JP2021182234A - Information processing system, log extraction method of information processing system, and log extraction program - Google Patents

Abstract

To provide a log extraction method and a program for an information processing system which improve the examination efficiency of an error occurrence cause by collectively extracting logs associated with an error occurrence place and hierarchically or graphically displaying them.SOLUTION: A computer of an information processing system includes extraction means for extracting a stack trace for displaying the type of called processing and its order when exception processing occurs in the computer and an application log to be outputted in each application, determination means that acquires, from the application log, a log from the input operation to processing of each process, and a log in which exception has occurred from a log of processing of each process, and also acquires the type of method used in a thread from the stack trace, and combines them, thereby determining an input operation and a method in which the exception processing has occurred, and display means for hierarchically displaying the application log and the stack trace together.SELECTED DRAWING: Figure 5

Description

The present invention relates to an information processing system, an information processing system log extraction method, and a log extraction program, and in particular, an information processing system including a computer in which a plurality of processes or a plurality of threads are operated, and information between a plurality of processes or a plurality of threads. Related to the log extraction method of the processing system and the log extraction program.

All logs are required to operate an information processing system. In particular, when a failure occurs, we are investigating the cause of the failure using the stored logs as clues, and it is indispensable to acquire the log.

In this regard, the current system of information processing is divided into small responsibilities and is operated by a huge collection of components. Therefore, the confirmed error log may not be the root cause of the error, but the error log caused by an error in other processing. At this time, there is known a technique for finding the root cause of an error by collectively extracting logs of a series of processes.

For example, in Patent Document 1, by associating data exchange between threads with an identifier, the output log is associated, saved, and extracted.

Further, in Patent Document 2, in order to collectively extract the processes between a plurality of processes, an identifier is added from the request unit to collectively extract the processes as a series of processes.

Japanese Unexamined Patent Publication No. 2017-162284 Japanese Unexamined Patent Publication No. 2018-97793

When an exceptional operation (for example, an error) is confirmed in an information processing system, the root cause of the error is investigated based on the error log, but it is difficult to associate the error log that caused the error with other logs.

In Patent Document 1, the relationship between threads is grasped using an identifier, but the log associated with the error occurrence location is collectively extracted, but how to show it to the user is expressed in a format that is easy to analyze. No consideration is given to what to do.

Although the log of a series of processes is extracted in Patent Document 2, many modified parts are required to be introduced into the system actually operated, and many systems such as control devices are already mixed and operated. There may be a problem that it cannot be installed in the existing system.

Based on the above, in view of the above problems, the purpose of the present invention is to improve the efficiency of investigating the cause of an error by extracting the log associated with the error occurrence location collectively and displaying it hierarchically or graphically. It is to provide an information processing system that can be used, a log extraction method for the information processing system, and a log extraction program.

From the above, in the present invention, "it has a plurality of processes composed of a plurality of threads, and each thread executes reading of the PLL which is a component of the program in the middle of the process, and is described in the module in the PLL. It is an information processing system that uses a computer that is configured to use the above methods and that communicates between processes by forming a hierarchy between processes, threads, and DLLs. A stack trace that displays what kind of processing was called in such an order, an extraction method that extracts the application log that is output for each application, a log from the application log from the input operation to the processing of each process, and each process. Obtain the log in which the exception occurred from the processing log of, and also obtain which method was used in the thread from the stack trace, and by combining them, determine from the input operation to the method in which the exception handling occurred. Judgment means and
It is configured like an information processing system characterized by having a display means for displaying application logs and stack traces in a hierarchical manner.

Further, in the present invention, "there is a plurality of processes composed of a plurality of threads, each thread executes reading of the PLL which is a component of the program in the middle of the process, and the method described in the module in the PLL is executed. It is a log extraction method of an information processing system using a computer that is configured to be used and that communicates between processes by forming a hierarchy between processes, threads, and DLLs. When an exception handling occurs in the computer, A stack trace that displays what kind of processing was called in what order and an application log that is output for each application are extracted, and from the application log, the log from the input operation to the processing of each process, and the processing of each process. Obtain the log in which the exception occurred from the log of, and also obtain which method was used in the thread from the stack trace, and by combining them, determine from the input operation to the method in which the exception handling occurred, and apply the application. It is configured as "a log extraction method of an information processing system characterized by displaying a log and a stack trace together hierarchically".

Further, in the present invention, "there is a plurality of processes composed of a plurality of threads, each thread executes reading of the PLL which is a component of the program in the middle of the process, and the method described in the module in the PLL is executed. It is a log extraction program used in a computer that is configured to be used and that communicates between processes by forming a hierarchy between the process, the thread, and the PLL, and which is used when an exception processing occurs in the computer. A stack trace that displays what kind of processing was called in such an order, an extraction program that extracts the application log output for each application, a log from the application log from the input operation to the processing of each process, and each process Obtain the log in which the exception occurred from the processing log of, and also obtain which method was used in the thread from the stack trace, and by combining them, determine from the input operation to the method in which the exception processing occurred. It is configured like a "log extraction program of an information processing system, which is characterized by being composed of a judgment program and a display program that displays an application log and a stack trace in a hierarchical manner."

According to the present invention, it is possible to improve the efficiency of investigating the cause of an error by extracting and displaying the log associated with the error occurrence location collectively.

The figure which conceptually shows the relationship of each element in a general computer system. The figure which shows the flow of processing in a computer PC as an example. The figure which shows an example of the processing flow when exception handling occurs. Diagram showing the relationship between application logs, stack traces, and hierarchies. The figure which shows a series of processing which performs the cause investigation and display of this invention. The figure which shows the configuration example of the stack trace. The figure which shows the configuration example of the error log of an application. The figure which showed an example which identifies and collects a series of information from the start of processing to the detection of error occurrence. The figure which extracted the error log which has the same IP, process ID, and thread ID from the trace log which took the search. A diagram that hierarchically displays a series of processes by combining the stack trace and application log.

Hereinafter, examples of the present invention will be described with reference to the drawings.

FIG. 1 is a diagram conceptually showing the relationship between each element in a general computer system.

The computer PC has N process Prs (Pr1 ... Prn) that are execution instances of the program, and a predetermined application is executed by running a plurality of process Prs. Thread th is a component of process Pr and a unit of processing, and M threads are grouped together to form a process.

Thread th executes reading of DLL (Dynamic Link Library), which is a component of the program, in the middle of the process, and uses the process (method) described in the DLL. The DLL can be called and executed as needed when processing is performed in each thread, and can be called from a plurality of threads at the same time. Although not described in FIG. 1, there is a module as a component of the DLL, and internal processing is described here.

The computer PC realizes interprocess communication according to the above configuration. This interprocess communication can be realized on the premise of socket communication because IP address and port number are required for linking logs, but there are other communication methods between processes such as data transfer by shared memory. There are several, and the present invention may utilize any of them.

FIG. 2 is a diagram illustrating the flow of processing in a computer PC. As illustrated here, information can be exchanged not only between processes in the same computer PC1 but also between processes of other computers PC2 by interprocess communication.

In the illustrated example, when the computer PC1 is given an input from the outside, an example of the processing flow (a to i) until the output processing is completed is shown. The contents of the process are as follows. a: The computer PC1 receives an external input, the process Pr11 and the thread th111 in the computer PC1 are started, and the process is started. b: In the processing of thread th111, the processing is passed to thread th121 of another process Pr12 in the computer PC1 as needed. c, d: In the processing of thread th121, the method in the DLL is used for processing. E: Further, in the processing of the thread th121, the processing is further passed to the thread th211 of the process Pr21 of another computer PC2. F, g: In the processing of thread th211, the method in the DLL is used for processing. h: Since all the processes have been returned to the thread th111 in the process Pr11 in the computer PC1, the processes are passed to the other thread th112. I: The computer PC1 performs output processing to the outside.

FIG. 3 shows an example of the processing flow when exception handling occurs. Here, it means that the exception processing has occurred in the DLL after the processing f. As described above, the module which is a component of the DLL describes the internal processing, which includes the processing when the exception processing occurs.

As described above, as shown in the process flow in a general computer with reference to FIGS. 2 and 3, each part and each function in the computer has a hierarchical structure consisting of a computer PC, a process Pr, and a thread th.

Here, as the response when exception handling occurs in the computer, it is a stack trace that displays what kind of processing (method) was called in what order, and a log that is output for each application, such as a trace log and an error log. There are known application logs that can be determined by the application designer.

Of these, the stack trace can record the flow of processing (which method was used) and can understand the processing (method) in which exception handling occurred, but on the other hand, in the method called from many processes, There is a problem that it is not known which operation caused the exception handling.

On the other hand, in the application log, when exception handling occurs, unless you are an application developer, you may not know what caused the exception handling, and if exception handling runs in a series of processes performed over the process, There is a problem that it is difficult to determine the root cause.

Therefore, in the present invention, the application log and the stack trace are linked and displayed. Specifically, from the application log, the log from the input operation to the processing of each process and the log where the exception occurred are obtained from the processing log of each process, and more detailed information (in the thread) from the stack trace. Was the method used)? Then, by combining them, it is possible to judge from the input operation to the method in which the exception handling occurs.

Furthermore, by displaying the application log and the stack trace together in a hierarchical manner, it is possible to quickly grasp the problem when exception handling occurs in the system.

FIG. 4 is a diagram showing the relationship between the application log, the stack trace, and the hierarchy. The case number is shown on the left side of FIG. 4, the hierarchical structure is shown by the computer PC, the process Pr, and the thread th, and the application log and the stack trace are shown, showing a specific example.

In case number 1, the hierarchy is computer PC1, and a trace log input to the computer PC1 as an application log and an error log of input but no output were obtained.

In case number 2, the hierarchy is thread th111 in the process Pr11 in the computer PC1, an error log that there is no response to the process of b is obtained as the application log, and the method used as the stack trace is recorded. NS.

In case number 3, the hierarchy is thread th121 in the process Pr12 in the computer PC1, an error log that there is no response to the process of e is obtained as the application log, and the method used as the stack trace is recorded. NS.

In case number 4, the hierarchy is thread th211 in the process Pr21 in the computer PC2, an error log that there is no response to the process of f is obtained as the application log, and even the method in which the error occurred as the stack trace is obtained. Processing is recorded.

Utilizing the above relationship, in the present invention, the cause is investigated and displayed by a series of processes shown in FIG. In the first processing step S100 of the flow of FIG. 5, the IP address, process ID, and thread ID of the computer PC in which the error occurred are specified from the stack trace.

FIG. 6 is a diagram showing a configuration example of a stack trace. Here, the IP address of the computer PC, the process ID, the thread ID, the function name, and the like are described. Here, since the process in which the error occurred is described at the top, attention is paid to the IP address (192.168.1.10), the process ID (21000), and the thread ID (20).

In the process step S110 of the flow of FIG. 5, an error log of an application having the same IP address, process ID, and thread ID is specified.

FIG. 7 is a diagram showing a configuration example of an error log of an application. Here, the level, the IP address of the computer PC, the input, the process ID, the thread ID, the own IP address, the request base IP, the request destination IP, the transmission port number, the reception port number, etc. are described for each time. .. By this reference processing, an error is described in the level after time 10:10:04, and the fourth line is the first event.

In the next processing step S120 of FIG. 5, related trace logs and error logs are collected from the application log based on the IP address and port number. Here, the process (trace log) from the searched application log identifier (IP and port number) to the error log is searched, and if "1" is entered in the input field, the process starts from there. End the search.

FIG. 8 is a diagram showing an example of identifying and collecting a series of information from the start of processing to the detection of error occurrence. As a result, a series of information from the start of processing in the first line of the application log of FIG. 8 to the detection of error occurrence in the fourth line can be specified and collected. As a search method in this case, among the logs appearing before your own log, C1 is searched as the case where the receive port and the send port are the same, and C2 is searched as the case where the own IP and the request destination IP are the same. By searching C3 as the case where the request source IP and the own IP are the same, the third line can be specified, and the range up to the first line in which "1" is entered in the input field can be specified.

In the next processing step S130 of FIG. 5, which part of the application log is processed is arranged from the IP address, process ID, and thread ID of the stack trace. FIG. 9 is a diagram in which an error log having the same IP, process ID, and thread ID is extracted from the trace log subjected to the search. It is an error log in which the range of light ink is extracted.

In the next processing step S140 of FIG. 5, by displaying the application log and the stack trace in a hierarchical manner, it is displayed up to the method part in which part of the series of processing the exception processing occurred.

FIG. 10 is a hierarchical display of a series of processes including the stack trace and the application log. When displaying, each line of the application log is described above, and the function name, which is the information of the stack trace, is sequentially written below it.

In realizing this, the present invention described above can be embodied as an information processing system, a log extraction method of an information processing apparatus, and a log extraction program. Of these, when the information processing system is used, the resources of the computer are used to "have a plurality of processes composed of a plurality of threads, and each thread executes the reading of the PLL, which is a component of the program, in the middle of the process. , An information processing system that uses a computer that is configured to use the methods described in the modules in the PLL and that communicates between the processes by forming a hierarchy between the processes, threads, and the PLL. Stack trace that displays what kind of process was called in what order when exception handling occurred in the computer, extraction means that extracts the application log to be output for each application, and from the application log, from the input operation to each process Exception handling from input operation by obtaining the log up to the processing and the log in which the exception occurred from the processing log of each process, and by obtaining which method was used in the thread from the stack trace and combining them. It is realized by configuring it as "an information processing system characterized by having a judgment means for determining up to the method in which the above occurs and a display means for displaying the application log and the stack trace in a hierarchical manner".

Similarly, the method and the program can be grasped, but since these can be applied as appropriate, detailed description thereof will be omitted.

PC, PC1, PC2: Computer Pr (Pr1 ... Prn): Process th: Thread

Claims (7)

It has multiple processes composed of multiple threads, and each thread is configured to read the DLL that is a component of the program in the middle of the process and use the method described in the module in the DLL. At the same time, it is an information processing system using a computer that forms a hierarchy between the process, the thread, and the DLL to communicate between the processes.
A stack trace that displays what kind of processing was called in what order when exception handling occurred in the computer, and an extraction means that extracts the application log to be output for each application.
From the application log, get the log from the input operation to the processing of each process, and from the log of the processing of each process, the log in which the exception occurred, and from the stack trace, get which method was used in the thread. And by combining them, a judgment means to judge from the input operation to the method in which the exception handling occurred,
An information processing system characterized by having a display means for displaying application logs and stack traces in a hierarchical manner. The information processing system according to claim 1.
The information processing system is composed of a plurality of computers, and is characterized in that when an exception processing occurs, the stack trace in the plurality of computers and the application log are extracted and the processing result is displayed. The information processing system according to claim 1 or 2.
The determination means identifies the IP address, process ID, and thread ID of the computer in which the error occurred from the stack trace, identifies the error log of the application having the same IP address, process ID, and thread ID, and identifies the application log. Collect related trace logs and error logs based on the IP address and port number from, and arrange which part of the application log is processed from the IP address, process ID, and thread ID of the stack trace.
An information processing system characterized in that, by displaying the application log and the stack trace in a layered manner on the display means, it is possible to display up to a method part in which part of a series of processes the exception processing has occurred. It has multiple processes composed of multiple threads, and each thread is configured to read the DLL that is a component of the program in the middle of the process and use the method described in the module in the DLL. At the same time, it is a log extraction method of an information processing system using a computer that forms a hierarchy between the process, the thread, and the DLL to communicate between the processes.
Extract the stack trace that displays what kind of processing was called in what order when exception handling occurred in the computer, and the application log that is output for each application.
From the application log, the log from the input operation to the processing of each process, the log in which the exception occurred is obtained from the processing log of each process, and from the stack trace, which method was used in the thread is obtained. By combining them, it is possible to judge from the input operation to the method in which the exception handling occurred.
A log extraction method for an information processing system characterized by displaying application logs and stack traces together in a hierarchical manner. The log extraction method for an information processing system according to claim 4.
The IP address, process ID, and thread ID of the computer in which the error occurred are specified from the stack trace, the error log of the application having the same IP address, process ID, and thread ID is specified, and the IP address and port are specified from the application log. Collect related trace logs and error logs based on the numbers, and arrange which part of the application log is processed from the IP address, process ID, and thread ID of the stack trace.
A log extraction method for an information processing system, characterized in that by displaying the application log and the stack trace in a layered manner, it is possible to display up to the method part in which part of a series of processes the exception handling has occurred. It has multiple processes composed of multiple threads, and each thread is configured to read the DLL that is a component of the program in the middle of the process and use the method described in the module in the DLL. At the same time, it is a log extraction program used in a computer that forms a hierarchy between the process, the thread, and the DLL to communicate between the processes.
A stack trace that displays what kind of processing was called in what order when exception handling occurred in the computer, and an extraction program that extracts the application log to be output for each application.
From the application log, the log from the input operation to the processing of each process, the log in which the exception occurred is obtained from the processing log of each process, and from the stack trace, which method was used in the thread is obtained. And by combining them, a judgment program that judges from the input operation to the method in which exception handling occurred,
A log extraction program for an information processing system, which is characterized by being composed of a display program that displays application logs and stack traces in a hierarchical manner. The log extraction program according to claim 6.
The determination program identifies the IP address, process ID, and thread ID of the computer in which the error occurred from the stack trace, identifies the error log of the application having the same IP address, process ID, and thread ID, and identifies the error log of the application from the application log. Collect related trace logs and error logs based on the IP address and port number, and arrange which part of the application log is processed from the IP address, process ID, and thread ID of the stack trace.
The display program displays the application log and the stack trace in a layered manner, so that the log extraction of the information processing system is characterized in that it displays the part of the method where the exception handling occurred in a series of processes. program.

Images