JP2021026412A - Log analyzer, method and program - Google Patents

Abstract

To appropriately determine an order to be treated to log data on the basis of practical use.SOLUTION: A log analyzer (100) comprises: a determination part (110) for determining the necessity of treatment to predetermined log data using one or more log determination models; an acquisition part (120) for acquiring present status information on a system including the node of the output source of the log data when it is determined that the treatment to the log data is necessary; and a specification part (130) for specifying the urgency of the treatment to the log data on the basis of the status information.SELECTED DRAWING: Figure 1

Description

The present invention relates to a log analyzer, method and program, and more particularly to a log analyzer, method and program for analyzing logs output from the system.

Patent Document 1 discloses a technique relating to a log analysis system that analyzes a log output by an information processing system. In the log analysis system according to Patent Document 1, a normal pattern and an abnormal pattern are stored in a storage unit for a combination of log messages. Then, the log analysis system determines whether or not the read log message matches the normal pattern and the abnormal pattern. If the log message does not match any of the log messages, the log analysis system generates a new pattern and records it in the storage unit.

Patent Document 2 discloses a technique relating to a log analysis system that generates a periodic model for each log format and uses the periodic model to determine whether or not the log is abnormal. Patent Document 3 discloses a technique relating to a log analysis platform that generates a regular expression pattern from a heterogeneous log source and generates a model and a profile from a training log. Patent Document 4 discloses a technique related to a log determination system. The log determination system according to Patent Document 4 learns from log data in advance and builds a log determination standard. Then, the log determination system determines whether the acquired log data is an abnormality log or a log indicating a precursor of an abnormality based on the established determination criteria.

International Publication No. 2016/132717 International Publication No. 2017/115458 Special Table 2019-501448 Japanese Unexamined Patent Publication No. 2014-115768

However, Patent Document 1 has a problem that it is difficult to determine the order in which measures should be taken even if it is determined that some measures are required for the log to be determined. The reason is that the urgency of countermeasures based on the degree of impact on actual operation is not taken into consideration. It should be noted that even in Patent Documents 2 to 4, such a problem cannot be solved.

The present disclosure has been made to solve such a problem, and provides a log analyzer, a method, and a program for appropriately determining the order in which log data should be dealt with in accordance with actual operation. The purpose is.

The log analyzer according to the first aspect of the present disclosure uses one or more log determination models to determine the necessity of dealing with predetermined log data, and a determination unit.
When it is determined that the log data needs to be dealt with, an acquisition unit that acquires the current status information about the system including the node from which the log data is output, and an acquisition unit.
Based on the situation information, a specific unit that identifies the urgency of dealing with the log data, and
To be equipped.

The log analysis method according to the second aspect of the present disclosure is
The computer
Using one or more log judgment models, it is judged whether or not it is necessary to deal with the predetermined log data.
When it is determined that the log data needs to be dealt with, the current status information about the system including the node from which the log data is output is acquired.
Based on the situation information, the urgency of dealing with the log data is specified.

The log analysis program according to the third aspect of the present disclosure is
A process of determining the necessity of dealing with a predetermined log data using one or more log determination models, and
When it is determined that the log data needs to be dealt with, the process of acquiring the current status information about the system including the node from which the log data is output, and the process of acquiring the current status information.
Based on the status information, the process of identifying the urgency of dealing with the log data and
Let the computer run.

According to the present disclosure, it is possible to provide a log analyzer, a method, and a program for appropriately determining the order in which log data should be dealt with in accordance with actual operation.

It is a block diagram which shows the structure of the log analysis apparatus which concerns on this Embodiment 1. It is a flowchart which shows the flow of the log analysis method which concerns on this Embodiment 1. It is a block diagram which shows the whole structure of the log analysis system which concerns on Embodiment 2. It is a block diagram which shows the structure of the log analysis apparatus which concerns on Embodiment 2. It is a flowchart which shows the flow of the log analysis method which concerns on this Embodiment 2. It is a block diagram which shows the whole structure of the log analysis system which concerns on this Embodiment 3. It is a block diagram which shows the structure of the log analysis apparatus which concerns on this Embodiment 3. It is a flowchart which shows the flow of the log analysis method which concerns on this Embodiment 3.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In each drawing, the same or corresponding elements are designated by the same reference numerals, and duplicate explanations are omitted as necessary for the sake of clarity of explanation.

<Embodiment 1>
FIG. 1 is a block diagram showing a configuration of a log analyzer 100 according to the first embodiment. The log analysis device 100 is an information processing device for analyzing log data output from at least a part of nodes in an information processing system including a plurality of nodes. The log analysis device 100 includes a determination unit 110, an acquisition unit 120, and a specific unit 130.

The determination unit 110 determines the necessity of dealing with the predetermined log data by using one or more log determination models. Here, the log data is a log message output from an operating system, middleware, an application, or the like running on a predetermined node. In addition, the log judgment model determines whether or not it is necessary for an operation or maintenance person (hereinafter referred to as an administrator) to deal with the information processing system by performing a predetermined calculation on the input log data. It is a judgment logic that outputs the result. For example, the log determination model is a program module in which the determination logic is implemented, or a model program learned by machine learning. Further, the determination unit 110 determines that no action is required when the log message merely indicates a notification of the processing status or indicates a warning. On the other hand, if the log message indicates an error, the determination unit 110 determines that the administrator needs to take action. Further, the determination unit 110 may determine that no action is required depending on the content of the error. Here, the countermeasures include, for example, temporary measures such as failure recovery work by the administrator, and permanent measures such as setting change, hardware replacement, or software repair. The temporary measures include, but are not limited to, restarting the application, data patching, data recovery, notification of failure to the user, and the like.

When the determination unit 110 determines that the log data needs to be dealt with, the acquisition unit 120 acquires the current status information about the system including the node from which the log data is output. Here, the status information is, for example, information such as a resource load status in a node and an operating status of a node, but is not limited thereto.

The identification unit 130 specifies the urgency of dealing with the log data based on the situation information acquired by the acquisition unit 120. Here, the urgency level is, for example, information indicating the urgency level of the response by the administrator, and may be any information that can distinguish at least two levels or more.

FIG. 2 is a flowchart showing the flow of the log analysis method according to the first embodiment. First, the determination unit 110 determines the necessity of dealing with the predetermined log data by using one or more log determination models (S11). When it is determined that the log data needs to be dealt with, the acquisition unit 120 acquires the current status information about the system including the node from which the log data is output (S12). Then, the specifying unit 130 specifies the urgency of dealing with the log data based on the situation information (S13). If it is determined in step S11 that no action is required for the log data, the process of the log analysis method is terminated.

As described above, in the present embodiment, in addition to determining whether or not the administrator needs to deal with the log data output from the system, the urgency of dealing with the log data is specified by using the current status information about the system. is there. In particular, when a plurality of types of errors are detected from a plurality of log data, it is not always necessary to deal with them in the order in which the errors occur. For example, if it takes a long time to take a specific action, it may be better to take another action first. Even if the combination of errors is the same, the priority of handling may differ depending on the current status information. Therefore, according to the present embodiment, even if there are a large number of log data that need to be dealt with, the administrator can appropriately determine the order in which the log data should be dealt with according to the actual operation.

The log analysis device 100 includes a processor, a memory, and a storage device as a configuration (not shown). Further, the storage device stores a computer program in which the processing of the log analysis method according to the present embodiment is implemented. Then, the processor reads the computer program from the storage device into the memory and executes the computer program. As a result, the processor realizes the functions of the determination unit 110, the acquisition unit 120, and the specific unit 130.

Alternatively, the determination unit 110, the acquisition unit 120, and the specific unit 130 may each be realized by dedicated hardware. Further, a part or all of each component of each device may be realized by a general-purpose or dedicated circuitry, a processor, or a combination thereof. These may be composed of a single chip or may be composed of a plurality of chips connected via a bus. A part or all of each component of each device may be realized by a combination of the above-mentioned circuit or the like and a program. Further, as a processor, a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), an FPGA (field-programmable gate array), or the like can be used.

Further, when a part or all of each component of the log analysis device 100 is realized by a plurality of information processing devices and circuits, the plurality of information processing devices and circuits may be centrally arranged. It may be distributed. For example, the information processing device, the circuit, and the like may be realized as a form in which each of the client-server system, the cloud computing system, and the like is connected via a communication network. Further, the function of the log analyzer 100 may be provided in the SaaS (Software as a Service) format.

<Embodiment 2>
The second embodiment is a specific embodiment of the first embodiment described above. FIG. 3 is a block diagram showing the overall configuration of the log analysis system 200 according to the second embodiment. The log analysis system 200 includes an information processing system 20, a status monitoring server 31, a log analysis device 32, a system configuration DB (DataBase) 33, a model DB 34, and an alert log DB 35, which are via network N. Is connected. The network N is a communication network such as a LAN (Local Area Network) and the Internet.

The information processing system 20 is an information processing system to be operated, and includes nodes 21, ... Nodes 2n (n is a natural number of 2 or more). Each node such as node 21 is a single computer device, an information processing board such as a blade server, a virtual machine, or the like. In addition, it is assumed that the operating system, middleware, applications, etc. are running on each node.

The status monitoring server 31 is a server device that monitors the operating status of each node of the information processing system 20. For example, when the status monitoring server 31 receives a status information acquisition request from the log analysis device 32, the status monitoring server 31 issues a command for acquiring the current load status and operating status of the specified node, and outputs the command response result to the log analysis device. Reply to 32. Here, the load status includes, but is not limited to, the CPU (Central Processing Unit) of the node, the memory, the HDD (Hard Disk Drive), and the network bandwidth usage rate. In addition, the operating status shall indicate whether the node is operating in the active system, the standby system, and the like. The status monitoring server 31 itself may be included in the information processing system 20. Further, since the status monitoring server 31 can be realized by a known technique, detailed description thereof will be omitted.

The system configuration DB 33 is a configuration management database that manages the configuration of the information processing system 20. The system configuration DB 33 manages at least the definition information and the cooperation destination information of each node. Here, the node definition information is information on the role and use of the node, the hardware specifications, and the software to be operated. The role and use of the node may be, for example, information that can identify whether the application running on the node is a business system or a management (monitoring) system. Further, the cooperation destination information is information about the node of the cooperation destination of the node, for example, a host name, an IP (Internet Protocol) address, or the like.

The model DB 34 is a database that manages the coping-free model 341 and the coping-requiring model 342. The coping-free model 341 and the coping-required model 342 are examples of the log determination model described above.

The action-free model 341 is a model for determining whether or not the action for the log data is unnecessary. First, the action-free model 341 determines that no action is required when the log data merely indicates a notification or warning. Further, for example, even if the log data is an error log, it may not have a substantial effect on the information processing system 20. In this case, even if the log data is an error log, it is not necessary for the administrator to take specific measures (operations, operations, etc.) for the information processing system 20. Therefore, the action-free model 341 determines that no action is required for such an error log.

The response-required model 342 is a model for determining whether or not a specific countermeasure for log data is known. For example, a specific countermeasure may be known in the past for a certain log data. Therefore, the action-requiring model 342 determines that such log data needs to be dealt with (because a specific coping method is known).

Therefore, if a certain log data is not detected in either the action-unnecessary model 341 or the action-requiring model 342 (the log formats do not match), it indicates that the action for the log data is unknown.

In addition, the action-free model 341 and the action-required model 342 collate with the input log data using a log format including a characteristic common character string and a variable part from the past log data, and match or do not match. Is output as a collation result.

Further, the coping-unnecessary model 341 and the coping-required model 342 are program modules and model formulas in which a process of inputting log data, performing a predetermined calculation using set parameters, and outputting a calculation result is implemented. Here, the parameters include a weighting coefficient and a bias. The coping-free model 341 and the coping-required model 342 can be realized by a neural network, a support vector machine, or the like. For example, the action-free model 341 and the action-requiring model 342 collate the learned log format with the input log data, and determine a match or a mismatch.

The alert log DB 35 is a database that manages analysis results and the like for log data output from the node 21 to 2n. The alert log DB 35 manages at least the log format 351 and the coping necessity 352 and the coping method 353 in association with each other. The log format 351 is log message format information that defines a common character string and a variable portion of the character string in the log data output from each node. For example, the log format 351 is composed of a fixed character string of a log message and a variable part. The log format 351 may be a preset one or one that has been analyzed and derived by the log analyzer 32. The log message itself may be used instead of the log format 351. The action necessity 352 is information indicating whether or not the log data corresponding to the log format 351 has been dealt with by the administrator in the past. The coping method 353 is information indicating the content of the coping taken by the administrator for the log format 351 for which the coping necessity 352 is "necessary". The coping method 353 includes, but is not limited to, re-execution of a predetermined job, restart of an application, and the like.

Each of the system configuration DB 33, the model DB 34, and the alert log DB 35 can be realized by database management software running on a computer provided with a storage device.

FIG. 4 is a block diagram showing the configuration of the log analyzer 32 according to the second embodiment. The log analysis device 32 includes a storage unit 41, a memory 42, an IF (InterFace) unit 43, and a control unit 44. The storage unit 41 is a non-volatile storage device such as a hard disk or a flash memory. The storage unit 41 stores the log analysis program 411. The log analysis program 411 is a computer program in which the processing of the log analysis method according to the present embodiment is implemented.

The memory 42 is a volatile storage device such as a RAM (Random Access Memory), and is a storage area for temporarily holding information when the control unit 44 operates. The IF unit 43 is an interface for inputting / outputting to / from the outside of the log analyzer 32. For example, the IF unit 43 outputs the data acquired from the outside to the control unit 44. Further, the IF unit 43 outputs the data received from the control unit 44 to the outside.

The control unit 44 is a processor, that is, a control device that controls each configuration of the log analysis device 32. The control unit 44 reads the log analysis program 411 from the storage unit 41 into the memory 42, and executes the log analysis program 411. As a result, the control unit 44 realizes the functions of the determination unit 441, the acquisition unit 442, the specific unit 443, the display unit 444, the registration unit 445, and the learning unit 446.

The determination unit 441 is an example of the determination unit 110 described above, and determines the necessity of coping with the input log data by using the coping-free model 341 and the coping-requiring model 342. Here, the determination unit 441 shall make a determination when it detects a log message output from each of the nodes 21 to 2n. Then, the determination unit 441 collates the log data with the log formats of the coping-unnecessary model 341 and the coping-required model 342, and determines whether or not they match. If the log data does not match either the response-unnecessary model 341 or the response-required model 342, the log data can be said to be a log for which the countermeasure is unknown (hereinafter referred to as an unknown log).

The acquisition unit 442 is an example of the acquisition unit 120 described above, and outputs log data from the system configuration DB 33 when the log data in the determination unit 441 does not match the action-unnecessary model 341 and matches the action-required model 342. Acquires the definition information of the node and the cooperation destination information of the node. For example, the acquisition unit 442 searches the system configuration DB 33 using the identification information of the node that outputs the log data as a key.

In addition, the acquisition unit 442 requests the status monitoring server 31 to acquire the load status and the operating status. The acquisition unit 442 may have the function of the status monitoring server 31.

The specific unit 443 is an example of the specific unit 130 described above, and specifies the range of influence on the information processing system 20 due to the error indicated by the log data from the node definition information and the cooperation destination information acquired by the acquisition unit 442.

In addition, the specific unit 443 specifies the urgency of the countermeasure based on the load status and the operating status acquired by the acquisition unit 442. As a result, the log analysis device 32 dynamically acquires the latest state of the node and identifies the urgency, so that the accuracy of the urgency is further improved.

Further, it is desirable that the specific unit 443 specifies the degree of urgency of the countermeasure based on the range of influence on the specified information processing system 20. As a result, the accuracy of identifying the degree of urgency is further improved.

Further, the specific unit 443 may specify the urgency of the countermeasure based on the acquired definition information of the node. For example, when the role of the node (definition information) indicates the management system, the specific unit 443 specifies the role of the node with a lower degree of urgency than in the case of the business system. As a result, it is possible to prioritize the recovery of business-related failures and minimize the impact on business.

Further, it is desirable that the specific unit 443 specifies the degree of urgency by further considering the time zone in which the log data was generated. The reason is that even if the same error occurs, the urgency of dealing with it differs depending on the time of day when it occurs. In particular, when the role (definition information) of the node indicates a business system, the specific unit 443 has a relatively high degree of urgency if the error occurrence time zone is the business time zone during the daytime, and is outside the business hours. At night, specify a relatively low degree of urgency. On the other hand, if the role of the node (definition information) is nighttime batch execution, the specific unit 443 has a relatively high urgency when the error occurrence time zone is nighttime, and a relative urgency when the error occurs during the daytime. Specify low. This improves the validity of the urgency.

In addition, the specifying unit 443 specifies a coping method corresponding to the log data from the alert log DB 35. For example, the specifying unit 443 specifies a coping method 353 in which the log data is associated with the corresponding log format 351.

The display unit 444 displays the log data on the display device (not shown) according to the urgency specified by the specific unit 443. As a result, the administrator can clearly grasp the urgency of the countermeasure. At this time, the display unit 444 may display the log data in association with the specified priority. Alternatively, the display unit 444 may display the log data in an order according to the specified priority. At the same time, the display unit 444 may display the range of influence on the information processing system 20 specified by the specific unit 443.

The registration unit 445 analyzes a plurality of log messages, determines a log format, and registers the determined log format 351 in the alert log DB 35. Since a known technique can be used for determining the log format, detailed description thereof will be omitted.

In addition, the registration unit 445 receives the input of the countermeasure necessity and the countermeasure method determined by the administrator for the unknown log, and registers the countermeasure necessity and the countermeasure method in the alert log DB35 in association with the corresponding log format. To do.

The learning unit 446 learns the coping unnecessary model 341 and the coping model 342 by using the log data (log format), the determination result of the log data (necessity of coping) and the coping content (coping method) as learning data. .. For example, the learning unit 446 attaches the corresponding coping necessity 352 as a label to each log format 351 as learning data, and machine-learns the coping-free model 341. Further, the learning unit 446 attaches the presence / absence of the coping method 353 as a label to the log format 351 for which the coping necessity 352 is "necessary" and uses it as learning data, and machine-learns the coping model 342. Then, the determination unit 441 makes a determination using the post-learning coping-free model 341 and the coping-requiring model 342.

FIG. 5 is a flowchart showing the flow of the log analysis method according to the second embodiment. First, the determination unit 441 detects the log data (log message) output from each of the nodes 21 to 2n (S201). Next, the determination unit 441 collates the log data with the log format of the no-action model 341 (S202). If it is determined that they match, the process returns to step S201. In this case, the administrator does not take any action because it is a known log that does not require any action.

On the other hand, when it is determined in step S202 that there is a mismatch, the determination unit 441 collates the log data with the log format of the model 342 requiring action (S203). If it is determined that they match, the acquisition unit 442 acquires the definition information of the node that outputs the log data and the cooperation destination information of the node from the system configuration DB 33. Then, the identification unit 443 specifies the range of influence on the information processing system 20 due to the error indicated by the log data from the acquired node definition information and cooperation destination information (S204).

Subsequently, the acquisition unit 442 requests the status monitoring server 31 to acquire the load status and the operating status. Then, the identification unit 443 specifies the urgency of the countermeasure based on the acquired load status and operation status, the range of influence on the system, the node definition information, the cooperation destination information, and the time zone when the log data is generated ( S205).

Then, the identification unit 443 specifies a coping method corresponding to the log data from the alert log DB35 (S206).

After that, the display unit 444 displays based on the degree of urgency (S207). For example, the display unit 444 displays the log data, the degree of urgency, and the degree of influence on the system on the display device in association with each other. After that, the process returns to step S201. As a result, the administrator can take measures against the log data in consideration of the contents displayed on the display device, particularly the degree of urgency.

When it is determined in step S203 that there is a mismatch, that is, when the detected log data is an unknown log, the display unit 444 displays on the display device that the log data is an unknown log. Then, the administrator examines whether or not it is necessary to deal with the unknown log, and if the action is "necessary", considers how to deal with it. The administrator may also determine the log format of the unknown log. After that, the administrator inputs the log format of the unknown log, the necessity of countermeasures, and the target method to the log analysis device 32. Therefore, the log analysis device 32 accepts the input of the log format of the unknown log, the necessity of countermeasures, and the target method (S208).

Then, the registration unit 445 associates the received log format of the unknown log with the necessity of countermeasures and the target method, and registers the log format in the alert log DB 35 (S209).

After that, the learning unit 446 uses the log format 351 registered in the alert log DB 35, the coping necessity 352, and the coping method 353 as learning data to machine-learn the coping-unnecessary model 341 and the coping model 342 (S210). After that, the process returns to step S201.

In this way, according to the present embodiment, the order in which the log data should be dealt with can be appropriately determined according to the actual operation.

<Embodiment 3>
The third embodiment is a modification of the second embodiment described above. FIG. 6 is a block diagram showing an overall configuration of the log analysis system 200a according to the third embodiment. The log analysis system 200a includes an information processing system 20, a status monitoring server 31, a log analysis device 32a, a system configuration DB 33, a model DB 34a, and an alert log DB 35a, which are connected via the network N. There is. In the following description, the same components as those in the second embodiment are designated by the same reference numerals, and the description thereof will be omitted as appropriate.

The model DB 34a manages a response-requiring model (low urgency) 3421, a response-requiring model (medium urgency) 3422, and a response-requiring model (high urgency) 3423 instead of the response-requiring model 342. The response-requiring model (low urgency) 3421, the response-requiring model (medium urgency) 3422, and the response-requiring model (high urgency) 3423 are log determination models for each urgency.

The alert log DB 35a manages the log format 351 in association with the urgency level 354.

FIG. 7 is a block diagram showing the configuration of the log analyzer 32a according to the third embodiment. The log analysis device 32a includes a storage unit 41a, a memory 42, an IF unit 43, and a control unit 44a. The storage unit 41a stores the log analysis program 411a. The log analysis program 411a is a computer program in which the processing of the log analysis method according to the present embodiment is implemented.

The control unit 44a reads the log analysis program 411a from the storage unit 41a into the memory 42, and executes the log analysis program 411a. As a result, the control unit 44a realizes the functions of the determination unit 441a, the acquisition unit 442a, the specific unit 443a, the display unit 444, the registration unit 445a, and the learning unit 446a.

The registration unit 445a accepts the input of the necessity, countermeasure, and urgency of the unknown log determined by the administrator, and alerts the corresponding log format by associating the response necessity, the countermeasure, and the urgency. Register in the log DB35a.

When it is determined that the log data needs to be dealt with, the learning unit 446a learns the log determination model corresponding to the specified urgency by using the learning data in the log data. For example, when the degree of urgency is specified as medium urgency, the learning unit 446a labels the log format 351 in which the necessity 352 is "necessary" and the urgency 354 is "medium" as the presence or absence of the countermeasure 353. Then, it is used as learning data, and a model requiring coping (medium urgency) 3422 is machine-learned. The same applies to the response-requiring model (low urgency) 3421 and the response-requiring model (high urgency) 3423.

The determination unit 441a refers to the log data for each of the plurality of log determination models (response required model (low urgency) 3421, response required model (medium urgency) 3422, and response required model (high urgency) 3423). Determine the need for action.

The identification unit 443a further adds the urgency corresponding to the log determination model used for determining the log data, and specifies the urgency.

The acquisition unit 442a further specifies the content of dealing with the log data based on the specified urgency.

FIG. 8 is a flowchart showing the flow of the log analysis method according to the third embodiment. In the following, description of the same processing as in FIG. 5 will be omitted. If it is determined in step S202 that there is a mismatch, the determination unit 441a collates the log data with the log format of the response-requiring model (high urgency) 3423 (S203a). When it is determined that there is a mismatch, the determination unit 441a collates the log data with the log format of the response-requiring model (medium urgency) 3422 (S203b). When it is determined that there is a mismatch, the determination unit 441a collates the log data with the log format of the response-requiring model (low urgency) 3421 (S203c).

If it is determined in any of steps S203a, S203b and S203c that they match, the process proceeds to step S204. After step S204, the identification unit 443a adds the acquired load status and operation status, the range of influence on the system, the node definition information, the cooperation destination information, and the time zone in which the log data was generated, and the log determined to match. The urgency of coping is specified based on the urgency corresponding to the determination model (S205a). For example, if it is determined in step S203a that they match, the identification unit 443a specifies the urgency of the countermeasure as "high".

Then, the specifying unit 443a specifies a coping method corresponding to the log data from the alert log DB35a based on the specified urgency (S206a). For example, when it is determined in step S203a that they match, the identification unit 443a specifies the coping method 353 associated with the log format 351 to which the log data corresponds and the urgency 354 which is "high".

If it is determined in step S203c that there is a mismatch, that is, if the detected log data does not match any of the models requiring action, an unknown log is created. In the case of an unknown log, the administrator examines the necessity of dealing with the unknown log, and if the action is "necessary", considers the coping method and the degree of urgency. The administrator may also determine the log format of the unknown log. After that, the administrator inputs the log format of the unknown log, the necessity of countermeasures, the target method, and the degree of urgency to the log analyzer 32. Therefore, the log analyzer 32 accepts the input of the log format of the unknown log, the necessity of countermeasures, the target method, and the degree of urgency (S208a).

Then, the registration unit 445a associates the received log format of the unknown log with the necessity of countermeasures, the target method, and the degree of urgency, and registers the log format in the alert log DB35a (S209a).

After that, the learning unit 446a uses the log format 351 registered in the alert log DB 35a, the coping necessity 352, the coping method 353, and the urgency level 354 as learning data as the coping unnecessary model 341 and the coping required model (low urgency) 3421. , The coping model (medium urgency) 3422 and the coping model (high urgency) 3423 are machine-learned (S210a). After that, the process returns to step S201.

As described above, also in this embodiment, the order in which the log data should be dealt with can be appropriately determined according to the actual operation.

<Other Embodiments>
In the above-described embodiment, the description is made as a hardware configuration, but the present invention is not limited to this. The present disclosure can also be realized by causing the CPU to execute a computer program.

In the above example, the program can be stored and supplied to a computer using various types of non-transitory computer readable media. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-temporary computer-readable media include magnetic recording media (eg flexible disks, magnetic tapes, hard disk drives), opto-magnetic recording media (eg optomagnetic disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / W, DVD (Digital Versatile Disc), semiconductor memory (for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)) are included. The program may also be supplied to the computer by various types of transient computer readable media. Examples of temporary computer-readable media include electrical, optical, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

The present disclosure is not limited to the above embodiment, and can be appropriately modified without departing from the spirit. Further, the present disclosure may be carried out by appropriately combining the respective embodiments.

Some or all of the above embodiments may also be described, but not limited to:
(Appendix A1)
A determination unit that determines the necessity of dealing with predetermined log data using one or more log determination models, and
When it is determined that the log data needs to be dealt with, an acquisition unit that acquires the current status information about the system including the node from which the log data is output, and an acquisition unit.
Based on the situation information, a specific unit that identifies the urgency of dealing with the log data, and
A log analyzer equipped with.
(Appendix A2)
The log analyzer according to Appendix A1, wherein the status information includes at least one of the load status and the operation status of the resources of the node.
(Appendix A3)
The acquisition unit
Further, the definition information of the node is acquired from the configuration database that manages the configuration of the system.
The specific part is
The log analyzer according to Appendix A1 or A2, which further adds the definition information to specify the degree of urgency.
(Appendix A4)
The acquisition unit
Further, the cooperation destination information regarding the cooperation destination node of the node is further acquired from the configuration database.
The specific part is
The log analysis device according to Appendix A3, which further considers the cooperation destination information and specifies the degree of urgency.
(Appendix A5)
The specific part is
The log analyzer according to any one of Supplementary A1 to A4, which further considers the time zone in which the log data is generated and specifies the degree of urgency.
(Appendix A6)
The log analysis apparatus according to any one of Supplementary A1 to A5, further comprising a learning unit for learning the log determination model by using the log data, a determination result of the log data, and a countermeasure content as learning data.
(Appendix A7)
The log analyzer has a plurality of log determination models for each degree of urgency.
The learning unit
When it is determined that it is necessary to deal with the log data, the log determination model corresponding to the specified urgency is learned by using the learning data in the log data.
The determination unit determines the necessity of dealing with the log data for each of the plurality of log determination models.
The specific part is
The log analysis device according to Appendix A6, which specifies the urgency by further adding the urgency corresponding to the log determination model used for determining the log data.
(Appendix A8)
The log analyzer according to any one of Supplementary A1 to A7, further comprising a display unit that displays the log data according to the specified urgency.
(Appendix A9)
The specific part is
The log analyzer according to any one of Supplementary A1 to A8, which further specifies the content of dealing with the log data based on the specified urgency.
(Appendix B1)
The computer
Using one or more log judgment models, it is judged whether or not it is necessary to deal with the predetermined log data.
When it is determined that the log data needs to be dealt with, the current status information about the system including the node from which the log data is output is acquired.
A log analysis method that identifies the urgency of dealing with the log data based on the status information.
(Appendix C1)
A process of determining the necessity of dealing with a predetermined log data using one or more log determination models, and
When it is determined that the log data needs to be dealt with, the process of acquiring the current status information about the system including the node from which the log data is output, and the process of acquiring the current status information.
Processing to identify the urgency of dealing with the log data based on the situation information,
A log analysis program that lets your computer run.

100 Log analysis device 110 Judgment unit 120 Acquisition unit 130 Specific unit 200 Log analysis system 20 Information processing system 21 node 2n node N network 31 Status monitoring server 32 Log analysis device 33 System configuration DB
34 Model DB
341 Action-free model 342 Action-required model 35 Alert log DB
351 Log format 352 Necessity of action 353 Action method 41 Storage section 411 Log analysis program 42 Memory 43 IF section 44 Control section 441 Judgment section 442 Acquisition section 443 Specific section 444 Display section 445 Registration section 446 Learning section 200a Log analysis system 32a Log analysis Device 34a model DB
3421 Response required model (low urgency)
3422 Needed to be dealt with (medium urgency)
3423 Need to deal with model (high urgency)
35a Alert log DB
354 Urgency 41a Storage unit 411a Log analysis program 44a Control unit 441a Judgment unit 442a Acquisition unit 443a Specific unit 445a Registration unit 446a Learning unit

Claims (10)

A determination unit that determines the necessity of dealing with predetermined log data using one or more log determination models, and
When it is determined that the log data needs to be dealt with, an acquisition unit that acquires the current status information about the system including the node from which the log data is output, and an acquisition unit.
Based on the situation information, a specific unit that identifies the urgency of dealing with the log data, and
A log analyzer equipped with. The log analyzer according to claim 1, wherein the status information includes at least one of a load status and an operating status of the resources of the node. The acquisition unit
Further, the definition information of the node is acquired from the configuration database that manages the configuration of the system.
The specific part is
The log analyzer according to claim 1 or 2, wherein the degree of urgency is specified by further adding the definition information. The acquisition unit
Further, the cooperation destination information regarding the cooperation destination node of the node is further acquired from the configuration database.
The specific part is
The log analyzer according to claim 3, wherein the urgency is specified by further adding the cooperation destination information. The specific part is
The log analyzer according to any one of claims 1 to 4, further taking into account the time zone in which the log data is generated, and specifying the degree of urgency. The log analysis device according to any one of claims 1 to 5, further comprising a learning unit for learning the log determination model by using the log data, a determination result of the log data, and a countermeasure content as learning data. The log analyzer has a plurality of log determination models for each degree of urgency.
The learning unit
When it is determined that it is necessary to deal with the log data, the log determination model corresponding to the specified urgency is learned by using the learning data in the log data.
The determination unit determines the necessity of dealing with the log data for each of the plurality of log determination models.
The specific part is
The log analysis apparatus according to claim 6, wherein the urgency corresponding to the log determination model used for determining the log data is further added to specify the urgency. The log analyzer according to any one of claims 1 to 7, further comprising a display unit that displays the log data according to the specified urgency. The computer
Using one or more log judgment models, it is judged whether or not it is necessary to deal with the predetermined log data.
When it is determined that the log data needs to be dealt with, the current status information about the system including the node from which the log data is output is acquired.
A log analysis method that identifies the urgency of dealing with the log data based on the status information. A process of determining the necessity of dealing with a predetermined log data using one or more log determination models, and
When it is determined that the log data needs to be dealt with, the process of acquiring the current status information about the system including the node from which the log data is output, and the process of acquiring the current status information.
Based on the status information, the process of identifying the urgency of dealing with the log data and
A log analysis program that lets your computer run.

Images