JP4420804B2 - Log income management system, method, and program - Google Patents

Description

  The present invention relates to a log acquisition management system for setting and managing log generation exclusion conditions in order to reduce logs to be acquired in log collection.

  Conventionally, in a client-server system, when a system failure or fraud such as data falsification or leakage occurs, the logs generated by the computers that make up the system are aggregated as a method for investigating the cause. There is a method to elucidate the cause using. However, the above method is inefficient because a large number of logs including logs that are not necessary for the cause elucidation must be recorded even if the information necessary for the cause elucidation is a small number of logs. . As a countermeasure for such a problem, there is a method in which a log judged to be unnecessary for the cause elucidation is not recorded by filtering.

For example, when detecting illegal access from the access log, there is a system in which not all access logs are subject to analysis, but only those that do not match a preset illegal access exclusion list are extracted as analysis subjects. (Patent Document 1).
JP 2003-280945 A (page 4, FIG. 3)

  However, in the system as described above, although additional setting of the filtering condition can be manually performed, it is impossible to determine the effectiveness of the set filtering condition and adjust the setting content. Although the filtering conditions as described above are appropriate at the time of setting, they are often inappropriate after the change due to changes in the access status, event occurrence status, and the like. For this reason, in order to obtain a more accurate log analysis result, it is desirable to appropriately adjust the conditions regarding log generation according to the access status, event occurrence status, and the like.

The present invention has been made in view of the above circumstances, and an object thereof is to provide a log acquisition management system and method capable of acquiring necessary logs efficiently and effectively.
Another object of the present invention is to provide a log acquisition management system and method that can automatically adjust conditions related to log generation according to the situation.
The present invention also provides a log acquisition management system and method that can determine the appropriateness of conditions related to log generation that have been set, and that can adjust the conditions related to log generation based on the determination result. Objective.

In order to achieve the above object, a log acquisition management system according to the first aspect of the present invention provides:
In response to the occurrence of the event, a determination means for determining whether the event corresponds to any of the log generation exclusion condition data indicating the log generation exclusion condition stored in the condition database;
If it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database, the log corresponding to the event is not generated and the number of times the log generation exclusion condition data is used A log generation means for updating and generating a log corresponding to the event and storing it in the log database when it is determined that the event does not correspond to any of the log generation exclusion condition data stored in the condition database; ,
Among the log generation exclusion condition data stored in the condition database, the condition deletion unit operable number of uses the log generation exclusion condition data satisfies a predetermined condition, to remove from the condition database,
It is characterized by providing.

In order to achieve the above object, a log acquisition management system according to the second aspect of the present invention provides:
In response to the occurrence of the event, a determination means for determining whether the event corresponds to any of the log generation exclusion condition data indicating the log generation exclusion condition stored in the condition database;
If it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database, a log corresponding to the event is not generated, and the event is stored in the condition database Log generation means for generating a log corresponding to the event and storing it in the log database when it is determined that none of the generation exclusion condition data corresponds to;
A condition for determining whether or not each log generation exclusion condition data stored in the condition database is appropriate and detecting inappropriate log generation exclusion condition data, and deleting the log generation exclusion condition data from the condition database Delete means,
With
When it is determined by the determination means that the event corresponds to any of the log generation exclusion condition data stored in the condition database, in the usage situation database in which the usage count data of each log generation exclusion condition data is stored further example Bei means for updating the value of the usage count data of the determined log generating exclusion condition data and the event is applicable,
The condition deletion means detects log generation exclusion condition data in which the usage count data of each log generation exclusion condition data stored in the usage status database satisfies a predetermined condition, and the detected log generation exclusion condition data is rejected. it is determined that the appropriate log generation exclusion conditions,
It is characterized by that.

In order to achieve the above object, a log acquisition management system according to the third aspect of the present invention provides:
In response to the occurrence of the event, a determination means for determining whether the event corresponds to any of the log generation exclusion condition data indicating the log generation exclusion condition stored in the condition database;
If it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database, a log corresponding to the event is not generated, and the event is stored in the condition database Log generation means for generating a log corresponding to the event and storing it in the log database when it is determined that none of the generation exclusion condition data corresponds to;
A condition for determining whether or not each log generation exclusion condition data stored in the condition database is appropriate and detecting inappropriate log generation exclusion condition data, and deleting the log generation exclusion condition data from the condition database Delete means,
With
When it is determined by the determination means that the event corresponds to any of the log generation exclusion condition data stored in the condition database, the usage count data of each log generation exclusion condition data is stored every predetermined time. in context base further example Bei means for updating the value of the usage count data of the determined log generating exclusion condition data and the event is applicable,
The condition deletion means detects log generation exclusion condition data in which the amount of change in the number of use exceeds a predetermined criterion based on the use count data of each log generation exclusion condition data stored in the usage situation database, the detected log generated exclusion condition data determined inappropriate log generation exclusion conditions,
It is characterized by that.

For the log stored in the log database, means for specifying a combination of items having a data value having a high appearance degree among items constituting the log;
Means for generating log generation exclusion condition data based on the identified combination of items;
Means for additionally registering the generated log generation exclusion condition data in the condition database;
May be further provided.

Moreover, the log acquisition management method according to the fourth aspect of the present invention is:
A determination step of determining whether the event corresponds to any of log generation exclusion condition data indicating an exclusion condition of log generation stored in the condition database in response to the occurrence of the event;
When it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database , the log generation unit does not generate a log corresponding to the event, and the log generation exclusion condition Update the number of times the data is used, and if it is determined that the event does not correspond to any of the log generation exclusion condition data stored in the condition database, a log corresponding to the event is generated and stored in the log database Log generation step to
A condition deleting step for deleting, from the condition database, log generation exclusion condition data in which the number of uses satisfies a predetermined condition among the log generation exclusion condition data stored in the condition database;
It is characterized by providing.
A program according to the fifth aspect of the present invention is
Computer
A determination means for determining whether the event corresponds to any one of the log generation exclusion condition data indicating the log generation exclusion condition stored in the condition database in response to the occurrence of the event;
If it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database, the log corresponding to the event is not generated and the number of times the log generation exclusion condition data is used A log generation means for updating and generating a log corresponding to the event and storing it in the log database when it is determined that the event does not correspond to any of the log generation exclusion condition data stored in the condition database;
Condition deletion means for deleting from the condition database log generation exclusion condition data in which the number of uses satisfies a predetermined condition among the log generation exclusion condition data stored in the condition database;
It is made to function as.

  Necessary logs can be acquired efficiently and effectively.

Hereinafter, a log acquisition management system according to an embodiment of the present invention will be described with reference to the drawings.
A hardware configuration diagram of a log acquisition management system 1 according to the present embodiment is illustrated in FIG. 1, and a functional configuration diagram is illustrated in FIG.
The log acquisition management system 1 includes a computer that includes a control unit 11, a storage unit 12, and a communication control unit 13. The log acquisition management system 1 is configured to be connectable to another computer via the network 10. The network 10 includes various networks such as a LAN and the Internet.

  The control unit 11 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like, and reads and executes an operation program or the like stored in advance in the storage unit 12 to execute a log. The generation unit 21, the log generation exclusion condition analysis unit 22, the log analysis unit 23, the log generation exclusion condition management unit 24, and the like are logically realized.

  In response to the occurrence of an event in the log acquisition target computer system, the log generation unit 21 performs log processing based on the log generation exclusion condition data stored in the log generation exclusion condition DB (database) 31 of the storage unit 12. Determine whether to generate. The log generation exclusion condition data indicates a condition (rule) for not generating a log. For example, as shown in FIG. 3, the condition ID and various items (IP address, ID, time, execution command, etc.) Contains data. The log generation unit 21 does not generate a log when the generated event corresponds to any of the log generation exclusion conditions registered in the log generation exclusion condition DB 31, and the event is not included in any log generation exclusion condition. If not applicable, a log corresponding to the event is generated and recorded in the log DB 32 of the storage unit 12.

  Further, the log generation unit 21 counts the number of times each log generation exclusion condition data registered in the log generation exclusion condition DB 31 is used every predetermined time. Specifically, when it is determined that a log is not generated based on a certain log generation exclusion condition, among the usage count data of each log generation exclusion condition stored in the condition usage status DB 33 of the storage unit 12, The number-of-uses data corresponding to the used log generation exclusion condition is specified, and for example, 1 is added to the value of the number of times of use corresponding to the time data included in the event and updated. The usage count data stored in the condition usage status DB 33 includes, for example, data such as a condition ID for specifying a log generation exclusion condition and a usage count, as shown in FIG. It is shown every predetermined time zone (for example, every several hours, every day, every week, etc.).

The log generation exclusion condition analysis unit 22 refers to the condition usage situation DB 33, analyzes the appropriateness of the log generation exclusion condition registered in the log generation exclusion condition DB31, and for the condition determined to be inappropriate, The condition ID and the like are delivered to the log generation exclusion condition management unit 24 together with the deletion request. In the analysis of the appropriateness of the log generation exclusion condition, the log generation exclusion condition in which the number of times of use has changed significantly, that is, the log generation exclusion condition in which the amount of change in the usage count exceeds a certain standard is inappropriate. Judge. A specific determination method is arbitrary. For example, using the usage count data stored in the condition usage status DB 33, the average value of the usage count is calculated for each log generation exclusion condition, and for each log generation exclusion condition, the usage count for each time is calculated first. If the difference is less than or equal to a preset threshold value (for example, 100), it is determined as an appropriate log generation exclusion condition. You may determine with appropriate log production | generation exclusion conditions. For example, using the usage count data shown in FIG. 4 as an example, for the condition ID “00002”, the usage count of the time “2004/10/10” is set to “2”. When the average value of the number of times of use of the log generation exclusion condition with the condition ID “00002” is “150” and the preset threshold value is “100”, the number of times of use of the time “2004/10/10” Since the difference between 2 ”and the average value“ 150 ”is larger than the threshold value“ 100 ”, it is determined that the log generation exclusion condition with the condition ID“ 00002 ”is inappropriate.
In addition, the condition to be inappropriate is not limited to the above, and any condition may be used as long as it is an inappropriate log generation exclusion condition when the number of uses in the condition usage status DB 33 satisfies a predetermined condition. The method can be used.

  The log analysis unit 23 reads the log generated by the log generation unit 21 from the log DB 32 and generates a combination (correlation rule) having a high appearance degree among the combinations of items constituting the log using the read log. The data is stored in the storage unit 12 together with the date and time of generation. Specifically, information on predetermined items such as IP address, ID, time, and execution command is extracted and extracted from the log read from the log DB 32 using a predetermined extraction rule set in the storage unit 12. Information is temporarily stored in the storage unit 12 as log analysis information. The extraction rule indicates the position of information of each item such as IP address, ID, time, execution command, etc. in various logs. For example, the extraction rule has a format of various logs such as an access log, a login log, an event log, and an application log. Based on the log type, it is generated and stored in advance. And about the log analysis information produced | generated from each log, the structure ratio etc. of each data are calculated for every item, such as ID, an object file, and an execution command. In addition, when including time in a calculation object item, you may calculate the structure ratio for every time slot | zone (XX hour range), for example. Then, the item having the highest configuration ratio is specified as the first item, and the log analysis information in which the data value having the highest configuration ratio is set for the first item is extracted. For the extracted log analysis information, the composition ratio of each data is calculated for each item, and the item having the highest composition ratio after the first item is specified as the second item. By repeating such a procedure, an n-th item (n = 1, 2,...) Is specified, and an association rule is generated by combining a plurality of data values having the highest composition ratio for the specified item. .

For example, when the log analysis information as shown in FIG. 5A is acquired and the data composition ratio of each item is acquired as shown in FIG. 5B, the highest composition ratio (this example) In this case, the item having “40% of“ ms_word.exe ”) is an“ execution command ”, and is therefore specified as the first item. Then, log analysis information in which the data value “ms_word.exe” having the highest composition ratio is set in the “execution command” is extracted. Here, for example, log analysis information as shown in FIG. 6 (A) is extracted, and when the data composition ratio of each item is acquired as shown in FIG. 6 (B), the highest composition ratio (this In the example, since an item having “75% of“ report.doc ”” is a “target file”, this is specified as the second item. For example, when it is set that the association rule is generated by combining the first item and the second item, for example, as shown in FIG. 6C, “execution command: ms_word.exe, target file: report” A correlation rule with “.doc” is generated.
The number of items to be combined can be arbitrarily set. For example, the number of items to be combined may be 3 (that is, a combination of the first, second, and third items).

In addition, the log analysis unit 23 selects a generated correlation rule that satisfies a predetermined criterion, and notifies the log generation exclusion condition management unit 24 of the selected correlation rule together with an addition request. Specifically, an association rule whose appearance rate exceeds a threshold (for example, 75%) in a predetermined period unit (for example, 10 day unit) is selected.
The association rule selection process will be specifically described. For example, it is assumed that the data of the correlation rule generated on each day until October 10 is stored in the storage unit 12 on October 10th. At this time, the appearance rate of each correlation rule generated in the past 10 days (that is, 1st to 10th) is calculated. For example, when a certain correlation rule A “ID: user001, file :, command” is generated seven times between 1 day and 10 days, the appearance rate is 70%, which is lower than the threshold value of 75% and is not selected. Then, on October 11 of the next day, when the appearance rate of the correlation rule generated in the past 10 days (that is, 2nd to 11th) is calculated, when the above-mentioned correlation rule A appears 8 times, The appearance rate is 80%, which is selected because it exceeds the threshold value of 75%.

  The log generation exclusion condition management unit 24 updates the log generation exclusion condition data registered in the log generation exclusion condition DB 31 based on data notified from the log generation exclusion condition analysis unit 22 and the log analysis unit 23. . Specifically, when the condition ID is received from the log generation exclusion condition analysis unit 22 together with the deletion request, the log generation corresponding to the received condition ID among the log generation exclusion condition data registered in the log generation exclusion condition DB 31 Delete exclusion condition data. When a correlation rule is received from the log generation exclusion condition analysis unit 22 together with an addition request, a condition ID is assigned to the received correlation rule and additionally registered in the log generation exclusion condition DB 31 as new log generation exclusion condition data. At this time, necessary aggregation processing may be performed for the log generation exclusion condition after addition. This aggregation process will be specifically described. For example, it is assumed that four users are registered in the computer system for which logs are acquired. Then, as shown in FIG. 7, when log generation exclusion condition data C is added to the current log generation exclusion condition data B, log generation exclusion conditions in which only the user name is different from the added log generation exclusion condition data D When data is created for all users registered in the system, these four log generation exclusion condition data are aggregated into one log generation exclusion condition data for which no value is set for “user name”. It is assumed that new log generation exclusion condition data E is used. This is not limited to the item “user name”, and other items (target file, execution command, etc.) can be similarly processed.

The storage unit 12 is constituted by, for example, a hard disk device or the like, and stores an operation program to be executed by the control unit 11 and various data necessary for processing. The storage unit 12 includes a log generation exclusion condition DB 31, a log DB 32, a condition usage status DB 33, and the like. The log generation exclusion condition DB 31 stores log generation exclusion condition data (see FIG. 3). The log DB 32 stores a log generated by the log generation unit 21. The condition usage situation DB 33 stores the condition ID of each log generation exclusion condition data registered in the log generation exclusion condition DB 31 and the use count data (see FIG. 4) indicating the use count.
The communication control unit 13 controls data communication with other computers via the network 10.

Next, the system operation of the log acquisition management system 1 according to the present embodiment will be described.
First, a log generation process for generating a log based on the log generation exclusion condition registered in the log generation exclusion condition DB 31 will be described with reference to the flowchart of FIG. Note that the control unit 11 reads log generation exclusion condition data registered in the log generation exclusion condition DB 31 at a predetermined timing as preprocessing. This read timing is arbitrary, and may be, for example, at the time of system startup or after the log generation exclusion condition DB 31 is updated.

The control unit 11 refers to the log generation exclusion condition data read from the log generation exclusion condition DB 31 in advance in response to the occurrence of an event such as an access request, a login request, or an application activation request in the log acquisition target computer system. Then, it is determined whether or not the generated event corresponds to any of the log generation exclusion conditions (step S1).
When it is determined in step S1 that the event does not correspond to any of the log generation exclusion conditions (step S1: NO), the control unit 11 generates a log corresponding to the event and stores it in the log DB 32 (step S2). ), This process is terminated.
If it is determined in step S1 that the event corresponds to any of the log generation exclusion conditions (step S1: YES), no log is generated, and the log generation exclusion condition (event corresponding to the determination in step S1 is applied). Then, the condition ID of the determined log generation exclusion condition) is specified, and 1 is added to the value of the number of times of use corresponding to the previously specified condition ID in the condition usage status DB 33 (step S3), and this process is terminated. To do.

  Next, the log generation exclusion condition deletion process for determining the appropriateness of the log generation exclusion condition data registered in the log generation exclusion condition DB 31 and detecting and deleting the inappropriate log generation exclusion condition is shown in the flowchart of FIG. The description will be given with reference. This process is executed, for example, every predetermined time (for example, every day).

  The control unit 11 reads the usage count data from the condition usage status DB 33 (step S11), and performs a process of analyzing the appropriateness of each log generation exclusion condition based on the read data (step S12). Specifically, each log generation exclusion condition data is analyzed for whether there is a significant change in the number of uses. For example, the average value of the usage count is calculated for each log generation exclusion condition, and for each log generation exclusion condition, the difference between the usage count for each time and the average value of the usage count calculated previously is obtained. If it is less than a set threshold (for example, 100), it is determined as an appropriate log generation exclusion condition. If the difference is larger than the threshold, it is determined as an inappropriate log generation exclusion condition. Is stored in the storage unit 12.

When the analysis is completed for all log generation exclusion conditions, it is determined whether or not there is a log generation exclusion condition determined to be inappropriate (step S13), and if it exists (step S13: YES), the condition ID is set. Corresponding log generation exclusion condition data is deleted from the log generation exclusion condition DB 31 (step S14). If there is no log generation exclusion condition determined to be inappropriate (step S13: NO), this process is terminated as it is.
As a result, the log generation exclusion condition that has become inappropriate can be deleted from the log generation exclusion condition DB 31.

  Next, log generation exclusion condition addition processing for detecting a log generation exclusion condition to be newly added based on the generated log and additionally registering it in the log generation exclusion condition DB 31 will be described with reference to FIG. This process is executed, for example, every predetermined time (for example, every day).

The control unit 11 reads a log stored in the log DB 32 (step S21), analyzes the read log, and generates an association rule that is a combination having a high appearance degree among combinations of items constituting the log, It memorize | stores in the memory | storage part 12 with a production | generation date (step S22).
Next, the control unit 11 calculates the appearance rate of each correlation rule generated in a predetermined period such as 10 days (step S23), and determines whether there is a correlation rule for which the calculated appearance rate exceeds the threshold value. A determination is made (step S24).
When there is a correlation rule whose appearance rate exceeds the threshold (step S24: YES), log generation exclusion condition data is generated by adding a condition ID to the corresponding correlation rule, and additionally registered in the log generation exclusion condition DB 31. (Step S25).
If there is no correlation rule whose appearance rate exceeds the threshold (step S24: NO), this process is terminated as it is.
Thereby, the log which appears frequently can be excluded from acquisition object, and the efficiency of log acquisition can be improved.

  As described above, according to the present invention, in the system for acquiring a log based on a condition related to log generation (log generation exclusion condition), a new log generation exclusion condition is additionally registered based on the generated log, In addition, the appropriateness of the log generation exclusion conditions that have been set is determined, and those that are determined to be inappropriate are deleted from the registration, so that appropriate log generation exclusion conditions can be maintained, which is effective effectively. You can get the logs you need.

Various modifications and applications can be applied to the present invention.
For example, an existing method such as the Apriori algorithm may be used in the association rule generation process.
Moreover, although the said embodiment demonstrated the case where a log acquisition management system was implement | achieved by one computer, a system structure is not limited to this, For example, the log production | generation part 21 is implement | achieved by one computer, The log generation exclusion condition analysis unit 22, the log analysis unit 23, and the log generation exclusion condition management unit 24 may be realized by another computer, and these computers may be connected via a network. In this case, each DB 31, 32, 33 may be provided in any computer.

The system of the present invention can be realized using a normal computer system, not a dedicated system. For example, a log acquisition management system 1 is obtained by storing a program for executing the above-described operation on a computer-readable recording medium (FD, CD-ROM, DVD, etc.) and distributing the program and installing the program in a computer. May be configured. Alternatively, it may be stored in a disk device of a server device on the network 10 such as the Internet and downloaded to a computer, for example.
In addition, when the OS realizes the above functions by sharing the OS or jointly with the OS and the application, etc., only the part other than the OS may be stored and distributed in the medium, or may be downloaded to the computer. Good.

It is a figure which illustrates the hardware constitutions of the log acquisition management system which concerns on embodiment of this invention. It is a figure which illustrates the function structure of the log acquisition management system of FIG. It is a figure which shows an example of the data structure of log production | generation exclusion condition data. It is a figure which shows an example of the data structure of use frequency data. It is a figure for demonstrating concretely the production | generation process of an association rule. It is a figure for demonstrating concretely the production | generation process of an association rule. It is a figure for demonstrating the aggregation process of log production | generation exclusion conditions. It is a flowchart for demonstrating a log production | generation process. It is a flowchart for demonstrating log generation exclusion condition deletion processing. It is a flowchart for demonstrating a log production | generation exclusion condition addition process.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Log acquisition management system 10 Network 11 Control part 12 Storage part 13 Communication control part 21 Log generation part 22 Log generation exclusion condition analysis part 23 Log analysis part 24 Log generation exclusion condition management part 31 Log generation exclusion condition DB
32 Log DB
33 Condition usage DB

Claims (6)

In response to the occurrence of the event, a determination means for determining whether the event corresponds to any of the log generation exclusion condition data indicating the log generation exclusion condition stored in the condition database;
If it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database, the log corresponding to the event is not generated and the number of times the log generation exclusion condition data is used A log generation means for updating and generating a log corresponding to the event and storing it in the log database when it is determined that the event does not correspond to any of the log generation exclusion condition data stored in the condition database; ,
Among the log generation exclusion condition data stored in the condition database, the condition deletion unit operable number of uses the log generation exclusion condition data satisfies a predetermined condition, to remove from the condition database,
A log acquisition management system comprising: In response to the occurrence of the event, a determination means for determining whether the event corresponds to any of the log generation exclusion condition data indicating the log generation exclusion condition stored in the condition database;
If it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database, a log corresponding to the event is not generated, and the event is stored in the condition database Log generation means for generating a log corresponding to the event and storing it in the log database when it is determined that none of the generation exclusion condition data corresponds to;
A condition for determining whether or not each log generation exclusion condition data stored in the condition database is appropriate and detecting inappropriate log generation exclusion condition data, and deleting the log generation exclusion condition data from the condition database Delete means,
With
When it is determined by the determination means that the event corresponds to any of the log generation exclusion condition data stored in the condition database, in the usage situation database in which the usage count data of each log generation exclusion condition data is stored , Further comprising means for updating the value of the usage count data of the log generation exclusion condition data determined to correspond to the event,
The condition deletion means detects log generation exclusion condition data in which the usage count data of each log generation exclusion condition data stored in the usage status database satisfies a predetermined condition, and the detected log generation exclusion condition data is rejected. Judge as appropriate log generation exclusion condition,
Features and to Carlo grayed acquisition management system that. In response to the occurrence of the event, a determination means for determining whether the event corresponds to any of the log generation exclusion condition data indicating the log generation exclusion condition stored in the condition database;
If it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database, a log corresponding to the event is not generated, and the event is stored in the condition database Log generation means for generating a log corresponding to the event and storing it in the log database when it is determined that none of the generation exclusion condition data corresponds to;
A condition for determining whether or not each log generation exclusion condition data stored in the condition database is appropriate and detecting inappropriate log generation exclusion condition data, and deleting the log generation exclusion condition data from the condition database Delete means,
With
When it is determined by the determination means that the event corresponds to any of the log generation exclusion condition data stored in the condition database, the usage count data of each log generation exclusion condition data is stored every predetermined time. In the usage database, further comprising means for updating the value of the usage count data of the log generation exclusion condition data determined to correspond to the event,
The condition deletion means detects log generation exclusion condition data in which the amount of change in the number of use exceeds a predetermined criterion based on the use count data of each log generation exclusion condition data stored in the usage situation database, The detected log generation exclusion condition data is determined as an inappropriate log generation exclusion condition.
Features and to Carlo grayed acquisition management system that. For the log stored in the log database, means for specifying a combination of items having a data value having a high appearance degree among items constituting the log;
Means for generating log generation exclusion condition data based on the identified combination of items;
Means for additionally registering the generated log generation exclusion condition data in the condition database;
The log acquisition management system according to any one of claims 1 to 3, further comprising: A determination step of determining whether the event corresponds to any of log generation exclusion condition data indicating an exclusion condition of log generation stored in the condition database in response to the occurrence of the event;
When it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database , the log generation unit does not generate a log corresponding to the event, and the log generation exclusion condition Update the number of times the data is used, and if it is determined that the event does not correspond to any of the log generation exclusion condition data stored in the condition database, a log corresponding to the event is generated and stored in the log database Log generation step to
A condition deleting step for deleting, from the condition database, log generation exclusion condition data in which the number of uses satisfies a predetermined condition among the log generation exclusion condition data stored in the condition database;
A log acquisition management method comprising:   Computer
  A determination means for determining whether the event corresponds to any one of the log generation exclusion condition data indicating the log generation exclusion condition stored in the condition database in response to the occurrence of the event;
  If it is determined that the event corresponds to any of the log generation exclusion condition data stored in the condition database, the log corresponding to the event is not generated and the number of times the log generation exclusion condition data is used A log generation means for updating and generating a log corresponding to the event and storing it in the log database when it is determined that the event does not correspond to any of the log generation exclusion condition data stored in the condition database;
  Condition deletion means for deleting from the condition database log generation exclusion condition data in which the number of uses satisfies a predetermined condition among the log generation exclusion condition data stored in the condition database;
  Program to function as.

Images