JP4963847B2 - Log information management method - Google Patents

Description

  The present invention relates to a log information management method, and more particularly to a log information management method in a computer embedded device.

  In a computer or a device controlled by a computer, operation history information (log information) is recorded in order to investigate the cause of the failure when a failure occurs. Since log information is generated in large quantities, it is not possible to record everything in a limited memory. In order to save log information in the limited log memory, when the log memory is full, new log information can be overwritten on the old log information (ring buffer method), or an external log server There is a method to transfer to and save. Examples of related art related to this will be given below.

  The “log recording method” disclosed in Patent Document 1 does not increase the storage amount of the log file without limit, and does not delete important log information in the past without being erased by overwriting. This is a recordable log recording method. A plurality of partial log information storage units for storing log information are provided. The recording execution date and time of the last log information is stored in a plurality of partial log information storage units. When recording the log information, if there is no free space in the partial log information storage unit, the last log date is referred to and the elapsed period from the oldest last log date is obtained. When the storage period has passed a preset period, this log information is deleted and new log information is recorded. When there is no file whose period has elapsed, a new partial log information storage unit is generated and the log information generated in the new partial log information storage unit is recorded.

  The “failure information logging device” disclosed in Patent Document 2 is a failure information logging device that can prevent failure information that becomes the root cause of failure from being discarded by making buffer overflow less likely to occur. Detects a failure that occurred in a running device. Fault information including a fault ID and an occurrence time corresponding to the fault content is generated. The occurrence time of the new failure information is compared with the occurrence time of the failure information stored in the buffer with the same failure ID as the new failure information. If the time difference between the two is within the specified value, the new failure information is discarded.

  The “image forming system” disclosed in Japanese Patent Laid-Open No. 2004-228561 always stores operation log information reliably. When the log acquisition target process that is the target of log information acquisition operates, the log information of the operation is written and stored in a ring buffer file system (ring file system). The stored log information is read out by the log information reading process and displayed on the display unit. It forms an image on a transfer sheet and outputs it, or displays it on a PC client connected via a network.

The “information processing apparatus” disclosed in Patent Document 4 is required for analyzing the occurrence of a failure by avoiding the inconvenience that the execution history information output at the time of the failure is overwritten by the execution history information output after the occurrence of the failure. This is an information processing apparatus that can be reliably stored in an external storage device without causing redundant storage capacity and without deteriorating system performance, using execution history information for a certain period as trace log information. The trace information storage function unit provided in the execution program main body stores the execution history and its processing state sequentially as trace information in the trace information storage area in the internal memory during program execution. When the trace information output function unit provided in the execution program main body receives the event notification of the failure occurrence from the system monitoring mechanism, the trace information stored in the trace information storage area in the internal memory is placed in the external storage device. Output to one of the trace information files.
Japanese Patent Laid-Open No. 10-11330 Japanese Patent Laid-Open No. 10-301815 Japanese Patent Laid-Open No. 2002-140210 JP 2002-215431 A

  However, the conventional log information management technique has the following problems. In a computer-embedded device that does not have a lot of memory, there is not enough memory to store log information, and it is necessary to store log information in a limited memory. When the log memory is full, important information cannot be recorded unless there is an external log server. Providing an external log server for all computer embedded devices is not possible in terms of cost. If log information is recorded by the ring buffer method, important log information will be erased. Of the log information related to the failure that occurred, only the latest log information can be saved. In the case of a failure whose root cause has occurred a long time ago, the cause cannot be determined from the log information.

  An object of the present invention is to solve the above-described conventional problems and efficiently record log information in a limited log memory in a computer embedded device or the like to increase the possibility of investigating the cause of an error. .

In order to solve the above-described problem, in the present invention , a link that is log information and is a set of a message ID of the log information itself and a message ID of the log information subsequent to the log information according to the occurrence of an event. and log memory for storing log information added information, and means for detecting to record the log information event, a full detection means for detecting that the log memory is full, the full when the detecting means detects the full memory for the log, if the message ID of the subsequent log information added to the log information have Zureka is a reserved ID indicating success completion, preceding the basis of the link information the log information, links and extracting means for extracting a log information, the deleting means for deleting the extracted log information, new log information in the memory for the log deleting the log information Postscript means additionally writes, was provided with a structure.

With the arrangements as described above, so to delete the log information of the successful completion of the event from the old one, to remove the little relation log information in the failure analysis, the log for memory at a time can be widely released. Further, by not storing log information linked to the successful end event, memory consumption can be reduced, and failure analysis can be performed at high speed only by using log information related to failure analysis.

  Hereinafter, the best mode for carrying out the present invention will be described in detail with reference to FIGS.

  The first embodiment of the present invention retains importance information related to the importance of log information, and when the log memory becomes full, the log information having the lowest importance is selected based on the importance information. This is a log information management method in which the oldest one is deleted and new log information is added.

  FIG. 1 is a conceptual diagram of a log information management method in Embodiment 1 of the present invention. The basic configuration of the log information management method according to the first embodiment of the present invention is the same as the conventional one. The appending and deletion processing methods are different from the conventional ones. In FIG. 1, event detection means 1 is means for detecting an event for which log information is to be recorded. The appending means 2 is means for appending new log information to the log memory. The log memory 3 is a memory for storing log information. The full detection means 4 is a means for inspecting whether the log memory is full. The extracting means 5 is a means for extracting the oldest log information with the lowest importance. The importance information holding means 6 is means for holding importance information of log information. The deletion means 7 is means for deleting the extracted log information from the log memory.

  FIG. 2 is a log information table of the log information management method according to the first embodiment of the present invention. Table 1 in FIG. 2A is a table showing a state where log information is recorded until the log memory becomes full. Table 2 in FIG. 2B is a table showing a state in which the oldest log information having the lowest importance is deleted when the log memory is full. FIG. 3 is a flowchart showing the processing procedure of the log information management method.

  The function and operation of the log information management method according to the first embodiment of the present invention configured as described above will be described. First, an overview of the function of the log information management method will be described with reference to FIG. Event detection means 1 detects an event for which log information is to be recorded. For example, an event to be recorded is detected by receiving notification of the occurrence of the event by an interrupt or the like and examining the type of the event. When an event to be recorded is detected, the full detection means 4 checks whether the log memory 3 is full. If not full, new log information is stored in the log memory 3. If it is full, the extraction means 5 refers to the importance information holding means 6 to obtain the importance information of the log information, and extracts the oldest log information having the lowest importance. The deleting means 7 deletes the least important log information from the log memory. After that, the additional log means 2 adds new log information to the log memory.

  Next, a method for adding log information will be described with reference to FIG. In advance, importance level information of log information is set in the importance level information holding means 6. With reference to this importance level information, when the log memory 3 is full, the log information is deleted from the less important log information. When log information is stored in the log memory 3, a log as shown in Table 1 of FIG. For simplicity, it is assumed that the log memory 3 has 10 lines. In this case, in order to add log information of a new event, it is necessary to delete old and less important log information. If the oldest DEBUG event is deleted, the log shown in Table 2 shown in FIG. Here, it is assumed that the importance increases in the order of debugging (DEBUG), information (INFO), and error (ERROR). Therefore, the log information of DEBUG events is erased one after another from the oldest. When there is no DEBUG event log information to be deleted, the INFO event log information is deleted in order of oldest. This information type is information explicitly added by each application when event log information is added.

  Next, the processing procedure of the log information management method will be described with reference to FIG. In step 1, the process waits until detection of an event to be logged. When an event is detected, it is checked in step 2 whether the log memory 3 is full. If not full, the log information is stored in the log memory 3. If it is full, in step 3, the importance level information is referred to and the oldest log information having the lowest importance level is extracted. In step 4, the extracted log information is deleted from the log memory 3. In step 5, the log information is stored in the log memory 3. In step 6, the process is repeated until log information management is completed.

  As described above, in the first embodiment of the present invention, the log information management method is based on the importance information when the importance information regarding the importance of the log information is held and the log memory is full. The oldest log information of the lowest importance is deleted, and new log information is added, so that the latest important log information can be accumulated while minimizing the adverse effect on failure analysis. .

  In the second embodiment of the present invention, when the log memory is full, the oldest log information linked to the log information of the successful end event is deleted, and new log information is added to the log memory. This is a log information management method.

  FIG. 4 is a conceptual diagram of a log information management method and a log information table according to the second embodiment of the present invention. The basic configuration of the log information management method in the second embodiment of the present invention is the same as that in the first embodiment. However, the appending and deletion processing methods are different. In FIG. 4A, event detection means 1 is means for detecting an event for which log information is to be recorded. The appending means 2 is means for appending new log information to the log memory. The log memory 3 is a memory for storing log information. The full detection means 4 is a means for inspecting whether the log memory is full. The extracting means 5 is means for extracting the oldest log information among the log information linked to the log information of the successful end event. The deletion means 7 is means for deleting the extracted log information from the log memory. Table 3 in FIG. 4B is a table showing a state in which the oldest log information in the log information linked to the log information of the successful end event is deleted when the log memory is full. FIG. 5 is a flowchart showing the processing procedure of the log information management method.

  The function and operation of the log information management method according to the second embodiment of the present invention configured as described above will be described. First, an overview of the log information management function will be described with reference to FIG. Event detection means 1 detects an event for which log information is to be recorded. When an event to be recorded is detected, the full detection means 4 checks whether the log memory is full. If not full, log information is stored in the log memory 3. If it is full, the extracting means 5 extracts the oldest log information among the log information linked to the log information of the successful end event. The deleting unit 7 deletes the extracted log information from the log memory. Thereafter, new log information is added to the log memory 3 by the additional recording means 2.

  Next, a method for adding log information will be described with reference to FIG. When the log memory 3 is full, the oldest log information linked to the log information of the successful end event is erased. In Table 1 of FIG. 2, the link information is placed in the second column, and information from where to where is recorded as the message ID. For simplicity, the message ID is a value between 10 and 999, and a reservation ID between 0 and 9 is used. Of the reservation IDs, the success end is 0 and the error end is 9. One log information sequence ends with 0 or 9. Since 168-> 169-> 0 in the log shown in Table 1 of FIG. 1 has been completed successfully, these two lines are erased when the log memory 3 becomes full. As a result, the log is as shown in Table 3 of FIG.

  Next, the processing procedure of the log information management method will be described with reference to FIG. In step 11, the process waits until detection of an event to be logged. When an event is detected, it is checked in step 12 whether the log memory 3 is full. If not full, the log information is stored in the log memory 3. If it is full, in step 13, the oldest log information in the link of the successful end event is extracted. In step 14, the extracted log information is deleted from the log memory 3. In step 15, new log information is stored in the log memory 3. In step 16, the process is repeated until log information management is completed.

  As described above, in the second embodiment of the present invention, when the log memory is full, the oldest log information linked to the log information of the successful end event is deleted when the log memory is full. Since the new log information is added to the log memory, the latest important log information can be accumulated by widely releasing the log memory at a time while eliminating the adverse effect on the failure analysis.

  The third embodiment of the present invention is a log information management system in which, when an event is successfully completed, the log information linked to the event is deleted, and when the event is not successful, new log information is added to the log memory.

  FIG. 6 is a conceptual diagram of a log information management method and a log information table according to the third embodiment of the present invention. The basic configuration of the log information management method in the third embodiment is the same as that in the first embodiment. However, the appending and deletion processing methods are different. In FIG. 6A, event detection means 1 is means for detecting an event for which log information is to be recorded. The appending means 2 is means for appending new log information to the log memory. The log memory 3 is a memory for storing log information. The extraction unit 5 is a unit that extracts log information linked to the success end event. The deletion means 7 is means for deleting the extracted log information from the log memory. Table 4 in FIG. 6B is a table showing a log in a state where log information linked to the success end event is deleted. FIG. 7 is a flowchart showing the processing procedure of the log information management method.

  The function and operation of the log information management method according to the third embodiment of the present invention configured as described above will be described. First, an overview of the function of the log information management method will be described with reference to FIG. Event detection means 1 detects an event for which log information is to be recorded. When an event to be recorded is detected, log information linked to a successful end event is extracted. The deleting unit 7 deletes the extracted log information from the log memory 3. The additional recording means 2 adds new log information to the log memory 3.

Next, a method for adding log information will be described with reference to FIG. This is a method that does not save log information of events that have been successfully completed. When an event as shown in Table 1 of FIG. 2 actually occurs, it is deleted when the message ID becomes 0. Therefore, finally, as shown in Table 4 of FIG. 6B, only the log information of the event that ended in error is stored.

  Next, the processing procedure of the log information management method will be described with reference to FIG. In step 21, the process waits until detection of an event to be logged. If an event is detected, it is checked in step 22 whether the event has been completed successfully. If not successful, the log information is stored in the log memory 3 in step 5. If successful completion, in step 23, log information linked to the successful completion event is extracted. In step 24, the extracted log information is deleted from the log memory 3. In step 26, the process is repeated until log information management is completed.

  As described above, in the third embodiment of the present invention, the log information management method is configured such that, when an event ends successfully, the log information linked to the event is deleted. Since it is configured to append, log memory consumption can be reduced, and failure analysis can be performed at higher speed.

  The log information management method of the present invention is most suitable as a log information management method in a computer embedded device.

It is a conceptual diagram of the log information management system in Example 1 of this invention. It is a table | surface of the log information of the log information management system in Example 1 of this invention. It is a flowchart which shows the process sequence of the log information management system in Example 1 of this invention. It is the conceptual diagram of the log information management system in Example 2 of this invention, and the table | surface of log information. It is a flowchart which shows the process sequence of the log information management system in Example 2 of this invention. It is the conceptual diagram of the log information management system in Example 3 of this invention, and the table | surface of log information. It is a flowchart which shows the process sequence of the log information management system in Example 3 of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Event detection means, 2 ... Additional recording means, 3 ... Log memory, 4 ... Full detection means, 5 ... Extraction means, 6 ... Importance information holding means, 7. ..Delete means.

Claims (4)

Log information for storing log information to which link information that is a set of a message ID of the log information and a message ID of the log information subsequent to the log information is attached according to the occurrence of an event A log memory, a means for detecting an event for recording log information, a full detection means for detecting that the log memory is full,
When said full detecting means detects the full memory for the log, if the message ID of the subsequent log information added are in the log information Zureka is a reserved ID indicating success completion, based on the link information comprising a preceding log information extraction means for extracting as log information to be linked, and deleting means for deleting the extracted log information, and a write-once means that adds the new log information to the log memory deleting the log information Log information management system characterized by Log information for storing log information to which link information that is a set of a message ID of the log information and a message ID of the log information subsequent to the log information is attached according to the occurrence of an event A log memory, a means for detecting an event for recording log information, a full detection means for detecting that the log memory is full,
When said full detecting means detects the full memory for the log, if the message ID of the subsequent log information added are in the log information Zureka is a reserved ID indicating success completion, based on the link information Extracting means for extracting the oldest log information to be linked among preceding log information ; deleting means for deleting the extracted log information; and additional writing means for adding new log information to the log memory from which the log information has been deleted; A log information management method comprising: Log information for storing log information to which link information that is a set of a message ID of the log information and a message ID of the log information subsequent to the log information is attached according to the occurrence of an event A log information management method in a log information management system including a log memory,
Detecting an event for which log information is to be recorded; a full detection step for detecting that the log memory is full;
When said detected is full of the memory for the log in full detecting step, if the message ID of the subsequent log information added are in the log information Zureka is a reserved ID indicating success completed, based on the link information the log information preceding Te, an extraction step of extracting as log information to be linked, a deletion step of deleting the extracted log information, and a write-once process of append new log information to the log memory deleting the log information A log information management method comprising: Log information for storing log information to which link information that is a set of a message ID of the log information and a message ID of the log information subsequent to the log information is attached according to the occurrence of an event A log information management method in a log information management system including a log memory,
Detecting an event for which log information is to be recorded; a full detection step for detecting that the log memory is full;
When said detected is full of the memory for the log in full detecting step, if the message ID of the subsequent log information added are in the log information Zureka is a reserved ID indicating success completed, based on the link information An extraction process for extracting the oldest log information to be linked among the preceding log information , a deletion process for deleting the extracted log information, and an additional recording process for adding new log information to the log memory from which the log information has been deleted And a log information management method.

Images