JP2016152017A - Log information collection program, log information collection device, and log information collection method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To suppress log information based on abnormality from being deleted.SOLUTION: A log information collection program causes a computer to collect log information about terminal equipment generated in accordance with processing from the acquisition of a processing request from the terminal equipment to the transmission of an execution result corresponding to the processing request to the terminal equipment, and to specify the transition information of screen display in the terminal equipment after result data indicating the execution result are displayed by the terminal equipment from the collected log information about the terminal equipment, and to determine whether to preferentially store the log information about the processing corresponding to the processing request in a storage part on the basis of the specified transition information of the screen display and the preliminarily set condition of a screen transition pattern.SELECTED DRAWING: Figure 1

Description

  The present specification relates to a log information collection program, a log information collection device, and a log information collection method.

  In order to investigate a problem in which an abnormality has occurred in the processing result, a log in which the processing status of the business program is recorded is analyzed. As for such log analysis, for example, there are the following techniques.

  As a first technique, there is a technique that can detect an abnormality early (for example, Patent Document 1). In the first technique, the display terminal stores the operation history of the user as operation log information in the operation log information storage area of the flash memory. Next, the error log information stored in advance in the error log information storage area of the flash memory is collated. If they match, it is displayed on the display panel as caution information. For example, it is determined whether or not abnormality log information, which is a specific operation procedure performed by the user when the display terminal hangs up, is included in the operation log information. If abnormalities such as hang-ups occur frequently, they are likely to be a sign of a serious failure. The display terminal can detect such a sign by itself. By displaying on the display panel, the user can be alerted.

  As a second technique, there is a technique for controlling collection and output of transaction debug information during operation (for example, Patent Document 2). In the second technique, transaction debug information is recorded in a debug information storage area. Debug information collection instruction information is stored in the instruction information area. Instruction information indicating whether or not to collect debug information by the collection instruction registration means is registered in the instruction information area. Debug information is recorded in the debug information storage area by the debug information storage means. Debug information is output from the debug information output means. The debug information is deleted from the debug information storage area by the debug information deleting means.

  As a third technique, there is an image processing technique capable of discriminating log information derived from one operation by an operator (for example, Patent Document 3). In the third technique, an image processing apparatus that performs processing relating to image formation executes a series of jobs that realize processing relating to image formation, and then records log information of the series of jobs in association with each other.

JP 2012-048681 A JP-A-6-12297 JP 2006-211587 A

  If a detailed log is always collected in the business system in preparation for the occurrence of an abnormality in the processing result, the detailed log required for the cause investigation can be collected. However, since logs are collected for all requests including processes in which no abnormal processing results have occurred, a large amount of logs are collected. The log that is always collected is deleted from the old log after a certain period of time or due to storage capacity limitations in consideration of trouble prevention due to insufficient capacity. Therefore, if it takes a long time from the occurrence of an abnormal event to the collection of logs, the logs necessary for investigation may disappear.

  In order not to save a large amount of logs even if detailed logs are collected, it may be possible to suppress saving of detailed logs in which no abnormalities have occurred in the processing results. However, the abnormality in the processing result notified by the business system includes an abnormality that cannot be detected autonomously by the business system program. That is, the business system program cannot accurately determine whether the processing result is normal.

  According to one aspect of the present invention, there is provided a technique for preventing log information based on abnormality from being erased.

  In one embodiment of the present invention, a computer is caused to execute the following processing. That is, the computer collects log information about the terminal device generated in response to processing from acquisition of the processing request from the terminal device to transmission of the execution result for the processing request to the terminal device. The computer identifies transition information of screen display in the terminal device after the result data indicating the execution result is displayed on the terminal device from the collected log information on the terminal device. Whether the computer preferentially holds log information about the processing corresponding to the processing request in the storage unit based on the transition information of the specified screen display and the condition of the screen transition pattern set in advance. decide.

  According to one aspect of the present invention, it is possible to prevent log information based on abnormality from being deleted.

An example of the log information collection device in this embodiment is shown. An example of the network configuration in this embodiment is shown. It is a figure for demonstrating the screen transition of business AP1 when a process result is normal in this embodiment, and the screen transition of business AP1 when a process result is abnormal. It is a figure for demonstrating the screen transition of business AP2 when the process result in this embodiment is normal, and the screen transition of business AP2 when the process result is abnormal. An example of the AP server in this embodiment is shown. An example of the abnormal condition definition in this embodiment is shown. An example of the determination decision definition of business AP in this embodiment is shown. It is a figure for demonstrating the log storage area in this embodiment. It is a figure for demonstrating the screen transition by the action of the user of business AP1, the process of business AP1, and the process of a log management part in the case where a process result is normal in this embodiment. It is a figure for demonstrating the screen transition by the action of the user of business AP1, the process of business AP1, and the process of a log management part in the case where a process result is abnormal in this embodiment. It is a figure for demonstrating the screen transition by the action of the user of business AP2, the process of business AP2, and the process of a log management part in the case where a process result is normal in this embodiment. It is a figure for demonstrating the screen transition by the action of the user of business AP2, the process of business AP2, and the process of a log management part in the case where a process result is abnormal in this embodiment (abnormal condition pattern A). It is a figure for demonstrating the screen transition by the action of the user of business AP2, the process of business AP2, and the process of a log management part in the case where a process result is abnormal in this embodiment (abnormal condition pattern B). It is a figure for demonstrating the screen transition by the action of the user of business AP2, the process of business AP2, and the process of a log management part in the case where a process result is abnormal in this embodiment (abnormal condition pattern C). The processing flow of the log management part in this embodiment is shown. It is an example of a configuration block diagram of a hardware environment of a computer that executes a program in the present embodiment.

  Programs (applications, middleware products, etc.) running on the business system display the result of processing the request requested by the user on the screen. However, when viewed from the user, the program may notify a result (abnormal result) different from the result requested by the user. The abnormality of the displayed result is a case where the program executes processing according to coding, but the system provides a result different from the result requested by the user from the viewpoint of the user. The program has not detected any abnormalities during processing and cannot detect abnormalities in the results. In such a case, a user using the system finds an abnormality in the processing result, and an investigation is requested by a notification from the user, and the investigation is started.

  At this time, the log accumulated in the system is provided as investigation data, and the investigation is carried out. However, the provided log does not record abnormality information, the cause of the abnormality is not known, and the investigation may be aborted because the cause is unknown.

  Further, as an example of the reason why the cause of the abnormality cannot be determined, there is an abnormality in the processing result that is not reproduced. If the cause of the error is not known from the log collected when an error occurs in the processing result, the detailed operation (log that can grasp the internal processing route and internal processing result) is collected, and the reproduction operation is performed. Done. However, even if the reproduction operation is performed, the condition that occurs is not known, and therefore, the abnormal event cannot be reproduced, and an effective detailed log may not be collected.

  Furthermore, as a reason why the cause of the abnormality cannot be determined, in order to investigate the processing result, a detailed log that can grasp the internal processing route and the internal processing result of the program that was operated when the abnormality occurred is required. However, since it is not known when an abnormality in the processing result will occur, if a detailed log is always collected for every request, a large amount of logs will be collected. For this reason, there may be a case where a log required for investigation does not remain when an abnormality occurs. The log that is always collected is deleted from the old log after a certain period of time or due to storage capacity limitations in consideration of trouble prevention due to insufficient capacity. Therefore, if it takes time from the occurrence of an abnormal event to the collection of logs, the logs necessary for investigation are deleted.

  For example, a user notices an abnormality in which a system program cannot be detected, and asks the product support center to investigate, but the system is still in operation and requests are processed one after another, and log collection continues. Yes.

  Log collection is performed after receiving a request from the user to investigate the abnormality. Therefore, it takes time from the occurrence of an abnormal event to the collection of data. As a result, the log information at the time of the occurrence of an abnormality has been deleted, and the logs required for investigation cannot be collected.

  In order to investigate the cause whenever an abnormality occurs in the processing result, do not save a detailed log with no result abnormality so that a large amount of logs are not saved even if detailed logs are collected at all times. It is possible to control. However, it is not known whether the result notified by the business system has been determined by the user to be correct. For this reason, it is impossible to determine which log does not need to be saved.

  Therefore, in this embodiment, even if there is no special notification from the user, it is determined to delete the log (when normal) or to save the log (when abnormal).

  For example, when the business program cannot detect an abnormality in the processing result and displays the result on the terminal device, and the user notices that the displayed result is abnormal, whether or not the user has detected the abnormality is used. Even if there is no special instruction from the user, it is determined by the user's action (screen transition operation). Whether the user has detected an abnormality is determined using the collected log (screen transition log).

  As a specific method, user behavior is determined based on a log related to screen transitions displayed by a business program. Define the behavior (screen transition) pattern at the time of abnormality so that the log management can recognize in advance. When the same operation as the behavior pattern at the time of the abnormality is performed and a log is notified, it can be determined that there is an abnormality.

  On the other hand, when the above action is not taken and the log of the abnormal pattern is not recorded, it is possible to determine that it is normal when the log for determining the process (the process is terminated) is collected.

This embodiment will be described in detail below.
FIG. 1 shows an example of a log information collection device according to this embodiment. The log information collection device 1 includes a collection unit 2, a specification unit 3, and a determination unit 4.

  The collection unit 2 collects log information about the terminal device generated in accordance with processing from acquisition of a processing request from the terminal device to transmission of an execution result for the processing request to the terminal device. An example of the collecting unit 2 is a collecting unit 43a.

  The specifying unit 3 specifies the transition information of the screen display in the terminal device after the result data indicating the execution result is displayed on the terminal device from the collected log information about the terminal device. An example of the specifying unit 3 is a determination unit 43b.

  The determination unit 4 preferentially holds log information about the processing corresponding to the processing request in the storage unit based on the specified transition information of the screen display and the condition of the screen transition pattern set in advance. Determine whether or not. An example of the determination unit 4 is a determination unit 43b.

  With this configuration, it is possible to prevent the log information based on the abnormality from being erased.

Further, this embodiment will be described in detail below.
FIG. 2 shows an example of a network configuration in the present embodiment. The client terminal 11 is connected to the business system 12 via the communication network 15. The business system 12 is connected to a WEB server 13 and a database (DB) server 14. The communication network 15 is a communication network such as the Internet or a LAN (Local Area Network).

  A web application such as the business application program 1 or the business application program 2 is installed in the WEB server 13. Hereinafter, the application program is referred to as “AP”.

  The DB server manages data used by the business AP by a database management system (DBMS).

  The user accesses the business AP 1 or business AP 2 of the WEB server 13 via the WEB browser program installed in the client terminal 11 and makes a processing request.

  FIG. 3 is a diagram for explaining the screen transition of the business AP1 when the processing result is normal and the screen transition of the business AP1 when the processing result is abnormal in the present embodiment. In business AP1, as shown in FIG. 3A, when the processing result is normal, the screen transitions in the order of the processing request screen 21, the result display screen 22, and the end screen 23.

  If the processing result is abnormal, the user takes action to confirm whether he / she has made any mistake. For example, as shown in FIG. 3B, when a processing request is input on the processing reception screen 21 and the processing request is displayed on the result display screen 22, it is assumed that the display content is abnormal. Then, the user returns to the process reception screen 21 before the transition to check whether there is an error in the content input on the screen, and confirms the input content on the screen. As a result of the confirmation of the input content, when the processing request can be executed again on the processing reception screen 21, the user executes the processing request again.

  FIG. 4 is a diagram for explaining the screen transition of the business AP 2 when the processing result is normal and the screen transition of the business AP 2 when the processing result is abnormal. As shown in FIG. 4A, when the processing result is normal, the screen transitions in the order of the processing request screen 31, the result display screen 32, the result history screen 33, and the end screen 34.

  When the processing result is abnormal (case 1), the user takes an action to confirm whether he / she has made any mistake. For example, as shown in FIG. 4B, when a processing request is input on the processing reception screen 31 and the processing request is displayed on the result display screen 32, it is assumed that the display content is abnormal. Then, the user returns to the process acceptance screen 31 before the transition to check whether there is an error in the content input on the screen, and confirms the input content on the screen. As a result of the confirmation of the input content, when the processing request can be performed again on the processing reception screen 31, the user performs the processing request again.

  If the processing result is abnormal (Case 2), the user takes an action to confirm whether he / she has made any mistake. As shown in FIG. 4C, it is assumed that the processing result history screen 33 is transitioned to and that the display content of the result history screen 33 is abnormal. Then, the user returns to the result display screen 32 or the process reception screen 31 before the transition to check whether the content input on the screen is correct, and confirms the input content on the screen. As a result of the confirmation of the input content, when the processing request can be performed again on the result display screen 32 or the processing reception screen 31, the user performs the processing request again.

  FIG. 5 shows an example of an AP server in the present embodiment. The AP server 13 includes a control unit 41 and a storage unit 47. The control unit 41 executes the business AP1 or business AP2 (42), the log management program, the operating system (OS) 44, etc. read from the storage unit 47. When executing the log management program, the control unit 41 functions as the log management unit 43.

  The OS 44 is a basic program for operating the AP server 13. The business AP 1 or the business AP 2 (42) is an application program that runs on the OS 44. The business AP1 or business AP2 (42) includes a function that operates as a processing request acquisition unit 42a, a processing result transmission unit 42b, and a log output unit 42c.

  The processing request acquisition unit 42a acquires the processing request transmitted from the client terminal 11, and passes the acquired processing request to a processing execution unit (not shown) that performs processing. The processing result transmission unit 42 b receives the processing result from the processing execution unit and transmits it to the client terminal 11.

  The log output unit 42 c outputs a log generated according to the operation of the business AP 1 or the business AP 2 (42) to the log management unit 43.

  The log management unit 43 is an application program or middleware program that runs on the OS 44. The log management unit 43 includes functions that operate as a collection unit 43a, a determination unit 43b, an output unit 43c, and a deletion unit 43d.

  The collection unit 43a collects logs output from the business AP1 or the business AP2 (42). The determination unit 43b determines whether or not there is a pattern in the collected log that matches the screen transition pattern from the result display screen in the client terminal that has been set in advance as an abnormality processing pattern.

  When there is a pattern in the log that matches the screen transition pattern from the result output screen, the determination unit 43b selectively selects the log for each processing request of the program that was operating to output the processing result. To be able to save to. To specify that the log for each processing request can be selectively saved, for example, the log for each processing request can be deleted according to a user instruction or automatically at a predetermined timing. It means that a deletion flag indicating that deletion is possible is given.

  The output unit 43 c stores a log for each processing request specified so as to be selectively saved in the log storage area 50.

  The deletion unit 43d deletes the log to which the deletion flag stored in the log storage area 50 is assigned, in units of processing request, after a certain period of time, due to storage capacity limitation or according to an operator instruction.

  The storage unit 47 stores an abnormal condition definition 48 and a determination confirmation definition 49. The abnormal condition definition 48 defines a log abnormal condition pattern for finding an abnormality in the log. The determination confirmation definition 49 is a definition for determining whether the log is normal or abnormal. The storage unit 47 includes a log storage area 50 for storing logs.

  FIG. 6 shows an example of the abnormal condition definition in this embodiment. FIG. 6A shows an example of the abnormal condition definition of the business AP1. The log transition pattern (abnormal condition pattern A) of the log determined to be abnormal is a case where the “process reception screen display” log is output after the “result display screen display” log.

FIG. 6B shows an example of the abnormal condition definition of the business AP2. The log transition pattern (abnormal condition pattern A) of the log determined to be abnormal is a pattern in which the “process reception screen creation display” log is output after the “result display screen display” log. The log transition pattern (abnormal condition pattern B) of a log determined to be abnormal is a pattern in which a “process display screen display” log is output after a “result history screen display” log. A log transition pattern (abnormal condition pattern C) of a log determined to be abnormal is a pattern in which a “process reception screen display” log is output after a “result history screen display” log.

  The abnormal condition pattern used in the present embodiment is an example, and the processing result and the screen transition pattern of the user determined to be abnormal differ depending on the business AP. Therefore, the abnormal condition pattern is set according to the business AP. be able to.

  FIG. 7 shows an example of the business AP determination confirmation definition in this embodiment. As shown in FIG. 7A, in the business AP1, when the “end screen display” or “new request request” log is output, the determination of normality or abnormality is confirmed.

  As illustrated in FIG. 7B, in the business AP 2, when the “end screen display” log is output, the determination of normality or abnormality is confirmed.

  FIG. 8 is a diagram for explaining a log storage area in the present embodiment. In the log storage area, a log corresponding to the processing request is stored for each processing request. When the log matches the pattern of the abnormal condition definition and the abnormality is confirmed, the log corresponding to the processing request is excluded from the deletion target, and therefore a deletion flag = 0 is assigned to the log. If the log does not match the pattern of the abnormal condition definition and normality is confirmed, the log corresponding to the processing request is to be deleted, so a deletion flag = 1 is assigned to the log. The log with the deletion flag = 1 is deleted at a predetermined timing or by an operator's operation.

  For example, the logs 51 to 53 output in the processing of the requests R1 to R3 are logs whose normality has been determined, and therefore the deletion flag = 1 is given as the deletion target.

  For example, since the log 54 output in the processing of the request R4 is a log in which an abnormality has been determined, a deletion flag = 0 is assigned as a non-deletion target. Note that the log 55 output in the processing of the request R5 is currently being output, and whether it is normal or abnormal has not yet been determined.

  FIG. 9 is a diagram for explaining the screen transition due to the action of the user of the business AP1, the processing of the business AP1, and the processing of the log management unit in the present embodiment when the processing result is normal. The user uses the client terminal 11 to display the process acceptance screen 21 of the business AP 1 (S11). In this case, when the business AP 1 performs the process acceptance screen display process (S 21), the business AP 1 outputs the log to the log management unit 43 (S 31).

  Next, the user inputs processing contents on the processing reception screen 21 (S12), and presses a predetermined button in the processing reception screen 21 to request execution processing (S13). When the business AP1 accepts the request processing by the request (S22), the business AP1 outputs the log to the log management unit 43 (S32).

  The business AP 1 performs processes 1 to n based on the received request process, and outputs a log corresponding to each process to the log management unit 43 (S 33, S 34). The business AP 1 performs a result display screen display process, displays the processing result on the result display screen (S 25), and outputs the log to the log management unit 43 (S 35).

  The user confirms the processing of the displayed result display screen 22 (S14). If there is no abnormality in the displayed processing result, the user presses the end button in the screen to display the end screen (S15, S16).

  When the business AP 1 receives an end process from the client terminal 11 (S 26), the business AP 1 performs an end screen display process (S 27), and outputs the log to the log management unit 43 (S 36).

  The log management unit 43 compares the log output from the business AP1 with the abnormal condition pattern 48-1 in the abnormal condition definition 48, and the log output from the business AP1 does not include the abnormal condition pattern 48-1. Determine whether.

  Further, the log management unit 43 compares the log output from the business AP 1 with the determination confirmation pattern 49-1 of the determination confirmation definition 49, and the log output from the business AP 1 includes the determination confirmation pattern 49-1. Judge whether or not.

  When the log output from the business AP 1 does not include the abnormal condition pattern 48-1, the log management unit 43 determines that the system is normal from the log when detecting the determination confirmation pattern 49-1. . In this case, the log management unit 43 adds a deletion flag = 1 to the log corresponding to the request and stores it in the log storage area 50.

  FIG. 10 is a diagram for explaining the screen transition due to the action of the user of the business AP1, the processing of the business AP1, and the processing of the log management unit when the processing result is abnormal in the present embodiment. In FIG. 10, the screen transition by the action of the user when it is determined to be abnormal in S15 of FIG. 9, the process of the business AP1, and the process of the log management unit will be described.

  The user confirms the processing of the displayed result display screen 22 (S14). When there is an abnormality in the displayed processing result (S15), the user returns to the processing reception screen 21 (S41). Accordingly, when the business AP 1 performs a process acceptance screen display process (S42), the business AP 1 outputs the log to the log management unit 43 (S43).

The user presses the end button in the screen to display the end screen (S16).
When the business AP 1 receives an end process from the client terminal 11 (S 26), the business AP 1 performs an end screen display process (S 27), and outputs the log to the log management unit 43 (S 36).

  The log management unit 43 compares the log output from the business AP1 with the abnormal condition pattern 48-1 in the abnormal condition definition 48, and the log output from the business AP1 does not include the abnormal condition pattern 48-1. Determine whether.

  Further, the log management unit 43 compares the log output from the business AP 1 with the determination confirmation pattern 49-1 of the determination confirmation definition 49, and the log output from the business AP 1 includes the determination confirmation pattern 49-1. Judge whether or not.

  When the log management unit 43 detects the determination confirmation pattern 49-1 after detecting the abnormal condition pattern 48-1 in the log output from the business AP 1, the log management unit 43 determines that the system is abnormal from the log. In this case, the log management unit 43 adds a deletion flag = 0 to the log corresponding to the request and stores it in the log storage area 50.

  FIG. 11 is a diagram for explaining the screen transition due to the action of the user of the business AP2, the process of the business AP2, and the process of the log management unit when the processing result is normal in the present embodiment. The user displays the process acceptance screen 31 of the business AP 2 using the client terminal 11 (S51). In this case, when the business AP 2 performs a process acceptance screen display process (S 71), the business AP 2 outputs the log to the log management unit 43.

  Next, the user inputs processing contents on the processing reception screen 31 (S52), and presses a predetermined button in the processing reception screen 31 to request execution processing (S53). When the business AP 2 receives the request process by the request (S 72), the business AP 2 outputs the log to the log management unit 43 (S 81).

  The business AP 2 performs processes 1 to n based on the received request process (S73), and outputs a log corresponding to the process 1 to the log management unit 43 (S81). The business AP 2 performs a result display screen display process, displays the result of process 1 on the result display screen (S 54), and outputs the log to the log management unit 43 (S 82). The user confirms the result of the process 1 displayed on the result display screen 32 (S54). When the displayed processing result is normal (S55), the business AP 2 performs a result display screen display process, displays the result of the process 2 on the result display screen, and outputs the log to the log management unit 43. The user confirms the result of the process 2 displayed on the result display screen 32 (S56).

  The business AP 2 performs a result display screen display process, displays the result of the process 2 on the result display screen, and outputs the log to the log management unit 43. The user confirms the result of the process 2 displayed on the result display screen 32 (S54).

  When the displayed processing result is normal (S57), the business AP 2 performs a result display screen display process, displays the result of the process n on the result display screen, and outputs the log to the log management unit 43 ( S83). The user confirms the result of the process n displayed on the result display screen 32 (S58).

  If the displayed processing result is normal (S59), the business AP 2 performs a result history screen notification process, causes the result history screen 33 to display the results of processes 1 to n, and stores the log in the log management unit 43. Output (S84). The user confirms the contents displayed on the result history screen 33 (S60).

  If the displayed processing result is abnormal, the user presses the end button in the screen to display the end screen (S62).

  Upon receiving the end process from the client terminal 11 (S78), the business AP 2 performs an end screen display process (S79) and outputs the log to the log management unit 43 (S85).

  The log management unit 43 compares the log output from the business AP 2 with the abnormal condition pattern 48-1 of the abnormal condition definition 48, and the log output from the business AP 2 does not include the abnormal condition pattern 48-1. Determine whether.

  Further, the log management unit 43 compares the log output from the business AP 2 with the determination confirmation pattern 49-1 of the determination confirmation definition 49, and the log output from the business AP 2 includes the determination confirmation pattern 49-1. Judge whether or not.

  When the log output from the business AP 2 does not include the abnormal condition pattern 48-1, the log management unit 43 determines that the system is normal from the log when detecting the determination confirmation pattern 49-1. . In this case, the log management unit 43 adds a deletion flag = 1 to the log corresponding to the request and stores it in the log storage area 50.

  FIG. 12 is a view for explaining the screen transition due to the action of the user of the business AP2, the process of the business AP2, and the process of the log management unit when the processing result is abnormal (abnormal condition pattern A) in the present embodiment. FIG. In FIG. 12, the screen transition due to the action of the user when it is determined to be abnormal in S59 of FIG. 11, the processing of the business AP2, and the processing of the log management unit will be described.

  The user confirms the result of the process n displayed on the result display screen 32 (S58). When the displayed processing result is abnormal (S59), the user returns to the processing reception screen 31 (S41). Accordingly, when the business AP 2 performs a process acceptance screen display process (S92), the business AP 2 outputs the log to the log management unit 43 (S93).

The user presses the end button in the screen to display the end screen (S62).
Upon receiving the end process from the client terminal 11 (S78), the business AP 2 performs an end screen display process (S79) and outputs the log to the log management unit 43 (S85).

  The log management unit 43 compares the log output from the business AP 2 with the abnormal condition pattern 48-1 of the abnormal condition definition 48, and the log output from the business AP 2 does not include the abnormal condition pattern 48-1. Determine whether. In this case, the log management unit 43 determines that the abnormal condition pattern A is included in the log output from the business AP 2.

  Further, the log management unit 43 compares the log output from the business AP 2 with the determination confirmation pattern 49-1 of the determination confirmation definition 49, and the log output from the business AP 2 includes the determination confirmation pattern 49-1. Determine whether or not. In this case, the log management unit 43 determines that the determination confirmation pattern A is included in the log output from the business AP 2.

  When the log management unit 43 detects the determination confirmation pattern 49-1 after detecting the abnormal condition pattern A in the log output from the business AP 2, the log management unit 43 determines that the system is abnormal from the log. In this case, the log management unit 43 adds a deletion flag = 0 to the log corresponding to the request and stores it in the log storage area 50.

  FIG. 13 is a diagram for explaining the screen transition due to the action of the user of the business AP2, the process of the business AP2, and the process of the log management unit when the processing result is abnormal (abnormal condition pattern B) in the present embodiment. FIG. In FIG. 12, the screen transition due to the action of the user when it is determined to be abnormal in S61 of FIG. 11, the processing of the business AP 2, and the processing of the log management unit will be described.

  The user confirms the contents displayed on the result history screen 33 (S60). When the displayed processing history result is abnormal (S61), the user returns to the result n display screen 32 (S94). Accordingly, when the business AP 2 performs the result n display screen display process (S95), the business AP 2 outputs the log to the log management unit 43 (S96).

The user presses the end button in the screen to display the end screen (S62).
Upon receiving the end process from the client terminal 11 (S78), the business AP 2 performs an end screen display process (S79) and outputs the log to the log management unit 43 (S85).

  The log management unit 43 compares the log output from the business AP 2 with the abnormal condition pattern 48-1 of the abnormal condition definition 48, and the log output from the business AP 2 does not include the abnormal condition pattern 48-1. Determine whether. In this case, the log management unit 43 determines that the abnormal condition pattern B is included in the log output from the business AP 2.

  Further, the log management unit 43 compares the log output from the business AP 2 with the determination confirmation pattern 49-1 of the determination confirmation definition 49, and the log output from the business AP 2 includes the determination confirmation pattern 49-1. Determine whether or not. In this case, the log management unit 43 determines that the determination confirmation pattern A is included in the log output from the business AP 2.

  When the log management unit 43 detects the determination confirmation pattern 49-1 after detecting the abnormal condition pattern A in the log output from the business AP 2, the log management unit 43 determines that the system is abnormal from the log. In this case, the log management unit 43 adds a deletion flag = 0 to the log corresponding to the request and stores it in the log storage area 50.

  FIG. 14 is a diagram for explaining the screen transition due to the action of the user of the business AP2, the process of the business AP2, and the process of the log management unit when the processing result is abnormal (abnormal condition pattern C) in the present embodiment. FIG. In FIG. 12, the screen transition due to the action of the user when it is determined to be abnormal in S59 of FIG. 11, the processing of the business AP2, and the processing of the log management unit will be described.

  The user confirms the contents displayed on the result history screen 33 (S60). When the displayed processing history result is abnormal (S61), the user returns to the processing reception screen 31 (S97). In response, when the business AP 2 performs the result n display screen display process (S98), the business AP 2 outputs the log to the log management unit 43 (S99).

The user presses the end button in the screen to display the end screen (S62).
Upon receiving the end process from the client terminal 11 (S78), the business AP 2 performs an end screen display process (S79) and outputs the log to the log management unit 43 (S85).

  The log management unit 43 compares the log output from the business AP 2 with the abnormal condition pattern 48-1 of the abnormal condition definition 48, and the log output from the business AP 2 does not include the abnormal condition pattern 48-1. Determine whether. In this case, the log management unit 43 determines that the abnormal condition pattern C is included in the log output from the business AP 2.

  Further, the log management unit 43 compares the log output from the business AP 2 with the determination confirmation pattern 49-1 of the determination confirmation definition 49, and the log output from the business AP 2 includes the determination confirmation pattern 49-1. Determine whether or not. In this case, the log management unit 43 determines that the determination confirmation pattern A is included in the log output from the business AP 2.

  When the log management unit 43 detects the determination confirmation pattern 49-1 after detecting the abnormal condition pattern A in the log output from the business AP 2, the log management unit 43 determines that the system is abnormal from the log. In this case, the log management unit 43 adds a deletion flag = 0 to the log corresponding to the request and stores it in the log storage area 50.

  FIG. 15 shows a processing flow of the log management unit in the present embodiment. The log management unit 43 reads the abnormal condition definition 48 and the determination confirmation definition 49 from the storage unit 47 (S101). The log management unit 43 acquires the log output from the business AP (S102). The log management unit 43 stores the log acquired in S102 in the work area W1 (S103).

  The log management unit 43 acquires the next output log (S104). The log management unit 43 stores the log acquired in S104 in the work area W2 (S103).

  The log management unit 43 determines whether or not the log pattern stored in the work areas W1 and W2 matches the abnormal condition pattern 48-1 of the abnormal condition definition 48 (S106). When the log pattern stored in the work area W2 does not match the abnormal condition pattern 48-1 (“NO” in S106), the log management unit 43 determines that the log pattern acquired in S104 is the determination confirmation pattern 49-1. It is determined whether or not (S107).

  When the log pattern acquired in S104 is not the determination confirmation pattern 49-1 (“NO” in S107), the log management unit 43 stores the log stored in the work area W2 in the work area W1 (S108), and then The output log is acquired (S104).

  When the log pattern acquired in S107 is the determination confirmation pattern (“YES” in S107), the log management unit 43 assigns the deletion flag = 1 to the log corresponding to the target processing request, and the log storage area 50 (S109).

  When the log pattern stored in the work area W2 matches the abnormal condition pattern 48-1 (“YES” in S106), the log management unit 43 acquires the log output thereafter (S111).

  When the log pattern acquired in S110 is not the determination confirmation pattern 49-1 (“NO” in S111), the log management unit 43 acquires the log output again (S111). The processes of S110 to S111 are repeated until the determination confirmation pattern 49-1 is detected from the log.

  When the log pattern acquired in S111 is a determination confirmation pattern (“YES” in S111), the log management unit 43 gives a deletion flag = 0 to the log corresponding to the target processing request, and the log storage area 50 To store.

  As a result, the log with the deletion flag = 1 can be deleted in units of processing requests at the operator's instruction or at a predetermined timing. As a result, for example, log information to which a deletion flag is assigned can be selectively deleted in units of processing requests after a certain time elapses, due to storage capacity limitations, or according to an operator instruction.

  According to this embodiment, the log management unit 43 includes a log of a program executed in the business system and a log generated in response to a screen transition operation of a user terminal that uses the business system (screen transition log). And collect. The log management unit 43 determines whether or not there is a pattern in the collected log that matches the screen transition pattern from the result display screen in the terminal set in advance as an abnormality processing pattern. When there is a pattern in the collected log that matches the screen transition pattern from the result display screen in the terminal set in advance as an abnormality processing pattern, the log management unit 43 is operating for the result output. The log of the processing unit of the selected program can be saved selectively. Therefore, it is possible to prevent the log information based on the abnormality (for example, the abnormality detected by the user) from being erased.

  FIG. 16 is an example of a configuration block diagram of a hardware environment of a computer that executes a program according to the present embodiment. The computer 60 functions as the client terminal 11, the WEB server 13, the DB server 14, and the like. The computer 60 includes a CPU 62, a ROM 63, a RAM 66, a communication I / F 64, a storage device 67, an output I / F 61, an input I / F 65, a reading device 68, a bus 69, an output device 71, and an input device 72.

  Here, CPU indicates a central processing unit. ROM indicates a read-only memory. RAM indicates random access memory. I / F indicates an interface. The bus 69 is connected to the CPU 62, ROM 63, RAM 66, communication I / F 64, storage device 67, output I / F 61, input I / F 65, and reading device 68. The reading device 68 is a device that reads a portable recording medium. The output device 71 is connected to the output I / F 61. The input device 72 is connected to the input I / F 65.

  As the storage device 67, various types of storage devices such as a hard disk, a flash memory, and a magnetic disk can be used. The storage device 67 or the ROM 63 stores a program according to the present embodiment that causes the CPU 62 to function as the response unit 3. Information is temporarily stored in the RAM 66. The storage device 67 or the RAM 66 stores an abnormal condition definition 48, a determination confirmation definition 49, and the like as the storage unit 37. The storage device 67 or the RAM 66 includes a log storage area 50.

  As the control unit 41, the CPU 62 reads out the program according to the present embodiment from the storage device 67 or the ROM 63, executes the program, and functions as the collection unit 2, the identification unit 3, and the determination unit 4.

  The program for realizing the processing described in the above embodiment may be stored in, for example, the storage device 67 from the program provider side via the communication network 70 and the communication I / F 66. Moreover, the program which implement | achieves the process demonstrated by the said embodiment may be stored in the portable storage medium marketed and distribute | circulated. In this case, the portable storage medium may be set in the reading device 68 and the program read by the CPU 62 and executed. As the portable storage medium, various types of storage media such as a CD-ROM, a flexible disk, an optical disk, a magneto-optical disk, an IC card, and a USB memory device can be used. The program stored in such a storage medium is read by the reading device 68.

  As the input device 72, a keyboard, a mouse, an electronic camera, a web camera, a microphone, a scanner, a sensor, a tablet, or the like can be used. The output device 71 can be a display, a printer, a speaker, or the like. The network 70 may be a communication network such as the Internet, a LAN, a WAN, a dedicated line, a wired line, and a wireless line.

  The present invention is not limited to the above-described embodiment, and various configurations or embodiments can be taken without departing from the gist of the present invention.

DESCRIPTION OF SYMBOLS 1 Log information collection apparatus 2 Collection part 3 Specification part 4 Determination part 11 Client terminal 12 Business system 13 WEB server 14 DB server 15 Communication network 41 Control part 42 Business AP1 / business AP2
42a processing request acquisition unit 42b processing result transmission unit 42c log output unit 43 log management unit 43a collection unit 43b determination unit 43c output unit 44 OS
47 Storage unit 48 Abnormal condition definition 49 Judgment definition 50 Log storage area

Claims (3)

On the computer,
Collecting log information about the terminal device generated in response to processing from acquisition of the processing request from the terminal device to transmission of the execution result for the processing request to the terminal device;
From the collected log information about the terminal device, specify the transition information of the screen display in the terminal device after the result data indicating the execution result is displayed on the terminal device,
Based on the specified transition information of the screen display and the condition of the screen transition pattern set in advance, it is determined whether or not to preferentially hold the log information about the processing corresponding to the processing request in the storage unit To
Log information collection program characterized by causing A collection unit that collects log information about the terminal device generated according to processing from acquisition of a processing request from the terminal device to transmission of an execution result for the processing request to the terminal device;
From the collected log information about the terminal device, a specifying unit that specifies transition information of screen display in the terminal device after the result data indicating the execution result is displayed on the terminal device;
Based on the specified transition information of the screen display and the condition of the screen transition pattern set in advance, it is determined whether or not to preferentially hold the log information about the processing corresponding to the processing request in the storage unit A decision unit to
A log information collecting apparatus comprising: Computer
Collect log information about the terminal device generated in response to processing from acquisition of the processing request from the terminal device to transmission of the execution result for the processing request to the terminal device,
From the collected log information about the terminal device, specify the transition information of the screen display in the terminal device after the result data indicating the execution result is displayed on the terminal device,
Based on the specified transition information of the screen display and the condition of the screen transition pattern set in advance, it is determined whether or not to preferentially hold the log information about the processing corresponding to the processing request in the storage unit To
A log information collecting method characterized by the above.

Images