JP5948291B2 - Monitoring information analyzing apparatus and method - Google Patents

Description

  The present invention relates to a monitoring information analysis apparatus and method, and more particularly, to a monitoring information analysis apparatus and method for extracting information useful for a user from monitoring information output by various machines.

  Today, centrally monitoring and managing devices and software with different roles from different manufacturers, mainly because of cost reduction. On the other hand, these various devices and software have a mechanism to output monitoring information (hereinafter referred to as “log”) that has its own form, and is used when monitoring and managing devices. . With the development of information equipment, the log information has become complicated and large-scale, and an efficient monitoring method is required.

  Under such circumstances, there is an analysis infrastructure for simplifying log analysis (see Non-Patent Document 1, for example). However, in order to use this technology, prior knowledge about the meaning of each log and the contents of the log message is required, which makes it unsuitable for application to huge and complex logs.

  In addition, there is known a failure information management method in which a log number is assigned to an error log that has occurred before and is retained for a certain period, and the same error log number is notified each time it occurs again. However, the log generated by the machine includes a message part that means the event that actually occurred, and error code-specific values and words such as an error code, ID number, location, and time. Even if the events that occur are the same, the error log is often not uniquely determined. For this reason, logs indicating the occurrence of the same event are managed with different numbers, which is inefficient and not useful.

  On the other hand, it targets syslog generated by network devices such as routers, and provides a method for grasping templates when a certain format such as vendor, message type, error code, and detailed message content is given in advance. This technology proposes a method of displaying the digest information of syslog using the positional relationship of routers (see Non-Patent Document 2, for example). However, this technique requires prior knowledge at least at the stage of collecting information. For example, you must know from which vendor the log is collected, which part of the message shows the error code, and not only prepare a template grasp mechanism, but also in advance Manual input and preparation are required. In addition, since the digest display function of syslog is a technique specialized for syslog, it cannot be applied to other monitoring log information.

Splunk http://www.splunk.com/ T. Qiu, Z. Ge, D. Pei, J. Wang, J, Xu, "What Happened in my Network? Mining Network Events from Router Syslogs", In IMC, 2010.

  Under these circumstances, there is a method of extracting a general log template that does not use prior information and the target is not limited to syslog. FIG. 1 shows an example of a log template and a message. This method performs batch processing by inputting all data every time a template is extracted. Specifically, the example of the first line in Fig. 1 reads a message log divided by spaces, performs clustering based on the score given using all log messages received so far, and selects clusters with low scores. This is an example of replacing with “*” as a parameter.

  However, since the above method is a batch method in which all data needs to be input every time a template is extracted, it cannot follow the log format that changes from moment to moment and cannot cope with a log that appears rarely. For this reason, a technique is required that can sequentially extract log templates and cope with changes in log generation rules and contents.

  The present invention has been made in view of the above points, and a monitoring information analysis apparatus capable of sequentially extracting a template portion of a log without a user knowing in advance a log generation rule generated by a machine. And to provide a method.

According to one aspect, a monitoring information analysis apparatus for extracting useful information from log information output from a device to be monitored,
A processed log message is obtained by inserting a blank space for splitting between specific symbols and particles, deleting the part that can be clearly recognized as a parameter, clustering similar messages, and acquiring the processed log Each word included in the message is classified into a predetermined case set based on the likelihood of being a template corresponding to each word position, and the degree of similarity between the acquired processed log message and each cluster is calculated, A cluster extraction unit that selects a cluster having the highest similarity, adds the acquired processed log message to the cluster having the highest similarity, and stores the cluster in the cluster storage unit;
There is provided a monitoring information analyzing apparatus comprising: a template extracting unit that reads a cluster from the cluster storage unit, adds a label to a word position that satisfies a predetermined condition, and extracts a template.

  According to one aspect, the template portion of the log is sequentially extracted by extracting the necessary information sequentially without the user directly knowing in advance the generation rules of the format of the monitoring information generated by the machine. It becomes possible to extract.

It is an example of template generation by a prior art. It is a structural example of the monitoring information analyzer in one embodiment of this invention. It is an example of the log message and template in one embodiment of this invention. It is a flowchart of the template grasping | ascertaining procedure in one embodiment of this invention. It is an example of the data preservation | save method of the cluster in one embodiment of this invention, and the element addition method to a cluster. It is an application example (offline use example) to the system in the first embodiment of the present invention. It is an application example (online use example) to the system in the second embodiment of the present invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 2 is a configuration example of a monitoring information analysis apparatus according to an embodiment of the present invention.

  The monitoring information analysis apparatus 100 shown in FIG. 1 includes a cluster extraction unit 110, a template generation unit 120, and a cluster storage unit 130. Although not shown, the memory has a message reading counter and a cluster number counter.

  The cluster extraction unit 110 acquires log messages and performs clustering. The log messages may be input sequentially or read from the log DB.

  The template generation unit 120 extracts only a log template by analyzing only the message body in the log. In the template generation unit 120, template processing, cluster separation processing, and cluster combination processing are performed.

  FIG. 3 shows an example of a log message and a template in one embodiment of the present invention.

  The input message includes a time stamp, the name of the monitoring device that generated the log, and the message body.

  In the message, it is assumed that words can be divided by spaces by inserting spaces between specific symbols and particles in advance. Also, parts that are clearly known as parameters, such as time and IP address, shall be removed in advance. A message to which these processes are added is defined as a processed message.

  Processed messages are classified as follows.

Case 1: When each word is composed only of numbers;
・ Case 2: When it consists of numbers and alphabets:
・ Case 3: When it consists only of numbers and specific symbols:
Case 4: When composed of symbols and alpha beds:
・ Case 5: Consists of only alpha beds:
-Case 6: Consists of symbols only:
However, if the message is in Japanese, hiragana, katakana and kanji may be added to the alpha bed.

  The above word classifications are classified according to the ease of inclusion in the template. The user can adjust the ease of inclusion in the template by defining new cases for specific words (down, up, etc.). In the following, only the case defined above will be described for simplicity.

  Hereinafter, the cluster extraction unit 110 and the template generation unit 120 will be described.

  FIG. 4 is a flowchart of the template grasping procedure according to the embodiment of the present invention.

  As shown in FIG. 3, the cluster extraction unit 110 receives a processed message in which a time stamp is deleted in advance and a space is added to a specific symbol character (“=”, “,” in the example of FIG. 3). Shall be.

  As an initial state, a cluster set C currently known is set in the cluster storage unit 130, this is set as an empty set (C (0)), the first processed message is read, and this is set as a target message. A message reading counter on a memory (not shown) is incremented (step 101).

  The cluster extraction unit 110 first divides the target message in units of blanks and obtains the total number L of divided words (step 102).

  The cluster is managed for each total number of words. If L has appeared so far, this is grasped, and if not, L is newly added to the cluster set C (step 104).

  Subsequently, the words in the processed message are analyzed and classified into each case. Among these, in the case of only symbols, the characters classified into “Case 6” and their positions are extracted. This is called a symbol list s in the processed message. For example, since the first word is only a number, it is “case 1”, and the second word “LINK” is only the alphabet, so “case 5”.

  The clusters are classified by the total number of words L and then managed in a memory (not shown) by a unique symbol list s (step 105). Therefore, a cluster is searched using the symbol list s grasped as L, and if it does not already appear (step 106, No), it is newly created (step 107).

  If there are clusters that match the total number of words L and the symbol list s (step 106, Yes), these are set as cluster candidates. The degree of similarity between the target message and each cluster is calculated, the cluster with the highest degree of similarity is selected, stored in the cluster storage unit 130, and the cluster number counter on the memory (not shown) is counted up (step 108). . At this time, if the degree of similarity between the cluster and the message is less than a threshold E (step 109, No), a cluster is newly created using the target processed message as not matching any cluster. It is created on the storage unit 130 and the number of clusters is counted up (step 110). In other cases (step 109, Yes), the target message is added to the cluster (step 111).

  In this example, as shown in FIG. 5, the cluster holds character information and word positions other than “Case 6” inside, and when a processed message is newly added to the cluster, the cluster is unique at each word position. Suppose that it only holds simple words. When the number of words at the same position exceeds a threshold value α, the oldest words are deleted in order.

  Hereinafter, calculation of the distance between the cluster and the processed message will be described.

In the following calculation, w _i (i = 1, 2, 3, 4) is set as a weight representing the likelihood of becoming a template part in each case i. From the definition of each case, w ₁ ≦ w ₂ ≦ w ₃ ≦ w ₄ .

Since the cluster holds word information at each word position, Φi having the highest value at each word position is calculated, and each case corresponding to each word position is set. Then, _let c _ki be the number of cases i in cluster k. By taking the sum of w _i * c _ki with respect to i, the maximum score obtained by matching the cluster is obtained. This is called the “maximum cluster score”.

Subsequently, it is checked whether words other than “case 6” in the processed message of interest are included in the cluster at each word position. If the word is contained in the cluster, the case of the word is examined, and the corresponding weight is added to obtain a match score. That is, if the number of words in each case i that matches the cluster in the target message is x _i , the match score is the sum of i of w _i * x _i .

  The match score at the end of all the words is divided by the maximum cluster score, ie

をクラスタと加工済みメッセージの距離として定義する。

Is defined as the distance between the cluster and the processed message.

  By calculating the above distance, the similarity is low when the numbers match as in "Case 1", and conversely when the letters consisting of only the alphabet match as in "Case 2" The similarity can be configured so as to be high.

  Subsequently, the template generation processing of the clustered message in the template generation unit 120 will be described. In the following, a method for generating a one-line template including an asterisk (*) from a cluster will be described, but the present invention is not limited to this example, and the cluster can be treated as a template corresponding to a “template cluster”.

  (1) First, a cluster is read from the cluster storage unit 130 to check whether the cluster meets the following conditions.

  Condition 1-1: Of the words held in the cluster, the number of words associated with a certain word position exceeds a threshold value α.

  Condition 1-2: The number of cluster hits is greater than or equal to a certain threshold value f. Here, the number of hits represents the number of logs that have been added to the cluster so far.

  Condition 1-3: There are those having only one word element in β or more word positions.

  A template is extracted by assigning a parameter label “(”, which is a parameter location, to a word position exceeding the threshold value in the above condition 1-1.

  Only the case is retained for the place where the parameter label is given, and in the future, when calculating the distance between the clusters, the word match is not checked, and the score is given as being unconditionally matched.

  Next, cluster separation processing of the template generation unit 120 will be described.

  The cluster separation process is a process of separating a log that is considered to be a different template as the same cluster as a cluster as a result of clustering. First, it is examined whether the cluster satisfies the following conditions.

  Condition 2-1: Conditions 1-1 and 1-2 are satisfied.

  Condition 2-2: There are places where the number of words associated with a certain word position is 2 or more and γ or less.

  Clusters that satisfy the above conditions have a part that should be a parameter according to condition 2-1, but are judged to be the same cluster according to condition 2-2 even though they include a part that cannot be considered as a parameter. . Therefore, the part that matches the condition 2-2 is divided and separated into new clusters.

  Further, as the cluster is separated, the internal parameter Φi is updated.

  The following describes how to update Φi.

  The method for calculating the distance between the processed message and the cluster is equivalent to the following linear identification problem.

これの性質を用いて、線形識別問題のオンラインアルゴリズムを適用することでパラメータを更新することができる。オンラインアルゴリズムは様々な方法があるが、例えば、非特許文献３（Passive Aggressive：K. Crammer, O. Dekel, J. Keshet, S. S. Shwartz, and Y. Singer, "Online Passive-Aggressive Algorithms," Journal of Machine Learning Research 7 (2006) pp. 551-585.）が挙げられる。

Using this property, the parameters can be updated by applying an online algorithm for the linear identification problem. There are various online algorithms. For example, Non-Patent Document 3 (Passive Aggressive: K. Crammer, O. Dekel, J. Keshet, SS Shwartz, and Y. Singer, "Online Passive-Aggressive Algorithms," Journal of Machine Learning Research 7 (2006) pp. 551-585.

  Next, cluster combination processing in the template generation unit 120 will be described.

  The cluster joining process is a process that promotes templating by newly joining clusters when excessive cluster division has been performed where the same cluster should be determined.

  First, it is checked whether the cluster satisfies the following conditions.

  Condition 3-1: The number of cluster hits (counter value of the number of clusters) is below a certain threshold.

  Condition 3-2: Clusters having the same number of words and the same symbol list and having a short distance exist.

  Condition 3-3: A predetermined number or more of messages are read (see the value of the read number counter).

  At this time, under conditions 3-1 and 3-3, despite the fact that the number of cluster hits is lower than that of the read message, there is a cluster with high similarity as in condition 3-2. Separation can be assumed. Therefore, the clusters matching the condition 3-2 are joined.

  The cluster combining method is simply realized by directly combining a set of words included in each word position.

  In addition, the parameters are updated at the time of cluster combination in the same way as the cluster separation process. The method is the same as in the cluster separation process.

  In the template generation unit 120, it is assumed that the templating process and the cluster joining / separating process each require calculation of the number of hits of the cluster, and these are performed at an arbitrary point in a certain log accumulation stage. For example, there is a case where the number of hits of each cluster exceeds a threshold value, every day, every week, every time a certain message is processed, or the like.

  In addition to the above, when it is desired to forcibly learn parameters, the user can separate and combine clusters by providing information to existing clusters. At this time, the condition 2- * and the condition 3- * are unconditionally processed.

  Below, the example which applied said structure and process is shown.

  The main components when the present invention is applied to a system (offline, online) are a DB that stores a template cluster of logs that have occurred in the past, and an analysis engine that performs sequential clustering on monitoring information using this DB It is a user interface that outputs this to the DB and the user, or gives a label etc. in advance or after the user. These can be implemented in the form shown in FIG. 6 or FIG.

  In FIG. 6, it is assumed that logs collected by the collection device are stored in the log DB in advance. FIG. 7 shows a form in which clustering is performed on a log that occurs from time to time, and the status of occurrence is monitored while sequentially updating a log template.

Here, it is assumed that the log collection device 1 is prepared in advance, and the device groups P _{0 to} P _n to be monitored also have a mechanism for generating a log.
[First embodiment]
The input log can be any device, but for example, the router syslog for network monitoring can be considered. In this case, the offline form of FIG. 6 will be described.

  Logs generated by network devices are collected centrally and stored in the log DB 2. The cluster extraction engine 110 receives these pieces of information and updates the log template information in the cluster DB 130 sequentially. Information about logs that occurred in the past, such as the time when a specific log template occurred, can be grasped through the log DB 2. The user also updates and adds templates offline.

[Second Embodiment]
In the first embodiment, log information is stored in the log DB 2 in advance, and a case where a template is extracted offline has been considered. However, it is possible to use a template that is extracted from time to time while extracting a template online. is there. Hereinafter, this usage example will be described with reference to FIG.

  It is grasped to which cluster each log information sent from the log collection device 1 belongs. Filtering rules and labeled rules are set in advance in the cluster, and using this, the user can grasp the status of logs that are generated every moment. Also in this case, as in the first embodiment, a user who arrives sequentially can perform template update or addition work at any time via the user interface.

  The operation of each component of the monitoring information analysis apparatus in the above embodiment is constructed as a program and installed on a computer used as the monitoring information analysis apparatus (for example, cluster extraction engine, template shaping / display unit). It can be executed or distributed via a network.

  The present invention is not limited to the above-described embodiments and examples, and various modifications and applications can be made within the scope of the claims.

1 Log collection device 2 Log DB
3 log information display unit 4 template display rule 100 monitoring information analysis device 110 cluster extraction unit, cluster extraction engine 120 template generation unit 130 cluster storage unit, cluster DB

Claims (7)

A monitoring information analysis device for extracting useful information from log information output from a monitored device,
A processed log message is obtained by inserting a blank space for splitting between specific symbols and particles, deleting the part that can be clearly recognized as a parameter, clustering similar messages, and acquiring the processed log Each word included in the message is classified into a predetermined case set based on the likelihood of being a template corresponding to each word position, and the degree of similarity between the acquired processed log message and each cluster is calculated, A cluster extraction unit that selects a cluster having the highest similarity, adds the acquired processed log message to the cluster having the highest similarity, and stores the cluster in the cluster storage unit;
A template extraction unit that reads a cluster from the cluster storage unit and extracts a template by assigning a label to a word position that satisfies a predetermined condition;
A monitoring information analyzing apparatus characterized by comprising: The cluster extraction means includes
The processed log message is divided into blank units, the total number of words is obtained, the words of the processed log message are classified into the case, the classified characters and character positions are extracted, and the total number of words is extracted. A means for selecting a cluster that matches the character and the character position as a cluster candidate, calculating a similarity between the cluster candidate and the processed log message, and selecting a cluster with the high similarity as a cluster. Monitoring information analysis equipment. The cluster extraction means includes
When classifying the words into predetermined cases,
Each word is composed only of numbers;
If it consists of numbers and letters:
When it consists only of numbers and specific symbols:
If consists of symbols and alphabet:
Alphabetic case only consists of:
If it consists only of symbols:
The monitoring information analysis apparatus according to claim 1 or 2, further comprising means for classifying the information into any one of the following. The template extraction means includes
The cluster is
Of the words held in the cluster, the number of words associated with a certain word position exceeds a predetermined threshold;
The number of hits of the cluster, which is the number of logs added to the cluster storage means so far, is greater than or equal to a predetermined threshold;
There is only one word element at a given number of word positions;
2. The monitoring information analysis apparatus according to claim 1, further comprising means for adding a label indicating a parameter location to the word position and extracting a template. Said template extracting means,
The number of words associated with a certain word position among the words held in the cluster exceeds a predetermined threshold value;
The number of hits of the cluster, which is the number of logs added to the cluster storage means so far, is greater than or equal to a predetermined threshold;
There are places where the number of words linked to a certain word position is two or more and not more than a predetermined value;
In this case, cluster separation means for re-forming a cluster so as to separately include a word group existing at a place where the number of words linked to a certain word position is two or more and a predetermined value or less, and divides the original cluster is provided. The monitoring information analysis apparatus according to claim 4, further comprising: Said template extracting means,
This number der Ruhi Wattage of the added log in clusters of the cluster storage means until there is a cluster is below a predetermined threshold value;
There is a cluster having a high degree of similarity with a cluster whose hit count is equal to or less than a predetermined threshold value ;
Reading more than a fixed number of processed log messages ;
5. The method according to claim 4, further comprising: a cluster combining unit that combines a set of words included in each word position with respect to a cluster in which the number of hits is equal to or less than a predetermined threshold and a cluster having a high similarity Monitoring information analyzer. A monitoring information analysis method for extracting useful information from log information output from a monitored device,
Cluster storage means for storing clusters;
In an apparatus having cluster extraction means and template extraction means,
The cluster extraction means obtains a processed log message in which a space for dividing is inserted between specific symbols and particles, and a portion that can be clearly recognized as a parameter is deleted, and similar messages are clustered. Each word included in the acquired processed log message is classified into a predetermined case that is set based on the likelihood of being a template corresponding to each word position, and between the acquired processed log message and each cluster A cluster extraction step of calculating a similarity , selecting a cluster having the highest similarity, adding the acquired processed log message to the cluster having the highest similarity, and storing the cluster in the cluster storage unit;
The template extraction means reads a cluster from the cluster storage means, extracts a template by assigning a label to a word position that satisfies a predetermined condition, and a template extraction step;
Monitoring information analysis method characterized by performing.

Images