effect that log data can be analyzed flexibly.

FIG. 1 is a diagram illustrating an example of a configuration of a network system including a log management apparatus according to the present embodiment. FIG. 2 is a diagram illustrating an example of the configuration of the log management apparatus according to the present embodiment. FIG. 3 is a diagram illustrating an example of an intermediate log stored in the intermediate log storage unit according to the present embodiment. FIG. 4A is a diagram for describing the operation types according to the present embodiment. FIG. 4B is a diagram for describing the operation types according to the present embodiment. FIG. 4C is a diagram for describing the operation types according to the present embodiment. FIG. 4D is a diagram for describing operation types according to the present embodiment. FIG. 4E is a diagram for describing operation types according to the present embodiment. FIG. 5 is a diagram illustrating an example of the graphing log stored in the graphing log storage unit according to the present embodiment. FIG. 6 is a diagram for explaining the outline of the processing of the graphing processing unit according to the present embodiment. FIG. 7 is a flowchart showing the flow of processing in the log management apparatus according to this embodiment. FIG. 8 is a flowchart showing the flow of processing in the graphing processing according to this embodiment. FIG. 9A is a diagram for explaining the effect of the log management apparatus according to the present embodiment. FIG. 9B is a diagram for explaining the effect of the log management apparatus according to the present embodiment. FIG. 10A is a diagram for explaining the effect of the log management apparatus according to the present embodiment. FIG. 10B is a diagram for explaining the effect of the log management apparatus according to the present embodiment. FIG. 11 is a diagram illustrating a computer that executes a log management program.

  Exemplary embodiments of a log management method, a log management system, a log management apparatus, and a log management program according to the present invention will be described below in detail with reference to the accompanying drawings. In addition, this invention is not limited by this embodiment.

(Embodiment)
(Configuration of log management apparatus 100)
FIG. 1 is a diagram illustrating an example of a configuration of a network system including a log management apparatus 100 according to the present embodiment. As shown in FIG. 1, the network system according to the present embodiment includes a plurality of hosts 10-1, 10-2,... 10-n (n is a natural number), a user terminal 20, a log management device 100, Is provided. The plurality of hosts 10-1, 10-2,... 10 -n, the user terminal 20, and the log management apparatus 100 are connected to each other via the network 5. In the following description, the hosts 10-1, 10-2,... 10-n are collectively referred to as “host 10” when they are collectively referred to. FIG. 1 is only an example. For example, the number of hosts 10 connected to the network 5 is not necessarily plural, and may be one.

  The host 10 is a device that outputs log data to be analyzed. For example, when various types of information processing are performed, the host 10 outputs log data (original log) in each format such as Syslog format, CSV format, XML format, and the like. The host 10 is an information processing apparatus on which an application operates, such as a PC (Personal Computer) or a server.

  The user terminal 20 is a terminal device operated by a user. It connects to the log management apparatus 100 via the network 5 and uses a graphed log described later. Thereby, the user can investigate the relationship of log data output from the host 10 and clarify the progress of information leakage.

  The log management apparatus 100 is an apparatus that analyzes log data output from the host 10. For example, the log management apparatus 100 stores a graphed log that is an analysis result, and appropriately provides a graphed log in response to a request from the user.

  FIG. 2 is a diagram illustrating an example of the configuration of the log management apparatus 100 according to the present embodiment. As illustrated in FIG. 2, the log management apparatus 100 includes a storage unit 110 and a control unit 120.

  The storage unit 110 includes a log storage unit 111, a conversion program storage unit 112, an intermediate log storage unit 113, and a graphing log storage unit 114. For example, the storage unit 110 is realized by a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

  The log storage unit 111 stores log data output from the host 10. For example, log data stored in the log storage unit 111 is collected from the host 10 by the collection unit 121 described later, and stored in each format such as Syslog format, CSV format, and XML format. For example, the log data stored in the log storage unit 111 is referred to by the selection unit 122 and the conversion unit 123 described later.

  For log data stored in the log storage unit 111, encryption using an existing encryption algorithm (for example, Camellia, RFC3713, etc.) or time stamp using a time stamp protocol (for example, RFC3161). , And a signature processing using an XML signature (for example, RFC2807, RFC3075) may be performed separately.

  The conversion program storage unit 112 stores a conversion program for converting log data into an intermediate log described later. For example, the conversion program stored in the conversion program storage unit 112 is set by the user for each type of log data to be added when log data to be analyzed is added. For example, the conversion program stored in the conversion program storage unit 112 is read by the conversion unit 123 described later. Note that the processing of the conversion program (processing of the conversion unit 123) will be described later.

  The intermediate log storage unit 113 stores any type of intermediate log among a predetermined number of types. For example, the intermediate log storage unit 113 stores the intermediate log converted by the conversion unit 123 described later. For example, the intermediate log storage unit 113 is referred to by a graphing processing unit 124 described later.

  FIG. 3 is a diagram illustrating an example of an intermediate log stored in the intermediate log storage unit 113 according to the present embodiment. As illustrated in FIG. 3, the intermediate log stored in the intermediate log storage unit 113 includes a “log ID”, “date / time”, “operation type”, “input content ID list”, and “output content ID list”. "Is a piece of information associated with each other. Here, the log ID is an identifier for uniquely identifying the intermediate log. For example, this log ID may be the same as the ID (identifier) of log data before being converted into the intermediate log. The date and time is information indicating the date and time when the event (log data) occurs. The operation type is information indicating the type of operation performed on the content in the event. The input content ID list is a list of content IDs of contents to be input for an event. The content ID is an identifier for uniquely identifying the content. The output content ID list is a list of content IDs of content to be output as events. For example, if the content is a file, the input content ID and the output content ID are a combination of the identification information (for example, IP address or MAC address) of the host 10 on which the operation indicated by the log data is performed and the file path. Expressed. If the content is a mail message, the input content ID and the output content ID are expressed by identification information (message ID or the like) of the message. Note that, in one intermediate log, the input content ID and the output content ID may be different or may match.

  Note that FIG. 3 is merely an example. For example, the intermediate log storage unit 113 does not necessarily have to include all of the information illustrated in FIG. 3, and may have at least one of the input content ID and the output content ID. For example, in addition to the information illustrated in FIG. 3, “optional item” may be included as additional information. The option items are, for example, log data items before conversion used for visualization, and information used for explanation and supplement. Specific examples of option items include “user ID (WHO)” for indicating what the subject who performed the operation indicated by the log data is, and where the operation indicated by the log data is performed. “Host ID (WHERE)” and the like can be mentioned.

  Here, the operation type will be described. In the present embodiment, the operation type is represented by any of the five types of information “generation”, “deletion”, “conversion”, “branch”, and “join”. Here, “generation” is information indicating that the content has been generated. “Delete” is information indicating that the content has been deleted. “Conversion” is information indicating that the content has been converted. “Branch” is information indicating that the content has branched into a plurality of contents. “Merging” is information indicating that a plurality of contents are merged into one content.

  4A to 4E are diagrams for explaining operation types according to the present embodiment. 4A shows an example of an intermediate log of the operation type “generation”, FIG. 4B shows an example of an intermediate log of the operation type “delete”, and FIG. 4C shows an intermediate log of the operation type “conversion”. An example is shown, FIG. 4D shows an example of an intermediate log of the operation type “branch”, and FIG. 4E shows an example of an intermediate log of the operation type “join”.

  As illustrated in FIG. 4A, the intermediate log of the operation type “generation” is information in which a log ID, a date and time, an operation type “generation”, and an output content ID are associated with each other. Examples of the intermediate log of the operation type “generation” include creation of a new file and generation of a new message.

  Further, as illustrated in FIG. 4B, the intermediate log of the operation type “deletion” is information in which the log ID, the date, the operation type “deletion”, and the input content ID are associated with each other. Examples of the intermediate log of the operation type “delete” include file deletion and message deletion.

  As shown in FIG. 4C, the intermediate log of the operation type “conversion” is information in which a log ID, date and time, operation type “conversion”, input content ID, and output content ID are associated with each other. . Examples of the intermediate log of the operation type “conversion” include content name and identifier change, file movement and name change, content content (byte string) change, file editing, and the like. If the content is only browsed, there is usually no change in the content. Therefore, no log data is generated, and as a result there is no corresponding intermediate log.

As shown in FIG. 4D, the intermediate log of the operation type “branch” includes a log ID, a date and time, an operation type “branch”, an input content ID, and a plurality of output content ID _{1 to} ID _N (N is (Natural number) is associated with the information. Examples of intermediate logs of operation type "branch" include file duplication (branch from original file to duplicate file), file attachment to email (branch from original file to email attachment), email For example, storage of attached files (branch from mail to storage file).

As shown in FIG. 4E, the intermediate log of the operation type “join” includes a log ID, date and time, operation type “join”, a plurality of input contents ID _{1 to} ID _N (N is a natural number), and an output. This is information associated with a content ID. An example of the intermediate log of the operation type “join” is file compression.

  The graphing log storage unit 114 stores a graphing log described later. For example, the graphing log storage unit 114 stores a graphing log generated by the graphing processing unit 124 described later. Here, the graphed log is information representing an association between the intermediate log and another intermediate log different from the intermediate log. The graphing log stored in the graphing log storage unit 114 is stored in a state that can be searched and viewed from the user terminal 20. The storage area for storing the graphing log is also referred to as “graphing log area”. The graphed log is also simply referred to as “node”.

  FIG. 5 is a diagram illustrating an example of the graphing log stored in the graphing log storage unit 114 according to the present embodiment. As shown in FIG. 5, the graphing log stored in the graphing log storage unit 114 includes “log ID”, “date / time”, “operation type”, “input log list”, and “output log list”. "Is a piece of information associated with each other. Here, the log ID is an identifier for uniquely identifying a node, and is represented by the same log ID as the intermediate log. The date / time is information representing the date / time when the log data corresponding to the log ID occurred. The operation type is information indicating the type of operation performed on the content in the log data corresponding to the log ID. The input log list is a list of information in which the content ID of the content that is the input of the operation corresponding to the log ID is associated with the log ID of the operation that output the content. The output log list is a list of information in which the content ID of the content output by the operation corresponding to the log ID is associated with the log ID of the operation using the content as an input. For example, an association (one-way or two-way link relationship) between nodes is formed by the input log list and the output log list.

  Note that FIG. 5 is merely an example. For example, like the intermediate log storage unit 113, the graphed log storage unit 114 may have “option items”.

  The control unit 120 includes a collection unit 121, a selection unit 122, a conversion unit 123, and a graphing processing unit 124. For example, the control unit 120 is realized by executing a program stored in an internal storage device using a RAM as a work area by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like. The control unit 120 may be realized by an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

  The collection unit 121 collects log data. For example, each time the log data is output from each host 10, the collection unit 121 receives the output log data. Then, the collection unit 121 stores the received log data in the log storage unit 111.

  The collecting unit 121 may not only passively collect log data but also actively collect log data. In this case, for example, log data generated by each host 10 is stored in the host 10. Then, the collection unit 121 collects log data stored in each host 10 at a predetermined timing. In other words, the collecting unit 121 can widely apply existing techniques for collecting log data. For example, as the collection unit 121, a Syslog protocol (RFC3164, RFC5424) used in the UNIX (registered trademark) system, FTP (RFC959) used in file transfer, SCP / SSH (RFC4250, RFC4251, RFC4252, RFC4253, RFC4254, RFC4255, RFC4256) or the like may be applied alone or in appropriate combination.

  The selection unit 122 selects a conversion program. For example, the selection unit 122 acquires log data that is an analysis target (processing target) from the log storage unit 111. Then, the selection unit 122 refers to the conversion program storage unit 112 and selects a conversion program corresponding to the type of log data to be analyzed. Then, the selection unit 122 outputs log data to be analyzed and information indicating the selected conversion program to the conversion unit 123.

  Note that the conversion program selected by the selection unit 122 is set in advance according to the type of log data. For example, the selection unit 122 identifies the type of log data, such as log data output by a specific host 10 or log data output by a specific application, using information associated with the log data. And select a specific conversion program.

  The conversion unit 123 converts log data output from the host 10 into an intermediate log. For example, the conversion unit 123 receives log data output from the selection unit 122 and information indicating the selected conversion program. Then, the conversion unit 123 reads a conversion program corresponding to information indicating the received conversion program from the conversion program storage unit 112. Then, the conversion unit 123 converts the log data received from the selection unit 122 into an intermediate log using the read conversion program.

  Specifically, the conversion unit 123 uses the log data to be analyzed as input data, and extracts items from the log data according to the type of the log data (for example, the type of format). The items extracted here are, for example, a log ID of log data, a date and time, an operation type, a content ID of content to be input, and a content ID of content to be output. Then, the conversion unit 123 performs normalization of each extracted item (for example, unification of date format, etc.) and associates each normalized item to generate an intermediate log. In other words, the intermediate logs generated here are classified into a predetermined number of operation types (generation, deletion, conversion, branching, and merge). Then, the conversion unit 123 stores the converted intermediate log in the conversion unit 123.

  The graphing processing unit 124 performs graphing processing for graphing from the intermediate log. For example, the graphing processing unit 124 uses, for example, a pattern (processing pattern) in which association processing corresponding to the type of the intermediate log is defined in the graphing process, and the intermediate log is different from the intermediate log. Is associated with the intermediate log. Specifically, the graphing processing unit 124 associates the intermediate logs that share the identifier of the content that is the input of the operation indicated by the log data or the content identifier output by the operation. As a result, the graphing processing unit 124 generates a graphing log, and stores the generated graphing log in the graphing log storage unit 114. The graphing processing unit 124 is an example of an association unit.

  FIG. 6 is a diagram for explaining the outline of the processing of the graphing processing unit 124 according to the present embodiment. In the example illustrated in FIG. 6, the intermediate log with the log ID 0 has the operation type “generation” and the output content “content ID 0”. In the intermediate log of log ID 1, the operation type is “branch”, the input content is “content ID 0”, and the output content is “content IDN (N is a natural number)”. In the intermediate log of log ID 2, the operation type is “delete” and the input content is “content IDN”.

  As illustrated in FIG. 6, for example, the graphing processing unit 124 associates the intermediate log with the log ID 0, the intermediate log with the log ID 1, and the intermediate log with the log ID 2. Here, since the output content of the intermediate log with the log ID 0 and the input content of the intermediate log with the log ID 1 both match with the “content ID 0”, the graphing processing unit 124 associates the intermediate logs with each other. In addition, since the output content of the intermediate log with the log ID 1 and the input content of the intermediate log with the log ID 2 both match with “content IDN”, the graphing processing unit 124 associates the intermediate logs with each other.

  As described above, the graphing processing unit 124 associates each intermediate log stored in the intermediate log storage unit 113. Note that FIG. 6 is merely an example. Specifically, the graphing processing unit 124 uses processing patterns corresponding to five types of intermediate logs of “generation”, “deletion”, “conversion”, “branch”, and “confluence”, respectively, Associate intermediate logs. Hereinafter, this processing pattern will be specifically described.

(Graphing process for generation)
First, a processing pattern (graphing processing for generation) of graphing processing for associating the intermediate log of the operation type “generation” will be described. Here, a case where the intermediate log to be analyzed is “intermediate log A” will be described. The intermediate log A is information in which a log ID “La”, a date and time “Da”, an operation type “generation”, an output content ID list “COa”, and an option item “Opta” are associated with each other.

  In this case, the graphing processing unit 124 creates a node based on the information of the intermediate log A. In the graphing process for generation, the graphing processing unit 124 registers each content ID included in the output content ID list and “NULL” in the output log ID list of the newly created node. Items (log ID, date / time, operation type, option item) are registered with the same values as the intermediate log. That is, the graphing processing unit 124 associates the log ID “La”, the date and time “Da”, the operation type “generation”, the output log ID list “<COa, NULL>”, and the option item “Opta”. Create “NULL” indicates an empty value.

(Graphing process for deletion)
Next, a graphing process pattern (deleting graphing process) for associating the intermediate log of the operation type “deletion” will be described. Here, a case where the intermediate log to be analyzed is “intermediate log A” will be described. The intermediate log A is information in which a log ID “La”, date and time “Da”, operation type “generation”, input content ID list “CIa”, and option item “Opta” are associated with each other.

  In this case, the graphing processing unit 124 selects the element of the output content ID that is the same as each content ID included in the input content ID list of the intermediate log to be analyzed from the graphing region (graphing log storage unit 114). Of the nodes having the date and time before the date and time of the intermediate log in the output log ID list, the node satisfying the node having the latest date and time is acquired. Then, the graphing processing unit 124 registers the log ID of the intermediate log to be analyzed in the log ID “NULL” corresponding to the same content ID in the acquired output log ID list of the node.

  Here, the graphing processing unit 124 indicates that “the node having the output content ID element identical to the input content ID list“ CIa ”in the output log ID list and having the date and time before the date and time“ Da ”of the intermediate log. Among them, the node having the log ID “Lx” is acquired as “the node with the newest date and time”. Then, the graphing processing unit 124 registers “La” in the log ID “NULL” corresponding to “CIa” in the output log ID list of the node with the acquired log ID “Lx”.

  Further, the graphing processing unit 124 creates a node based on the information of the intermediate log A. In the graphing process for deletion, the graphing processing unit 124 uses the input content ID list of the intermediate log to be analyzed and each content ID as the input log ID list of the newly created node. The log ID of the node is registered, and the same values as the intermediate log are registered for the other items. That is, the graphing processing unit 124 associates the log ID “La”, the date and time “Da”, the operation type “delete”, the input log ID list “<CIa, Lx>”, and the option item “Opta”. Create

(Graphization processing for conversion)
Next, a graphing process pattern (conversion graphing process) for associating the intermediate log of the operation type “conversion” will be described. Here, a case where the intermediate log to be analyzed is “intermediate log A” will be described. This intermediate log A is associated with log ID “La”, date and time “Da”, operation type “conversion”, input content ID list “CIa”, output content ID list “COa”, and option item “Opta”. Information.

  In this case, the graphing processing unit 124 creates a node based on the information of the intermediate log A. In the graphing process for conversion, the graphing processing unit 124 registers “NULL” in the input log ID list of the newly created node, and each output included in the output content ID list in the output log ID list. The content ID and “NULL” are registered, and the same values as the intermediate log are registered for the other items. That is, the graphing processing unit 124 includes the log ID “La”, the date and time “Da”, the operation type “conversion”, the input log ID list “NULL”, the output log ID list “<COa, NULL>”, and the option item “ A node associated with “Opta” is created.

  Further, the graphing processing unit 124 has an element of the output content ID that is the same as each content ID included in the input content ID list of the intermediate log to be analyzed in the output log ID list from the graphing area, and , Among the nodes having the date and time before the date and time of the intermediate log, the node that satisfies the node having the newest date and time is acquired. Then, the graphing processing unit 124 registers the log ID of the intermediate log to be analyzed in the log ID “NULL” corresponding to the same content ID in the acquired output log ID list of the node.

  Here, the graphing processing unit 124 indicates that “the node having the output content ID element identical to the input content ID list“ CIa ”in the output log ID list and having the date and time before the date and time“ Da ”of the intermediate log. Among them, the node having the log ID “Lx” is acquired as “the node with the newest date and time”. Then, the graphing processing unit 124 registers “La” in the log ID “NULL” corresponding to “CIa” in the output log ID list of the node with the acquired log ID “Lx”.

  Further, the graphing processing unit 124 associates each content ID included in the input content ID list of the intermediate log to be analyzed with the node ID of the acquired node in the created node input log ID list “NULL”. Register the attached information. In other words, the graphing processing unit 124 registers the input log ID list “<CIa, Lx>” in the input log ID list “NULL” of the node with the created log ID “La”.

(Graphization processing for branching)
Next, a graphing process pattern (branching graphing process) for associating the intermediate log of the operation type “branch” will be described. Here, a case where the intermediate log to be analyzed is “intermediate log A” will be described. This intermediate log A includes log ID “La”, date and time “Da”, operation type “generation”, input content ID list “CIa”, output content ID list “COa1, COa2,... COaN ′ (N ′ is a natural number) ) ”And the option item“ Opta ”are associated with each other.

  In this case, the graphing processing unit 124 creates a node based on the information of the intermediate log A. In the graphing process for branching, the graphing processing unit 124 registers “NULL” in the input log ID list of the newly created node, and the output log ID list includes each item included in the output content ID list. The content ID and “NULL” are registered, and the same values as the intermediate log are registered for the other items. That is, the graphing processing unit 124 includes a log ID “La”, a date and time “Da”, an operation type “branch”, an input log ID list “NULL”, and an output log ID list “<COa1, NULL>, <COa2, NULL>”. ,... <COaN ′, NULL> ”and the option item“ Opta ”are associated with each other.

  Further, the graphing processing unit 124 has an element of the output content ID that is the same as each content ID included in the input content ID list of the intermediate log to be analyzed in the output log ID list from the graphing area, and , Among the nodes having the date and time before the date and time of the intermediate log, the node that satisfies the node having the newest date and time is acquired. Then, the graphing processing unit 124 registers the log ID of the intermediate log to be analyzed in the log ID “NULL” corresponding to the same content ID in the acquired output log ID list of the node.

  Here, the graphing processing unit 124 indicates that “the node having the output content ID element identical to the input content ID list“ CIa ”in the output log ID list and having the date and time before the date and time“ Da ”of the intermediate log. Among them, the node having the log ID “Lx” is acquired as “the node with the newest date and time”. Then, the graphing processing unit 124 registers “La” in the log ID “NULL” corresponding to “CIa” in the output log ID list of the node with the acquired log ID “Lx”.

  Further, the graphing processing unit 124 associates each content ID included in the input content ID list of the intermediate log to be analyzed with the node ID of the acquired node in the created node input log ID list “NULL”. Register the attached information. In other words, the graphing processing unit 124 registers the input log ID list “<CIa, Lx>” in the input log ID list “NULL” of the node with the created log ID “La”.

(Graphing process for merge)
Next, a graphing process pattern (merging graphing process) for associating intermediate logs of the operation type “join” will be described. Here, a case where the intermediate log to be analyzed is “intermediate log A” will be described. This intermediate log A includes log ID “La”, date and time “Da”, operation type “join”, input content ID list “CIa1, CIa2,... CIaN (N is a natural number)”, and output content ID list “COa”. , And the option item “Opta” are associated with each other.

  In this case, the graphing processing unit 124 creates a node based on the information of the intermediate log A. In the graphing process for merging, the graphing processing unit 124 registers “NULL” in the input log ID list of the newly created node, and each output included in the output content ID list in the output log ID list. The content ID and “NULL” are registered, and the same values as the intermediate log are registered for the other items. That is, the graphing processing unit 124 includes the log ID “La”, the date and time “Da”, the operation type “conversion”, the input log ID list “NULL”, the output log ID list “<COa, NULL>”, and the option item “ A node associated with “Opta” is created.

  Further, the graphing processing unit 124 has an element of the output content ID that is the same as each content ID included in the input content ID list of the intermediate log to be analyzed in the output log ID list from the graphing area, and , A node group satisfying the node having the latest date among the nodes having the date and time before the date and time of the intermediate log is acquired. Then, the graphing processing unit 124 registers the log ID of the intermediate log to be analyzed in the log ID “NULL” corresponding to the same content ID in the acquired output log ID list of the node.

  Here, the graphing processing unit 124 has elements of the output content ID that are the same as the “input content ID list“ CIai (1 ≦ i ≦ N) ”in the output log ID list, and the date and time“ The node group Xj with the log ID “Lxj (1 ≦ j ≦ M, M is a natural number)” is acquired as “the node with the newest date among the nodes having the date before Da”. Then, the graphing processing unit 124 registers “La” in the log ID “NULL” corresponding to “CIai” in the output log ID list of the node with the acquired log ID “Lxj”.

  Further, the graphing processing unit 124 associates each content ID included in the input content ID list of the intermediate log to be analyzed with the node ID of the acquired node in the created node input log ID list “NULL”. Register the attached information. That is, the graphing processing unit 124 registers the input log ID list “<CIai, Lxj>” in the input log ID list “NULL” of the created node with the log ID “La”.

  As described above, the graphing processing unit 124 associates each intermediate log stored in the intermediate log storage unit 113 with another intermediate log using the processing pattern corresponding to the type of each intermediate log. Then, the graphing processing unit 124 stores the node created by the association in the graphing log storage unit 114.

(Processing flow in the log management apparatus 100)
FIG. 7 is a flowchart showing the flow of processing in the log management apparatus 100 according to the present embodiment. As illustrated in FIG. 7, the log management device 100 collects output log data each time log data is output from each host 10 (step S <b> 101). Here, the collected log data is stored in the log storage unit 111.

  Subsequently, the log management apparatus 100 selects a conversion program corresponding to the type of log data to be analyzed (step S102). Then, the log management apparatus 100 converts the collected log data into an intermediate log using the selected conversion program (step S103). Here, the intermediate log is stored in the intermediate log storage unit 113.

  Then, the log management apparatus 100 performs graphing processing (step S104). Here, the graphing process will be described with reference to FIG.

  FIG. 8 is a flowchart showing the flow of processing in the graphing processing according to this embodiment. As shown in FIG. 8, in the log management apparatus 100, the graphing processing unit 124 sorts a plurality of intermediate logs (intermediate log group) stored in the intermediate log storage unit 113 by date and time (step S201). Then, the graphing processing unit 124 takes out the oldest intermediate log (step S202).

  Subsequently, the graphing processing unit 124 determines whether or not the operation type of the extracted intermediate log is “generation” (step S203). Here, if it is “generation” (Yes in step S203), the graphing processing unit 124 performs graphing processing for generation (step S204), and registers the node created by this graphing processing in the graphing log area. (Step S214).

  On the other hand, if it is not “generation” (No in step S203), the graphing processing unit 124 determines whether or not the operation type of the extracted intermediate log is “deletion” (step S205). If it is “delete” (step S205 Yes), the graphing processing unit 124 performs a graphing process for deletion (step S206), and registers the node created by this graphing process in the graphing log area. (Step S214).

  On the other hand, if it is not “delete” (No in step S205), the graphing processing unit 124 determines whether or not the operation type of the extracted intermediate log is “conversion” (step S207). If it is “conversion” (step S207 Yes), the graphing processing unit 124 performs graphing processing for conversion (step S208), and registers the node created by this graphing processing in the graphing log area. (Step S214).

  On the other hand, if it is not “conversion” (No in step S207), the graphing processing unit 124 determines whether or not the operation type of the extracted intermediate log is “branch” (step S209). Here, if it is “branch” (step S209 Yes), the graphing processing unit 124 performs graphing processing for branching (step S210), and registers the node created by this graphing processing in the graphing log area. (Step S214).

  On the other hand, if it is not “branch” (No in step S209), the graphing processing unit 124 determines whether or not the operation type of the extracted intermediate log is “join” (step S211). Here, if it is “join” (step S211 Yes), the graphing processing unit 124 performs graphing processing for joining (step S212), and registers the node created by this graphing processing in the graphing log area. (Step S214).

  Then, the graphing processing unit 124 determines whether or not there is an intermediate log (step S215). If there is still an intermediate log (step S215 Yes), the process proceeds to step S202. If there is no intermediate log (step S215 No), the process is terminated.

  In step S211, if it is not “join” (step S211 No), the graphing processing unit 124 outputs an error (step S213) and ends the process.

  7 and 8 are merely examples, and each of the processes described above may be appropriately changed within a range in which the process contents do not contradict each other. For example, the process of selecting the graphing process corresponding to each operation type may be executed in any order.

(Effects of log management apparatus 100)
The log management apparatus 100 according to the present embodiment converts log data output from the host 10 into a predetermined type of intermediate log. Then, the log management apparatus 100 associates the intermediate log with an intermediate log different from the intermediate log according to the type of the intermediate log. For this reason, the log management apparatus 100 can flexibly analyze log data.

  9A to 10B are diagrams for explaining the effect of the log management apparatus 100 according to the present embodiment. In the prior art, a processing program for performing graphing is executed according to the type of log data (FIG. 9A). For this reason, since a different graphed log is created for each processing program, it is difficult to associate the log data with each other when the types of log data are different. Note that visualization means, for example, expressing information that is not understood by log data alone in a visible format or providing the information in such a format.

  In contrast, the log management apparatus 100 according to the present embodiment selects a conversion program according to the type of log data, and converts the log data into an intermediate log using the selected conversion program (FIG. 9B). The intermediate log is represented by one of a predetermined number of types. Then, the log management apparatus 100 performs association (graphing process) using the association processing pattern corresponding to the type of the intermediate log. For this reason, the log management apparatus 100 can associate each other even if different types of log data are converted into an intermediate log.

  In the prior art, a processing program for performing a series of processing (normalization, association, graphing, etc.) until a graphed log is generated is required for each type of log data (FIG. 10A). . For this reason, every time log data to be analyzed is added, it takes effort to prepare a processing program for performing a series of processing, for example, processing program N + 1.

  On the other hand, the log management apparatus 100 according to the present embodiment divides the log data into an intermediate log, and divides it into a process depending on the type of the log data and a common process (graphing process). Is possible (FIG. 10B). Therefore, in the log management apparatus 100, when adding log data to be analyzed, only a conversion program N + 1 for conversion to an intermediate log is added, and a series of processing is executed without adding graphing processing. It becomes possible to do. For this reason, the log management apparatus 100 can add log data to be analyzed with less effort.

(Other embodiments)
Although the embodiments of the present invention have been described so far, the present invention may be implemented in various different forms other than the above-described embodiments.

(System configuration)
Also, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or the processes described as being performed manually can be performed. All or a part can be automatically performed by a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or a part of the distribution / integration may be functionally or physically distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the log management device 100 may be realized as a log management system including a conversion device including a collection unit 121, a selection unit 122, and a conversion unit 123, and an association device including a graphing processing unit 124.

(program)
The log management apparatus 100 described in the above embodiment can also be realized by executing a program prepared in advance by a computer. Therefore, in the following, an example of a computer that executes a log management program that realizes the same function as the log management apparatus 100 illustrated in FIG. 2 will be described.

  FIG. 11 is a diagram illustrating a computer 1000 that executes a log management program. As illustrated in FIG. 11, the computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, and a network interface 1070, and these units are connected by a bus 1080. The

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012 as illustrated in FIG. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031 as illustrated in FIG. The disk drive interface 1040 is connected to the disk drive 1041 as illustrated in FIG. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive.

  Here, as illustrated in FIG. 11, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the above data processing program is stored in, for example, the hard disk drive 1031 as a program module in which a command executed by the computer 1000 is described.

  The various data described in the above embodiment is stored as program data, for example, in the memory 1010 or the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1031 to the RAM 1012 as necessary, and executes each procedure.

  The program module 1093 and the program data 1094 related to the log management program are not limited to being stored in the hard disk drive 1031, but are stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive or the like. Also good. Alternatively, the program module 1093 and the program data 1094 related to the log management program are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.), and the network interface 1070 is stored. Via the CPU 1020.

  These embodiments and modifications thereof are included in the invention disclosed in the claims and equivalents thereof as well as included in the technology disclosed in the present application.

100 log management device 123 conversion unit 124 graphing processing unit

Claims (8)

A log management method executed by a log management system,
A conversion step of converting log data output from the computer into an intermediate log of any kind among a predetermined number of kinds set in advance;
An association step of associating the intermediate log with another intermediate log different from the intermediate log using a pattern in which an association process corresponding to the type of the intermediate log is defined. Log management method. In the conversion step, the information indicating the predetermined number of types includes generation information indicating that the content has been generated, deletion information indicating that the content has been deleted, conversion information indicating that the content has been converted, and content. The log data is converted into the intermediate log including any one of branch information indicating that the content has been branched into a plurality of contents and merge information indicating that the plurality of contents are merged into one content,
The association step performs the association according to any of the generation information, the deletion information, the conversion information, the branch information, and the merge information included in the intermediate log. The log management method according to 1.   The log management method according to claim 1 or 2, wherein the conversion step converts the log data into the intermediate log by using a program corresponding to the log data.   In the converting step, the log data includes an identifier for identifying the log data, a date and time when an operation related to the content is performed, a content of the operation performed on the content, and a list of identifiers of the content that is the input of the operation And converting to an intermediate log having any one or a plurality of items from the list of content identifiers output by the operation. Log management method.   5. The log management method according to claim 4, wherein the associating step associates the intermediate logs having the same content identifier that is the input of the operation or the content identifier output by the operation. A log management system comprising a conversion device and an association device,
The conversion device includes a conversion unit that converts log data output from a computer into an intermediate log of any type among a predetermined number of types set in advance,
The associating device includes an associating unit that associates the intermediate log with another intermediate log different from the intermediate log using a pattern in which an association process corresponding to the type of the intermediate log is defined. Log management system characterized by A conversion unit that converts log data output from the computer into an intermediate log of any type among a predetermined number of types set in advance;
Using the pattern in which the association process corresponding to the type of the intermediate log is defined, and an association unit that associates the intermediate log with another intermediate log different from the intermediate log. Log management device. A conversion step for converting log data output from the computer into an intermediate log of any type among a predetermined number of types set in advance;
Using a pattern in which an association process corresponding to the type of the intermediate log is defined, causing the computer to execute an association step of associating the intermediate log with another intermediate log different from the intermediate log. Feature log management program.

Images